head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC7:1.1.1.14 netbsd-11-0-RC6:1.1.1.14 netbsd-11-0-RC5:1.1.1.14 netbsd-11-0-RC4:1.1.1.14 netbsd-11-0-RC3:1.1.1.14 netbsd-11-0-RC2:1.1.1.14 netbsd-11-0-RC1:1.1.1.14 perseant-exfatfs-base-20250801:1.1.1.14 netbsd-11:1.1.1.14.0.10 netbsd-11-base:1.1.1.14 netbsd-10-1-RELEASE:1.1.1.14 perseant-exfatfs-base-20240630:1.1.1.14 perseant-exfatfs:1.1.1.14.0.8 perseant-exfatfs-base:1.1.1.14 netbsd-8-3-RELEASE:1.1.1.11 netbsd-9-4-RELEASE:1.1.1.13 netbsd-10-0-RELEASE:1.1.1.14 netbsd-10-0-RC6:1.1.1.14 netbsd-10-0-RC5:1.1.1.14 netbsd-10-0-RC4:1.1.1.14 netbsd-10-0-RC3:1.1.1.14 netbsd-10-0-RC2:1.1.1.14 netbsd-10-0-RC1:1.1.1.14 netbsd-10:1.1.1.14.0.6 netbsd-10-base:1.1.1.14 netbsd-9-3-RELEASE:1.1.1.13 cjep_sun2x:1.1.1.14.0.4 cjep_sun2x-base:1.1.1.14 cjep_staticlib_x-base1:1.1.1.14 netbsd-9-2-RELEASE:1.1.1.13 cjep_staticlib_x:1.1.1.14.0.2 cjep_staticlib_x-base:1.1.1.14 netbsd-9-1-RELEASE:1.1.1.13 phil-wifi-20200421:1.1.1.14 phil-wifi-20200411:1.1.1.14 phil-wifi-20200406:1.1.1.14 netbsd-8-2-RELEASE:1.1.1.11 netbsd-9-0-RELEASE:1.1.1.13 netbsd-9-0-RC2:1.1.1.13 netbsd-9-0-RC1:1.1.1.13 netbsd-9:1.1.1.13.0.2 netbsd-9-base:1.1.1.13 phil-wifi-20190609:1.1.1.13 netbsd-8-1-RELEASE:1.1.1.11 netbsd-8-1-RC1:1.1.1.11 pgoyette-compat-merge-20190127:1.1.1.12.2.1 pgoyette-compat-20190127:1.1.1.13 pgoyette-compat-20190118:1.1.1.13 pgoyette-compat-1226:1.1.1.13 pgoyette-compat-1126:1.1.1.13 pgoyette-compat-1020:1.1.1.13 pgoyette-compat-0930:1.1.1.13 pgoyette-compat-0906:1.1.1.13 netbsd-7-2-RELEASE:1.1.1.7.2.1 pgoyette-compat-0728:1.1.1.13 clang-337282:1.1.1.13 netbsd-8-0-RELEASE:1.1.1.11 phil-wifi:1.1.1.12.0.4 phil-wifi-base:1.1.1.12 pgoyette-compat-0625:1.1.1.12 netbsd-8-0-RC2:1.1.1.11 pgoyette-compat-0521:1.1.1.12 pgoyette-compat-0502:1.1.1.12 pgoyette-compat-0422:1.1.1.12 netbsd-8-0-RC1:1.1.1.11 pgoyette-compat-0415:1.1.1.12 pgoyette-compat-0407:1.1.1.12 pgoyette-compat-0330:1.1.1.12 pgoyette-compat-0322:1.1.1.12 pgoyette-compat-0315:1.1.1.12 netbsd-7-1-2-RELEASE:1.1.1.7.2.1 pgoyette-compat:1.1.1.12.0.2 pgoyette-compat-base:1.1.1.12 netbsd-7-1-1-RELEASE:1.1.1.7.2.1 clang-319952:1.1.1.12 matt-nb8-mediatek:1.1.1.11.0.8 matt-nb8-mediatek-base:1.1.1.11 clang-309604:1.1.1.12 perseant-stdc-iso10646:1.1.1.11.0.6 perseant-stdc-iso10646-base:1.1.1.11 netbsd-8:1.1.1.11.0.4 netbsd-8-base:1.1.1.11 prg-localcount2-base3:1.1.1.11 prg-localcount2-base2:1.1.1.11 prg-localcount2-base1:1.1.1.11 prg-localcount2:1.1.1.11.0.2 prg-localcount2-base:1.1.1.11 pgoyette-localcount-20170426:1.1.1.11 bouyer-socketcan-base1:1.1.1.11 pgoyette-localcount-20170320:1.1.1.11 netbsd-7-1:1.1.1.7.2.1.0.6 netbsd-7-1-RELEASE:1.1.1.7.2.1 netbsd-7-1-RC2:1.1.1.7.2.1 clang-294123:1.1.1.11 netbsd-7-nhusb-base-20170116:1.1.1.7.2.1 bouyer-socketcan:1.1.1.10.0.2 bouyer-socketcan-base:1.1.1.10 clang-291444:1.1.1.10 pgoyette-localcount-20170107:1.1.1.9 netbsd-7-1-RC1:1.1.1.7.2.1 pgoyette-localcount-20161104:1.1.1.9 netbsd-7-0-2-RELEASE:1.1.1.7.2.1 localcount-20160914:1.1.1.9 netbsd-7-nhusb:1.1.1.7.2.1.0.4 netbsd-7-nhusb-base:1.1.1.7.2.1 clang-280599:1.1.1.9 pgoyette-localcount-20160806:1.1.1.9 pgoyette-localcount-20160726:1.1.1.9 pgoyette-localcount:1.1.1.9.0.2 pgoyette-localcount-base:1.1.1.9 netbsd-7-0-1-RELEASE:1.1.1.7.2.1 clang-261930:1.1.1.9 netbsd-7-0:1.1.1.7.2.1.0.2 netbsd-7-0-RELEASE:1.1.1.7.2.1 netbsd-7-0-RC3:1.1.1.7.2.1 netbsd-7-0-RC2:1.1.1.7.2.1 netbsd-7-0-RC1:1.1.1.7.2.1 clang-237755:1.1.1.8 clang-232565:1.1.1.8 clang-227398:1.1.1.8 tls-maxphys-base:1.1.1.7 tls-maxphys:1.1.1.7.0.4 netbsd-7:1.1.1.7.0.2 netbsd-7-base:1.1.1.7 clang-215315:1.1.1.7 clang-209886:1.1.1.6 yamt-pagecache:1.1.1.5.0.4 yamt-pagecache-base9:1.1.1.5 tls-earlyentropy:1.1.1.5.0.2 tls-earlyentropy-base:1.1.1.6 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.5 riastradh-drm2-base3:1.1.1.5 clang-202566:1.1.1.5 clang-201163:1.1.1.4 clang-199312:1.1.1.3 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.53; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.53; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.38; author joerg; state Exp; branches; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2014.01.15.21.26.25; author joerg; state Exp; branches; next 1.1.1.4; commitid NQXlzzA0SPkc5glx; 1.1.1.4 date 2014.02.14.20.07.26; author joerg; state Exp; branches; next 1.1.1.5; commitid annVkZ1sc17rF6px; 1.1.1.5 date 2014.03.04.19.55.05; author joerg; state Exp; branches 1.1.1.5.2.1 1.1.1.5.4.1; next 1.1.1.6; commitid 29z1hJonZISIXprx; 1.1.1.6 date 2014.05.30.18.14.44; author joerg; state Exp; branches; next 1.1.1.7; commitid 8q0kdlBlCn09GACx; 1.1.1.7 date 2014.08.10.17.08.35; author joerg; state Exp; branches 1.1.1.7.2.1 1.1.1.7.4.1; next 1.1.1.8; commitid N85tXAN6Ex9VZPLx; 1.1.1.8 date 2015.01.29.19.57.30; author joerg; state Exp; branches; next 1.1.1.9; commitid mlISSizlPKvepX7y; 1.1.1.9 date 2016.02.27.22.12.05; author joerg; state Exp; branches 1.1.1.9.2.1; next 1.1.1.10; commitid tIimz3oDlh1NpBWy; 1.1.1.10 date 2017.01.11.10.35.36; author joerg; state Exp; branches 1.1.1.10.2.1; next 1.1.1.11; commitid CNnUNfII1jgNmxBz; 1.1.1.11 date 2017.02.09.17.38.31; author joerg; state Exp; branches; next 1.1.1.12; commitid UxB8JMFWM7xyMiFz; 1.1.1.12 date 2017.08.01.19.35.15; author joerg; state Exp; branches 1.1.1.12.2.1 1.1.1.12.4.1; next 1.1.1.13; commitid pMuDy65V0VicSx1A; 1.1.1.13 date 2018.07.17.18.31.06; author joerg; state Exp; branches; next 1.1.1.14; commitid wDzL46ALjrCZgwKA; 1.1.1.14 date 2019.11.13.22.19.29; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.5.2.1 date 2014.08.10.07.08.10; author tls; state Exp; branches; next ; commitid t01A1TLTYxkpGMLx; 1.1.1.5.4.1 date 2014.03.04.19.55.05; author yamt; state dead; branches; next 1.1.1.5.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.5.4.2 date 2014.05.22.16.18.31; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.7.2.1 date 2015.06.04.20.04.30; author snj; state Exp; branches; next ; commitid yRnjq9fueSo6n9oy; 1.1.1.7.4.1 date 2014.08.10.17.08.35; author tls; state dead; branches; next 1.1.1.7.4.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.7.4.2 date 2014.08.19.23.47.32; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.9.2.1 date 2017.03.20.06.52.42; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.10.2.1 date 2017.04.21.16.51.40; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.1.1.12.2.1 date 2018.07.28.04.33.24; author pgoyette; state Exp; branches; next ; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.12.4.1 date 2019.06.10.21.45.29; author christos; state Exp; branches; next 1.1.1.12.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.12.4.2 date 2020.04.13.07.46.39; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @//=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a meta-engine for path-sensitive dataflow analysis that // is built on GREngine, but provides the boilerplate to execute transfer // functions and build the ExplodedGraph at the expression level. // //===----------------------------------------------------------------------===// #define DEBUG_TYPE "ExprEngine" #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" #include "PrettyStackTraceLocationContext.h" #include "clang/AST/CharUnits.h" #include "clang/AST/ParentMap.h" #include "clang/AST/StmtCXX.h" #include "clang/AST/StmtObjC.h" #include "clang/Basic/Builtins.h" #include "clang/Basic/PrettyStackTrace.h" #include "clang/Basic/SourceManager.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "llvm/ADT/ImmutableList.h" #include "llvm/ADT/Statistic.h" #include "llvm/Support/raw_ostream.h" #ifndef NDEBUG #include "llvm/Support/GraphWriter.h" #endif using namespace clang; using namespace ento; using llvm::APSInt; STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called"); STATISTIC(NumMaxBlockCountReached, "The # of aborted paths due to reaching the maximum block count in " "a top level function"); STATISTIC(NumMaxBlockCountReachedInInlined, "The # of aborted paths due to reaching the maximum block count in " "an inlined function"); STATISTIC(NumTimesRetriedWithoutInlining, "The # of times we re-evaluated a call without inlining"); //===----------------------------------------------------------------------===// // Engine construction and deletion. //===----------------------------------------------------------------------===// ExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn) : AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), currStmtIdx(0), currBldrCtx(0), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { unsigned TrimInterval = mgr.options.getGraphTrimInterval(); if (TrimInterval != 0) { // Enable eager node reclaimation when constructing the ExplodedGraph. G.enableNodeReclamation(TrimInterval); } } ExprEngine::~ExprEngine() { BR.FlushReports(); } //===----------------------------------------------------------------------===// // Utility methods. //===----------------------------------------------------------------------===// ProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { ProgramStateRef state = StateMgr.getInitialState(InitLoc); const Decl *D = InitLoc->getDecl(); // Preconditions. // FIXME: It would be nice if we had a more general mechanism to add // such preconditions. Some day. do { if (const FunctionDecl *FD = dyn_cast(D)) { // Precondition: the first argument of 'main' is an integer guaranteed // to be > 0. const IdentifierInfo *II = FD->getIdentifier(); if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) break; const ParmVarDecl *PD = FD->getParamDecl(0); QualType T = PD->getType(); const BuiltinType *BT = dyn_cast(T); if (!BT || !BT->isInteger()) break; const MemRegion *R = state->getRegion(PD, InitLoc); if (!R) break; SVal V = state->getSVal(loc::MemRegionVal(R)); SVal Constraint_untested = evalBinOp(state, BO_GT, V, svalBuilder.makeZeroVal(T), getContext().IntTy); Optional Constraint = Constraint_untested.getAs(); if (!Constraint) break; if (ProgramStateRef newState = state->assume(*Constraint, true)) state = newState; } break; } while (0); if (const ObjCMethodDecl *MD = dyn_cast(D)) { // Precondition: 'self' is always non-null upon entry to an Objective-C // method. const ImplicitParamDecl *SelfD = MD->getSelfDecl(); const MemRegion *R = state->getRegion(SelfD, InitLoc); SVal V = state->getSVal(loc::MemRegionVal(R)); if (Optional LV = V.getAs()) { // Assume that the pointer value in 'self' is non-null. state = state->assume(*LV, true); assert(state && "'self' cannot be null"); } } if (const CXXMethodDecl *MD = dyn_cast(D)) { if (!MD->isStatic()) { // Precondition: 'this' is always non-null upon entry to the // top-level function. This is our starting assumption for // analyzing an "open" program. const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); if (SFC->getParent() == 0) { loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); SVal V = state->getSVal(L); if (Optional LV = V.getAs()) { state = state->assume(*LV, true); assert(state && "'this' cannot be null"); } } } } return state; } ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State, const LocationContext *LC, const Expr *Ex, const Expr *Result) { SVal V = State->getSVal(Ex, LC); if (!Result) { // If we don't have an explicit result expression, we're in "if needed" // mode. Only create a region if the current value is a NonLoc. if (!V.getAs()) return State; Result = Ex; } else { // We need to create a region no matter what. For sanity, make sure we don't // try to stuff a Loc into a non-pointer temporary region. assert(!V.getAs() || Loc::isLocType(Result->getType()) || Result->getType()->isMemberPointerType()); } ProgramStateManager &StateMgr = State->getStateManager(); MemRegionManager &MRMgr = StateMgr.getRegionManager(); StoreManager &StoreMgr = StateMgr.getStoreManager(); // We need to be careful about treating a derived type's value as // bindings for a base type. Unless we're creating a temporary pointer region, // start by stripping and recording base casts. SmallVector Casts; const Expr *Inner = Ex->IgnoreParens(); if (!Loc::isLocType(Result->getType())) { while (const CastExpr *CE = dyn_cast(Inner)) { if (CE->getCastKind() == CK_DerivedToBase || CE->getCastKind() == CK_UncheckedDerivedToBase) Casts.push_back(CE); else if (CE->getCastKind() != CK_NoOp) break; Inner = CE->getSubExpr()->IgnoreParens(); } } // Create a temporary object region for the inner expression (which may have // a more derived type) and bind the value into it. const TypedValueRegion *TR = NULL; if (const MaterializeTemporaryExpr *MT = dyn_cast(Result)) { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) TR = MRMgr.getCXXStaticTempObjectRegion(Inner); } if (!TR) TR = MRMgr.getCXXTempObjectRegion(Inner, LC); SVal Reg = loc::MemRegionVal(TR); if (V.isUnknown()) V = getSValBuilder().conjureSymbolVal(Result, LC, TR->getValueType(), currBldrCtx->blockCount()); State = State->bindLoc(Reg, V); // Re-apply the casts (from innermost to outermost) for type sanity. for (SmallVectorImpl::reverse_iterator I = Casts.rbegin(), E = Casts.rend(); I != E; ++I) { Reg = StoreMgr.evalDerivedToBase(Reg, *I); } State = State->BindExpr(Result, LC, Reg); return State; } //===----------------------------------------------------------------------===// // Top-level transfer function logic (Dispatcher). //===----------------------------------------------------------------------===// /// evalAssume - Called by ConstraintManager. Used to call checker-specific /// logic for handling assumptions on symbolic values. ProgramStateRef ExprEngine::processAssume(ProgramStateRef state, SVal cond, bool assumption) { return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); } bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { return getCheckerManager().wantsRegionChangeUpdate(state); } ProgramStateRef ExprEngine::processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef Explicits, ArrayRef Regions, const CallEvent *Call) { return getCheckerManager().runCheckersForRegionChanges(state, invalidated, Explicits, Regions, Call); } void ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) { getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); } void ExprEngine::processEndWorklist(bool hasWorkRemaining) { getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); } void ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currStmtIdx = StmtIdx; currBldrCtx = Ctx; switch (E.getKind()) { case CFGElement::Statement: ProcessStmt(const_cast(E.castAs().getStmt()), Pred); return; case CFGElement::Initializer: ProcessInitializer(E.castAs().getInitializer(), Pred); return; case CFGElement::AutomaticObjectDtor: case CFGElement::DeleteDtor: case CFGElement::BaseDtor: case CFGElement::MemberDtor: case CFGElement::TemporaryDtor: ProcessImplicitDtor(E.castAs(), Pred); return; } } static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const CFGStmt S, const ExplodedNode *Pred, const LocationContext *LC) { // Are we never purging state values? if (AMgr.options.AnalysisPurgeOpt == PurgeNone) return false; // Is this the beginning of a basic block? if (Pred->getLocation().getAs()) return true; // Is this on a non-expression? if (!isa(S.getStmt())) return true; // Run before processing a call. if (CallEvent::isCallStmt(S.getStmt())) return true; // Is this an expression that is consumed by another expression? If so, // postpone cleaning out the state. ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); return !PM.isConsumedExpr(cast(S.getStmt())); } void ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt, ProgramPoint::Kind K) { assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || ReferenceStmt == 0 || isa(ReferenceStmt)) && "PostStmt is not generally supported by the SymbolReaper yet"); assert(LC && "Must pass the current (or expiring) LocationContext"); if (!DiagnosticStmt) { DiagnosticStmt = ReferenceStmt; assert(DiagnosticStmt && "Required for clearing a LocationContext"); } NumRemoveDeadBindings++; ProgramStateRef CleanedState = Pred->getState(); // LC is the location context being destroyed, but SymbolReaper wants a // location context that is still live. (If this is the top-level stack // frame, this will be null.) if (!ReferenceStmt) { assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind && "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext"); LC = LC->getParent(); } const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : 0; SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); // Create a state in which dead bindings are removed from the environment // and the store. TODO: The function should just return new env and store, // not a new state. CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); // Process any special transfer function for dead symbols. // A tag to track convenience transitions, which can be removed at cleanup. static SimpleProgramPointTag cleanupTag("ExprEngine : Clean Node"); if (!SymReaper.hasDeadSymbols()) { // Generate a CleanedNode that has the environment and store cleaned // up. Since no symbols are dead, we can optimize and not clean out // the constraint manager. StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx); Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K); } else { // Call checkers with the non-cleaned state so that they could query the // values of the soon to be dead symbols. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, DiagnosticStmt, *this, K); // For each node in CheckedSet, generate CleanedNodes that have the // environment, the store, and the constraints cleaned up but have the // user-supplied states as the predecessors. StmtNodeBuilder Bldr(CheckedSet, Out, *currBldrCtx); for (ExplodedNodeSet::const_iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef CheckerState = (*I)->getState(); // The constraint manager has not been cleaned up yet, so clean up now. CheckerState = getConstraintManager().removeDeadBindings(CheckerState, SymReaper); assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Environment as a part of " "checkDeadSymbols processing."); assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Store as a part of " "checkDeadSymbols processing."); // Create a state based on CleanedState with CheckerState GDM and // generate a transition to that state. ProgramStateRef CleanedCheckerSt = StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K); } } } void ExprEngine::ProcessStmt(const CFGStmt S, ExplodedNode *Pred) { // Reclaim any unnecessary nodes in the ExplodedGraph. G.reclaimRecentlyAllocatedNodes(); const Stmt *currStmt = S.getStmt(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), currStmt->getLocStart(), "Error evaluating statement"); // Remove dead bindings and symbols. ExplodedNodeSet CleanedStates; if (shouldRemoveDeadBindings(AMgr, S, Pred, Pred->getLocationContext())){ removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); } else CleanedStates.Add(Pred); // Visit the statement. ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CleanedStates.begin(), E = CleanedStates.end(); I != E; ++I) { ExplodedNodeSet DstI; // Visit the statement. Visit(currStmt, *I, DstI); Dst.insert(DstI); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer Init, ExplodedNode *Pred) { const CXXCtorInitializer *BMI = Init.getInitializer(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), BMI->getSourceLocation(), "Error evaluating initializer"); // We don't clean up dead bindings here. const StackFrameContext *stackFrame = cast(Pred->getLocationContext()); const CXXConstructorDecl *decl = cast(stackFrame->getDecl()); ProgramStateRef State = Pred->getState(); SVal thisVal = State->getSVal(svalBuilder.getCXXThis(decl, stackFrame)); ExplodedNodeSet Tmp(Pred); SVal FieldLoc; // Evaluate the initializer, if necessary if (BMI->isAnyMemberInitializer()) { // Constructors build the object directly in the field, // but non-objects must be copied in from the initializer. const Expr *Init = BMI->getInit()->IgnoreImplicit(); if (!isa(Init)) { const ValueDecl *Field; if (BMI->isIndirectMemberInitializer()) { Field = BMI->getIndirectMember(); FieldLoc = State->getLValue(BMI->getIndirectMember(), thisVal); } else { Field = BMI->getMember(); FieldLoc = State->getLValue(BMI->getMember(), thisVal); } SVal InitVal; if (BMI->getNumArrayIndices() > 0) { // Handle arrays of trivial type. We can represent this with a // primitive load/copy from the base array region. const ArraySubscriptExpr *ASE; while ((ASE = dyn_cast(Init))) Init = ASE->getBase()->IgnoreImplicit(); SVal LValue = State->getSVal(Init, stackFrame); if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); // If we fail to get the value for some reason, use a symbolic value. if (InitVal.isUnknownOrUndef()) { SValBuilder &SVB = getSValBuilder(); InitVal = SVB.conjureSymbolVal(BMI->getInit(), stackFrame, Field->getType(), currBldrCtx->blockCount()); } } else { InitVal = State->getSVal(BMI->getInit(), stackFrame); } assert(Tmp.size() == 1 && "have not generated any new nodes yet"); assert(*Tmp.begin() == Pred && "have not generated any new nodes yet"); Tmp.clear(); PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP); } } else { assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer()); // We already did all the work when visiting the CXXConstructExpr. } // Construct PostInitializer nodes whether the state changed or not, // so that the diagnostics don't get confused. PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); ExplodedNodeSet Dst; NodeBuilder Bldr(Tmp, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { ExplodedNode *N = *I; Bldr.generateNode(PP, N->getState(), N); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred) { ExplodedNodeSet Dst; switch (D.getKind()) { case CFGElement::AutomaticObjectDtor: ProcessAutomaticObjDtor(D.castAs(), Pred, Dst); break; case CFGElement::BaseDtor: ProcessBaseDtor(D.castAs(), Pred, Dst); break; case CFGElement::MemberDtor: ProcessMemberDtor(D.castAs(), Pred, Dst); break; case CFGElement::TemporaryDtor: ProcessTemporaryDtor(D.castAs(), Pred, Dst); break; case CFGElement::DeleteDtor: ProcessDeleteDtor(D.castAs(), Pred, Dst); break; default: llvm_unreachable("Unexpected dtor kind."); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const VarDecl *varDecl = Dtor.getVarDecl(); QualType varType = varDecl->getType(); ProgramStateRef state = Pred->getState(); SVal dest = state->getLValue(varDecl, Pred->getLocationContext()); const MemRegion *Region = dest.castAs().getRegion(); if (const ReferenceType *refType = varType->getAs()) { varType = refType->getPointeeType(); Region = state->getSVal(Region).getAsRegion(); } VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(), /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDeleteExpr *DE = Dtor.getDeleteExpr(); const Stmt *Arg = DE->getArgument(); SVal ArgVal = State->getSVal(Arg, LCtx); // If the argument to delete is known to be a null value, // don't run destructor. if (State->isNull(ArgVal).isConstrainedTrue()) { QualType DTy = DE->getDestroyedType(); QualType BTy = getContext().getBaseElementType(DTy); const CXXRecordDecl *RD = BTy->getAsCXXRecordDecl(); const CXXDestructorDecl *Dtor = RD->getDestructor(); PostImplicitCall PP(Dtor, DE->getLocStart(), LCtx); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(PP, Pred->getState(), Pred); return; } VisitCXXDestructor(DE->getDestroyedType(), ArgVal.getAsRegion(), DE, /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const LocationContext *LCtx = Pred->getLocationContext(); ProgramStateRef State = Pred->getState(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal ThisVal = Pred->getState()->getSVal(ThisPtr); // Create the base object region. const CXXBaseSpecifier *Base = D.getBaseSpecifier(); QualType BaseTy = Base->getType(); SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy, Base->isVirtual()); VisitCXXDestructor(BaseTy, BaseVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst); } void ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const FieldDecl *Member = D.getFieldDecl(); ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisVal = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal FieldVal = State->getLValue(Member, State->getSVal(ThisVal).castAs()); VisitCXXDestructor(Member->getType(), FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst); } void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType(); // FIXME: Inlining of temporary destructors is not supported yet anyway, so we // just put a NULL region for now. This will need to be changed later. VisitCXXDestructor(varType, NULL, D.getBindTemporaryExpr(), /*IsBase=*/ false, Pred, Dst); } void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &DstTop) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating statement"); ExplodedNodeSet Dst; StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx); assert(!isa(S) || S == cast(S)->IgnoreParens()); switch (S->getStmtClass()) { // C++ and ARC stuff we don't support yet. case Expr::ObjCIndirectCopyRestoreExprClass: case Stmt::CXXDependentScopeMemberExprClass: case Stmt::CXXTryStmtClass: case Stmt::CXXTypeidExprClass: case Stmt::CXXUuidofExprClass: case Stmt::MSPropertyRefExprClass: case Stmt::CXXUnresolvedConstructExprClass: case Stmt::DependentScopeDeclRefExprClass: case Stmt::UnaryTypeTraitExprClass: case Stmt::BinaryTypeTraitExprClass: case Stmt::TypeTraitExprClass: case Stmt::ArrayTypeTraitExprClass: case Stmt::ExpressionTraitExprClass: case Stmt::UnresolvedLookupExprClass: case Stmt::UnresolvedMemberExprClass: case Stmt::CXXNoexceptExprClass: case Stmt::PackExpansionExprClass: case Stmt::SubstNonTypeTemplateParmPackExprClass: case Stmt::FunctionParmPackExprClass: case Stmt::SEHTryStmtClass: case Stmt::SEHExceptStmtClass: case Stmt::LambdaExprClass: case Stmt::SEHFinallyStmtClass: { const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); Engine.addAbortedBlock(node, currBldrCtx->getBlock()); break; } case Stmt::ParenExprClass: llvm_unreachable("ParenExprs already handled."); case Stmt::GenericSelectionExprClass: llvm_unreachable("GenericSelectionExprs already handled."); // Cases that should never be evaluated simply because they shouldn't // appear in the CFG. case Stmt::BreakStmtClass: case Stmt::CaseStmtClass: case Stmt::CompoundStmtClass: case Stmt::ContinueStmtClass: case Stmt::CXXForRangeStmtClass: case Stmt::DefaultStmtClass: case Stmt::DoStmtClass: case Stmt::ForStmtClass: case Stmt::GotoStmtClass: case Stmt::IfStmtClass: case Stmt::IndirectGotoStmtClass: case Stmt::LabelStmtClass: case Stmt::NoStmtClass: case Stmt::NullStmtClass: case Stmt::SwitchStmtClass: case Stmt::WhileStmtClass: case Expr::MSDependentExistsStmtClass: case Stmt::CapturedStmtClass: case Stmt::OMPParallelDirectiveClass: llvm_unreachable("Stmt should not be in analyzer evaluation loop"); case Stmt::ObjCSubscriptRefExprClass: case Stmt::ObjCPropertyRefExprClass: llvm_unreachable("These are handled by PseudoObjectExpr"); case Stmt::GNUNullExprClass: { // GNU __null is a pointer-width integer, not an actual pointer. ProgramStateRef state = Pred->getState(); state = state->BindExpr(S, Pred->getLocationContext(), svalBuilder.makeIntValWithPtrWidth(0, false)); Bldr.generateNode(S, Pred, state); break; } case Stmt::ObjCAtSynchronizedStmtClass: Bldr.takeNodes(Pred); VisitObjCAtSynchronizedStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ExprWithCleanupsClass: // Handled due to fully linearised CFG. break; // Cases not handled yet; but will handle some day. case Stmt::DesignatedInitExprClass: case Stmt::ExtVectorElementExprClass: case Stmt::ImaginaryLiteralClass: case Stmt::ObjCAtCatchStmtClass: case Stmt::ObjCAtFinallyStmtClass: case Stmt::ObjCAtTryStmtClass: case Stmt::ObjCAutoreleasePoolStmtClass: case Stmt::ObjCEncodeExprClass: case Stmt::ObjCIsaExprClass: case Stmt::ObjCProtocolExprClass: case Stmt::ObjCSelectorExprClass: case Stmt::ParenListExprClass: case Stmt::PredefinedExprClass: case Stmt::ShuffleVectorExprClass: case Stmt::ConvertVectorExprClass: case Stmt::VAArgExprClass: case Stmt::CUDAKernelCallExprClass: case Stmt::OpaqueValueExprClass: case Stmt::AsTypeExprClass: case Stmt::AtomicExprClass: // Fall through. // Cases we intentionally don't evaluate, since they don't need // to be explicitly evaluated. case Stmt::AddrLabelExprClass: case Stmt::AttributedStmtClass: case Stmt::IntegerLiteralClass: case Stmt::CharacterLiteralClass: case Stmt::ImplicitValueInitExprClass: case Stmt::CXXScalarValueInitExprClass: case Stmt::CXXBoolLiteralExprClass: case Stmt::ObjCBoolLiteralExprClass: case Stmt::FloatingLiteralClass: case Stmt::SizeOfPackExprClass: case Stmt::StringLiteralClass: case Stmt::ObjCStringLiteralClass: case Stmt::CXXBindTemporaryExprClass: case Stmt::CXXPseudoDestructorExprClass: case Stmt::SubstNonTypeTemplateParmExprClass: case Stmt::CXXNullPtrLiteralExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDefaultArgExprClass: case Stmt::CXXDefaultInitExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(PreVisit, Tmp, *currBldrCtx); const Expr *ArgE; if (const CXXDefaultArgExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else if (const CXXDefaultInitExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else llvm_unreachable("unknown constant wrapper kind"); bool IsTemporary = false; if (const MaterializeTemporaryExpr *MTE = dyn_cast(ArgE)) { ArgE = MTE->GetTemporaryExpr(); IsTemporary = true; } Optional ConstantVal = svalBuilder.getConstantVal(ArgE); if (!ConstantVal) ConstantVal = UnknownVal(); const LocationContext *LCtx = Pred->getLocationContext(); for (ExplodedNodeSet::iterator I = PreVisit.begin(), E = PreVisit.end(); I != E; ++I) { ProgramStateRef State = (*I)->getState(); State = State->BindExpr(S, LCtx, *ConstantVal); if (IsTemporary) State = createTemporaryRegionIfNeeded(State, LCtx, cast(S), cast(S)); Bldr2.generateNode(S, *I, State); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } // Cases we evaluate as opaque expressions, conjuring a symbol. case Stmt::CXXStdInitializerListExprClass: case Expr::ObjCArrayLiteralClass: case Expr::ObjCDictionaryLiteralClass: case Expr::ObjCBoxedExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx); const Expr *Ex = cast(S); QualType resultType = Ex->getType(); for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); it != et; ++it) { ExplodedNode *N = *it; const LocationContext *LCtx = N->getLocationContext(); SVal result = svalBuilder.conjureSymbolVal(0, Ex, LCtx, resultType, currBldrCtx->blockCount()); ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); Bldr2.generateNode(S, N, state); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } case Stmt::ArraySubscriptExprClass: Bldr.takeNodes(Pred); VisitLvalArraySubscriptExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::GCCAsmStmtClass: Bldr.takeNodes(Pred); VisitGCCAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MSAsmStmtClass: Bldr.takeNodes(Pred); VisitMSAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BlockExprClass: Bldr.takeNodes(Pred); VisitBlockExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryOperatorClass: { const BinaryOperator* B = cast(S); if (B->isLogicalOp()) { Bldr.takeNodes(Pred); VisitLogicalExpr(B, Pred, Dst); Bldr.addNodes(Dst); break; } else if (B->getOpcode() == BO_Comma) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), state->getSVal(B->getRHS(), Pred->getLocationContext()))); break; } Bldr.takeNodes(Pred); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (B->isRelationalOp() || B->isEqualityOp())) { ExplodedNodeSet Tmp; VisitBinaryOperator(cast(S), Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast(S)); } else VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXOperatorCallExprClass: { const CXXOperatorCallExpr *OCE = cast(S); // For instance method operators, make sure the 'this' argument has a // valid region. const Decl *Callee = OCE->getCalleeDecl(); if (const CXXMethodDecl *MD = dyn_cast_or_null(Callee)) { if (MD->isInstance()) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); ProgramStateRef NewState = createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0)); if (NewState != State) { Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/0, ProgramPoint::PreStmtKind); // Did we cache out? if (!Pred) break; } } } // FALLTHROUGH } case Stmt::CallExprClass: case Stmt::CXXMemberCallExprClass: case Stmt::UserDefinedLiteralClass: { Bldr.takeNodes(Pred); VisitCallExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXCatchStmtClass: { Bldr.takeNodes(Pred); VisitCXXCatchStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXTemporaryObjectExprClass: case Stmt::CXXConstructExprClass: { Bldr.takeNodes(Pred); VisitCXXConstructExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXNewExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PostVisit; VisitCXXNewExpr(cast(S), Pred, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDeleteExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; const CXXDeleteExpr *CDE = cast(S); getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); for (ExplodedNodeSet::iterator i = PreVisit.begin(), e = PreVisit.end(); i != e ; ++i) VisitCXXDeleteExpr(CDE, *i, Dst); Bldr.addNodes(Dst); break; } // FIXME: ChooseExpr is really a constant. We need to fix // the CFG do not model them as explicit control-flow. case Stmt::ChooseExprClass: { // __builtin_choose_expr Bldr.takeNodes(Pred); const ChooseExpr *C = cast(S); VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CompoundAssignOperatorClass: Bldr.takeNodes(Pred); VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::CompoundLiteralExprClass: Bldr.takeNodes(Pred); VisitCompoundLiteralExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryConditionalOperatorClass: case Stmt::ConditionalOperatorClass: { // '?' operator Bldr.takeNodes(Pred); const AbstractConditionalOperator *C = cast(S); VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXThisExprClass: Bldr.takeNodes(Pred); VisitCXXThisExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::DeclRefExprClass: { Bldr.takeNodes(Pred); const DeclRefExpr *DE = cast(S); VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::DeclStmtClass: Bldr.takeNodes(Pred); VisitDeclStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ImplicitCastExprClass: case Stmt::CStyleCastExprClass: case Stmt::CXXStaticCastExprClass: case Stmt::CXXDynamicCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::ObjCBridgedCastExprClass: { Bldr.takeNodes(Pred); const CastExpr *C = cast(S); // Handle the previsit checks. ExplodedNodeSet dstPrevisit; getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); // Handle the expression itself. ExplodedNodeSet dstExpr; for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), e = dstPrevisit.end(); i != e ; ++i) { VisitCast(C, C->getSubExpr(), *i, dstExpr); } // Handle the postvisit checks. getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); Bldr.addNodes(Dst); break; } case Expr::MaterializeTemporaryExprClass: { Bldr.takeNodes(Pred); const MaterializeTemporaryExpr *MTE = cast(S); CreateCXXTemporaryObject(MTE, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::InitListExprClass: Bldr.takeNodes(Pred); VisitInitListExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MemberExprClass: Bldr.takeNodes(Pred); VisitMemberExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCIvarRefExprClass: Bldr.takeNodes(Pred); VisitLvalObjCIvarRefExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCForCollectionStmtClass: Bldr.takeNodes(Pred); VisitObjCForCollectionStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCMessageExprClass: Bldr.takeNodes(Pred); VisitObjCMessage(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCAtThrowStmtClass: case Stmt::CXXThrowExprClass: // FIXME: This is not complete. We basically treat @@throw as // an abort. Bldr.generateSink(S, Pred, Pred->getState()); break; case Stmt::ReturnStmtClass: Bldr.takeNodes(Pred); VisitReturnStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::OffsetOfExprClass: Bldr.takeNodes(Pred); VisitOffsetOfExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::UnaryExprOrTypeTraitExprClass: Bldr.takeNodes(Pred); VisitUnaryExprOrTypeTraitExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::StmtExprClass: { const StmtExpr *SE = cast(S); if (SE->getSubStmt()->body_empty()) { // Empty statement expression. assert(SE->getType() == getContext().VoidTy && "Empty statement expression must have void type."); break; } if (Expr *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(SE, Pred, state->BindExpr(SE, Pred->getLocationContext(), state->getSVal(LastExpr, Pred->getLocationContext()))); } break; } case Stmt::UnaryOperatorClass: { Bldr.takeNodes(Pred); const UnaryOperator *U = cast(S); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) { ExplodedNodeSet Tmp; VisitUnaryOperator(U, Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, U); } else VisitUnaryOperator(U, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::PseudoObjectExprClass: { Bldr.takeNodes(Pred); ProgramStateRef state = Pred->getState(); const PseudoObjectExpr *PE = cast(S); if (const Expr *Result = PE->getResultExpr()) { SVal V = state->getSVal(Result, Pred->getLocationContext()); Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), V)); } else Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), UnknownVal())); Bldr.addNodes(Dst); break; } } } bool ExprEngine::replayWithoutInlining(ExplodedNode *N, const LocationContext *CalleeLC) { const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); assert(CalleeSF && CallerSF); ExplodedNode *BeforeProcessingCall = 0; const Stmt *CE = CalleeSF->getCallSite(); // Find the first node before we started processing the call expression. while (N) { ProgramPoint L = N->getLocation(); BeforeProcessingCall = N; N = N->pred_empty() ? NULL : *(N->pred_begin()); // Skip the nodes corresponding to the inlined code. if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) continue; // We reached the caller. Find the node right before we started // processing the call. if (L.isPurgeKind()) continue; if (L.getAs()) continue; if (L.getAs()) continue; if (Optional SP = L.getAs()) if (SP->getStmt() == CE) continue; break; } if (!BeforeProcessingCall) return false; // TODO: Clean up the unneeded nodes. // Build an Epsilon node from which we will restart the analyzes. // Note that CE is permitted to be NULL! ProgramPoint NewNodeLoc = EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); // Add the special flag to GDM to signal retrying with no inlining. // Note, changing the state ensures that we are not going to cache out. ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); NewNodeState = NewNodeState->set(const_cast(CE)); // Make the new node a successor of BeforeProcessingCall. bool IsNew = false; ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); // We cached out at this point. Caching out is common due to us backtracking // from the inlined function, which might spawn several paths. if (!IsNew) return true; NewNode->addPredecessor(BeforeProcessingCall, G); // Add the new node to the work list. Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), CalleeSF->getIndex()); NumTimesRetriedWithoutInlining++; return true; } /// Block entrance. (Update counters). void ExprEngine::processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); // FIXME: Refactor this into a checker. if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) { static SimpleProgramPointTag tag("ExprEngine : Block count exceeded"); const ExplodedNode *Sink = nodeBuilder.generateSink(Pred->getState(), Pred, &tag); // Check if we stopped at the top level function or not. // Root node should have the location context of the top most function. const LocationContext *CalleeLC = Pred->getLocation().getLocationContext(); const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const LocationContext *RootLC = (*G.roots_begin())->getLocation().getLocationContext(); if (RootLC->getCurrentStackFrame() != CalleeSF) { Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); // Re-run the call evaluation without inlining it, by storing the // no-inlining policy in the state and enqueuing the new work item on // the list. Replay should almost never fail. Use the stats to catch it // if it does. if ((!AMgr.options.NoRetryExhausted && replayWithoutInlining(Pred, CalleeLC))) return; NumMaxBlockCountReachedInInlined++; } else NumMaxBlockCountReached++; // Make sink nodes as exhausted(for stats) only if retry failed. Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); } } //===----------------------------------------------------------------------===// // Branch processing. //===----------------------------------------------------------------------===// /// RecoverCastedSymbol - A helper function for ProcessBranch that is used /// to try to recover some path-sensitivity for casts of symbolic /// integers that promote their values (which are currently not tracked well). /// This function returns the SVal bound to Condition->IgnoreCasts if all the // cast(s) did was sign-extend the original value. static SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx) { const Expr *Ex = dyn_cast(Condition); if (!Ex) return UnknownVal(); uint64_t bits = 0; bool bitsInit = false; while (const CastExpr *CE = dyn_cast(Ex)) { QualType T = CE->getType(); if (!T->isIntegralOrEnumerationType()) return UnknownVal(); uint64_t newBits = Ctx.getTypeSize(T); if (!bitsInit || newBits < bits) { bitsInit = true; bits = newBits; } Ex = CE->getSubExpr(); } // We reached a non-cast. Is it a symbolic value? QualType T = Ex->getType(); if (!bitsInit || !T->isIntegralOrEnumerationType() || Ctx.getTypeSize(T) > bits) return UnknownVal(); return state->getSVal(Ex, LCtx); } static const Stmt *ResolveCondition(const Stmt *Condition, const CFGBlock *B) { if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) return Condition; // For logical operations, we still have the case where some branches // use the traditional "merge" approach and others sink the branch // directly into the basic blocks representing the logical operation. // We need to distinguish between those two cases here. // The invariants are still shifting, but it is possible that the // last element in a CFGBlock is not a CFGStmt. Look for the last // CFGStmt as the value of the condition. CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend(); for (; I != E; ++I) { CFGElement Elem = *I; Optional CS = Elem.getAs(); if (!CS) continue; if (CS->getStmt() != Condition) break; return Condition; } assert(I != E); while (Condition) { BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) return Condition; Condition = BO->getRHS()->IgnoreParens(); } llvm_unreachable("could not resolve condition"); } void ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext& BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { const LocationContext *LCtx = Pred->getLocationContext(); PrettyStackTraceLocationContext StackCrashInfo(LCtx); currBldrCtx = &BldCtx; // Check for NULL conditions; e.g. "for(;;)" if (!Condition) { BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); NullCondBldr.markInfeasible(false); NullCondBldr.generateNode(Pred->getState(), true, Pred); return; } SValBuilder &SVB = Pred->getState()->getStateManager().getSValBuilder(); SVal TrueVal = SVB.makeTruthVal(true); SVal FalseVal = SVB.makeTruthVal(false); if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); // If the value is already available, we don't need to do anything. if (Pred->getState()->getSVal(Condition, LCtx).isUnknownOrUndef()) { // Resolve the condition in the presence of nested '||' and '&&'. Condition = ResolveCondition(Condition, BldCtx.getBlock()); } // Cast truth values to the correct type. if (const Expr *Ex = dyn_cast(Condition)) { TrueVal = SVB.evalCast(TrueVal, Ex->getType(), getContext().getLogicalOperationType()); FalseVal = SVB.evalCast(FalseVal, Ex->getType(), getContext().getLogicalOperationType()); } PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), Condition->getLocStart(), "Error evaluating branch"); ExplodedNodeSet CheckersOutSet; getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, Pred, *this); // We generated only sinks. if (CheckersOutSet.empty()) return; BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); for (NodeBuilder::iterator I = CheckersOutSet.begin(), E = CheckersOutSet.end(); E != I; ++I) { ExplodedNode *PredI = *I; if (PredI->isSink()) continue; ProgramStateRef PrevState = PredI->getState(); SVal X = PrevState->getSVal(Condition, PredI->getLocationContext()); if (X.isUnknownOrUndef()) { // Give it a chance to recover from unknown. if (const Expr *Ex = dyn_cast(Condition)) { if (Ex->getType()->isIntegralOrEnumerationType()) { // Try to recover some path-sensitivity. Right now casts of symbolic // integers that promote their values are currently not tracked well. // If 'Condition' is such an expression, try and recover the // underlying value and use that instead. SVal recovered = RecoverCastedSymbol(getStateManager(), PrevState, Condition, PredI->getLocationContext(), getContext()); if (!recovered.isUnknown()) { X = recovered; } } } } ProgramStateRef StTrue, StFalse; // If the condition is still unknown, give up. if (X.isUnknownOrUndef()) { StTrue = PrevState->BindExpr(Condition, BldCtx.LC, TrueVal); StFalse = PrevState->BindExpr(Condition, BldCtx.LC, FalseVal); builder.generateNode(StTrue, true, PredI); builder.generateNode(StFalse, false, PredI); continue; } DefinedSVal V = X.castAs(); tie(StTrue, StFalse) = PrevState->assume(V); // Process the true branch. if (builder.isFeasible(true)) { if (StTrue) { StTrue = StTrue->BindExpr(Condition, BldCtx.LC, TrueVal); builder.generateNode(StTrue, true, PredI); } else builder.markInfeasible(true); } // Process the false branch. if (builder.isFeasible(false)) { if (StFalse) { StFalse = StFalse->BindExpr(Condition, BldCtx.LC, FalseVal); builder.generateNode(StFalse, false, PredI); } else builder.markInfeasible(false); } } currBldrCtx = 0; } /// The GDM component containing the set of global variables which have been /// previously initialized with explicit initializers. REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedGlobalsSet, llvm::ImmutableSet) void ExprEngine::processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, clang::ento::ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currBldrCtx = &BuilderCtx; const VarDecl *VD = cast(DS->getSingleDecl()); ProgramStateRef state = Pred->getState(); bool initHasRun = state->contains(VD); BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF); if (!initHasRun) { state = state->add(VD); } builder.generateNode(state, initHasRun, Pred); builder.markInfeasible(!initHasRun); currBldrCtx = 0; } /// processIndirectGoto - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a computed goto jump. void ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { ProgramStateRef state = builder.getState(); SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); // Three possibilities: // // (1) We know the computed label. // (2) The label is NULL (or some other constant), or Undefined. // (3) We have no clue about the label. Dispatch to all targets. // typedef IndirectGotoNodeBuilder::iterator iterator; if (Optional LV = V.getAs()) { const LabelDecl *L = LV->getLabel(); for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { if (I.getLabel() == L) { builder.generateNode(I, state); return; } } llvm_unreachable("No block with label."); } if (V.getAs() || V.getAs()) { // Dispatch to the first target and mark it as a sink. //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); // FIXME: add checker visit. // UndefBranches.insert(N); return; } // This is really a catch-all. We don't support symbolics yet. // FIXME: Implement dispatch for symbolic pointers. for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) builder.generateNode(I, state); } /// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path /// nodes when the control reaches the end of a function. void ExprEngine::processEndOfFunction(NodeBuilderContext& BC, ExplodedNode *Pred) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); StateMgr.EndPath(Pred->getState()); ExplodedNodeSet Dst; if (Pred->getLocationContext()->inTopFrame()) { // Remove dead symbols. ExplodedNodeSet AfterRemovedDead; removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead); // Notify checkers. for (ExplodedNodeSet::iterator I = AfterRemovedDead.begin(), E = AfterRemovedDead.end(); I != E; ++I) { getCheckerManager().runCheckersForEndFunction(BC, Dst, *I, *this); } } else { getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this); } Engine.enqueueEndOfFunction(Dst); } /// ProcessSwitch - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a switch statement. void ExprEngine::processSwitch(SwitchNodeBuilder& builder) { typedef SwitchNodeBuilder::iterator iterator; ProgramStateRef state = builder.getState(); const Expr *CondE = builder.getCondition(); SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); if (CondV_untested.isUndef()) { //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); // FIXME: add checker //UndefBranches.insert(N); return; } DefinedOrUnknownSVal CondV = CondV_untested.castAs(); ProgramStateRef DefaultSt = state; iterator I = builder.begin(), EI = builder.end(); bool defaultIsFeasible = I == EI; for ( ; I != EI; ++I) { // Successor may be pruned out during CFG construction. if (!I.getBlock()) continue; const CaseStmt *Case = I.getCase(); // Evaluate the LHS of the case value. llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); // Get the RHS of the case, if it exists. llvm::APSInt V2; if (const Expr *E = Case->getRHS()) V2 = E->EvaluateKnownConstInt(getContext()); else V2 = V1; // FIXME: Eventually we should replace the logic below with a range // comparison, rather than concretize the values within the range. // This should be easy once we have "ranges" for NonLVals. do { nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, CondV, CaseVal); // Now "assume" that the case matches. if (ProgramStateRef stateNew = state->assume(Res, true)) { builder.generateCaseStmtNode(I, stateNew); // If CondV evaluates to a constant, then we know that this // is the *only* case that we can take, so stop evaluating the // others. if (CondV.getAs()) return; } // Now "assume" that the case doesn't match. Add this state // to the default state (if it is feasible). if (DefaultSt) { if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { defaultIsFeasible = true; DefaultSt = stateNew; } else { defaultIsFeasible = false; DefaultSt = NULL; } } // Concretize the next value in the range. if (V1 == V2) break; ++V1; assert (V1 <= V2); } while (true); } if (!defaultIsFeasible) return; // If we have switch(enum value), the default branch is not // feasible if all of the enum constants not covered by 'case:' statements // are not feasible values for the switch condition. // // Note that this isn't as accurate as it could be. Even if there isn't // a case for a particular enum value as long as that enum value isn't // feasible then it shouldn't be considered for making 'default:' reachable. const SwitchStmt *SS = builder.getSwitch(); const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); if (CondExpr->getType()->getAs()) { if (SS->isAllEnumCasesCovered()) return; } builder.generateDefaultCaseNode(DefaultSt); } //===----------------------------------------------------------------------===// // Transfer functions: Loads and stores. //===----------------------------------------------------------------------===// void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef state = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); if (const VarDecl *VD = dyn_cast(D)) { // C permits "extern void v", and if you cast the address to a valid type, // you can even do things with it. We simply pretend assert(Ex->isGLValue() || VD->getType()->isVoidType()); SVal V = state->getLValue(VD, Pred->getLocationContext()); // For references, the 'lvalue' is the pointer address stored in the // reference region. if (VD->getType()->isReferenceType()) { if (const MemRegion *R = V.getAsRegion()) V = state->getSVal(R); else V = UnknownVal(); } Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } if (const EnumConstantDecl *ED = dyn_cast(D)) { assert(!Ex->isGLValue()); SVal V = svalBuilder.makeIntVal(ED->getInitVal()); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); return; } if (const FunctionDecl *FD = dyn_cast(D)) { SVal V = svalBuilder.getFunctionPointer(FD); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: Compute lvalue of field pointers-to-member. // Right now we just use a non-null void pointer, so that it gives proper // results in boolean contexts. SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy, currBldrCtx->blockCount()); state = state->assume(V.castAs(), true); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } llvm_unreachable("Support for this Decl not implemented."); } /// VisitArraySubscriptExpr - Transfer function for array accesses void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, ExplodedNode *Pred, ExplodedNodeSet &Dst){ const Expr *Base = A->getBase()->IgnoreParens(); const Expr *Idx = A->getIdx()->IgnoreParens(); ExplodedNodeSet checkerPreStmt; getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), ei = checkerPreStmt.end(); it != ei; ++it) { const LocationContext *LCtx = (*it)->getLocationContext(); ProgramStateRef state = (*it)->getState(); SVal V = state->getLValue(A->getType(), state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); assert(A->isGLValue()); Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 0, ProgramPoint::PostLValueKind); } } /// VisitMemberExpr - Transfer function for member expressions. void ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &TopDst) { StmtNodeBuilder Bldr(Pred, TopDst, *currBldrCtx); ExplodedNodeSet Dst; ValueDecl *Member = M->getMemberDecl(); // Handle static member variables and enum constants accessed via // member syntax. if (isa(Member) || isa(Member)) { Bldr.takeNodes(Pred); VisitCommonDeclRefExpr(M, Member, Pred, Dst); Bldr.addNodes(Dst); return; } ProgramStateRef state = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); Expr *BaseExpr = M->getBase(); // Handle C++ method calls. if (const CXXMethodDecl *MD = dyn_cast(Member)) { if (MD->isInstance()) state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal MDVal = svalBuilder.getFunctionPointer(MD); state = state->BindExpr(M, LCtx, MDVal); Bldr.generateNode(M, Pred, state); return; } // Handle regular struct fields / member variables. state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal baseExprVal = state->getSVal(BaseExpr, LCtx); FieldDecl *field = cast(Member); SVal L = state->getLValue(field, baseExprVal); if (M->isGLValue() || M->getType()->isArrayType()) { // We special case rvalue of array type because the analyzer cannot reason // about it, since we expect all regions to be wrapped in Locs. So we will // treat these as lvalues assuming that they will decay to pointers as soon // as they are used. if (!M->isGLValue()) { assert(M->getType()->isArrayType()); const ImplicitCastExpr *PE = dyn_cast(Pred->getParentMap().getParent(M)); if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) { assert(false && "We assume that array is always wrapped in ArrayToPointerDecay"); L = UnknownVal(); } } if (field->getType()->isReferenceType()) { if (const MemRegion *R = L.getAsRegion()) L = state->getSVal(R); else L = UnknownVal(); } Bldr.generateNode(M, Pred, state->BindExpr(M, LCtx, L), 0, ProgramPoint::PostLValueKind); } else { Bldr.takeNodes(Pred); evalLoad(Dst, M, M, Pred, state, L); Bldr.addNodes(Dst); } } namespace { class CollectReachableSymbolsCallback : public SymbolVisitor { InvalidatedSymbols Symbols; public: CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) { Symbols.insert(Sym); return true; } }; } // end anonymous namespace // A value escapes in three possible cases: // (1) We are binding to something that is not a memory region. // (2) We are binding to a MemrRegion that does not have stack storage. // (3) We are binding to a MemRegion with stack storage that the store // does not understand. ProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) { // Are we storing to something that causes the value to "escape"? bool escapes = true; // TODO: Move to StoreManager. if (Optional regionLoc = Loc.getAs()) { escapes = !regionLoc->getRegion()->hasStackStorage(); if (!escapes) { // To test (3), generate a new state with the binding added. If it is // the same state, then it escapes (since the store cannot represent // the binding). // Do this only if we know that the store is not supposed to generate the // same state. SVal StoredVal = State->getSVal(regionLoc->getRegion()); if (StoredVal != Val) escapes = (State == (State->bindLoc(*regionLoc, Val))); } } // If our store can represent the binding and we aren't storing to something // that doesn't have local storage then just return and have the simulation // state continue as is. if (!escapes) return State; // Otherwise, find all symbols referenced by 'val' that we are tracking // and stop tracking them. CollectReachableSymbolsCallback Scanner = State->scanReachableSymbols(Val); const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols(); State = getCheckerManager().runCheckersForPointerEscape(State, EscapedSymbols, /*CallEvent*/ 0, PSK_EscapeOnBind, 0); return State; } ProgramStateRef ExprEngine::notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef ExplicitRegions, ArrayRef Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) { if (!Invalidated || Invalidated->empty()) return State; if (!Call) return getCheckerManager().runCheckersForPointerEscape(State, *Invalidated, 0, PSK_EscapeOther, &ITraits); // If the symbols were invalidated by a call, we want to find out which ones // were invalidated directly due to being arguments to the call. InvalidatedSymbols SymbolsDirectlyInvalidated; for (ArrayRef::iterator I = ExplicitRegions.begin(), E = ExplicitRegions.end(); I != E; ++I) { if (const SymbolicRegion *R = (*I)->StripCasts()->getAs()) SymbolsDirectlyInvalidated.insert(R->getSymbol()); } InvalidatedSymbols SymbolsIndirectlyInvalidated; for (InvalidatedSymbols::const_iterator I=Invalidated->begin(), E = Invalidated->end(); I!=E; ++I) { SymbolRef sym = *I; if (SymbolsDirectlyInvalidated.count(sym)) continue; SymbolsIndirectlyInvalidated.insert(sym); } if (!SymbolsDirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsDirectlyInvalidated, Call, PSK_DirectEscapeOnCall, &ITraits); // Notify about the symbols that get indirectly invalidated by the call. if (!SymbolsIndirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsIndirectlyInvalidated, Call, PSK_IndirectEscapeOnCall, &ITraits); return State; } /// evalBind - Handle the semantics of binding a value to a specific location. /// This method is used by evalStore and (soon) VisitDeclStmt, and others. void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit, const ProgramPoint *PP) { const LocationContext *LC = Pred->getLocationContext(); PostStmt PS(StoreE, LC); if (!PP) PP = &PS; // Do a previsit of the bind. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, StoreE, *this, *PP); StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx); // If the location is not a 'Loc', it will already be handled by // the checkers. There is nothing left to do. if (!location.getAs()) { const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/0, /*tag*/0); ProgramStateRef state = Pred->getState(); state = processPointerEscapedOnBind(state, location, Val); Bldr.generateNode(L, state, Pred); return; } for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I!=E; ++I) { ExplodedNode *PredI = *I; ProgramStateRef state = PredI->getState(); state = processPointerEscapedOnBind(state, location, Val); // When binding the value, pass on the hint that this is a initialization. // For initializations, we do not need to inform clients of region // changes. state = state->bindLoc(location.castAs(), Val, /* notifyChanges = */ !atDeclInit); const MemRegion *LocReg = 0; if (Optional LocRegVal = location.getAs()) { LocReg = LocRegVal->getRegion(); } const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0); Bldr.generateNode(L, state, PredI); } } /// evalStore - Handle the semantics of a store via an assignment. /// @@param Dst The node set to store generated state nodes /// @@param AssignE The assignment expression if the store happens in an /// assignment. /// @@param LocationE The location expression that is stored to. /// @@param state The current simulation state /// @@param location The location to store the value /// @@param Val The value to be stored void ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *LocationE, ExplodedNode *Pred, ProgramStateRef state, SVal location, SVal Val, const ProgramPointTag *tag) { // Proceed with the store. We use AssignE as the anchor for the PostStore // ProgramPoint if it is non-NULL, and LocationE otherwise. const Expr *StoreE = AssignE ? AssignE : LocationE; // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); if (Tmp.empty()) return; if (location.isUndef()) return; for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) evalBind(Dst, StoreE, *NI, location, Val, false); } void ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(!location.getAs() && "location cannot be a NonLoc."); // Are we loading from a region? This actually results in two loads; one // to fetch the address of the referenced value and one to fetch the // referenced value. if (const TypedValueRegion *TR = dyn_cast_or_null(location.getAsRegion())) { QualType ValTy = TR->getValueType(); if (const ReferenceType *RT = ValTy->getAs()) { static SimpleProgramPointTag loadReferenceTag("ExprEngine : Load Reference"); ExplodedNodeSet Tmp; evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, location, &loadReferenceTag, getContext().getPointerType(RT->getPointeeType())); // Perform the load from the referenced value. for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { state = (*I)->getState(); location = state->getSVal(BoundEx, (*I)->getLocationContext()); evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); } return; } } evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); } void ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(NodeEx); assert(BoundEx); // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); if (Tmp.empty()) return; StmtNodeBuilder Bldr(Tmp, Dst, *currBldrCtx); if (location.isUndef()) return; // Proceed with the load. for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { state = (*NI)->getState(); const LocationContext *LCtx = (*NI)->getLocationContext(); SVal V = UnknownVal(); if (location.isValid()) { if (LoadTy.isNull()) LoadTy = BoundEx->getType(); V = state->getSVal(location.castAs(), LoadTy); } Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag, ProgramPoint::PostLoadKind); } } void ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *NodeEx, const Stmt *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, bool isLoad) { StmtNodeBuilder BldrTop(Pred, Dst, *currBldrCtx); // Early checks for performance reason. if (location.isUnknown()) { return; } ExplodedNodeSet Src; BldrTop.takeNodes(Pred); StmtNodeBuilder Bldr(Pred, Src, *currBldrCtx); if (Pred->getState() != state) { // Associate this new state with an ExplodedNode. // FIXME: If I pass null tag, the graph is incorrect, e.g for // int *p; // p = 0; // *p = 0xDEADBEEF; // "p = 0" is not noted as "Null pointer value stored to 'p'" but // instead "int *p" is noted as // "Variable 'p' initialized to a null pointer value" static SimpleProgramPointTag tag("ExprEngine: Location"); Bldr.generateNode(NodeEx, Pred, state, &tag); } ExplodedNodeSet Tmp; getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, NodeEx, BoundEx, *this); BldrTop.addNodes(Tmp); } std::pair ExprEngine::geteagerlyAssumeBinOpBifurcationTags() { static SimpleProgramPointTag eagerlyAssumeBinOpBifurcationTrue("ExprEngine : Eagerly Assume True"), eagerlyAssumeBinOpBifurcationFalse("ExprEngine : Eagerly Assume False"); return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue, &eagerlyAssumeBinOpBifurcationFalse); } void ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex) { StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { ExplodedNode *Pred = *I; // Test if the previous node was as the same expression. This can happen // when the expression fails to evaluate to anything meaningful and // (as an optimization) we don't generate a node. ProgramPoint P = Pred->getLocation(); if (!P.getAs() || P.castAs().getStmt() != Ex) { continue; } ProgramStateRef state = Pred->getState(); SVal V = state->getSVal(Ex, Pred->getLocationContext()); Optional SEV = V.getAs(); if (SEV && SEV->isExpression()) { const std::pair &tags = geteagerlyAssumeBinOpBifurcationTags(); ProgramStateRef StateTrue, StateFalse; tie(StateTrue, StateFalse) = state->assume(*SEV); // First assume that the condition is true. if (StateTrue) { SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateTrue, tags.first); } // Next, assume that the condition is false. if (StateFalse) { SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateFalse, tags.second); } } } } void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); // We have processed both the inputs and the outputs. All of the outputs // should evaluate to Locs. Nuke all of their values. // FIXME: Some day in the future it would be nice to allow a "plug-in" // which interprets the inline asm and stores proper results in the // outputs. ProgramStateRef state = Pred->getState(); for (GCCAsmStmt::const_outputs_iterator OI = A->begin_outputs(), OE = A->end_outputs(); OI != OE; ++OI) { SVal X = state->getSVal(*OI, Pred->getLocationContext()); assert (!X.getAs()); // Should be an Lval, or unknown, undef. if (Optional LV = X.getAs()) state = state->bindLoc(*LV, UnknownVal()); } Bldr.generateNode(A, Pred, state); } void ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(A, Pred, Pred->getState()); } //===----------------------------------------------------------------------===// // Visualization. //===----------------------------------------------------------------------===// #ifndef NDEBUG static ExprEngine* GraphPrintCheckerState; static SourceManager* GraphPrintSourceManager; namespace llvm { template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} // FIXME: Since we do not cache error nodes in ExprEngine now, this does not // work. static std::string getNodeAttributes(const ExplodedNode *N, void*) { #if 0 // FIXME: Replace with a general scheme to tell if the node is // an error node. if (GraphPrintCheckerState->isImplicitNullDeref(N) || GraphPrintCheckerState->isExplicitNullDeref(N) || GraphPrintCheckerState->isUndefDeref(N) || GraphPrintCheckerState->isUndefStore(N) || GraphPrintCheckerState->isUndefControlFlow(N) || GraphPrintCheckerState->isUndefResult(N) || GraphPrintCheckerState->isBadCall(N) || GraphPrintCheckerState->isUndefArg(N)) return "color=\"red\",style=\"filled\""; if (GraphPrintCheckerState->isNoReturnCall(N)) return "color=\"blue\",style=\"filled\""; #endif return ""; } static void printLocation(raw_ostream &Out, SourceLocation SLoc) { if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) << "\\l"; } } static std::string getNodeLabel(const ExplodedNode *N, void*){ std::string sbuf; llvm::raw_string_ostream Out(sbuf); // Program Location. ProgramPoint Loc = N->getLocation(); switch (Loc.getKind()) { case ProgramPoint::BlockEntranceKind: { Out << "Block Entrance: B" << Loc.castAs().getBlock()->getBlockID(); if (const NamedDecl *ND = dyn_cast(Loc.getLocationContext()->getDecl())) { Out << " ("; ND->printName(Out); Out << ")"; } break; } case ProgramPoint::BlockExitKind: assert (false); break; case ProgramPoint::CallEnterKind: Out << "CallEnter"; break; case ProgramPoint::CallExitBeginKind: Out << "CallExitBegin"; break; case ProgramPoint::CallExitEndKind: Out << "CallExitEnd"; break; case ProgramPoint::PostStmtPurgeDeadSymbolsKind: Out << "PostStmtPurgeDeadSymbols"; break; case ProgramPoint::PreStmtPurgeDeadSymbolsKind: Out << "PreStmtPurgeDeadSymbols"; break; case ProgramPoint::EpsilonKind: Out << "Epsilon Point"; break; case ProgramPoint::PreImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PreCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PostCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostInitializerKind: { Out << "PostInitializer: "; const CXXCtorInitializer *Init = Loc.castAs().getInitializer(); if (const FieldDecl *FD = Init->getAnyMember()) Out << *FD; else { QualType Ty = Init->getTypeSourceInfo()->getType(); Ty = Ty.getLocalUnqualifiedType(); LangOptions LO; // FIXME. Ty.print(Out, LO); } break; } case ProgramPoint::BlockEdgeKind: { const BlockEdge &E = Loc.castAs(); Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" << E.getDst()->getBlockID() << ')'; if (const Stmt *T = E.getSrc()->getTerminator()) { SourceLocation SLoc = T->getLocStart(); Out << "\\|Terminator: "; LangOptions LO; // FIXME. E.getSrc()->printTerminator(Out, LO); if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); } if (isa(T)) { const Stmt *Label = E.getDst()->getLabel(); if (Label) { if (const CaseStmt *C = dyn_cast(Label)) { Out << "\\lcase "; LangOptions LO; // FIXME. C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); if (const Stmt *RHS = C->getRHS()) { Out << " .. "; RHS->printPretty(Out, 0, PrintingPolicy(LO)); } Out << ":"; } else { assert (isa(Label)); Out << "\\ldefault:"; } } else Out << "\\l(implicit) default:"; } else if (isa(T)) { // FIXME } else { Out << "\\lCondition: "; if (*E.getSrc()->succ_begin() == E.getDst()) Out << "true"; else Out << "false"; } Out << "\\l"; } #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isUndefControlFlow(N)) { Out << "\\|Control-flow based on\\lUndefined value.\\l"; } #endif break; } default: { const Stmt *S = Loc.castAs().getStmt(); Out << S->getStmtClassName() << ' ' << (const void*) S << ' '; LangOptions LO; // FIXME. S->printPretty(Out, 0, PrintingPolicy(LO)); printLocation(Out, S->getLocStart()); if (Loc.getAs()) Out << "\\lPreStmt\\l;"; else if (Loc.getAs()) Out << "\\lPostLoad\\l;"; else if (Loc.getAs()) Out << "\\lPostStore\\l"; else if (Loc.getAs()) Out << "\\lPostLValue\\l"; #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isImplicitNullDeref(N)) Out << "\\|Implicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isExplicitNullDeref(N)) Out << "\\|Explicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isUndefDeref(N)) Out << "\\|Dereference of undefialied value.\\l"; else if (GraphPrintCheckerState->isUndefStore(N)) Out << "\\|Store to Undefined Loc."; else if (GraphPrintCheckerState->isUndefResult(N)) Out << "\\|Result of operation is undefined."; else if (GraphPrintCheckerState->isNoReturnCall(N)) Out << "\\|Call to function marked \"noreturn\"."; else if (GraphPrintCheckerState->isBadCall(N)) Out << "\\|Call to NULL/Undefined."; else if (GraphPrintCheckerState->isUndefArg(N)) Out << "\\|Argument in call is undefined"; #endif break; } } ProgramStateRef state = N->getState(); Out << "\\|StateID: " << (const void*) state.getPtr() << " NodeID: " << (const void*) N << "\\|"; state->printDOT(Out); Out << "\\l"; if (const ProgramPointTag *tag = Loc.getTag()) { Out << "\\|Tag: " << tag->getTagDescription(); Out << "\\l"; } return Out.str(); } }; } // end llvm namespace #endif #ifndef NDEBUG template ExplodedNode *GetGraphNode(ITERATOR I) { return *I; } template <> ExplodedNode* GetGraphNode::iterator> (llvm::DenseMap::iterator I) { return I->first; } #endif void ExprEngine::ViewGraph(bool trim) { #ifndef NDEBUG if (trim) { std::vector Src; // Flush any outstanding reports to make sure we cover all the nodes. // This does not cause them to get displayed. for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) const_cast(*I)->FlushReports(BR); // Iterate through the reports and get their nodes. for (BugReporter::EQClasses_iterator EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { ExplodedNode *N = const_cast(EI->begin()->getErrorNode()); if (N) Src.push_back(N); } ViewGraph(Src); } else { GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); GraphPrintCheckerState = NULL; GraphPrintSourceManager = NULL; } #endif } void ExprEngine::ViewGraph(ArrayRef Nodes) { #ifndef NDEBUG GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); OwningPtr TrimmedG(G.trim(Nodes)); if (!TrimmedG.get()) llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; else llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); GraphPrintCheckerState = NULL; GraphPrintSourceManager = NULL; #endif } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d121 1 a121 1 svalBuilder.getConditionType()); d601 1 d667 2 d1389 3 d1396 14 a1409 1 Condition = ResolveCondition(Condition, BldCtx.getBlock()); d1452 2 d1456 6 a1461 2 builder.generateNode(PrevState, true, PredI); builder.generateNode(PrevState, false, PredI); a1465 2 ProgramStateRef StTrue, StFalse; d1470 2 a1471 1 if (StTrue) d1473 1 a1473 1 else d1479 2 a1480 1 if (StFalse) d1482 1 a1482 1 else d1777 1 a1777 1 ExplodedNodeSet &Dst) { d1779 2 a1780 5 // FIXME: Prechecks eventually go in ::Visit(). ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, M, *this); ExplodedNodeSet EvalSet; d1786 5 a1790 8 ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { VisitCommonDeclRefExpr(M, Member, Pred, EvalSet); } } else { StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); ExplodedNodeSet Tmp; d1792 3 a1794 17 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef state = (*I)->getState(); const LocationContext *LCtx = (*I)->getLocationContext(); Expr *BaseExpr = M->getBase(); // Handle C++ method calls. if (const CXXMethodDecl *MD = dyn_cast(Member)) { if (MD->isInstance()) state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal MDVal = svalBuilder.getFunctionPointer(MD); state = state->BindExpr(M, LCtx, MDVal); Bldr.generateNode(M, *I, state); continue; } d1796 3 a1798 1 // Handle regular struct fields / member variables. a1799 1 SVal baseExprVal = state->getSVal(BaseExpr, LCtx); d1801 2 a1802 2 FieldDecl *field = cast(Member); SVal L = state->getLValue(field, baseExprVal); d1804 3 a1806 14 if (M->isGLValue() || M->getType()->isArrayType()) { // We special-case rvalues of array type because the analyzer cannot // reason about them, since we expect all regions to be wrapped in Locs. // We instead treat these as lvalues and assume that they will decay to // pointers as soon as they are used. if (!M->isGLValue()) { assert(M->getType()->isArrayType()); const ImplicitCastExpr *PE = dyn_cast((*I)->getParentMap().getParent(M)); if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) { llvm_unreachable("should always be wrapped in ArrayToPointerDecay"); L = UnknownVal(); } } d1808 23 a1830 6 if (field->getType()->isReferenceType()) { if (const MemRegion *R = L.getAsRegion()) L = state->getSVal(R); else L = UnknownVal(); } d1832 5 a1836 7 Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), 0, ProgramPoint::PostLValueKind); } else { Bldr.takeNodes(*I); evalLoad(Tmp, M, M, *I, state, L); Bldr.addNodes(Tmp); } d1838 7 a1845 2 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, M, *this); @ 1.1.1.3 log @Import Clang 3.5svn r199312 @ text @a288 4 case CFGElement::NewAllocator: ProcessNewAllocator(E.castAs().getAllocatorExpr(), Pred); return; a549 11 void ExprEngine::ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred) { //TODO: Implement VisitCXXNewAllocatorCall ExplodedNodeSet Dst; NodeBuilder Bldr(Pred, Dst, *currBldrCtx); const LocationContext *LCtx = Pred->getLocationContext(); PostImplicitCall PP(NE->getOperatorNew(), NE->getLocStart(), LCtx); Bldr.generateNode(PP, Pred->getState(), Pred); Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } @ 1.1.1.4 log @Import Clang 3.5svn r201163. @ text @d556 1 d558 4 a561 13 AnalysisManager &AMgr = getAnalysisManager(); AnalyzerOptions &Opts = AMgr.options; // TODO: We're not evaluating allocators for all cases just yet as // we're not handling the return value correctly, which causes false // positives when the alpha.cplusplus.NewDeleteLeaks check is on. if (Opts.mayInlineCXXAllocator()) VisitCXXNewAllocatorCall(NE, Pred, Dst); else { NodeBuilder Bldr(Pred, Dst, *currBldrCtx); const LocationContext *LCtx = Pred->getLocationContext(); PostImplicitCall PP(NE->getOperatorNew(), NE->getLocStart(), LCtx); Bldr.generateNode(PP, Pred->getState(), Pred); } @ 1.1.1.5 log @Import Clang 3.5svn r202566. @ text @a57 2 static const char* TagProviderName = "ExprEngine"; d369 1 a369 1 static SimpleProgramPointTag cleanupTag(TagProviderName, "Clean Node"); a731 1 case Stmt::OMPSimdDirectiveClass: d1276 1 a1276 1 static SimpleProgramPointTag tag(TagProviderName, "Block count exceeded"); d2070 1 a2070 1 loadReferenceTag(TagProviderName, "Load Reference"); d2153 1 a2153 1 static SimpleProgramPointTag tag(TagProviderName, "Location"); d2165 2 a2166 4 eagerlyAssumeBinOpBifurcationTrue(TagProviderName, "Eagerly Assume True"), eagerlyAssumeBinOpBifurcationFalse(TagProviderName, "Eagerly Assume False"); @ 1.1.1.5.2.1 log @Rebase. @ text @d16 2 a42 2 #define DEBUG_TYPE "ExprEngine" d73 1 a73 1 currStmtIdx(0), currBldrCtx(nullptr), d158 1 a158 1 if (SFC->getParent() == nullptr) { d214 1 a214 1 const TypedValueRegion *TR = nullptr; d338 1 a338 1 ReferenceStmt == nullptr || isa(ReferenceStmt)) d359 1 a359 1 const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : nullptr; d667 1 a667 1 VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(), d874 1 a874 2 SVal result = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, resultType, d954 1 a954 1 Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/nullptr, d1213 1 a1213 1 ExplodedNode *BeforeProcessingCall = nullptr; d1220 1 a1220 1 N = N->pred_empty() ? nullptr : *(N->pred_begin()); a1354 27 #ifndef NDEBUG static const Stmt *getRightmostLeaf(const Stmt *Condition) { while (Condition) { const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) { return Condition; } Condition = BO->getRHS()->IgnoreParens(); } return nullptr; } #endif // Returns the condition the branch at the end of 'B' depends on and whose value // has been evaluated within 'B'. // In most cases, the terminator condition of 'B' will be evaluated fully in // the last statement of 'B'; in those cases, the resolved condition is the // given 'Condition'. // If the condition of the branch is a logical binary operator tree, the CFG is // optimized: in that case, we know that the expression formed by all but the // rightmost leaf of the logical binary operator tree must be true, and thus // the branch condition is at this point equivalent to the truth value of that // rightmost leaf; the CFG block thus only evaluates this rightmost leaf // expression in its final statement. As the full condition in that case was // not evaluated, and is thus not in the SVal cache, we need to use that leaf // expression to evaluate the truth value of the condition in the current state // space. a1363 6 // FIXME: This is a workaround until we handle temporary destructor branches // correctly; currently, temporary destructor branches lead to blocks that // only have a terminator (and no statements). These blocks violate the // invariant this function assumes. if (B->getTerminator().isTemporaryDtorsBranch()) return Condition; d1378 12 a1389 3 const Stmt *LastStmt = CS->getStmt(); assert(LastStmt == Condition || LastStmt == getRightmostLeaf(Condition)); return LastStmt; d1469 1 a1469 1 std::tie(StTrue, StFalse) = PrevState->assume(V); d1487 1 a1487 1 currBldrCtx = nullptr; d1516 1 a1516 1 currBldrCtx = nullptr; d1657 1 a1657 1 DefaultSt = nullptr; d1718 1 a1718 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1730 1 a1730 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1741 1 a1741 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1771 1 a1771 1 Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), nullptr, d1835 1 d1846 1 a1846 1 Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), nullptr, d1866 1 a1866 1 bool VisitSymbol(SymbolRef Sym) override { d1912 1 a1912 1 /*CallEvent*/ nullptr, d1914 1 a1914 1 nullptr); d1933 1 a1933 1 nullptr, d1990 1 a1990 2 const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr, /*tag*/nullptr); d2011 1 a2011 1 const MemRegion *LocReg = nullptr; d2016 2 a2017 2 const ProgramPoint L = PostStore(StoreE, LC, LocReg, nullptr); d2199 1 a2199 1 std::tie(StateTrue, StateFalse) = state->assume(*SEV); d2406 1 a2406 1 C->getLHS()->printPretty(Out, nullptr, PrintingPolicy(LO)); d2410 1 a2410 1 RHS->printPretty(Out, nullptr, PrintingPolicy(LO)); d2452 1 a2452 1 S->printPretty(Out, nullptr, PrintingPolicy(LO)); d2542 2 a2543 2 GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; d2553 1 a2553 1 std::unique_ptr TrimmedG(G.trim(Nodes)); d2560 2 a2561 2 GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; @ 1.1.1.6 log @Import Clang 3.5svn r209886. @ text @d16 2 a42 2 #define DEBUG_TYPE "ExprEngine" d73 1 a73 1 currStmtIdx(0), currBldrCtx(nullptr), d158 1 a158 1 if (SFC->getParent() == nullptr) { d214 1 a214 1 const TypedValueRegion *TR = nullptr; d338 1 a338 1 ReferenceStmt == nullptr || isa(ReferenceStmt)) d359 1 a359 1 const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : nullptr; d667 1 a667 1 VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(), d874 1 a874 2 SVal result = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, resultType, d954 1 a954 1 Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/nullptr, d1213 1 a1213 1 ExplodedNode *BeforeProcessingCall = nullptr; d1220 1 a1220 1 N = N->pred_empty() ? nullptr : *(N->pred_begin()); a1354 27 #ifndef NDEBUG static const Stmt *getRightmostLeaf(const Stmt *Condition) { while (Condition) { const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) { return Condition; } Condition = BO->getRHS()->IgnoreParens(); } return nullptr; } #endif // Returns the condition the branch at the end of 'B' depends on and whose value // has been evaluated within 'B'. // In most cases, the terminator condition of 'B' will be evaluated fully in // the last statement of 'B'; in those cases, the resolved condition is the // given 'Condition'. // If the condition of the branch is a logical binary operator tree, the CFG is // optimized: in that case, we know that the expression formed by all but the // rightmost leaf of the logical binary operator tree must be true, and thus // the branch condition is at this point equivalent to the truth value of that // rightmost leaf; the CFG block thus only evaluates this rightmost leaf // expression in its final statement. As the full condition in that case was // not evaluated, and is thus not in the SVal cache, we need to use that leaf // expression to evaluate the truth value of the condition in the current state // space. a1363 6 // FIXME: This is a workaround until we handle temporary destructor branches // correctly; currently, temporary destructor branches lead to blocks that // only have a terminator (and no statements). These blocks violate the // invariant this function assumes. if (B->getTerminator().isTemporaryDtorsBranch()) return Condition; d1378 12 a1389 3 const Stmt *LastStmt = CS->getStmt(); assert(LastStmt == Condition || LastStmt == getRightmostLeaf(Condition)); return LastStmt; d1469 1 a1469 1 std::tie(StTrue, StFalse) = PrevState->assume(V); d1487 1 a1487 1 currBldrCtx = nullptr; d1516 1 a1516 1 currBldrCtx = nullptr; d1657 1 a1657 1 DefaultSt = nullptr; d1718 1 a1718 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1730 1 a1730 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1741 1 a1741 1 Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, d1771 1 a1771 1 Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), nullptr, d1835 1 d1846 1 a1846 1 Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), nullptr, d1866 1 a1866 1 bool VisitSymbol(SymbolRef Sym) override { d1912 1 a1912 1 /*CallEvent*/ nullptr, d1914 1 a1914 1 nullptr); d1933 1 a1933 1 nullptr, d1990 1 a1990 2 const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr, /*tag*/nullptr); d2011 1 a2011 1 const MemRegion *LocReg = nullptr; d2016 2 a2017 2 const ProgramPoint L = PostStore(StoreE, LC, LocReg, nullptr); d2199 1 a2199 1 std::tie(StateTrue, StateFalse) = state->assume(*SEV); d2406 1 a2406 1 C->getLHS()->printPretty(Out, nullptr, PrintingPolicy(LO)); d2410 1 a2410 1 RHS->printPretty(Out, nullptr, PrintingPolicy(LO)); d2452 1 a2452 1 S->printPretty(Out, nullptr, PrintingPolicy(LO)); d2542 2 a2543 2 GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; d2553 1 a2553 1 std::unique_ptr TrimmedG(G.trim(Nodes)); d2560 2 a2561 2 GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; @ 1.1.1.7 log @Import clang 3.6svn r215315. @ text @a53 9 typedef std::pair CXXBindTemporaryContext; // Keeps track of whether CXXBindTemporaryExpr nodes have been evaluated. // The StackFrameContext assures that nested calls due to inlined recursive // functions do not interfere. REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedTemporariesSet, llvm::ImmutableSet) a661 8 ExplodedNodeSet CleanDtorState; StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx); ProgramStateRef State = Pred->getState(); assert(State->contains( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame()))); State = State->remove( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame())); StmtBldr.generateNode(D.getBindTemporaryExpr(), Pred, State); d664 3 a666 4 assert(CleanDtorState.size() == 1); ExplodedNode *CleanPred = *CleanDtorState.begin(); // FIXME: Inlining of temporary destructors is not supported yet anyway, so // we just put a NULL region for now. This will need to be changed later. d668 1 a668 38 /*IsBase=*/false, CleanPred, Dst); } void ExprEngine::processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { BranchNodeBuilder TempDtorBuilder(Pred, Dst, BldCtx, DstT, DstF); if (Pred->getState()->contains( std::make_pair(BTE, Pred->getStackFrame()))) { TempDtorBuilder.markInfeasible(false); TempDtorBuilder.generateNode(Pred->getState(), true, Pred); } else { TempDtorBuilder.markInfeasible(true); TempDtorBuilder.generateNode(Pred->getState(), false, Pred); } } void ExprEngine::VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst) { if (!getAnalysisManager().options.includeTemporaryDtorsInCFG()) { // In case we don't have temporary destructors in the CFG, do not mark // the initialization - we would otherwise never clean it up. Dst = PreVisit; return; } StmtNodeBuilder StmtBldr(PreVisit, Dst, *currBldrCtx); for (ExplodedNode *Node : PreVisit) { ProgramStateRef State = Node->getState(); assert(!State->contains( std::make_pair(BTE, Node->getStackFrame()))); State = State->add( std::make_pair(BTE, Node->getStackFrame())); StmtBldr.generateNode(BTE, Node, State); } a701 1 case Stmt::SEHLeaveStmtClass: a734 15 case Stmt::OMPForDirectiveClass: case Stmt::OMPSectionsDirectiveClass: case Stmt::OMPSectionDirectiveClass: case Stmt::OMPSingleDirectiveClass: case Stmt::OMPMasterDirectiveClass: case Stmt::OMPCriticalDirectiveClass: case Stmt::OMPParallelForDirectiveClass: case Stmt::OMPParallelSectionsDirectiveClass: case Stmt::OMPTaskDirectiveClass: case Stmt::OMPTaskyieldDirectiveClass: case Stmt::OMPBarrierDirectiveClass: case Stmt::OMPTaskwaitDirectiveClass: case Stmt::OMPFlushDirectiveClass: case Stmt::OMPOrderedDirectiveClass: case Stmt::OMPAtomicDirectiveClass: a759 11 case Stmt::CXXBindTemporaryExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet Next; VisitCXXBindTemporaryExpr(cast(S), PreVisit, Next); getCheckerManager().runCheckersForPostStmt(Dst, Next, S, *this); Bldr.addNodes(Dst); break; } d797 1 d1392 5 a1396 2 assert(!B->getTerminator().isTemporaryDtorsBranch() && "Temporary destructor branches handled by processBindTemporary."); a1424 2 assert((!Condition || !isa(Condition)) && "CXXBindTemporaryExprs are handled by processBindTemporary."); a1587 16 #if 0 static bool stackFrameDoesNotContainInitializedTemporaries(ExplodedNode &Pred) { const StackFrameContext* Frame = Pred.getStackFrame(); const llvm::ImmutableSet &Set = Pred.getState()->get(); return std::find_if(Set.begin(), Set.end(), [&](const CXXBindTemporaryContext &Ctx) { if (Ctx.second == Frame) { Ctx.first->dump(); llvm::errs() << "\n"; } return Ctx.second == Frame; }) == Set.end(); } #endif a1591 3 // FIXME: Assert that stackFrameDoesNotContainInitializedTemporaries(*Pred)). // We currently cannot enable this assert, as lifetime extended temporaries // are not modelled correctly. d2255 3 a2257 2 for (const Expr *O : A->outputs()) { SVal X = state->getSVal(O, Pred->getLocationContext()); d2431 1 a2431 2 if (C->getLHS()) C->getLHS()->printPretty(Out, nullptr, PrintingPolicy(LO)); a2473 1 assert(S != nullptr && "Expecting non-null Stmt"); d2515 1 a2515 1 Out << "\\|StateID: " << (const void*) state.get() @ 1.1.1.7.2.1 log @Update LLVM to 3.6.1, requested by joerg in ticket 824. @ text @d674 4 a677 7 if (State->contains( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame()))) { // FIXME: Currently we insert temporary destructors for default parameters, // but we don't insert the constructors. State = State->remove( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame())); } d681 2 a682 5 // FIXME: Currently CleanDtorState can be empty here due to temporaries being // bound to default parameters. assert(CleanDtorState.size() <= 1); ExplodedNode *CleanPred = CleanDtorState.empty() ? Pred : *CleanDtorState.begin(); d718 4 a721 10 if (!State->contains( std::make_pair(BTE, Node->getStackFrame()))) { // FIXME: Currently the state might already contain the marker due to // incorrect handling of temporaries bound to default parameters; for // those, we currently skip the CXXBindTemporaryExpr but rely on adding // temporary destructor nodes. State = State->add( std::make_pair(BTE, Node->getStackFrame())); } a742 1 case Stmt::CXXFoldExprClass: a750 1 case Stmt::TypoExprClass: a791 1 case Stmt::OMPForSimdDirectiveClass: a797 1 case Stmt::OMPParallelForSimdDirectiveClass: a805 2 case Stmt::OMPTargetDirectiveClass: case Stmt::OMPTeamsDirectiveClass: d855 1 a866 1 case Stmt::PredefinedExprClass: @ 1.1.1.8 log @Import Clang 3.6RC1 r227398. @ text @d674 4 a677 7 if (State->contains( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame()))) { // FIXME: Currently we insert temporary destructors for default parameters, // but we don't insert the constructors. State = State->remove( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame())); } d681 2 a682 5 // FIXME: Currently CleanDtorState can be empty here due to temporaries being // bound to default parameters. assert(CleanDtorState.size() <= 1); ExplodedNode *CleanPred = CleanDtorState.empty() ? Pred : *CleanDtorState.begin(); d718 4 a721 10 if (!State->contains( std::make_pair(BTE, Node->getStackFrame()))) { // FIXME: Currently the state might already contain the marker due to // incorrect handling of temporaries bound to default parameters; for // those, we currently skip the CXXBindTemporaryExpr but rely on adding // temporary destructor nodes. State = State->add( std::make_pair(BTE, Node->getStackFrame())); } a742 1 case Stmt::CXXFoldExprClass: a750 1 case Stmt::TypoExprClass: a791 1 case Stmt::OMPForSimdDirectiveClass: a797 1 case Stmt::OMPParallelForSimdDirectiveClass: a805 2 case Stmt::OMPTargetDirectiveClass: case Stmt::OMPTeamsDirectiveClass: d855 1 a866 1 case Stmt::PredefinedExprClass: @ 1.1.1.9 log @Import Clang 3.8.0rc3 r261930. @ text @a28 1 #include "clang/StaticAnalyzer/Core/PathSensitive/LoopWidening.h" d177 1 a177 1 d268 1 a268 1 ProgramStateRef d318 1 a318 1 d330 1 a330 1 d478 2 a479 6 if (auto *CtorExpr = findDirectConstructorForCurrentCFGElement()) { assert(BMI->getInit()->IgnoreImplicit() == CtorExpr); (void)CtorExpr; // The field was directly constructed, so there is no need to bind. } else { const Expr *Init = BMI->getInit()->IgnoreImplicit(); d515 1 a515 1 a756 1 case Stmt::MSPropertySubscriptExprClass: d759 1 a768 4 case Stmt::CoroutineBodyStmtClass: case Stmt::CoawaitExprClass: case Stmt::CoreturnStmtClass: case Stmt::CoyieldExprClass: d772 1 d778 1 a778 1 a818 1 case Stmt::OMPTaskgroupDirectiveClass: a822 1 case Stmt::OMPTargetDataDirectiveClass: a823 5 case Stmt::OMPCancellationPointDirectiveClass: case Stmt::OMPCancelDirectiveClass: case Stmt::OMPTaskLoopDirectiveClass: case Stmt::OMPTaskLoopSimdDirectiveClass: case Stmt::OMPDistributeDirectiveClass: a861 1 case Stmt::DesignatedInitUpdateExprClass: a893 1 case Stmt::NoInitExprClass: d899 1 a899 3 case Stmt::CXXNullPtrLiteralExprClass: case Stmt::OMPArraySectionExprClass: case Stmt::TypeTraitExprClass: { d962 1 a962 1 d970 1 a970 1 it != et; ++it) { d979 1 a979 1 d982 1 a982 1 break; a1008 11 case Stmt::LambdaExprClass: if (AMgr.options.shouldInlineLambdas()) { Bldr.takeNodes(Pred); VisitLambdaExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); } else { const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); Engine.addAbortedBlock(node, currBldrCtx->getBlock()); } break; d1027 1 a1027 1 d1072 1 a1072 1 d1081 1 a1081 1 case Stmt::CXXConstructExprClass: { d1103 1 a1103 1 for (ExplodedNodeSet::iterator i = PreVisit.begin(), d1169 1 a1169 1 case Stmt::CXXFunctionalCastExprClass: d1176 1 a1176 1 d1180 1 a1180 1 e = dstPrevisit.end(); i != e ; ++i) { d1197 1 a1197 1 d1292 1 a1292 1 if (const Expr *Result = PE->getResultExpr()) { d1373 1 a1373 1 NodeBuilderWithSinks &nodeBuilder, a1376 17 // If this block is terminated by a loop and it has already been visited the // maximum number of times, widen the loop. unsigned int BlockCount = nodeBuilder.getContext().blockCount(); if (BlockCount == AMgr.options.maxBlockVisitOnPath - 1 && AMgr.options.shouldWidenLoops()) { const Stmt *Term = nodeBuilder.getContext().getBlock()->getTerminator(); if (!(Term && (isa(Term) || isa(Term) || isa(Term)))) return; // Widen. const LocationContext *LCtx = Pred->getLocationContext(); ProgramStateRef WidenedState = getWidenedLoopState(Pred->getState(), LCtx, BlockCount, Term); nodeBuilder.generateNode(WidenedState, Pred); return; } d1378 1 a1378 1 if (BlockCount >= AMgr.options.maxBlockVisitOnPath) { d1535 1 d1581 1 a1581 1 d1748 1 a1748 1 d1756 1 a1756 1 d1770 41 a1810 18 ProgramStateRef StateCase; if (Optional NL = CondV.getAs()) std::tie(StateCase, DefaultSt) = DefaultSt->assumeWithinInclusiveRange(*NL, V1, V2); else // UnknownVal StateCase = DefaultSt; if (StateCase) builder.generateCaseStmtNode(I, StateCase); // Now "assume" that the case doesn't match. Add this state // to the default state (if it is feasible). if (DefaultSt) defaultIsFeasible = true; else { defaultIsFeasible = false; break; } d1847 1 a1847 1 // you can even do things with it. We simply pretend d1849 1 a1849 32 const LocationContext *LocCtxt = Pred->getLocationContext(); const Decl *D = LocCtxt->getDecl(); const auto *MD = D ? dyn_cast(D) : nullptr; const auto *DeclRefEx = dyn_cast(Ex); SVal V; bool IsReference; if (AMgr.options.shouldInlineLambdas() && DeclRefEx && DeclRefEx->refersToEnclosingVariableOrCapture() && MD && MD->getParent()->isLambda()) { // Lookup the field of the lambda. const CXXRecordDecl *CXXRec = MD->getParent(); llvm::DenseMap LambdaCaptureFields; FieldDecl *LambdaThisCaptureField; CXXRec->getCaptureFields(LambdaCaptureFields, LambdaThisCaptureField); const FieldDecl *FD = LambdaCaptureFields[VD]; if (!FD) { // When a constant is captured, sometimes no corresponding field is // created in the lambda object. assert(VD->getType().isConstQualified()); V = state->getLValue(VD, LocCtxt); IsReference = false; } else { Loc CXXThis = svalBuilder.getCXXThis(MD, LocCtxt->getCurrentStackFrame()); SVal CXXThisVal = state->getSVal(CXXThis); V = state->getLValue(FD, CXXThisVal); IsReference = FD->getType()->isReferenceType(); } } else { V = state->getLValue(VD, LocCtxt); IsReference = VD->getType()->isReferenceType(); } d1853 1 a1853 1 if (IsReference) { d1898 1 a1903 3 assert(A->isGLValue() || (!AMgr.getLangOpts().CPlusPlus && A->getType().isCForbiddenLValueType())); d1912 1 d2001 1 a2001 1 class CollectReachableSymbolsCallback final : public SymbolVisitor { a2002 1 d2060 1 a2060 1 ProgramStateRef d2067 1 a2067 1 d2078 1 a2078 1 // If the symbols were invalidated by a call, we want to find out which ones d2125 1 d2138 1 d2144 1 a2144 1 d2297 1 a2297 1 d2322 1 a2322 1 d2345 1 a2345 1 SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); d2637 1 a2637 1 Out << "\\l"; d2640 1 a2640 1 Out << "\\|Tag: " << tag->getTagDescription(); d2649 11 @ 1.1.1.9.2.1 log @Sync with HEAD @ text @d30 1 a31 1 #include "llvm/Support/SaveAndRestore.h" d205 12 a216 20 // MaterializeTemporaryExpr may appear out of place, after a few field and // base-class accesses have been made to the object, even though semantically // it is the whole object that gets materialized and lifetime-extended. // // For example: // // `-MaterializeTemporaryExpr // `-MemberExpr // `-CXXTemporaryObjectExpr // // instead of the more natural // // `-MemberExpr // `-MaterializeTemporaryExpr // `-CXXTemporaryObjectExpr // // Use the usual methods for obtaining the expression of the base object, // and record the adjustments that we need to make to obtain the sub-object // that the whole expression 'Ex' refers to. This trick is usual, // in the sense that CodeGen takes a similar route. d218 3 a220 4 SmallVector CommaLHSs; SmallVector Adjustments; const Expr *Init = Ex->skipRValueSubobjectAdjustments(CommaLHSs, Adjustments); d222 2 d231 1 a231 1 TR = MRMgr.getCXXStaticTempObjectRegion(Init); d234 1 a234 1 TR = MRMgr.getCXXTempObjectRegion(Init, LC); a237 18 // Make the necessary adjustments to obtain the sub-object. for (auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) { const SubobjectAdjustment &Adj = *I; switch (Adj.Kind) { case SubobjectAdjustment::DerivedToBaseAdjustment: Reg = StoreMgr.evalDerivedToBase(Reg, Adj.DerivedToBase.BasePath); break; case SubobjectAdjustment::FieldAdjustment: Reg = StoreMgr.getLValueField(Adj.Field, Reg); break; case SubobjectAdjustment::MemberPointerAdjustment: // FIXME: Unimplemented. State->bindDefault(Reg, UnknownVal()); return State; } } // Try to recover some path sensitivity in case we couldn't compute the value. a240 2 // Bind the value of the expression to the sub-object region, and then bind // the sub-object region to our expression. d242 8 d265 4 d495 1 a495 1 if (Init->getType()->isArrayType()) { d503 2 a504 3 if (!Field->getType()->isReferenceType()) if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); d599 3 a601 3 if (varType->isReferenceType()) { Region = state->getSVal(Region).getAsRegion()->getBaseRegion(); varType = cast(Region)->getValueType(); a756 1 case Stmt::CXXInheritedCtorInitExprClass: a832 5 case Stmt::OMPTargetEnterDataDirectiveClass: case Stmt::OMPTargetExitDataDirectiveClass: case Stmt::OMPTargetParallelDirectiveClass: case Stmt::OMPTargetParallelForDirectiveClass: case Stmt::OMPTargetUpdateDirectiveClass: a838 14 case Stmt::OMPDistributeParallelForDirectiveClass: case Stmt::OMPDistributeParallelForSimdDirectiveClass: case Stmt::OMPDistributeSimdDirectiveClass: case Stmt::OMPTargetParallelForSimdDirectiveClass: case Stmt::OMPTargetSimdDirectiveClass: case Stmt::OMPTeamsDistributeDirectiveClass: case Stmt::OMPTeamsDistributeSimdDirectiveClass: case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass: case Stmt::OMPTeamsDistributeParallelForDirectiveClass: case Stmt::OMPTargetTeamsDirectiveClass: case Stmt::OMPTargetTeamsDistributeDirectiveClass: case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass: case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass: case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass: a877 2 case Stmt::ArrayInitLoopExprClass: case Stmt::ArrayInitIndexExprClass: d895 1 a908 1 case Stmt::ObjCAvailabilityCheckExprClass: d1203 5 d1209 4 a1212 1 VisitCast(C, C->getSubExpr(), Pred, dstExpr); d1223 1 a1223 8 ExplodedNodeSet dstPrevisit; getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, MTE, *this); ExplodedNodeSet dstExpr; for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), e = dstPrevisit.end(); i != e ; ++i) { CreateCXXTemporaryObject(MTE, *i, dstExpr); } getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, MTE, *this); a1239 6 case Stmt::AtomicExprClass: Bldr.takeNodes(Pred); VisitAtomicExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; a1747 8 void ExprEngine::processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) { SaveAndRestore NodeContextRAII(currBldrCtx, &BC); getCheckerManager().runCheckersForBeginFunction(Dst, L, Pred, *this); } d1751 1 a1751 2 ExplodedNode *Pred, const ReturnStmt *RS) { d1773 1 a1773 1 Engine.enqueueEndOfFunction(Dst, RS); d1819 1 a1819 1 DefaultSt->assumeInclusiveRange(*NL, V1, V2); d1953 2 a1954 2 ExplodedNodeSet CheckerPreStmt; getCheckerManager().runCheckersForPreStmt(CheckerPreStmt, Pred, A, *this); d1956 1 a1956 2 ExplodedNodeSet EvalSet; StmtNodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx); d1961 4 a1964 3 for (auto *Node : CheckerPreStmt) { const LocationContext *LCtx = Node->getLocationContext(); ProgramStateRef state = Node->getState(); d1968 1 a1968 1 Bldr.generateNode(A, Node, state->BindExpr(A, LCtx, V), nullptr, a1970 2 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, A, *this); d2029 1 a2029 1 dyn_cast((*I)->getParentMap().getParentIgnoreParens(M)); a2054 38 void ExprEngine::VisitAtomicExpr(const AtomicExpr *AE, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ExplodedNodeSet AfterPreSet; getCheckerManager().runCheckersForPreStmt(AfterPreSet, Pred, AE, *this); // For now, treat all the arguments to C11 atomics as escaping. // FIXME: Ideally we should model the behavior of the atomics precisely here. ExplodedNodeSet AfterInvalidateSet; StmtNodeBuilder Bldr(AfterPreSet, AfterInvalidateSet, *currBldrCtx); for (ExplodedNodeSet::iterator I = AfterPreSet.begin(), E = AfterPreSet.end(); I != E; ++I) { ProgramStateRef State = (*I)->getState(); const LocationContext *LCtx = (*I)->getLocationContext(); SmallVector ValuesToInvalidate; for (unsigned SI = 0, Count = AE->getNumSubExprs(); SI != Count; SI++) { const Expr *SubExpr = AE->getSubExprs()[SI]; SVal SubExprVal = State->getSVal(SubExpr, LCtx); ValuesToInvalidate.push_back(SubExprVal); } State = State->invalidateRegions(ValuesToInvalidate, AE, currBldrCtx->blockCount(), LCtx, /*CausedByPointerEscape*/true, /*Symbols=*/nullptr); SVal ResultVal = UnknownVal(); State = State->BindExpr(AE, LCtx, ResultVal); Bldr.generateNode(AE, *I, State, nullptr, ProgramPoint::PostStmtKind); } getCheckerManager().runCheckersForPostStmt(Dst, AfterInvalidateSet, AE, *this); } d2461 17 a2480 1 // De-duplicate some source location pretty-printing. a2489 6 static void printLocation2(raw_ostream &Out, SourceLocation SLoc) { if (SLoc.isFileID() && GraphPrintSourceManager->isInMainFile(SLoc)) Out << "line " << GraphPrintSourceManager->getExpansionLineNumber(SLoc); else SLoc.print(Out, *GraphPrintSourceManager); } d2503 6 d2633 7 d2661 21 a2688 34 // Analysis stack backtrace. Out << "Location context stack (from current to outer):\\l"; const LocationContext *LC = Loc.getLocationContext(); unsigned Idx = 0; for (; LC; LC = LC->getParent(), ++Idx) { Out << Idx << ". (" << (const void *)LC << ") "; switch (LC->getKind()) { case LocationContext::StackFrame: if (const NamedDecl *D = dyn_cast(LC->getDecl())) Out << "Calling " << D->getQualifiedNameAsString(); else Out << "Calling anonymous code"; if (const Stmt *S = cast(LC)->getCallSite()) { Out << " at "; printLocation2(Out, S->getLocStart()); } break; case LocationContext::Block: Out << "Invoking block"; if (const Decl *D = cast(LC)->getBlockDecl()) { Out << " defined at "; printLocation2(Out, D->getLocStart()); } break; case LocationContext::Scope: Out << "Entering scope"; // FIXME: Add more info once ScopeContext is activated. break; } Out << "\\l"; } Out << "\\l"; @ 1.1.1.10 log @Import Clang pre-4.0.0 r291444. @ text @d30 1 a31 1 #include "llvm/Support/SaveAndRestore.h" d205 12 a216 20 // MaterializeTemporaryExpr may appear out of place, after a few field and // base-class accesses have been made to the object, even though semantically // it is the whole object that gets materialized and lifetime-extended. // // For example: // // `-MaterializeTemporaryExpr // `-MemberExpr // `-CXXTemporaryObjectExpr // // instead of the more natural // // `-MemberExpr // `-MaterializeTemporaryExpr // `-CXXTemporaryObjectExpr // // Use the usual methods for obtaining the expression of the base object, // and record the adjustments that we need to make to obtain the sub-object // that the whole expression 'Ex' refers to. This trick is usual, // in the sense that CodeGen takes a similar route. d218 3 a220 4 SmallVector CommaLHSs; SmallVector Adjustments; const Expr *Init = Ex->skipRValueSubobjectAdjustments(CommaLHSs, Adjustments); d222 2 d231 1 a231 1 TR = MRMgr.getCXXStaticTempObjectRegion(Init); d234 1 a234 1 TR = MRMgr.getCXXTempObjectRegion(Init, LC); a237 18 // Make the necessary adjustments to obtain the sub-object. for (auto I = Adjustments.rbegin(), E = Adjustments.rend(); I != E; ++I) { const SubobjectAdjustment &Adj = *I; switch (Adj.Kind) { case SubobjectAdjustment::DerivedToBaseAdjustment: Reg = StoreMgr.evalDerivedToBase(Reg, Adj.DerivedToBase.BasePath); break; case SubobjectAdjustment::FieldAdjustment: Reg = StoreMgr.getLValueField(Adj.Field, Reg); break; case SubobjectAdjustment::MemberPointerAdjustment: // FIXME: Unimplemented. State->bindDefault(Reg, UnknownVal()); return State; } } // Try to recover some path sensitivity in case we couldn't compute the value. a240 2 // Bind the value of the expression to the sub-object region, and then bind // the sub-object region to our expression. d242 8 d265 4 d495 1 a495 1 if (Init->getType()->isArrayType()) { d599 3 a601 3 if (varType->isReferenceType()) { Region = state->getSVal(Region).getAsRegion()->getBaseRegion(); varType = cast(Region)->getValueType(); a756 1 case Stmt::CXXInheritedCtorInitExprClass: a832 5 case Stmt::OMPTargetEnterDataDirectiveClass: case Stmt::OMPTargetExitDataDirectiveClass: case Stmt::OMPTargetParallelDirectiveClass: case Stmt::OMPTargetParallelForDirectiveClass: case Stmt::OMPTargetUpdateDirectiveClass: a838 13 case Stmt::OMPDistributeParallelForDirectiveClass: case Stmt::OMPDistributeParallelForSimdDirectiveClass: case Stmt::OMPDistributeSimdDirectiveClass: case Stmt::OMPTargetParallelForSimdDirectiveClass: case Stmt::OMPTargetSimdDirectiveClass: case Stmt::OMPTeamsDistributeDirectiveClass: case Stmt::OMPTeamsDistributeSimdDirectiveClass: case Stmt::OMPTeamsDistributeParallelForSimdDirectiveClass: case Stmt::OMPTeamsDistributeParallelForDirectiveClass: case Stmt::OMPTargetTeamsDirectiveClass: case Stmt::OMPTargetTeamsDistributeDirectiveClass: case Stmt::OMPTargetTeamsDistributeParallelForDirectiveClass: case Stmt::OMPTargetTeamsDistributeParallelForSimdDirectiveClass: a877 2 case Stmt::ArrayInitLoopExprClass: case Stmt::ArrayInitIndexExprClass: d895 1 a908 1 case Stmt::ObjCAvailabilityCheckExprClass: d1203 5 d1209 4 a1212 1 VisitCast(C, C->getSubExpr(), Pred, dstExpr); d1223 1 a1223 8 ExplodedNodeSet dstPrevisit; getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, MTE, *this); ExplodedNodeSet dstExpr; for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), e = dstPrevisit.end(); i != e ; ++i) { CreateCXXTemporaryObject(MTE, *i, dstExpr); } getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, MTE, *this); a1239 6 case Stmt::AtomicExprClass: Bldr.takeNodes(Pred); VisitAtomicExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; a1747 8 void ExprEngine::processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) { SaveAndRestore NodeContextRAII(currBldrCtx, &BC); getCheckerManager().runCheckersForBeginFunction(Dst, L, Pred, *this); } d1751 1 a1751 2 ExplodedNode *Pred, const ReturnStmt *RS) { d1773 1 a1773 1 Engine.enqueueEndOfFunction(Dst, RS); d1819 1 a1819 1 DefaultSt->assumeInclusiveRange(*NL, V1, V2); d1953 2 a1954 2 ExplodedNodeSet CheckerPreStmt; getCheckerManager().runCheckersForPreStmt(CheckerPreStmt, Pred, A, *this); d1956 1 a1956 2 ExplodedNodeSet EvalSet; StmtNodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx); d1961 4 a1964 3 for (auto *Node : CheckerPreStmt) { const LocationContext *LCtx = Node->getLocationContext(); ProgramStateRef state = Node->getState(); d1968 1 a1968 1 Bldr.generateNode(A, Node, state->BindExpr(A, LCtx, V), nullptr, a1970 2 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, A, *this); d2029 1 a2029 1 dyn_cast((*I)->getParentMap().getParentIgnoreParens(M)); a2054 38 void ExprEngine::VisitAtomicExpr(const AtomicExpr *AE, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ExplodedNodeSet AfterPreSet; getCheckerManager().runCheckersForPreStmt(AfterPreSet, Pred, AE, *this); // For now, treat all the arguments to C11 atomics as escaping. // FIXME: Ideally we should model the behavior of the atomics precisely here. ExplodedNodeSet AfterInvalidateSet; StmtNodeBuilder Bldr(AfterPreSet, AfterInvalidateSet, *currBldrCtx); for (ExplodedNodeSet::iterator I = AfterPreSet.begin(), E = AfterPreSet.end(); I != E; ++I) { ProgramStateRef State = (*I)->getState(); const LocationContext *LCtx = (*I)->getLocationContext(); SmallVector ValuesToInvalidate; for (unsigned SI = 0, Count = AE->getNumSubExprs(); SI != Count; SI++) { const Expr *SubExpr = AE->getSubExprs()[SI]; SVal SubExprVal = State->getSVal(SubExpr, LCtx); ValuesToInvalidate.push_back(SubExprVal); } State = State->invalidateRegions(ValuesToInvalidate, AE, currBldrCtx->blockCount(), LCtx, /*CausedByPointerEscape*/true, /*Symbols=*/nullptr); SVal ResultVal = UnknownVal(); State = State->BindExpr(AE, LCtx, ResultVal); Bldr.generateNode(AE, *I, State, nullptr, ProgramPoint::PostStmtKind); } getCheckerManager().runCheckersForPostStmt(Dst, AfterInvalidateSet, AE, *this); } d2461 17 a2480 1 // De-duplicate some source location pretty-printing. a2489 6 static void printLocation2(raw_ostream &Out, SourceLocation SLoc) { if (SLoc.isFileID() && GraphPrintSourceManager->isInMainFile(SLoc)) Out << "line " << GraphPrintSourceManager->getExpansionLineNumber(SLoc); else SLoc.print(Out, *GraphPrintSourceManager); } d2503 6 d2633 7 d2661 21 a2688 34 // Analysis stack backtrace. Out << "Location context stack (from current to outer):\\l"; const LocationContext *LC = Loc.getLocationContext(); unsigned Idx = 0; for (; LC; LC = LC->getParent(), ++Idx) { Out << Idx << ". (" << (const void *)LC << ") "; switch (LC->getKind()) { case LocationContext::StackFrame: if (const NamedDecl *D = dyn_cast(LC->getDecl())) Out << "Calling " << D->getQualifiedNameAsString(); else Out << "Calling anonymous code"; if (const Stmt *S = cast(LC)->getCallSite()) { Out << " at "; printLocation2(Out, S->getLocStart()); } break; case LocationContext::Block: Out << "Invoking block"; if (const Decl *D = cast(LC)->getBlockDecl()) { Out << " defined at "; printLocation2(Out, D->getLocStart()); } break; case LocationContext::Scope: Out << "Entering scope"; // FIXME: Add more info once ScopeContext is activated. break; } Out << "\\l"; } Out << "\\l"; @ 1.1.1.10.2.1 log @Sync with HEAD @ text @d518 2 a519 3 if (!Field->getType()->isReferenceType()) if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); a872 1 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass: @ 1.1.1.11 log @Import Clang 4.0RC1 r294123. @ text @d518 2 a519 3 if (!Field->getType()->isReferenceType()) if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); a872 1 case Stmt::OMPTargetTeamsDistributeSimdDirectiveClass: @ 1.1.1.12 log @Import clang r309604 from branches/release_50 @ text @d185 1 a185 1 const Expr *InitWithAdjustments, d187 1 a187 6 // FIXME: This function is a hack that works around the quirky AST // we're often having with respect to C++ temporaries. If only we modelled // the actual execution order of statements properly in the CFG, // all the hassle with adjustments would not be necessary, // and perhaps the whole function would be removed. SVal InitValWithAdjustments = State->getSVal(InitWithAdjustments, LC); d191 1 a191 1 if (!InitValWithAdjustments.getAs()) d193 1 a193 1 Result = InitWithAdjustments; d197 1 a197 2 assert(!InitValWithAdjustments.getAs() || Loc::isLocType(Result->getType()) || d229 1 a229 2 const Expr *Init = InitWithAdjustments->skipRValueSubobjectAdjustments( CommaLHSs, Adjustments); a243 1 SVal BaseReg = Reg; d257 1 a257 1 State = State->bindDefault(Reg, UnknownVal(), LC); d262 7 a268 31 // What remains is to copy the value of the object to the new region. // FIXME: In other words, what we should always do is copy value of the // Init expression (which corresponds to the bigger object) to the whole // temporary region TR. However, this value is often no longer present // in the Environment. If it has disappeared, we instead invalidate TR. // Still, what we can do is assign the value of expression Ex (which // corresponds to the sub-object) to the TR's sub-region Reg. At least, // values inside Reg would be correct. SVal InitVal = State->getSVal(Init, LC); if (InitVal.isUnknown()) { InitVal = getSValBuilder().conjureSymbolVal(Result, LC, Init->getType(), currBldrCtx->blockCount()); State = State->bindLoc(BaseReg.castAs(), InitVal, LC, false); // Then we'd need to take the value that certainly exists and bind it over. if (InitValWithAdjustments.isUnknown()) { // Try to recover some path sensitivity in case we couldn't // compute the value. InitValWithAdjustments = getSValBuilder().conjureSymbolVal( Result, LC, InitWithAdjustments->getType(), currBldrCtx->blockCount()); } State = State->bindLoc(Reg.castAs(), InitValWithAdjustments, LC, false); } else { State = State->bindLoc(BaseReg.castAs(), InitVal, LC, false); } // The result expression would now point to the correct sub-region of the // newly created temporary region. Do this last in order to getSVal of Init // correctly in case (Result == Init). a269 4 // Notify checkers once for two bindLoc()s. State = processRegionChange(State, TR, LC); a288 1 const LocationContext *LCtx, d291 1 a291 2 Explicits, Regions, LCtx, Call); a326 2 case CFGElement::LifetimeEnds: return; d616 1 a616 9 const MemRegion *ValueRegion = state->getSVal(Region).getAsRegion(); if (!ValueRegion) { // FIXME: This should not happen. The language guarantees a presence // of a valid initializer here, so the reference shall not be undefined. // It seems that we're calling destructors over variables that // were not initialized yet. return; } Region = ValueRegion->getBaseRegion(); d770 1 a770 1 // C++, OpenMP and ARC stuff we don't support yet. a792 1 case Stmt::DependentCoawaitExprClass: d798 30 a827 1 case Stmt::SEHFinallyStmtClass: a874 30 case Stmt::CapturedStmtClass: { const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); Engine.addAbortedBlock(node, currBldrCtx->getBlock()); break; } case Stmt::ParenExprClass: llvm_unreachable("ParenExprs already handled."); case Stmt::GenericSelectionExprClass: llvm_unreachable("GenericSelectionExprs already handled."); // Cases that should never be evaluated simply because they shouldn't // appear in the CFG. case Stmt::BreakStmtClass: case Stmt::CaseStmtClass: case Stmt::CompoundStmtClass: case Stmt::ContinueStmtClass: case Stmt::CXXForRangeStmtClass: case Stmt::DefaultStmtClass: case Stmt::DoStmtClass: case Stmt::ForStmtClass: case Stmt::GotoStmtClass: case Stmt::IfStmtClass: case Stmt::IndirectGotoStmtClass: case Stmt::LabelStmtClass: case Stmt::NoStmtClass: case Stmt::NullStmtClass: case Stmt::SwitchStmtClass: case Stmt::WhileStmtClass: case Expr::MSDependentExistsStmtClass: a1130 1 LLVM_FALLTHROUGH; d1859 2 a1860 2 assert(V1.getBitWidth() == getContext().getIntWidth(CondE->getType())); d2168 1 a2168 3 SVal Loc, SVal Val, const LocationContext *LCtx) { d2184 1 a2184 1 escapes = (State == (State->bindLoc(*regionLoc, Val, LCtx))); d2281 1 a2281 1 state = processPointerEscapedOnBind(state, location, Val, LC); d2291 1 a2291 1 state = processPointerEscapedOnBind(state, location, Val, LC); d2297 1 a2297 1 Val, LC, /* notifyChanges = */ !atDeclInit); d2523 1 a2523 1 state = state->bindLoc(*LV, UnknownVal(), Pred->getLocationContext()); @ 1.1.1.12.4.1 log @Sync with HEAD @ text @d1 1 a1 1 //===- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ----------===// d18 1 a18 8 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" #include "clang/AST/DeclBase.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprCXX.h" #include "clang/AST/ExprObjC.h" a19 2 #include "clang/AST/PrettyPrinter.h" #include "clang/AST/Stmt.h" d22 1 a22 8 #include "clang/AST/Type.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/Analysis/CFG.h" #include "clang/Analysis/ConstructionContext.h" #include "clang/Analysis/ProgramPoint.h" #include "clang/Basic/IdentifierTable.h" #include "clang/Basic/LLVM.h" #include "clang/Basic/LangOptions.h" a23 1 #include "clang/Basic/SourceLocation.h" a24 3 #include "clang/Basic/Specifiers.h" #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" a28 4 #include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" #include "clang/StaticAnalyzer/Core/PathSensitive/LoopUnrolling.h" a29 15 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/DenseMap.h" #include "llvm/ADT/ImmutableMap.h" #include "llvm/ADT/ImmutableSet.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/SmallVector.h" a30 5 #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include "llvm/Support/DOTGraphTraits.h" #include "llvm/Support/ErrorHandling.h" #include "llvm/Support/GraphWriter.h" d33 4 a36 7 #include #include #include #include #include #include #include d40 1 d55 2 d58 5 a62 93 //===----------------------------------------------------------------------===// // Internal program state traits. //===----------------------------------------------------------------------===// // When modeling a C++ constructor, for a variety of reasons we need to track // the location of the object for the duration of its ConstructionContext. // ObjectsUnderConstruction maps statements within the construction context // to the object's location, so that on every such statement the location // could have been retrieved. /// ConstructedObjectKey is used for being able to find the path-sensitive /// memory region of a freshly constructed object while modeling the AST node /// that syntactically represents the object that is being constructed. /// Semantics of such nodes may sometimes require access to the region that's /// not otherwise present in the program state, or to the very fact that /// the construction context was present and contained references to these /// AST nodes. class ConstructedObjectKey { typedef std::pair< llvm::PointerUnion, const LocationContext *> ConstructedObjectKeyImpl; ConstructedObjectKeyImpl Impl; const void *getAnyASTNodePtr() const { if (const Stmt *S = getStmt()) return S; else return getCXXCtorInitializer(); } public: ConstructedObjectKey( llvm::PointerUnion P, const LocationContext *LC) : Impl(P, LC) { // This is the full list of statements that require additional actions when // encountered. This list may be expanded when new actions are implemented. assert(getCXXCtorInitializer() || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt())); } const Stmt *getStmt() const { return Impl.first.dyn_cast(); } const CXXCtorInitializer *getCXXCtorInitializer() const { return Impl.first.dyn_cast(); } const LocationContext *getLocationContext() const { return Impl.second; } void print(llvm::raw_ostream &OS, PrinterHelper *Helper, PrintingPolicy &PP) { OS << '(' << getLocationContext() << ',' << getAnyASTNodePtr() << ") "; if (const Stmt *S = getStmt()) { S->printPretty(OS, Helper, PP); } else { const CXXCtorInitializer *I = getCXXCtorInitializer(); OS << I->getAnyMember()->getNameAsString(); } } void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddPointer(Impl.first.getOpaqueValue()); ID.AddPointer(Impl.second); } bool operator==(const ConstructedObjectKey &RHS) const { return Impl == RHS.Impl; } bool operator<(const ConstructedObjectKey &RHS) const { return Impl < RHS.Impl; } }; typedef llvm::ImmutableMap ObjectsUnderConstructionMap; REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) // Additionally, track a set of destructors that correspond to elided // constructors when copy elision occurs. typedef std::pair ElidedDestructorItem; typedef llvm::ImmutableSet ElidedDestructorSet; REGISTER_TRAIT_WITH_PROGRAMSTATE(ElidedDestructors, ElidedDestructorSet) d70 1 a70 2 ExprEngine::ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, bool gcEnabled, d74 15 a88 10 : CTU(CTU), AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { d112 2 a113 1 if (const auto *FD = dyn_cast(D)) { d122 1 a122 1 const auto *BT = dyn_cast(T); d146 1 a146 1 while (false); d148 1 a148 1 if (const auto *MD = dyn_cast(D)) { d162 1 a162 1 if (const auto *MD = dyn_cast(D)) { d167 1 a167 1 const StackFrameContext *SFC = InitLoc->getStackFrame(); a237 5 // Take the region for Init, i.e. for the whole object. If we do not remember // the region in which the object originally was constructed, come up with // a new temporary region out of thin air and copy the contents of the object // (which are currently present in the Environment, because Init is an rvalue) // into that region. This is not correct, but it is better than nothing. d239 9 a247 16 if (const auto *MT = dyn_cast(Result)) { if (Optional V = getObjectUnderConstruction(State, MT, LC)) { State = finishObjectConstruction(State, MT, LC); State = State->BindExpr(Result, LC, *V); return State; } else { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) { TR = MRMgr.getCXXStaticTempObjectRegion(Init); } else { TR = MRMgr.getCXXTempObjectRegion(Init, LC); } } } else { a248 1 } d265 1 a265 3 State = State->invalidateRegions(Reg, InitWithAdjustments, currBldrCtx->blockCount(), LC, true, nullptr, nullptr, nullptr); d284 1 a284 2 // Then we'd need to take the value that certainly exists and bind it // over. a308 73 ProgramStateRef ExprEngine::addObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC, SVal V) { ConstructedObjectKey Key(P, LC->getStackFrame()); // FIXME: Currently the state might already contain the marker due to // incorrect handling of temporaries bound to default parameters. assert(!State->get(Key) || isa(Key.getStmt())); return State->set(Key, V); } Optional ExprEngine::getObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); return Optional::create(State->get(Key)); } ProgramStateRef ExprEngine::finishObjectConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); assert(State->contains(Key)); return State->remove(Key); } ProgramStateRef ExprEngine::elideDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(!State->contains(I)); return State->add(I); } ProgramStateRef ExprEngine::cleanupElidedDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(State->contains(I)); return State->remove(I); } bool ExprEngine::isDestructorElided(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); return State->contains(I); } bool ExprEngine::areAllObjectsFullyConstructed(ProgramStateRef State, const LocationContext *FromLC, const LocationContext *ToLC) { const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) return false; for (auto I: State->get()) if (I.second == LC) return false; LC = LC->getParent(); } return true; } a331 25 static void printObjectsUnderConstructionForContext(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LC) { PrintingPolicy PP = LC->getAnalysisDeclContext()->getASTContext().getPrintingPolicy(); for (auto I : State->get()) { ConstructedObjectKey Key = I.first; SVal Value = I.second; if (Key.getLocationContext() != LC) continue; Key.print(Out, nullptr, PP); Out << " : " << Value << NL; } for (auto I : State->get()) { if (I.second != LC) continue; Out << '(' << I.second << ',' << (const void *)I.first << ") "; I.first->printPretty(Out, nullptr, PP); Out << " : (constructor elided)" << NL; } } d333 1 a333 12 const char *NL, const char *Sep, const LocationContext *LCtx) { if (LCtx) { if (!State->get().isEmpty()) { Out << Sep << "Objects under construction:" << NL; LCtx->dumpStack(Out, "", NL, Sep, [&](const LocationContext *LC) { printObjectsUnderConstructionForContext(Out, State, NL, Sep, LC); }); } } d349 1 a349 3 case CFGElement::Constructor: case CFGElement::CXXRecordTypedCall: ProcessStmt(E.castAs().getStmt(), Pred); d352 1 a352 1 ProcessInitializer(E.castAs(), Pred); a364 3 case CFGElement::LoopExit: ProcessLoopExit(E.castAs().getLoopStmt(), Pred); return; a365 2 case CFGElement::ScopeBegin: case CFGElement::ScopeEnd: d371 1 a371 1 const Stmt *S, d374 1 d384 1 a384 1 if (!isa(S)) d388 1 a388 1 if (CallEvent::isCallStmt(S)) d394 1 a394 1 return !PM.isConsumedExpr(cast(S)); d424 1 a424 1 const StackFrameContext *SFC = LC ? LC->getStackFrame() : nullptr; a426 7 for (auto I : CleanedState->get()) { if (SymbolRef Sym = I.second.getAsSymbol()) SymReaper.markLive(Sym); if (const MemRegion *MR = I.second.getAsRegion()) SymReaper.markLive(MR); } d455 3 a457 2 for (const auto I : CheckedSet) { ProgramStateRef CheckerState = I->getState(); d474 1 a474 1 Bldr.generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K); d479 2 a480 1 void ExprEngine::ProcessStmt(const Stmt *currStmt, ExplodedNode *Pred) { d484 1 d491 2 a492 4 if (shouldRemoveDeadBindings(AMgr, currStmt, Pred, Pred->getLocationContext())) { removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); d498 2 a499 1 for (const auto I : CleanedStates) { d502 1 a502 1 Visit(currStmt, I, DstI); d510 1 a510 19 void ExprEngine::ProcessLoopExit(const Stmt* S, ExplodedNode *Pred) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating end of the loop"); ExplodedNodeSet Dst; Dst.Add(Pred); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef NewState = Pred->getState(); if(AMgr.options.shouldUnrollLoops()) NewState = processLoopEnd(S, NewState); LoopExit PP(S, Pred->getLocationContext()); Bldr.generateNode(PP, NewState, Pred); // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer CFGInit, d512 1 a512 3 const CXXCtorInitializer *BMI = CFGInit.getInitializer(); const Expr *Init = BMI->getInit()->IgnoreImplicit(); const LocationContext *LC = Pred->getLocationContext(); d519 4 a522 2 const auto *stackFrame = cast(Pred->getLocationContext()); const auto *decl = cast(stackFrame->getDecl()); d527 1 a527 1 ExplodedNodeSet Tmp; d534 3 a536 1 if (getObjectUnderConstruction(State, BMI, LC)) { a537 5 // But we still need to stop tracking the object under construction. State = finishObjectConstruction(State, BMI, LC); NodeBuilder Bldr(Pred, Tmp, *currBldrCtx); PostStore PS(Init, LC, /*Loc*/ nullptr, /*tag*/ nullptr); Bldr.generateNode(PS, State, Pred); d539 1 d573 4 a581 1 Tmp.insert(Pred); d590 3 a592 3 for (const auto I : Tmp) { ProgramStateRef State = I->getState(); Bldr.generateNode(PP, State, I); a667 7 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; Region = makeZeroElementRegion(state, loc::MemRegionVal(Region), varType, CallOpts.IsArrayCtorOrDtor).getAsRegion(); d669 1 a669 1 Pred, Dst, CallOpts); a678 1 QualType DTy = DE->getDestroyedType(); d684 1 d695 4 a698 15 EvalCallOptions CallOpts; const MemRegion *ArgR = ArgVal.getAsRegion(); if (DE->isArrayForm()) { // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). CallOpts.IsArrayCtorOrDtor = true; // Yes, it may even be a multi-dimensional array. while (const auto *AT = getContext().getAsArrayType(DTy)) DTy = AT->getElementType(); if (ArgR) ArgR = getStoreManager().GetElementZeroRegion(cast(ArgR), DTy); } VisitCXXDestructor(DTy, ArgR, DE, /*IsBase=*/false, Pred, Dst, CallOpts); d705 1 a705 1 const auto *CurDtor = cast(LCtx->getDecl()); d707 1 a707 1 LCtx->getStackFrame()); d717 1 a717 1 CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst, {}); a722 1 QualType T = Member->getType(); d726 1 a726 1 const auto *CurDtor = cast(LCtx->getDecl()); d728 1 a728 1 LCtx->getStackFrame()); d732 3 a734 9 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; FieldVal = makeZeroElementRegion(State, FieldVal, T, CallOpts.IsArrayCtorOrDtor); VisitCXXDestructor(T, FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst, CallOpts); d740 2 a741 1 const CXXBindTemporaryExpr *BTE = D.getBindTemporaryExpr(); d743 2 a744 6 const LocationContext *LC = Pred->getLocationContext(); const MemRegion *MR = nullptr; if (Optional V = getObjectUnderConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext())) { d746 3 a748 17 // but we don't insert the constructors, so the entry in // ObjectsUnderConstruction may be missing. State = finishObjectConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext()); MR = V->getAsRegion(); } // If copy elision has occured, and the constructor corresponding to the // destructor was elided, we need to skip the destructor as well. if (isDestructorElided(State, BTE, LC)) { State = cleanupElidedDestructor(State, BTE, LC); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); PostImplicitCall PP(D.getDestructorDecl(getContext()), D.getBindTemporaryExpr()->getLocStart(), Pred->getLocationContext()); Bldr.generateNode(PP, State, Pred); return; a749 3 ExplodedNodeSet CleanDtorState; StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx); d752 1 a752 1 QualType T = D.getBindTemporaryExpr()->getSubExpr()->getType(); d758 4 a761 20 EvalCallOptions CallOpts; CallOpts.IsTemporaryCtorOrDtor = true; if (!MR) { CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; // If we have no MR, we still need to unwrap the array to avoid destroying // the whole array at once. Regardless, we'd eventually need to model array // destructors properly, element-by-element. while (const ArrayType *AT = getContext().getAsArrayType(T)) { T = AT->getElementType(); CallOpts.IsArrayCtorOrDtor = true; } } else { // We'd eventually need to makeZeroElementRegion() trick here, // but for now we don't have the respective construction contexts, // so MR would always be null in this case. Do nothing for now. } VisitCXXDestructor(T, MR, D.getBindTemporaryExpr(), /*IsBase=*/false, CleanPred, Dst, CallOpts); d771 2 a772 3 ProgramStateRef State = Pred->getState(); const LocationContext *LC = Pred->getLocationContext(); if (getObjectUnderConstruction(State, BTE, LC)) { d774 1 a774 1 TempDtorBuilder.generateNode(State, true, Pred); d777 1 a777 1 TempDtorBuilder.generateNode(State, false, Pred); a783 3 // This is a fallback solution in case we didn't have a construction // context when we were constructing the temporary. Otherwise the map should // have been populated there. d793 4 a796 3 const LocationContext *LC = Node->getLocationContext(); if (!getObjectUnderConstruction(State, BTE, LC)) { // FIXME: Currently the state might also already contain the marker due to d800 2 a801 1 State = addObjectUnderConstruction(State, BTE, LC, UnknownVal()); a806 22 ProgramStateRef ExprEngine::escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const { class CollectReachableSymbolsCallback final : public SymbolVisitor { InvalidatedSymbols Symbols; public: explicit CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) override { Symbols.insert(Sym); return true; } }; const CollectReachableSymbolsCallback &Scanner = State->scanReachableSymbols(V); return getCheckerManager().runCheckersForPointerEscape( State, Scanner.getSymbols(), /*CallEvent*/ nullptr, K, nullptr); } d895 2 a896 1 case Stmt::CapturedStmtClass: { a990 1 case Stmt::FixedPointLiteralClass: d1025 1 a1025 1 if (const auto *DefE = dyn_cast(S)) d1027 1 a1027 1 else if (const auto *DefE = dyn_cast(S)) d1033 2 a1034 1 if (const auto *MTE = dyn_cast(ArgE)) { d1044 3 a1046 2 for (const auto I : PreVisit) { ProgramStateRef State = I->getState(); d1052 1 a1052 1 Bldr2.generateNode(S, I, State); d1073 1 a1073 1 const auto *Ex = cast(S); d1076 3 a1078 1 for (const auto N : preVisit) { d1083 2 a1084 14 ProgramStateRef State = N->getState()->BindExpr(Ex, LCtx, result); // Escape pointers passed into the list, unless it's an ObjC boxed // expression which is not a boxable C structure. if (!(isa(Ex) && !cast(Ex)->getSubExpr() ->getType()->isRecordType())) for (auto Child : Ex->children()) { assert(Child); SVal Val = State->getSVal(Child, LCtx); State = escapeValue(State, Val, PSK_EscapeOther); } Bldr2.generateNode(S, N, State); d1094 1 a1094 1 VisitArraySubscriptExpr(cast(S), Pred, Dst); d1128 1 a1128 1 const auto *B = cast(S); d1160 1 a1160 1 const auto *OCE = cast(S); d1165 1 a1165 1 if (const auto *MD = dyn_cast_or_null(Callee)) { a1182 1 d1185 1 a1185 1 case Stmt::UserDefinedLiteralClass: d1190 1 d1192 1 a1192 1 case Stmt::CXXCatchStmtClass: d1197 1 d1200 1 a1200 1 case Stmt::CXXConstructExprClass: d1205 1 a1208 4 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); d1210 1 a1210 3 for (const auto i : PreVisit) VisitCXXNewExpr(cast(S), i, PostVisit); d1219 1 a1219 1 const auto *CDE = cast(S); d1222 3 a1224 2 for (const auto i : PreVisit) VisitCXXDeleteExpr(CDE, i, Dst); d1234 1 a1234 1 const auto *C = cast(S); d1255 2 a1256 1 const auto *C = cast(S); d1270 1 a1270 1 const auto *DE = cast(S); d1291 1 a1291 1 const auto *C = cast(S); d1303 1 a1303 1 const auto *MTE = cast(S); d1307 4 a1310 2 for (const auto i : dstPrevisit) CreateCXXTemporaryObject(MTE, i, dstExpr); d1365 1 a1365 1 case Stmt::OffsetOfExprClass: { d1367 1 a1367 8 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet PostVisit; for (const auto Node : PreVisit) VisitOffsetOfExpr(cast(S), Node, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); a1369 1 } d1379 1 a1379 1 const auto *SE = cast(S); d1388 1 a1388 2 if (const auto *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { d1400 1 a1400 1 const auto *U = cast(S); d1415 1 a1415 1 const auto *PE = cast(S); d1434 2 a1435 2 const StackFrameContext *CalleeSF = CalleeLC->getStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getStackFrame(); d1447 1 a1447 1 if (L.getStackFrame() != CallerSF) a1499 19 // If we reach a loop which has a known bound (and meets // other constraints) then consider completely unrolling it. if(AMgr.options.shouldUnrollLoops()) { unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath; const Stmt *Term = nodeBuilder.getContext().getBlock()->getTerminator(); if (Term) { ProgramStateRef NewState = updateLoopStack(Term, AMgr.getASTContext(), Pred, maxBlockVisitOnPath); if (NewState != Pred->getState()) { ExplodedNode *UpdatedNode = nodeBuilder.generateNode(NewState, Pred); if (!UpdatedNode) return; Pred = UpdatedNode; } } // Is we are inside an unrolled loop then no need the check the counters. if(isUnrolledState(Pred->getState())) return; } d1527 1 a1527 1 const LocationContext *CalleeSF = CalleeLC->getStackFrame(); d1530 1 a1530 1 if (RootLC->getStackFrame() != CalleeSF) { d1564 1 a1564 1 const auto *Ex = dyn_cast(Condition); d1571 1 a1571 1 while (const auto *CE = dyn_cast(Ex)) { d1599 1 a1599 1 const auto *BO = dyn_cast(Condition); d1625 1 a1625 1 if (const auto *Ex = dyn_cast(Condition)) d1628 1 a1628 1 const auto *BO = dyn_cast(Condition); d1676 1 a1676 1 if (const auto *Ex = dyn_cast(Condition)) d1692 4 a1695 1 for (const auto PredI : CheckersOutSet) { d1704 1 a1704 1 if (const auto *Ex = dyn_cast(Condition)) { d1761 1 a1761 1 ExplodedNodeSet &Dst, d1767 1 a1767 1 const auto *VD = cast(DS->getSingleDecl()); d1785 1 d1796 1 a1796 1 using iterator = IndirectGotoNodeBuilder::iterator; d1822 1 a1822 1 for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) d1826 16 d1855 3 a1857 53 // FIXME: We currently cannot assert that temporaries are clear, because // lifetime extended temporaries are not always modelled correctly. In some // cases when we materialize the temporary, we do // createTemporaryRegionIfNeeded(), and the region changes, and also the // respective destructor becomes automatic from temporary. So for now clean up // the state manually before asserting. Ideally, the code above the assertion // should go away, but the assertion should remain. { ExplodedNodeSet CleanUpObjects; NodeBuilder Bldr(Pred, CleanUpObjects, BC); ProgramStateRef State = Pred->getState(); const LocationContext *FromLC = Pred->getLocationContext(); const LocationContext *ToLC = FromLC->getStackFrame()->getParent(); const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) { // The comment above only pardons us for not cleaning up a // CXXBindTemporaryExpr. If any other statements are found here, // it must be a separate problem. assert(isa(I.first.getStmt())); State = State->remove(I.first); // Also cleanup the elided destructor info. ElidedDestructorItem Item( cast(I.first.getStmt()), I.first.getLocationContext()); State = State->remove(Item); } // Also suppress the assertion for elided destructors when temporary // destructors are not provided at all by the CFG, because there's no // good place to clean them up. if (!AMgr.getAnalyzerOptions().includeTemporaryDtorsInCFG()) for (auto I : State->get()) if (I.second == LC) State = State->remove(I); LC = LC->getParent(); } if (State != Pred->getState()) { Pred = Bldr.generateNode(Pred->getLocation(), State, Pred); if (!Pred) { // The node with clean temporaries already exists. We might have reached // it on a path on which we initialize different temporaries. return; } } } assert(areAllObjectsFullyConstructed(Pred->getState(), Pred->getLocationContext(), Pred->getStackFrame()->getParent())); d1868 4 a1871 2 for (const auto I : AfterRemovedDead) getCheckerManager().runCheckersForEndFunction(BC, Dst, I, *this, RS); d1873 1 a1873 1 getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this, RS); d1882 1 a1882 2 using iterator = SwitchNodeBuilder::iterator; d1971 1 a1971 1 if (const auto *VD = dyn_cast(D)) { d1977 1 a1977 1 const auto *MD = dyn_cast_or_null(D); d1979 2 a1980 2 Optional> VInfo; d1989 8 a1996 4 // Sema follows a sequence of complex rules to determine whether the // variable should be captured. if (const FieldDecl *FD = LambdaCaptureFields[VD]) { d1998 1 a1998 1 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame()); d2000 2 a2001 1 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType()); d2003 3 a2007 6 if (!VInfo) VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType()); SVal V = VInfo->first; bool IsReference = VInfo->second->isReferenceType(); d2021 1 a2021 1 if (const auto *ED = dyn_cast(D)) { d2027 1 a2027 1 if (const auto *FD = dyn_cast(D)) { d2033 1 a2033 1 if (isa(D) || isa(D)) { a2036 2 // FIXME: Maybe delegate this to the surrounding operator&. // Note how this expression is lvalue, however pointer-to-member is NonLoc. d2041 1 a2041 6 ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: proper support for bound declarations. // For now, let's just prevent crashing. d2049 1 a2049 1 void ExprEngine::VisitArraySubscriptExpr(const ArraySubscriptExpr *A, d2052 1 d2061 3 a2063 8 bool IsVectorType = A->getBase()->getType()->isVectorType(); // The "like" case is for situations where C standard prohibits the type to // be an lvalue, e.g. taking the address of a subscript of an expression of // type "void *". bool IsGLValueLike = A->isGLValue() || (A->getType().isCForbiddenLValueType() && !AMgr.getLangOpts().CPlusPlus); d2068 5 a2072 22 if (IsGLValueLike) { QualType T = A->getType(); // One of the forbidden LValue types! We still need to have sensible // symbolic locations to represent this stuff. Note that arithmetic on // void pointers is a GCC extension. if (T->isVoidType()) T = getContext().CharTy; SVal V = state->getLValue(T, state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); Bldr.generateNode(A, Node, state->BindExpr(A, LCtx, V), nullptr, ProgramPoint::PostLValueKind); } else if (IsVectorType) { // FIXME: non-glvalue vector reads are not modelled. Bldr.generateNode(A, Node, state, nullptr); } else { llvm_unreachable("Array subscript should be an lValue when not \ a vector and not a forbidden lvalue type"); } d2081 1 d2086 2 a2087 2 ExplodedNodeSet EvalSet; ValueDecl *Member = M->getMemberDecl(); d2091 6 a2096 3 if (isa(Member) || isa(Member)) { for (const auto I : CheckedSet) VisitCommonDeclRefExpr(M, Member, I, EvalSet); d2101 4 a2104 3 for (const auto I : CheckedSet) { ProgramStateRef state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2108 1 a2108 1 if (const auto *MD = dyn_cast(Member)) { d2115 1 a2115 1 Bldr.generateNode(M, I, state); d2123 1 a2123 1 const auto *field = cast(Member); d2133 2 a2134 2 const auto *PE = dyn_cast(I->getParentMap().getParentIgnoreParens(M)); d2147 1 a2147 1 Bldr.generateNode(M, I, state->BindExpr(M, LCtx, L), nullptr, d2150 2 a2151 2 Bldr.takeNodes(I); evalLoad(Tmp, M, M, I, state, L); d2171 4 a2174 3 for (const auto I : AfterPreSet) { ProgramStateRef State = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2191 1 a2191 1 Bldr.generateNode(AE, I, State, nullptr, d2198 15 d2249 9 a2257 1 State = escapeValue(State, Val, PSK_EscapeOnBind); d2268 1 d2282 3 a2284 2 for (const auto I : ExplicitRegions) { if (const SymbolicRegion *R = I->StripCasts()->getAs()) d2289 3 a2291 1 for (const auto &sym : *Invalidated) { d2315 1 d2339 3 a2341 1 for (const auto PredI : CheckedSet) { d2390 2 a2391 2 for (const auto I : Tmp) evalBind(Dst, StoreE, I, location, Val, false); d2401 2 a2402 1 QualType LoadTy) { d2404 37 d2454 3 a2456 3 for (const auto I : Tmp) { state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2465 1 a2465 1 Bldr.generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag, d2522 2 a2523 1 for (const auto Pred : Src) { d2573 1 a2573 1 assert(!X.getAs()); // Should be an Lval, or unknown, undef. d2597 3 d2601 1 a2601 3 template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple = false) : DefaultDOTGraphTraits(isSimple) {} d2606 1 a2606 1 return {}; d2619 6 d2627 1 d2635 1 a2635 1 case ProgramPoint::BlockEntranceKind: d2639 1 d2642 1 a2642 1 assert(false); a2668 6 case ProgramPoint::LoopExitKind: { LoopExit LE = Loc.castAs(); Out << "LoopExit: " << LE.getLoopStmt()->getStmtClassName(); break; } d2727 1 a2727 1 if (const auto *C = dyn_cast(Label)) { d2741 1 a2741 1 assert(isa(Label)); a2781 2 else if (Loc.getAs()) Out << "\\lPostAllocatorCall\\l"; d2791 34 a2824 1 state->printDOT(Out, N->getLocationContext()); d2835 1 a2835 2 } // namespace llvm d2841 1 a2841 1 std::vector Src; d2845 2 a2846 2 for (const auto I : BR) const_cast(I)->FlushReports(BR); d2851 1 a2851 1 const auto *N = const_cast(EI->begin()->getErrorNode()); @ 1.1.1.12.4.2 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.12.2.1 log @Sync with HEAD @ text @d1 1 a1 1 //===- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ----------===// d18 1 a18 8 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" #include "clang/AST/DeclBase.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprCXX.h" #include "clang/AST/ExprObjC.h" a19 2 #include "clang/AST/PrettyPrinter.h" #include "clang/AST/Stmt.h" d22 1 a22 8 #include "clang/AST/Type.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/Analysis/CFG.h" #include "clang/Analysis/ConstructionContext.h" #include "clang/Analysis/ProgramPoint.h" #include "clang/Basic/IdentifierTable.h" #include "clang/Basic/LLVM.h" #include "clang/Basic/LangOptions.h" a23 1 #include "clang/Basic/SourceLocation.h" a24 3 #include "clang/Basic/Specifiers.h" #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" a28 4 #include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" #include "clang/StaticAnalyzer/Core/PathSensitive/LoopUnrolling.h" a29 15 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/DenseMap.h" #include "llvm/ADT/ImmutableMap.h" #include "llvm/ADT/ImmutableSet.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/SmallVector.h" a30 5 #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include "llvm/Support/DOTGraphTraits.h" #include "llvm/Support/ErrorHandling.h" #include "llvm/Support/GraphWriter.h" d33 4 a36 7 #include #include #include #include #include #include #include d40 1 d55 2 d58 5 a62 93 //===----------------------------------------------------------------------===// // Internal program state traits. //===----------------------------------------------------------------------===// // When modeling a C++ constructor, for a variety of reasons we need to track // the location of the object for the duration of its ConstructionContext. // ObjectsUnderConstruction maps statements within the construction context // to the object's location, so that on every such statement the location // could have been retrieved. /// ConstructedObjectKey is used for being able to find the path-sensitive /// memory region of a freshly constructed object while modeling the AST node /// that syntactically represents the object that is being constructed. /// Semantics of such nodes may sometimes require access to the region that's /// not otherwise present in the program state, or to the very fact that /// the construction context was present and contained references to these /// AST nodes. class ConstructedObjectKey { typedef std::pair< llvm::PointerUnion, const LocationContext *> ConstructedObjectKeyImpl; ConstructedObjectKeyImpl Impl; const void *getAnyASTNodePtr() const { if (const Stmt *S = getStmt()) return S; else return getCXXCtorInitializer(); } public: ConstructedObjectKey( llvm::PointerUnion P, const LocationContext *LC) : Impl(P, LC) { // This is the full list of statements that require additional actions when // encountered. This list may be expanded when new actions are implemented. assert(getCXXCtorInitializer() || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt())); } const Stmt *getStmt() const { return Impl.first.dyn_cast(); } const CXXCtorInitializer *getCXXCtorInitializer() const { return Impl.first.dyn_cast(); } const LocationContext *getLocationContext() const { return Impl.second; } void print(llvm::raw_ostream &OS, PrinterHelper *Helper, PrintingPolicy &PP) { OS << '(' << getLocationContext() << ',' << getAnyASTNodePtr() << ") "; if (const Stmt *S = getStmt()) { S->printPretty(OS, Helper, PP); } else { const CXXCtorInitializer *I = getCXXCtorInitializer(); OS << I->getAnyMember()->getNameAsString(); } } void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddPointer(Impl.first.getOpaqueValue()); ID.AddPointer(Impl.second); } bool operator==(const ConstructedObjectKey &RHS) const { return Impl == RHS.Impl; } bool operator<(const ConstructedObjectKey &RHS) const { return Impl < RHS.Impl; } }; typedef llvm::ImmutableMap ObjectsUnderConstructionMap; REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) // Additionally, track a set of destructors that correspond to elided // constructors when copy elision occurs. typedef std::pair ElidedDestructorItem; typedef llvm::ImmutableSet ElidedDestructorSet; REGISTER_TRAIT_WITH_PROGRAMSTATE(ElidedDestructors, ElidedDestructorSet) d70 1 a70 2 ExprEngine::ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, bool gcEnabled, d74 15 a88 10 : CTU(CTU), AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { d112 2 a113 1 if (const auto *FD = dyn_cast(D)) { d122 1 a122 1 const auto *BT = dyn_cast(T); d146 1 a146 1 while (false); d148 1 a148 1 if (const auto *MD = dyn_cast(D)) { d162 1 a162 1 if (const auto *MD = dyn_cast(D)) { d167 1 a167 1 const StackFrameContext *SFC = InitLoc->getStackFrame(); a237 5 // Take the region for Init, i.e. for the whole object. If we do not remember // the region in which the object originally was constructed, come up with // a new temporary region out of thin air and copy the contents of the object // (which are currently present in the Environment, because Init is an rvalue) // into that region. This is not correct, but it is better than nothing. d239 9 a247 16 if (const auto *MT = dyn_cast(Result)) { if (Optional V = getObjectUnderConstruction(State, MT, LC)) { State = finishObjectConstruction(State, MT, LC); State = State->BindExpr(Result, LC, *V); return State; } else { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) { TR = MRMgr.getCXXStaticTempObjectRegion(Init); } else { TR = MRMgr.getCXXTempObjectRegion(Init, LC); } } } else { a248 1 } d265 1 a265 3 State = State->invalidateRegions(Reg, InitWithAdjustments, currBldrCtx->blockCount(), LC, true, nullptr, nullptr, nullptr); d284 1 a284 2 // Then we'd need to take the value that certainly exists and bind it // over. a308 73 ProgramStateRef ExprEngine::addObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC, SVal V) { ConstructedObjectKey Key(P, LC->getStackFrame()); // FIXME: Currently the state might already contain the marker due to // incorrect handling of temporaries bound to default parameters. assert(!State->get(Key) || isa(Key.getStmt())); return State->set(Key, V); } Optional ExprEngine::getObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); return Optional::create(State->get(Key)); } ProgramStateRef ExprEngine::finishObjectConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); assert(State->contains(Key)); return State->remove(Key); } ProgramStateRef ExprEngine::elideDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(!State->contains(I)); return State->add(I); } ProgramStateRef ExprEngine::cleanupElidedDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(State->contains(I)); return State->remove(I); } bool ExprEngine::isDestructorElided(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); return State->contains(I); } bool ExprEngine::areAllObjectsFullyConstructed(ProgramStateRef State, const LocationContext *FromLC, const LocationContext *ToLC) { const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) return false; for (auto I: State->get()) if (I.second == LC) return false; LC = LC->getParent(); } return true; } a331 25 static void printObjectsUnderConstructionForContext(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LC) { PrintingPolicy PP = LC->getAnalysisDeclContext()->getASTContext().getPrintingPolicy(); for (auto I : State->get()) { ConstructedObjectKey Key = I.first; SVal Value = I.second; if (Key.getLocationContext() != LC) continue; Key.print(Out, nullptr, PP); Out << " : " << Value << NL; } for (auto I : State->get()) { if (I.second != LC) continue; Out << '(' << I.second << ',' << (const void *)I.first << ") "; I.first->printPretty(Out, nullptr, PP); Out << " : (constructor elided)" << NL; } } d333 1 a333 12 const char *NL, const char *Sep, const LocationContext *LCtx) { if (LCtx) { if (!State->get().isEmpty()) { Out << Sep << "Objects under construction:" << NL; LCtx->dumpStack(Out, "", NL, Sep, [&](const LocationContext *LC) { printObjectsUnderConstructionForContext(Out, State, NL, Sep, LC); }); } } d349 1 a349 3 case CFGElement::Constructor: case CFGElement::CXXRecordTypedCall: ProcessStmt(E.castAs().getStmt(), Pred); d352 1 a352 1 ProcessInitializer(E.castAs(), Pred); a364 3 case CFGElement::LoopExit: ProcessLoopExit(E.castAs().getLoopStmt(), Pred); return; a365 2 case CFGElement::ScopeBegin: case CFGElement::ScopeEnd: d371 1 a371 1 const Stmt *S, d374 1 d384 1 a384 1 if (!isa(S)) d388 1 a388 1 if (CallEvent::isCallStmt(S)) d394 1 a394 1 return !PM.isConsumedExpr(cast(S)); d424 1 a424 1 const StackFrameContext *SFC = LC ? LC->getStackFrame() : nullptr; a426 7 for (auto I : CleanedState->get()) { if (SymbolRef Sym = I.second.getAsSymbol()) SymReaper.markLive(Sym); if (const MemRegion *MR = I.second.getAsRegion()) SymReaper.markLive(MR); } d455 3 a457 2 for (const auto I : CheckedSet) { ProgramStateRef CheckerState = I->getState(); d474 1 a474 1 Bldr.generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K); d479 2 a480 1 void ExprEngine::ProcessStmt(const Stmt *currStmt, ExplodedNode *Pred) { d484 1 d491 2 a492 4 if (shouldRemoveDeadBindings(AMgr, currStmt, Pred, Pred->getLocationContext())) { removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); d498 2 a499 1 for (const auto I : CleanedStates) { d502 1 a502 1 Visit(currStmt, I, DstI); d510 1 a510 19 void ExprEngine::ProcessLoopExit(const Stmt* S, ExplodedNode *Pred) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating end of the loop"); ExplodedNodeSet Dst; Dst.Add(Pred); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef NewState = Pred->getState(); if(AMgr.options.shouldUnrollLoops()) NewState = processLoopEnd(S, NewState); LoopExit PP(S, Pred->getLocationContext()); Bldr.generateNode(PP, NewState, Pred); // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer CFGInit, d512 1 a512 3 const CXXCtorInitializer *BMI = CFGInit.getInitializer(); const Expr *Init = BMI->getInit()->IgnoreImplicit(); const LocationContext *LC = Pred->getLocationContext(); d519 4 a522 2 const auto *stackFrame = cast(Pred->getLocationContext()); const auto *decl = cast(stackFrame->getDecl()); d527 1 a527 1 ExplodedNodeSet Tmp; d534 3 a536 1 if (getObjectUnderConstruction(State, BMI, LC)) { a537 5 // But we still need to stop tracking the object under construction. State = finishObjectConstruction(State, BMI, LC); NodeBuilder Bldr(Pred, Tmp, *currBldrCtx); PostStore PS(Init, LC, /*Loc*/ nullptr, /*tag*/ nullptr); Bldr.generateNode(PS, State, Pred); d539 1 d573 4 a581 1 Tmp.insert(Pred); d590 3 a592 3 for (const auto I : Tmp) { ProgramStateRef State = I->getState(); Bldr.generateNode(PP, State, I); a667 7 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; Region = makeZeroElementRegion(state, loc::MemRegionVal(Region), varType, CallOpts.IsArrayCtorOrDtor).getAsRegion(); d669 1 a669 1 Pred, Dst, CallOpts); a678 1 QualType DTy = DE->getDestroyedType(); d684 1 d695 4 a698 15 EvalCallOptions CallOpts; const MemRegion *ArgR = ArgVal.getAsRegion(); if (DE->isArrayForm()) { // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). CallOpts.IsArrayCtorOrDtor = true; // Yes, it may even be a multi-dimensional array. while (const auto *AT = getContext().getAsArrayType(DTy)) DTy = AT->getElementType(); if (ArgR) ArgR = getStoreManager().GetElementZeroRegion(cast(ArgR), DTy); } VisitCXXDestructor(DTy, ArgR, DE, /*IsBase=*/false, Pred, Dst, CallOpts); d705 1 a705 1 const auto *CurDtor = cast(LCtx->getDecl()); d707 1 a707 1 LCtx->getStackFrame()); d717 1 a717 1 CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst, {}); a722 1 QualType T = Member->getType(); d726 1 a726 1 const auto *CurDtor = cast(LCtx->getDecl()); d728 1 a728 1 LCtx->getStackFrame()); d732 3 a734 9 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; FieldVal = makeZeroElementRegion(State, FieldVal, T, CallOpts.IsArrayCtorOrDtor); VisitCXXDestructor(T, FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst, CallOpts); d740 2 a741 1 const CXXBindTemporaryExpr *BTE = D.getBindTemporaryExpr(); d743 2 a744 6 const LocationContext *LC = Pred->getLocationContext(); const MemRegion *MR = nullptr; if (Optional V = getObjectUnderConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext())) { d746 3 a748 17 // but we don't insert the constructors, so the entry in // ObjectsUnderConstruction may be missing. State = finishObjectConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext()); MR = V->getAsRegion(); } // If copy elision has occured, and the constructor corresponding to the // destructor was elided, we need to skip the destructor as well. if (isDestructorElided(State, BTE, LC)) { State = cleanupElidedDestructor(State, BTE, LC); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); PostImplicitCall PP(D.getDestructorDecl(getContext()), D.getBindTemporaryExpr()->getLocStart(), Pred->getLocationContext()); Bldr.generateNode(PP, State, Pred); return; a749 3 ExplodedNodeSet CleanDtorState; StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx); d752 1 a752 1 QualType T = D.getBindTemporaryExpr()->getSubExpr()->getType(); d758 4 a761 20 EvalCallOptions CallOpts; CallOpts.IsTemporaryCtorOrDtor = true; if (!MR) { CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; // If we have no MR, we still need to unwrap the array to avoid destroying // the whole array at once. Regardless, we'd eventually need to model array // destructors properly, element-by-element. while (const ArrayType *AT = getContext().getAsArrayType(T)) { T = AT->getElementType(); CallOpts.IsArrayCtorOrDtor = true; } } else { // We'd eventually need to makeZeroElementRegion() trick here, // but for now we don't have the respective construction contexts, // so MR would always be null in this case. Do nothing for now. } VisitCXXDestructor(T, MR, D.getBindTemporaryExpr(), /*IsBase=*/false, CleanPred, Dst, CallOpts); d771 2 a772 3 ProgramStateRef State = Pred->getState(); const LocationContext *LC = Pred->getLocationContext(); if (getObjectUnderConstruction(State, BTE, LC)) { d774 1 a774 1 TempDtorBuilder.generateNode(State, true, Pred); d777 1 a777 1 TempDtorBuilder.generateNode(State, false, Pred); a783 3 // This is a fallback solution in case we didn't have a construction // context when we were constructing the temporary. Otherwise the map should // have been populated there. d793 4 a796 3 const LocationContext *LC = Node->getLocationContext(); if (!getObjectUnderConstruction(State, BTE, LC)) { // FIXME: Currently the state might also already contain the marker due to d800 2 a801 1 State = addObjectUnderConstruction(State, BTE, LC, UnknownVal()); a806 22 ProgramStateRef ExprEngine::escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const { class CollectReachableSymbolsCallback final : public SymbolVisitor { InvalidatedSymbols Symbols; public: explicit CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) override { Symbols.insert(Sym); return true; } }; const CollectReachableSymbolsCallback &Scanner = State->scanReachableSymbols(V); return getCheckerManager().runCheckersForPointerEscape( State, Scanner.getSymbols(), /*CallEvent*/ nullptr, K, nullptr); } d895 2 a896 1 case Stmt::CapturedStmtClass: { a990 1 case Stmt::FixedPointLiteralClass: d1025 1 a1025 1 if (const auto *DefE = dyn_cast(S)) d1027 1 a1027 1 else if (const auto *DefE = dyn_cast(S)) d1033 2 a1034 1 if (const auto *MTE = dyn_cast(ArgE)) { d1044 3 a1046 2 for (const auto I : PreVisit) { ProgramStateRef State = I->getState(); d1052 1 a1052 1 Bldr2.generateNode(S, I, State); d1073 1 a1073 1 const auto *Ex = cast(S); d1076 3 a1078 1 for (const auto N : preVisit) { d1083 2 a1084 14 ProgramStateRef State = N->getState()->BindExpr(Ex, LCtx, result); // Escape pointers passed into the list, unless it's an ObjC boxed // expression which is not a boxable C structure. if (!(isa(Ex) && !cast(Ex)->getSubExpr() ->getType()->isRecordType())) for (auto Child : Ex->children()) { assert(Child); SVal Val = State->getSVal(Child, LCtx); State = escapeValue(State, Val, PSK_EscapeOther); } Bldr2.generateNode(S, N, State); d1094 1 a1094 1 VisitArraySubscriptExpr(cast(S), Pred, Dst); d1128 1 a1128 1 const auto *B = cast(S); d1160 1 a1160 1 const auto *OCE = cast(S); d1165 1 a1165 1 if (const auto *MD = dyn_cast_or_null(Callee)) { a1182 1 d1185 1 a1185 1 case Stmt::UserDefinedLiteralClass: d1190 1 d1192 1 a1192 1 case Stmt::CXXCatchStmtClass: d1197 1 d1200 1 a1200 1 case Stmt::CXXConstructExprClass: d1205 1 a1208 4 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); d1210 1 a1210 3 for (const auto i : PreVisit) VisitCXXNewExpr(cast(S), i, PostVisit); d1219 1 a1219 1 const auto *CDE = cast(S); d1222 3 a1224 2 for (const auto i : PreVisit) VisitCXXDeleteExpr(CDE, i, Dst); d1234 1 a1234 1 const auto *C = cast(S); d1255 2 a1256 1 const auto *C = cast(S); d1270 1 a1270 1 const auto *DE = cast(S); d1291 1 a1291 1 const auto *C = cast(S); d1303 1 a1303 1 const auto *MTE = cast(S); d1307 4 a1310 2 for (const auto i : dstPrevisit) CreateCXXTemporaryObject(MTE, i, dstExpr); d1365 1 a1365 1 case Stmt::OffsetOfExprClass: { d1367 1 a1367 8 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet PostVisit; for (const auto Node : PreVisit) VisitOffsetOfExpr(cast(S), Node, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); a1369 1 } d1379 1 a1379 1 const auto *SE = cast(S); d1388 1 a1388 2 if (const auto *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { d1400 1 a1400 1 const auto *U = cast(S); d1415 1 a1415 1 const auto *PE = cast(S); d1434 2 a1435 2 const StackFrameContext *CalleeSF = CalleeLC->getStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getStackFrame(); d1447 1 a1447 1 if (L.getStackFrame() != CallerSF) a1499 19 // If we reach a loop which has a known bound (and meets // other constraints) then consider completely unrolling it. if(AMgr.options.shouldUnrollLoops()) { unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath; const Stmt *Term = nodeBuilder.getContext().getBlock()->getTerminator(); if (Term) { ProgramStateRef NewState = updateLoopStack(Term, AMgr.getASTContext(), Pred, maxBlockVisitOnPath); if (NewState != Pred->getState()) { ExplodedNode *UpdatedNode = nodeBuilder.generateNode(NewState, Pred); if (!UpdatedNode) return; Pred = UpdatedNode; } } // Is we are inside an unrolled loop then no need the check the counters. if(isUnrolledState(Pred->getState())) return; } d1527 1 a1527 1 const LocationContext *CalleeSF = CalleeLC->getStackFrame(); d1530 1 a1530 1 if (RootLC->getStackFrame() != CalleeSF) { d1564 1 a1564 1 const auto *Ex = dyn_cast(Condition); d1571 1 a1571 1 while (const auto *CE = dyn_cast(Ex)) { d1599 1 a1599 1 const auto *BO = dyn_cast(Condition); d1625 1 a1625 1 if (const auto *Ex = dyn_cast(Condition)) d1628 1 a1628 1 const auto *BO = dyn_cast(Condition); d1676 1 a1676 1 if (const auto *Ex = dyn_cast(Condition)) d1692 4 a1695 1 for (const auto PredI : CheckersOutSet) { d1704 1 a1704 1 if (const auto *Ex = dyn_cast(Condition)) { d1761 1 a1761 1 ExplodedNodeSet &Dst, d1767 1 a1767 1 const auto *VD = cast(DS->getSingleDecl()); d1785 1 d1796 1 a1796 1 using iterator = IndirectGotoNodeBuilder::iterator; d1822 1 a1822 1 for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) d1826 16 d1855 3 a1857 53 // FIXME: We currently cannot assert that temporaries are clear, because // lifetime extended temporaries are not always modelled correctly. In some // cases when we materialize the temporary, we do // createTemporaryRegionIfNeeded(), and the region changes, and also the // respective destructor becomes automatic from temporary. So for now clean up // the state manually before asserting. Ideally, the code above the assertion // should go away, but the assertion should remain. { ExplodedNodeSet CleanUpObjects; NodeBuilder Bldr(Pred, CleanUpObjects, BC); ProgramStateRef State = Pred->getState(); const LocationContext *FromLC = Pred->getLocationContext(); const LocationContext *ToLC = FromLC->getStackFrame()->getParent(); const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) { // The comment above only pardons us for not cleaning up a // CXXBindTemporaryExpr. If any other statements are found here, // it must be a separate problem. assert(isa(I.first.getStmt())); State = State->remove(I.first); // Also cleanup the elided destructor info. ElidedDestructorItem Item( cast(I.first.getStmt()), I.first.getLocationContext()); State = State->remove(Item); } // Also suppress the assertion for elided destructors when temporary // destructors are not provided at all by the CFG, because there's no // good place to clean them up. if (!AMgr.getAnalyzerOptions().includeTemporaryDtorsInCFG()) for (auto I : State->get()) if (I.second == LC) State = State->remove(I); LC = LC->getParent(); } if (State != Pred->getState()) { Pred = Bldr.generateNode(Pred->getLocation(), State, Pred); if (!Pred) { // The node with clean temporaries already exists. We might have reached // it on a path on which we initialize different temporaries. return; } } } assert(areAllObjectsFullyConstructed(Pred->getState(), Pred->getLocationContext(), Pred->getStackFrame()->getParent())); d1868 4 a1871 2 for (const auto I : AfterRemovedDead) getCheckerManager().runCheckersForEndFunction(BC, Dst, I, *this, RS); d1873 1 a1873 1 getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this, RS); d1882 1 a1882 2 using iterator = SwitchNodeBuilder::iterator; d1971 1 a1971 1 if (const auto *VD = dyn_cast(D)) { d1977 1 a1977 1 const auto *MD = dyn_cast_or_null(D); d1979 2 a1980 2 Optional> VInfo; d1989 8 a1996 4 // Sema follows a sequence of complex rules to determine whether the // variable should be captured. if (const FieldDecl *FD = LambdaCaptureFields[VD]) { d1998 1 a1998 1 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame()); d2000 2 a2001 1 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType()); d2003 3 a2007 6 if (!VInfo) VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType()); SVal V = VInfo->first; bool IsReference = VInfo->second->isReferenceType(); d2021 1 a2021 1 if (const auto *ED = dyn_cast(D)) { d2027 1 a2027 1 if (const auto *FD = dyn_cast(D)) { d2033 1 a2033 1 if (isa(D) || isa(D)) { a2036 2 // FIXME: Maybe delegate this to the surrounding operator&. // Note how this expression is lvalue, however pointer-to-member is NonLoc. d2041 1 a2041 6 ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: proper support for bound declarations. // For now, let's just prevent crashing. d2049 1 a2049 1 void ExprEngine::VisitArraySubscriptExpr(const ArraySubscriptExpr *A, d2052 1 d2061 3 a2063 8 bool IsVectorType = A->getBase()->getType()->isVectorType(); // The "like" case is for situations where C standard prohibits the type to // be an lvalue, e.g. taking the address of a subscript of an expression of // type "void *". bool IsGLValueLike = A->isGLValue() || (A->getType().isCForbiddenLValueType() && !AMgr.getLangOpts().CPlusPlus); d2068 5 a2072 22 if (IsGLValueLike) { QualType T = A->getType(); // One of the forbidden LValue types! We still need to have sensible // symbolic locations to represent this stuff. Note that arithmetic on // void pointers is a GCC extension. if (T->isVoidType()) T = getContext().CharTy; SVal V = state->getLValue(T, state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); Bldr.generateNode(A, Node, state->BindExpr(A, LCtx, V), nullptr, ProgramPoint::PostLValueKind); } else if (IsVectorType) { // FIXME: non-glvalue vector reads are not modelled. Bldr.generateNode(A, Node, state, nullptr); } else { llvm_unreachable("Array subscript should be an lValue when not \ a vector and not a forbidden lvalue type"); } d2081 1 d2086 2 a2087 2 ExplodedNodeSet EvalSet; ValueDecl *Member = M->getMemberDecl(); d2091 6 a2096 3 if (isa(Member) || isa(Member)) { for (const auto I : CheckedSet) VisitCommonDeclRefExpr(M, Member, I, EvalSet); d2101 4 a2104 3 for (const auto I : CheckedSet) { ProgramStateRef state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2108 1 a2108 1 if (const auto *MD = dyn_cast(Member)) { d2115 1 a2115 1 Bldr.generateNode(M, I, state); d2123 1 a2123 1 const auto *field = cast(Member); d2133 2 a2134 2 const auto *PE = dyn_cast(I->getParentMap().getParentIgnoreParens(M)); d2147 1 a2147 1 Bldr.generateNode(M, I, state->BindExpr(M, LCtx, L), nullptr, d2150 2 a2151 2 Bldr.takeNodes(I); evalLoad(Tmp, M, M, I, state, L); d2171 4 a2174 3 for (const auto I : AfterPreSet) { ProgramStateRef State = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2191 1 a2191 1 Bldr.generateNode(AE, I, State, nullptr, d2198 15 d2249 9 a2257 1 State = escapeValue(State, Val, PSK_EscapeOnBind); d2268 1 d2282 3 a2284 2 for (const auto I : ExplicitRegions) { if (const SymbolicRegion *R = I->StripCasts()->getAs()) d2289 3 a2291 1 for (const auto &sym : *Invalidated) { d2315 1 d2339 3 a2341 1 for (const auto PredI : CheckedSet) { d2390 2 a2391 2 for (const auto I : Tmp) evalBind(Dst, StoreE, I, location, Val, false); d2401 2 a2402 1 QualType LoadTy) { d2404 37 d2454 3 a2456 3 for (const auto I : Tmp) { state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2465 1 a2465 1 Bldr.generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag, d2522 2 a2523 1 for (const auto Pred : Src) { d2573 1 a2573 1 assert(!X.getAs()); // Should be an Lval, or unknown, undef. d2597 3 d2601 1 a2601 3 template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple = false) : DefaultDOTGraphTraits(isSimple) {} d2606 1 a2606 1 return {}; d2619 6 d2627 1 d2635 1 a2635 1 case ProgramPoint::BlockEntranceKind: d2639 1 d2642 1 a2642 1 assert(false); a2668 6 case ProgramPoint::LoopExitKind: { LoopExit LE = Loc.castAs(); Out << "LoopExit: " << LE.getLoopStmt()->getStmtClassName(); break; } d2727 1 a2727 1 if (const auto *C = dyn_cast(Label)) { d2741 1 a2741 1 assert(isa(Label)); a2781 2 else if (Loc.getAs()) Out << "\\lPostAllocatorCall\\l"; d2791 34 a2824 1 state->printDOT(Out, N->getLocationContext()); d2835 1 a2835 2 } // namespace llvm d2841 1 a2841 1 std::vector Src; d2845 2 a2846 2 for (const auto I : BR) const_cast(I)->FlushReports(BR); d2851 1 a2851 1 const auto *N = const_cast(EI->begin()->getErrorNode()); @ 1.1.1.13 log @Import clang r337282 from trunk @ text @d1 1 a1 1 //===- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ----------===// d18 1 a18 8 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" #include "clang/AST/DeclBase.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/DeclObjC.h" #include "clang/AST/Expr.h" #include "clang/AST/ExprCXX.h" #include "clang/AST/ExprObjC.h" a19 2 #include "clang/AST/PrettyPrinter.h" #include "clang/AST/Stmt.h" d22 1 a22 8 #include "clang/AST/Type.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/Analysis/CFG.h" #include "clang/Analysis/ConstructionContext.h" #include "clang/Analysis/ProgramPoint.h" #include "clang/Basic/IdentifierTable.h" #include "clang/Basic/LLVM.h" #include "clang/Basic/LangOptions.h" a23 1 #include "clang/Basic/SourceLocation.h" a24 3 #include "clang/Basic/Specifiers.h" #include "clang/StaticAnalyzer/Core/AnalyzerOptions.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" a28 4 #include "clang/StaticAnalyzer/Core/PathSensitive/ConstraintManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ExplodedGraph.h" #include "clang/StaticAnalyzer/Core/PathSensitive/LoopUnrolling.h" a29 15 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/DenseMap.h" #include "llvm/ADT/ImmutableMap.h" #include "llvm/ADT/ImmutableSet.h" #include "llvm/ADT/Optional.h" #include "llvm/ADT/SmallVector.h" a30 5 #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include "llvm/Support/DOTGraphTraits.h" #include "llvm/Support/ErrorHandling.h" #include "llvm/Support/GraphWriter.h" d33 4 a36 7 #include #include #include #include #include #include #include d40 1 d55 2 d58 5 a62 93 //===----------------------------------------------------------------------===// // Internal program state traits. //===----------------------------------------------------------------------===// // When modeling a C++ constructor, for a variety of reasons we need to track // the location of the object for the duration of its ConstructionContext. // ObjectsUnderConstruction maps statements within the construction context // to the object's location, so that on every such statement the location // could have been retrieved. /// ConstructedObjectKey is used for being able to find the path-sensitive /// memory region of a freshly constructed object while modeling the AST node /// that syntactically represents the object that is being constructed. /// Semantics of such nodes may sometimes require access to the region that's /// not otherwise present in the program state, or to the very fact that /// the construction context was present and contained references to these /// AST nodes. class ConstructedObjectKey { typedef std::pair< llvm::PointerUnion, const LocationContext *> ConstructedObjectKeyImpl; ConstructedObjectKeyImpl Impl; const void *getAnyASTNodePtr() const { if (const Stmt *S = getStmt()) return S; else return getCXXCtorInitializer(); } public: ConstructedObjectKey( llvm::PointerUnion P, const LocationContext *LC) : Impl(P, LC) { // This is the full list of statements that require additional actions when // encountered. This list may be expanded when new actions are implemented. assert(getCXXCtorInitializer() || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt()) || isa(getStmt())); } const Stmt *getStmt() const { return Impl.first.dyn_cast(); } const CXXCtorInitializer *getCXXCtorInitializer() const { return Impl.first.dyn_cast(); } const LocationContext *getLocationContext() const { return Impl.second; } void print(llvm::raw_ostream &OS, PrinterHelper *Helper, PrintingPolicy &PP) { OS << '(' << getLocationContext() << ',' << getAnyASTNodePtr() << ") "; if (const Stmt *S = getStmt()) { S->printPretty(OS, Helper, PP); } else { const CXXCtorInitializer *I = getCXXCtorInitializer(); OS << I->getAnyMember()->getNameAsString(); } } void Profile(llvm::FoldingSetNodeID &ID) const { ID.AddPointer(Impl.first.getOpaqueValue()); ID.AddPointer(Impl.second); } bool operator==(const ConstructedObjectKey &RHS) const { return Impl == RHS.Impl; } bool operator<(const ConstructedObjectKey &RHS) const { return Impl < RHS.Impl; } }; typedef llvm::ImmutableMap ObjectsUnderConstructionMap; REGISTER_TRAIT_WITH_PROGRAMSTATE(ObjectsUnderConstruction, ObjectsUnderConstructionMap) // Additionally, track a set of destructors that correspond to elided // constructors when copy elision occurs. typedef std::pair ElidedDestructorItem; typedef llvm::ImmutableSet ElidedDestructorSet; REGISTER_TRAIT_WITH_PROGRAMSTATE(ElidedDestructors, ElidedDestructorSet) d70 1 a70 2 ExprEngine::ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr, bool gcEnabled, d74 15 a88 10 : CTU(CTU), AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS, mgr.getAnalyzerOptions()), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { d112 2 a113 1 if (const auto *FD = dyn_cast(D)) { d122 1 a122 1 const auto *BT = dyn_cast(T); d146 1 a146 1 while (false); d148 1 a148 1 if (const auto *MD = dyn_cast(D)) { d162 1 a162 1 if (const auto *MD = dyn_cast(D)) { d167 1 a167 1 const StackFrameContext *SFC = InitLoc->getStackFrame(); a237 5 // Take the region for Init, i.e. for the whole object. If we do not remember // the region in which the object originally was constructed, come up with // a new temporary region out of thin air and copy the contents of the object // (which are currently present in the Environment, because Init is an rvalue) // into that region. This is not correct, but it is better than nothing. d239 9 a247 16 if (const auto *MT = dyn_cast(Result)) { if (Optional V = getObjectUnderConstruction(State, MT, LC)) { State = finishObjectConstruction(State, MT, LC); State = State->BindExpr(Result, LC, *V); return State; } else { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) { TR = MRMgr.getCXXStaticTempObjectRegion(Init); } else { TR = MRMgr.getCXXTempObjectRegion(Init, LC); } } } else { a248 1 } d265 1 a265 3 State = State->invalidateRegions(Reg, InitWithAdjustments, currBldrCtx->blockCount(), LC, true, nullptr, nullptr, nullptr); d284 1 a284 2 // Then we'd need to take the value that certainly exists and bind it // over. a308 73 ProgramStateRef ExprEngine::addObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC, SVal V) { ConstructedObjectKey Key(P, LC->getStackFrame()); // FIXME: Currently the state might already contain the marker due to // incorrect handling of temporaries bound to default parameters. assert(!State->get(Key) || isa(Key.getStmt())); return State->set(Key, V); } Optional ExprEngine::getObjectUnderConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); return Optional::create(State->get(Key)); } ProgramStateRef ExprEngine::finishObjectConstruction( ProgramStateRef State, llvm::PointerUnion P, const LocationContext *LC) { ConstructedObjectKey Key(P, LC->getStackFrame()); assert(State->contains(Key)); return State->remove(Key); } ProgramStateRef ExprEngine::elideDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(!State->contains(I)); return State->add(I); } ProgramStateRef ExprEngine::cleanupElidedDestructor(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); assert(State->contains(I)); return State->remove(I); } bool ExprEngine::isDestructorElided(ProgramStateRef State, const CXXBindTemporaryExpr *BTE, const LocationContext *LC) { ElidedDestructorItem I(BTE, LC); return State->contains(I); } bool ExprEngine::areAllObjectsFullyConstructed(ProgramStateRef State, const LocationContext *FromLC, const LocationContext *ToLC) { const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) return false; for (auto I: State->get()) if (I.second == LC) return false; LC = LC->getParent(); } return true; } a331 25 static void printObjectsUnderConstructionForContext(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep, const LocationContext *LC) { PrintingPolicy PP = LC->getAnalysisDeclContext()->getASTContext().getPrintingPolicy(); for (auto I : State->get()) { ConstructedObjectKey Key = I.first; SVal Value = I.second; if (Key.getLocationContext() != LC) continue; Key.print(Out, nullptr, PP); Out << " : " << Value << NL; } for (auto I : State->get()) { if (I.second != LC) continue; Out << '(' << I.second << ',' << (const void *)I.first << ") "; I.first->printPretty(Out, nullptr, PP); Out << " : (constructor elided)" << NL; } } d333 1 a333 12 const char *NL, const char *Sep, const LocationContext *LCtx) { if (LCtx) { if (!State->get().isEmpty()) { Out << Sep << "Objects under construction:" << NL; LCtx->dumpStack(Out, "", NL, Sep, [&](const LocationContext *LC) { printObjectsUnderConstructionForContext(Out, State, NL, Sep, LC); }); } } d349 1 a349 3 case CFGElement::Constructor: case CFGElement::CXXRecordTypedCall: ProcessStmt(E.castAs().getStmt(), Pred); d352 1 a352 1 ProcessInitializer(E.castAs(), Pred); a364 3 case CFGElement::LoopExit: ProcessLoopExit(E.castAs().getLoopStmt(), Pred); return; a365 2 case CFGElement::ScopeBegin: case CFGElement::ScopeEnd: d371 1 a371 1 const Stmt *S, d374 1 d384 1 a384 1 if (!isa(S)) d388 1 a388 1 if (CallEvent::isCallStmt(S)) d394 1 a394 1 return !PM.isConsumedExpr(cast(S)); d424 1 a424 1 const StackFrameContext *SFC = LC ? LC->getStackFrame() : nullptr; a426 7 for (auto I : CleanedState->get()) { if (SymbolRef Sym = I.second.getAsSymbol()) SymReaper.markLive(Sym); if (const MemRegion *MR = I.second.getAsRegion()) SymReaper.markLive(MR); } d455 3 a457 2 for (const auto I : CheckedSet) { ProgramStateRef CheckerState = I->getState(); d474 1 a474 1 Bldr.generateNode(DiagnosticStmt, I, CleanedCheckerSt, &cleanupTag, K); d479 2 a480 1 void ExprEngine::ProcessStmt(const Stmt *currStmt, ExplodedNode *Pred) { d484 1 d491 2 a492 4 if (shouldRemoveDeadBindings(AMgr, currStmt, Pred, Pred->getLocationContext())) { removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); d498 2 a499 1 for (const auto I : CleanedStates) { d502 1 a502 1 Visit(currStmt, I, DstI); d510 1 a510 19 void ExprEngine::ProcessLoopExit(const Stmt* S, ExplodedNode *Pred) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating end of the loop"); ExplodedNodeSet Dst; Dst.Add(Pred); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef NewState = Pred->getState(); if(AMgr.options.shouldUnrollLoops()) NewState = processLoopEnd(S, NewState); LoopExit PP(S, Pred->getLocationContext()); Bldr.generateNode(PP, NewState, Pred); // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer CFGInit, d512 1 a512 3 const CXXCtorInitializer *BMI = CFGInit.getInitializer(); const Expr *Init = BMI->getInit()->IgnoreImplicit(); const LocationContext *LC = Pred->getLocationContext(); d519 4 a522 2 const auto *stackFrame = cast(Pred->getLocationContext()); const auto *decl = cast(stackFrame->getDecl()); d527 1 a527 1 ExplodedNodeSet Tmp; d534 3 a536 1 if (getObjectUnderConstruction(State, BMI, LC)) { a537 5 // But we still need to stop tracking the object under construction. State = finishObjectConstruction(State, BMI, LC); NodeBuilder Bldr(Pred, Tmp, *currBldrCtx); PostStore PS(Init, LC, /*Loc*/ nullptr, /*tag*/ nullptr); Bldr.generateNode(PS, State, Pred); d539 1 d573 4 a581 1 Tmp.insert(Pred); d590 3 a592 3 for (const auto I : Tmp) { ProgramStateRef State = I->getState(); Bldr.generateNode(PP, State, I); a667 7 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; Region = makeZeroElementRegion(state, loc::MemRegionVal(Region), varType, CallOpts.IsArrayCtorOrDtor).getAsRegion(); d669 1 a669 1 Pred, Dst, CallOpts); a678 1 QualType DTy = DE->getDestroyedType(); d684 1 d695 4 a698 15 EvalCallOptions CallOpts; const MemRegion *ArgR = ArgVal.getAsRegion(); if (DE->isArrayForm()) { // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). CallOpts.IsArrayCtorOrDtor = true; // Yes, it may even be a multi-dimensional array. while (const auto *AT = getContext().getAsArrayType(DTy)) DTy = AT->getElementType(); if (ArgR) ArgR = getStoreManager().GetElementZeroRegion(cast(ArgR), DTy); } VisitCXXDestructor(DTy, ArgR, DE, /*IsBase=*/false, Pred, Dst, CallOpts); d705 1 a705 1 const auto *CurDtor = cast(LCtx->getDecl()); d707 1 a707 1 LCtx->getStackFrame()); d717 1 a717 1 CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst, {}); a722 1 QualType T = Member->getType(); d726 1 a726 1 const auto *CurDtor = cast(LCtx->getDecl()); d728 1 a728 1 LCtx->getStackFrame()); d732 3 a734 9 // FIXME: We need to run the same destructor on every element of the array. // This workaround will just run the first destructor (which will still // invalidate the entire array). EvalCallOptions CallOpts; FieldVal = makeZeroElementRegion(State, FieldVal, T, CallOpts.IsArrayCtorOrDtor); VisitCXXDestructor(T, FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst, CallOpts); d740 2 a741 1 const CXXBindTemporaryExpr *BTE = D.getBindTemporaryExpr(); d743 2 a744 6 const LocationContext *LC = Pred->getLocationContext(); const MemRegion *MR = nullptr; if (Optional V = getObjectUnderConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext())) { d746 3 a748 17 // but we don't insert the constructors, so the entry in // ObjectsUnderConstruction may be missing. State = finishObjectConstruction(State, D.getBindTemporaryExpr(), Pred->getLocationContext()); MR = V->getAsRegion(); } // If copy elision has occured, and the constructor corresponding to the // destructor was elided, we need to skip the destructor as well. if (isDestructorElided(State, BTE, LC)) { State = cleanupElidedDestructor(State, BTE, LC); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); PostImplicitCall PP(D.getDestructorDecl(getContext()), D.getBindTemporaryExpr()->getLocStart(), Pred->getLocationContext()); Bldr.generateNode(PP, State, Pred); return; a749 3 ExplodedNodeSet CleanDtorState; StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx); d752 1 a752 1 QualType T = D.getBindTemporaryExpr()->getSubExpr()->getType(); d758 4 a761 20 EvalCallOptions CallOpts; CallOpts.IsTemporaryCtorOrDtor = true; if (!MR) { CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; // If we have no MR, we still need to unwrap the array to avoid destroying // the whole array at once. Regardless, we'd eventually need to model array // destructors properly, element-by-element. while (const ArrayType *AT = getContext().getAsArrayType(T)) { T = AT->getElementType(); CallOpts.IsArrayCtorOrDtor = true; } } else { // We'd eventually need to makeZeroElementRegion() trick here, // but for now we don't have the respective construction contexts, // so MR would always be null in this case. Do nothing for now. } VisitCXXDestructor(T, MR, D.getBindTemporaryExpr(), /*IsBase=*/false, CleanPred, Dst, CallOpts); d771 2 a772 3 ProgramStateRef State = Pred->getState(); const LocationContext *LC = Pred->getLocationContext(); if (getObjectUnderConstruction(State, BTE, LC)) { d774 1 a774 1 TempDtorBuilder.generateNode(State, true, Pred); d777 1 a777 1 TempDtorBuilder.generateNode(State, false, Pred); a783 3 // This is a fallback solution in case we didn't have a construction // context when we were constructing the temporary. Otherwise the map should // have been populated there. d793 4 a796 3 const LocationContext *LC = Node->getLocationContext(); if (!getObjectUnderConstruction(State, BTE, LC)) { // FIXME: Currently the state might also already contain the marker due to d800 2 a801 1 State = addObjectUnderConstruction(State, BTE, LC, UnknownVal()); a806 22 ProgramStateRef ExprEngine::escapeValue(ProgramStateRef State, SVal V, PointerEscapeKind K) const { class CollectReachableSymbolsCallback final : public SymbolVisitor { InvalidatedSymbols Symbols; public: explicit CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) override { Symbols.insert(Sym); return true; } }; const CollectReachableSymbolsCallback &Scanner = State->scanReachableSymbols(V); return getCheckerManager().runCheckersForPointerEscape( State, Scanner.getSymbols(), /*CallEvent*/ nullptr, K, nullptr); } d895 2 a896 1 case Stmt::CapturedStmtClass: { a990 1 case Stmt::FixedPointLiteralClass: d1025 1 a1025 1 if (const auto *DefE = dyn_cast(S)) d1027 1 a1027 1 else if (const auto *DefE = dyn_cast(S)) d1033 2 a1034 1 if (const auto *MTE = dyn_cast(ArgE)) { d1044 3 a1046 2 for (const auto I : PreVisit) { ProgramStateRef State = I->getState(); d1052 1 a1052 1 Bldr2.generateNode(S, I, State); d1073 1 a1073 1 const auto *Ex = cast(S); d1076 3 a1078 1 for (const auto N : preVisit) { d1083 2 a1084 14 ProgramStateRef State = N->getState()->BindExpr(Ex, LCtx, result); // Escape pointers passed into the list, unless it's an ObjC boxed // expression which is not a boxable C structure. if (!(isa(Ex) && !cast(Ex)->getSubExpr() ->getType()->isRecordType())) for (auto Child : Ex->children()) { assert(Child); SVal Val = State->getSVal(Child, LCtx); State = escapeValue(State, Val, PSK_EscapeOther); } Bldr2.generateNode(S, N, State); d1094 1 a1094 1 VisitArraySubscriptExpr(cast(S), Pred, Dst); d1128 1 a1128 1 const auto *B = cast(S); d1160 1 a1160 1 const auto *OCE = cast(S); d1165 1 a1165 1 if (const auto *MD = dyn_cast_or_null(Callee)) { a1182 1 d1185 1 a1185 1 case Stmt::UserDefinedLiteralClass: d1190 1 d1192 1 a1192 1 case Stmt::CXXCatchStmtClass: d1197 1 d1200 1 a1200 1 case Stmt::CXXConstructExprClass: d1205 1 a1208 4 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); d1210 1 a1210 3 for (const auto i : PreVisit) VisitCXXNewExpr(cast(S), i, PostVisit); d1219 1 a1219 1 const auto *CDE = cast(S); d1222 3 a1224 2 for (const auto i : PreVisit) VisitCXXDeleteExpr(CDE, i, Dst); d1234 1 a1234 1 const auto *C = cast(S); d1255 2 a1256 1 const auto *C = cast(S); d1270 1 a1270 1 const auto *DE = cast(S); d1291 1 a1291 1 const auto *C = cast(S); d1303 1 a1303 1 const auto *MTE = cast(S); d1307 4 a1310 2 for (const auto i : dstPrevisit) CreateCXXTemporaryObject(MTE, i, dstExpr); d1365 1 a1365 1 case Stmt::OffsetOfExprClass: { d1367 1 a1367 8 ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet PostVisit; for (const auto Node : PreVisit) VisitOffsetOfExpr(cast(S), Node, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); a1369 1 } d1379 1 a1379 1 const auto *SE = cast(S); d1388 1 a1388 2 if (const auto *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { d1400 1 a1400 1 const auto *U = cast(S); d1415 1 a1415 1 const auto *PE = cast(S); d1434 2 a1435 2 const StackFrameContext *CalleeSF = CalleeLC->getStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getStackFrame(); d1447 1 a1447 1 if (L.getStackFrame() != CallerSF) a1499 19 // If we reach a loop which has a known bound (and meets // other constraints) then consider completely unrolling it. if(AMgr.options.shouldUnrollLoops()) { unsigned maxBlockVisitOnPath = AMgr.options.maxBlockVisitOnPath; const Stmt *Term = nodeBuilder.getContext().getBlock()->getTerminator(); if (Term) { ProgramStateRef NewState = updateLoopStack(Term, AMgr.getASTContext(), Pred, maxBlockVisitOnPath); if (NewState != Pred->getState()) { ExplodedNode *UpdatedNode = nodeBuilder.generateNode(NewState, Pred); if (!UpdatedNode) return; Pred = UpdatedNode; } } // Is we are inside an unrolled loop then no need the check the counters. if(isUnrolledState(Pred->getState())) return; } d1527 1 a1527 1 const LocationContext *CalleeSF = CalleeLC->getStackFrame(); d1530 1 a1530 1 if (RootLC->getStackFrame() != CalleeSF) { d1564 1 a1564 1 const auto *Ex = dyn_cast(Condition); d1571 1 a1571 1 while (const auto *CE = dyn_cast(Ex)) { d1599 1 a1599 1 const auto *BO = dyn_cast(Condition); d1625 1 a1625 1 if (const auto *Ex = dyn_cast(Condition)) d1628 1 a1628 1 const auto *BO = dyn_cast(Condition); d1676 1 a1676 1 if (const auto *Ex = dyn_cast(Condition)) d1692 4 a1695 1 for (const auto PredI : CheckersOutSet) { d1704 1 a1704 1 if (const auto *Ex = dyn_cast(Condition)) { d1761 1 a1761 1 ExplodedNodeSet &Dst, d1767 1 a1767 1 const auto *VD = cast(DS->getSingleDecl()); d1785 1 d1796 1 a1796 1 using iterator = IndirectGotoNodeBuilder::iterator; d1822 1 a1822 1 for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) d1826 16 d1855 3 a1857 53 // FIXME: We currently cannot assert that temporaries are clear, because // lifetime extended temporaries are not always modelled correctly. In some // cases when we materialize the temporary, we do // createTemporaryRegionIfNeeded(), and the region changes, and also the // respective destructor becomes automatic from temporary. So for now clean up // the state manually before asserting. Ideally, the code above the assertion // should go away, but the assertion should remain. { ExplodedNodeSet CleanUpObjects; NodeBuilder Bldr(Pred, CleanUpObjects, BC); ProgramStateRef State = Pred->getState(); const LocationContext *FromLC = Pred->getLocationContext(); const LocationContext *ToLC = FromLC->getStackFrame()->getParent(); const LocationContext *LC = FromLC; while (LC != ToLC) { assert(LC && "ToLC must be a parent of FromLC!"); for (auto I : State->get()) if (I.first.getLocationContext() == LC) { // The comment above only pardons us for not cleaning up a // CXXBindTemporaryExpr. If any other statements are found here, // it must be a separate problem. assert(isa(I.first.getStmt())); State = State->remove(I.first); // Also cleanup the elided destructor info. ElidedDestructorItem Item( cast(I.first.getStmt()), I.first.getLocationContext()); State = State->remove(Item); } // Also suppress the assertion for elided destructors when temporary // destructors are not provided at all by the CFG, because there's no // good place to clean them up. if (!AMgr.getAnalyzerOptions().includeTemporaryDtorsInCFG()) for (auto I : State->get()) if (I.second == LC) State = State->remove(I); LC = LC->getParent(); } if (State != Pred->getState()) { Pred = Bldr.generateNode(Pred->getLocation(), State, Pred); if (!Pred) { // The node with clean temporaries already exists. We might have reached // it on a path on which we initialize different temporaries. return; } } } assert(areAllObjectsFullyConstructed(Pred->getState(), Pred->getLocationContext(), Pred->getStackFrame()->getParent())); d1868 4 a1871 2 for (const auto I : AfterRemovedDead) getCheckerManager().runCheckersForEndFunction(BC, Dst, I, *this, RS); d1873 1 a1873 1 getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this, RS); d1882 1 a1882 2 using iterator = SwitchNodeBuilder::iterator; d1971 1 a1971 1 if (const auto *VD = dyn_cast(D)) { d1977 1 a1977 1 const auto *MD = dyn_cast_or_null(D); d1979 2 a1980 2 Optional> VInfo; d1989 8 a1996 4 // Sema follows a sequence of complex rules to determine whether the // variable should be captured. if (const FieldDecl *FD = LambdaCaptureFields[VD]) { d1998 1 a1998 1 svalBuilder.getCXXThis(MD, LocCtxt->getStackFrame()); d2000 2 a2001 1 VInfo = std::make_pair(state->getLValue(FD, CXXThisVal), FD->getType()); d2003 3 a2007 6 if (!VInfo) VInfo = std::make_pair(state->getLValue(VD, LocCtxt), VD->getType()); SVal V = VInfo->first; bool IsReference = VInfo->second->isReferenceType(); d2021 1 a2021 1 if (const auto *ED = dyn_cast(D)) { d2027 1 a2027 1 if (const auto *FD = dyn_cast(D)) { d2033 1 a2033 1 if (isa(D) || isa(D)) { a2036 2 // FIXME: Maybe delegate this to the surrounding operator&. // Note how this expression is lvalue, however pointer-to-member is NonLoc. d2041 1 a2041 6 ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: proper support for bound declarations. // For now, let's just prevent crashing. d2049 1 a2049 1 void ExprEngine::VisitArraySubscriptExpr(const ArraySubscriptExpr *A, d2052 1 d2061 3 a2063 8 bool IsVectorType = A->getBase()->getType()->isVectorType(); // The "like" case is for situations where C standard prohibits the type to // be an lvalue, e.g. taking the address of a subscript of an expression of // type "void *". bool IsGLValueLike = A->isGLValue() || (A->getType().isCForbiddenLValueType() && !AMgr.getLangOpts().CPlusPlus); d2068 5 a2072 22 if (IsGLValueLike) { QualType T = A->getType(); // One of the forbidden LValue types! We still need to have sensible // symbolic locations to represent this stuff. Note that arithmetic on // void pointers is a GCC extension. if (T->isVoidType()) T = getContext().CharTy; SVal V = state->getLValue(T, state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); Bldr.generateNode(A, Node, state->BindExpr(A, LCtx, V), nullptr, ProgramPoint::PostLValueKind); } else if (IsVectorType) { // FIXME: non-glvalue vector reads are not modelled. Bldr.generateNode(A, Node, state, nullptr); } else { llvm_unreachable("Array subscript should be an lValue when not \ a vector and not a forbidden lvalue type"); } d2081 1 d2086 2 a2087 2 ExplodedNodeSet EvalSet; ValueDecl *Member = M->getMemberDecl(); d2091 6 a2096 3 if (isa(Member) || isa(Member)) { for (const auto I : CheckedSet) VisitCommonDeclRefExpr(M, Member, I, EvalSet); d2101 4 a2104 3 for (const auto I : CheckedSet) { ProgramStateRef state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2108 1 a2108 1 if (const auto *MD = dyn_cast(Member)) { d2115 1 a2115 1 Bldr.generateNode(M, I, state); d2123 1 a2123 1 const auto *field = cast(Member); d2133 2 a2134 2 const auto *PE = dyn_cast(I->getParentMap().getParentIgnoreParens(M)); d2147 1 a2147 1 Bldr.generateNode(M, I, state->BindExpr(M, LCtx, L), nullptr, d2150 2 a2151 2 Bldr.takeNodes(I); evalLoad(Tmp, M, M, I, state, L); d2171 4 a2174 3 for (const auto I : AfterPreSet) { ProgramStateRef State = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2191 1 a2191 1 Bldr.generateNode(AE, I, State, nullptr, d2198 15 d2249 9 a2257 1 State = escapeValue(State, Val, PSK_EscapeOnBind); d2268 1 d2282 3 a2284 2 for (const auto I : ExplicitRegions) { if (const SymbolicRegion *R = I->StripCasts()->getAs()) d2289 3 a2291 1 for (const auto &sym : *Invalidated) { d2315 1 d2339 3 a2341 1 for (const auto PredI : CheckedSet) { d2390 2 a2391 2 for (const auto I : Tmp) evalBind(Dst, StoreE, I, location, Val, false); d2401 2 a2402 1 QualType LoadTy) { d2404 37 d2454 3 a2456 3 for (const auto I : Tmp) { state = I->getState(); const LocationContext *LCtx = I->getLocationContext(); d2465 1 a2465 1 Bldr.generateNode(NodeEx, I, state->BindExpr(BoundEx, LCtx, V), tag, d2522 2 a2523 1 for (const auto Pred : Src) { d2573 1 a2573 1 assert(!X.getAs()); // Should be an Lval, or unknown, undef. d2597 3 d2601 1 a2601 3 template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple = false) : DefaultDOTGraphTraits(isSimple) {} d2606 1 a2606 1 return {}; d2619 6 d2627 1 d2635 1 a2635 1 case ProgramPoint::BlockEntranceKind: d2639 1 d2642 1 a2642 1 assert(false); a2668 6 case ProgramPoint::LoopExitKind: { LoopExit LE = Loc.castAs(); Out << "LoopExit: " << LE.getLoopStmt()->getStmtClassName(); break; } d2727 1 a2727 1 if (const auto *C = dyn_cast(Label)) { d2741 1 a2741 1 assert(isa(Label)); a2781 2 else if (Loc.getAs()) Out << "\\lPostAllocatorCall\\l"; d2791 34 a2824 1 state->printDOT(Out, N->getLocationContext()); d2835 1 a2835 2 } // namespace llvm d2841 1 a2841 1 std::vector Src; d2845 2 a2846 2 for (const auto I : BR) const_cast(I)->FlushReports(BR); d2851 1 a2851 1 const auto *N = const_cast(EI->begin()->getErrorNode()); @ 1.1.1.14 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.7.4.1 log @file ExprEngine.cpp was added on branch tls-maxphys on 2014-08-19 23:47:32 +0000 @ text @d1 2688 @ 1.1.1.7.4.2 log @Rebase to HEAD as of a few days ago. @ text @a0 2688 //=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a meta-engine for path-sensitive dataflow analysis that // is built on GREngine, but provides the boilerplate to execute transfer // functions and build the ExplodedGraph at the expression level. // //===----------------------------------------------------------------------===// #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" #include "PrettyStackTraceLocationContext.h" #include "clang/AST/CharUnits.h" #include "clang/AST/ParentMap.h" #include "clang/AST/StmtCXX.h" #include "clang/AST/StmtObjC.h" #include "clang/Basic/Builtins.h" #include "clang/Basic/PrettyStackTrace.h" #include "clang/Basic/SourceManager.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "llvm/ADT/ImmutableList.h" #include "llvm/ADT/Statistic.h" #include "llvm/Support/raw_ostream.h" #ifndef NDEBUG #include "llvm/Support/GraphWriter.h" #endif using namespace clang; using namespace ento; using llvm::APSInt; #define DEBUG_TYPE "ExprEngine" STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called"); STATISTIC(NumMaxBlockCountReached, "The # of aborted paths due to reaching the maximum block count in " "a top level function"); STATISTIC(NumMaxBlockCountReachedInInlined, "The # of aborted paths due to reaching the maximum block count in " "an inlined function"); STATISTIC(NumTimesRetriedWithoutInlining, "The # of times we re-evaluated a call without inlining"); typedef std::pair CXXBindTemporaryContext; // Keeps track of whether CXXBindTemporaryExpr nodes have been evaluated. // The StackFrameContext assures that nested calls due to inlined recursive // functions do not interfere. REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedTemporariesSet, llvm::ImmutableSet) //===----------------------------------------------------------------------===// // Engine construction and deletion. //===----------------------------------------------------------------------===// static const char* TagProviderName = "ExprEngine"; ExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn) : AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), currStmtIdx(0), currBldrCtx(nullptr), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { unsigned TrimInterval = mgr.options.getGraphTrimInterval(); if (TrimInterval != 0) { // Enable eager node reclaimation when constructing the ExplodedGraph. G.enableNodeReclamation(TrimInterval); } } ExprEngine::~ExprEngine() { BR.FlushReports(); } //===----------------------------------------------------------------------===// // Utility methods. //===----------------------------------------------------------------------===// ProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { ProgramStateRef state = StateMgr.getInitialState(InitLoc); const Decl *D = InitLoc->getDecl(); // Preconditions. // FIXME: It would be nice if we had a more general mechanism to add // such preconditions. Some day. do { if (const FunctionDecl *FD = dyn_cast(D)) { // Precondition: the first argument of 'main' is an integer guaranteed // to be > 0. const IdentifierInfo *II = FD->getIdentifier(); if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) break; const ParmVarDecl *PD = FD->getParamDecl(0); QualType T = PD->getType(); const BuiltinType *BT = dyn_cast(T); if (!BT || !BT->isInteger()) break; const MemRegion *R = state->getRegion(PD, InitLoc); if (!R) break; SVal V = state->getSVal(loc::MemRegionVal(R)); SVal Constraint_untested = evalBinOp(state, BO_GT, V, svalBuilder.makeZeroVal(T), svalBuilder.getConditionType()); Optional Constraint = Constraint_untested.getAs(); if (!Constraint) break; if (ProgramStateRef newState = state->assume(*Constraint, true)) state = newState; } break; } while (0); if (const ObjCMethodDecl *MD = dyn_cast(D)) { // Precondition: 'self' is always non-null upon entry to an Objective-C // method. const ImplicitParamDecl *SelfD = MD->getSelfDecl(); const MemRegion *R = state->getRegion(SelfD, InitLoc); SVal V = state->getSVal(loc::MemRegionVal(R)); if (Optional LV = V.getAs()) { // Assume that the pointer value in 'self' is non-null. state = state->assume(*LV, true); assert(state && "'self' cannot be null"); } } if (const CXXMethodDecl *MD = dyn_cast(D)) { if (!MD->isStatic()) { // Precondition: 'this' is always non-null upon entry to the // top-level function. This is our starting assumption for // analyzing an "open" program. const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); if (SFC->getParent() == nullptr) { loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); SVal V = state->getSVal(L); if (Optional LV = V.getAs()) { state = state->assume(*LV, true); assert(state && "'this' cannot be null"); } } } } return state; } ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State, const LocationContext *LC, const Expr *Ex, const Expr *Result) { SVal V = State->getSVal(Ex, LC); if (!Result) { // If we don't have an explicit result expression, we're in "if needed" // mode. Only create a region if the current value is a NonLoc. if (!V.getAs()) return State; Result = Ex; } else { // We need to create a region no matter what. For sanity, make sure we don't // try to stuff a Loc into a non-pointer temporary region. assert(!V.getAs() || Loc::isLocType(Result->getType()) || Result->getType()->isMemberPointerType()); } ProgramStateManager &StateMgr = State->getStateManager(); MemRegionManager &MRMgr = StateMgr.getRegionManager(); StoreManager &StoreMgr = StateMgr.getStoreManager(); // We need to be careful about treating a derived type's value as // bindings for a base type. Unless we're creating a temporary pointer region, // start by stripping and recording base casts. SmallVector Casts; const Expr *Inner = Ex->IgnoreParens(); if (!Loc::isLocType(Result->getType())) { while (const CastExpr *CE = dyn_cast(Inner)) { if (CE->getCastKind() == CK_DerivedToBase || CE->getCastKind() == CK_UncheckedDerivedToBase) Casts.push_back(CE); else if (CE->getCastKind() != CK_NoOp) break; Inner = CE->getSubExpr()->IgnoreParens(); } } // Create a temporary object region for the inner expression (which may have // a more derived type) and bind the value into it. const TypedValueRegion *TR = nullptr; if (const MaterializeTemporaryExpr *MT = dyn_cast(Result)) { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) TR = MRMgr.getCXXStaticTempObjectRegion(Inner); } if (!TR) TR = MRMgr.getCXXTempObjectRegion(Inner, LC); SVal Reg = loc::MemRegionVal(TR); if (V.isUnknown()) V = getSValBuilder().conjureSymbolVal(Result, LC, TR->getValueType(), currBldrCtx->blockCount()); State = State->bindLoc(Reg, V); // Re-apply the casts (from innermost to outermost) for type sanity. for (SmallVectorImpl::reverse_iterator I = Casts.rbegin(), E = Casts.rend(); I != E; ++I) { Reg = StoreMgr.evalDerivedToBase(Reg, *I); } State = State->BindExpr(Result, LC, Reg); return State; } //===----------------------------------------------------------------------===// // Top-level transfer function logic (Dispatcher). //===----------------------------------------------------------------------===// /// evalAssume - Called by ConstraintManager. Used to call checker-specific /// logic for handling assumptions on symbolic values. ProgramStateRef ExprEngine::processAssume(ProgramStateRef state, SVal cond, bool assumption) { return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); } bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { return getCheckerManager().wantsRegionChangeUpdate(state); } ProgramStateRef ExprEngine::processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef Explicits, ArrayRef Regions, const CallEvent *Call) { return getCheckerManager().runCheckersForRegionChanges(state, invalidated, Explicits, Regions, Call); } void ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) { getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); } void ExprEngine::processEndWorklist(bool hasWorkRemaining) { getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); } void ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currStmtIdx = StmtIdx; currBldrCtx = Ctx; switch (E.getKind()) { case CFGElement::Statement: ProcessStmt(const_cast(E.castAs().getStmt()), Pred); return; case CFGElement::Initializer: ProcessInitializer(E.castAs().getInitializer(), Pred); return; case CFGElement::NewAllocator: ProcessNewAllocator(E.castAs().getAllocatorExpr(), Pred); return; case CFGElement::AutomaticObjectDtor: case CFGElement::DeleteDtor: case CFGElement::BaseDtor: case CFGElement::MemberDtor: case CFGElement::TemporaryDtor: ProcessImplicitDtor(E.castAs(), Pred); return; } } static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const CFGStmt S, const ExplodedNode *Pred, const LocationContext *LC) { // Are we never purging state values? if (AMgr.options.AnalysisPurgeOpt == PurgeNone) return false; // Is this the beginning of a basic block? if (Pred->getLocation().getAs()) return true; // Is this on a non-expression? if (!isa(S.getStmt())) return true; // Run before processing a call. if (CallEvent::isCallStmt(S.getStmt())) return true; // Is this an expression that is consumed by another expression? If so, // postpone cleaning out the state. ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); return !PM.isConsumedExpr(cast(S.getStmt())); } void ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt, ProgramPoint::Kind K) { assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || ReferenceStmt == nullptr || isa(ReferenceStmt)) && "PostStmt is not generally supported by the SymbolReaper yet"); assert(LC && "Must pass the current (or expiring) LocationContext"); if (!DiagnosticStmt) { DiagnosticStmt = ReferenceStmt; assert(DiagnosticStmt && "Required for clearing a LocationContext"); } NumRemoveDeadBindings++; ProgramStateRef CleanedState = Pred->getState(); // LC is the location context being destroyed, but SymbolReaper wants a // location context that is still live. (If this is the top-level stack // frame, this will be null.) if (!ReferenceStmt) { assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind && "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext"); LC = LC->getParent(); } const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : nullptr; SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); // Create a state in which dead bindings are removed from the environment // and the store. TODO: The function should just return new env and store, // not a new state. CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); // Process any special transfer function for dead symbols. // A tag to track convenience transitions, which can be removed at cleanup. static SimpleProgramPointTag cleanupTag(TagProviderName, "Clean Node"); if (!SymReaper.hasDeadSymbols()) { // Generate a CleanedNode that has the environment and store cleaned // up. Since no symbols are dead, we can optimize and not clean out // the constraint manager. StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx); Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K); } else { // Call checkers with the non-cleaned state so that they could query the // values of the soon to be dead symbols. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, DiagnosticStmt, *this, K); // For each node in CheckedSet, generate CleanedNodes that have the // environment, the store, and the constraints cleaned up but have the // user-supplied states as the predecessors. StmtNodeBuilder Bldr(CheckedSet, Out, *currBldrCtx); for (ExplodedNodeSet::const_iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef CheckerState = (*I)->getState(); // The constraint manager has not been cleaned up yet, so clean up now. CheckerState = getConstraintManager().removeDeadBindings(CheckerState, SymReaper); assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Environment as a part of " "checkDeadSymbols processing."); assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Store as a part of " "checkDeadSymbols processing."); // Create a state based on CleanedState with CheckerState GDM and // generate a transition to that state. ProgramStateRef CleanedCheckerSt = StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K); } } } void ExprEngine::ProcessStmt(const CFGStmt S, ExplodedNode *Pred) { // Reclaim any unnecessary nodes in the ExplodedGraph. G.reclaimRecentlyAllocatedNodes(); const Stmt *currStmt = S.getStmt(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), currStmt->getLocStart(), "Error evaluating statement"); // Remove dead bindings and symbols. ExplodedNodeSet CleanedStates; if (shouldRemoveDeadBindings(AMgr, S, Pred, Pred->getLocationContext())){ removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); } else CleanedStates.Add(Pred); // Visit the statement. ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CleanedStates.begin(), E = CleanedStates.end(); I != E; ++I) { ExplodedNodeSet DstI; // Visit the statement. Visit(currStmt, *I, DstI); Dst.insert(DstI); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer Init, ExplodedNode *Pred) { const CXXCtorInitializer *BMI = Init.getInitializer(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), BMI->getSourceLocation(), "Error evaluating initializer"); // We don't clean up dead bindings here. const StackFrameContext *stackFrame = cast(Pred->getLocationContext()); const CXXConstructorDecl *decl = cast(stackFrame->getDecl()); ProgramStateRef State = Pred->getState(); SVal thisVal = State->getSVal(svalBuilder.getCXXThis(decl, stackFrame)); ExplodedNodeSet Tmp(Pred); SVal FieldLoc; // Evaluate the initializer, if necessary if (BMI->isAnyMemberInitializer()) { // Constructors build the object directly in the field, // but non-objects must be copied in from the initializer. const Expr *Init = BMI->getInit()->IgnoreImplicit(); if (!isa(Init)) { const ValueDecl *Field; if (BMI->isIndirectMemberInitializer()) { Field = BMI->getIndirectMember(); FieldLoc = State->getLValue(BMI->getIndirectMember(), thisVal); } else { Field = BMI->getMember(); FieldLoc = State->getLValue(BMI->getMember(), thisVal); } SVal InitVal; if (BMI->getNumArrayIndices() > 0) { // Handle arrays of trivial type. We can represent this with a // primitive load/copy from the base array region. const ArraySubscriptExpr *ASE; while ((ASE = dyn_cast(Init))) Init = ASE->getBase()->IgnoreImplicit(); SVal LValue = State->getSVal(Init, stackFrame); if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); // If we fail to get the value for some reason, use a symbolic value. if (InitVal.isUnknownOrUndef()) { SValBuilder &SVB = getSValBuilder(); InitVal = SVB.conjureSymbolVal(BMI->getInit(), stackFrame, Field->getType(), currBldrCtx->blockCount()); } } else { InitVal = State->getSVal(BMI->getInit(), stackFrame); } assert(Tmp.size() == 1 && "have not generated any new nodes yet"); assert(*Tmp.begin() == Pred && "have not generated any new nodes yet"); Tmp.clear(); PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP); } } else { assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer()); // We already did all the work when visiting the CXXConstructExpr. } // Construct PostInitializer nodes whether the state changed or not, // so that the diagnostics don't get confused. PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); ExplodedNodeSet Dst; NodeBuilder Bldr(Tmp, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { ExplodedNode *N = *I; Bldr.generateNode(PP, N->getState(), N); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred) { ExplodedNodeSet Dst; switch (D.getKind()) { case CFGElement::AutomaticObjectDtor: ProcessAutomaticObjDtor(D.castAs(), Pred, Dst); break; case CFGElement::BaseDtor: ProcessBaseDtor(D.castAs(), Pred, Dst); break; case CFGElement::MemberDtor: ProcessMemberDtor(D.castAs(), Pred, Dst); break; case CFGElement::TemporaryDtor: ProcessTemporaryDtor(D.castAs(), Pred, Dst); break; case CFGElement::DeleteDtor: ProcessDeleteDtor(D.castAs(), Pred, Dst); break; default: llvm_unreachable("Unexpected dtor kind."); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred) { ExplodedNodeSet Dst; AnalysisManager &AMgr = getAnalysisManager(); AnalyzerOptions &Opts = AMgr.options; // TODO: We're not evaluating allocators for all cases just yet as // we're not handling the return value correctly, which causes false // positives when the alpha.cplusplus.NewDeleteLeaks check is on. if (Opts.mayInlineCXXAllocator()) VisitCXXNewAllocatorCall(NE, Pred, Dst); else { NodeBuilder Bldr(Pred, Dst, *currBldrCtx); const LocationContext *LCtx = Pred->getLocationContext(); PostImplicitCall PP(NE->getOperatorNew(), NE->getLocStart(), LCtx); Bldr.generateNode(PP, Pred->getState(), Pred); } Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const VarDecl *varDecl = Dtor.getVarDecl(); QualType varType = varDecl->getType(); ProgramStateRef state = Pred->getState(); SVal dest = state->getLValue(varDecl, Pred->getLocationContext()); const MemRegion *Region = dest.castAs().getRegion(); if (const ReferenceType *refType = varType->getAs()) { varType = refType->getPointeeType(); Region = state->getSVal(Region).getAsRegion(); } VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(), /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDeleteExpr *DE = Dtor.getDeleteExpr(); const Stmt *Arg = DE->getArgument(); SVal ArgVal = State->getSVal(Arg, LCtx); // If the argument to delete is known to be a null value, // don't run destructor. if (State->isNull(ArgVal).isConstrainedTrue()) { QualType DTy = DE->getDestroyedType(); QualType BTy = getContext().getBaseElementType(DTy); const CXXRecordDecl *RD = BTy->getAsCXXRecordDecl(); const CXXDestructorDecl *Dtor = RD->getDestructor(); PostImplicitCall PP(Dtor, DE->getLocStart(), LCtx); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(PP, Pred->getState(), Pred); return; } VisitCXXDestructor(DE->getDestroyedType(), ArgVal.getAsRegion(), DE, /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const LocationContext *LCtx = Pred->getLocationContext(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal ThisVal = Pred->getState()->getSVal(ThisPtr); // Create the base object region. const CXXBaseSpecifier *Base = D.getBaseSpecifier(); QualType BaseTy = Base->getType(); SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy, Base->isVirtual()); VisitCXXDestructor(BaseTy, BaseVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst); } void ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const FieldDecl *Member = D.getFieldDecl(); ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisVal = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal FieldVal = State->getLValue(Member, State->getSVal(ThisVal).castAs()); VisitCXXDestructor(Member->getType(), FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst); } void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ExplodedNodeSet CleanDtorState; StmtNodeBuilder StmtBldr(Pred, CleanDtorState, *currBldrCtx); ProgramStateRef State = Pred->getState(); assert(State->contains( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame()))); State = State->remove( std::make_pair(D.getBindTemporaryExpr(), Pred->getStackFrame())); StmtBldr.generateNode(D.getBindTemporaryExpr(), Pred, State); QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType(); assert(CleanDtorState.size() == 1); ExplodedNode *CleanPred = *CleanDtorState.begin(); // FIXME: Inlining of temporary destructors is not supported yet anyway, so // we just put a NULL region for now. This will need to be changed later. VisitCXXDestructor(varType, nullptr, D.getBindTemporaryExpr(), /*IsBase=*/false, CleanPred, Dst); } void ExprEngine::processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE, NodeBuilderContext &BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { BranchNodeBuilder TempDtorBuilder(Pred, Dst, BldCtx, DstT, DstF); if (Pred->getState()->contains( std::make_pair(BTE, Pred->getStackFrame()))) { TempDtorBuilder.markInfeasible(false); TempDtorBuilder.generateNode(Pred->getState(), true, Pred); } else { TempDtorBuilder.markInfeasible(true); TempDtorBuilder.generateNode(Pred->getState(), false, Pred); } } void ExprEngine::VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE, ExplodedNodeSet &PreVisit, ExplodedNodeSet &Dst) { if (!getAnalysisManager().options.includeTemporaryDtorsInCFG()) { // In case we don't have temporary destructors in the CFG, do not mark // the initialization - we would otherwise never clean it up. Dst = PreVisit; return; } StmtNodeBuilder StmtBldr(PreVisit, Dst, *currBldrCtx); for (ExplodedNode *Node : PreVisit) { ProgramStateRef State = Node->getState(); assert(!State->contains( std::make_pair(BTE, Node->getStackFrame()))); State = State->add( std::make_pair(BTE, Node->getStackFrame())); StmtBldr.generateNode(BTE, Node, State); } } void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &DstTop) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating statement"); ExplodedNodeSet Dst; StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx); assert(!isa(S) || S == cast(S)->IgnoreParens()); switch (S->getStmtClass()) { // C++ and ARC stuff we don't support yet. case Expr::ObjCIndirectCopyRestoreExprClass: case Stmt::CXXDependentScopeMemberExprClass: case Stmt::CXXTryStmtClass: case Stmt::CXXTypeidExprClass: case Stmt::CXXUuidofExprClass: case Stmt::MSPropertyRefExprClass: case Stmt::CXXUnresolvedConstructExprClass: case Stmt::DependentScopeDeclRefExprClass: case Stmt::TypeTraitExprClass: case Stmt::ArrayTypeTraitExprClass: case Stmt::ExpressionTraitExprClass: case Stmt::UnresolvedLookupExprClass: case Stmt::UnresolvedMemberExprClass: case Stmt::CXXNoexceptExprClass: case Stmt::PackExpansionExprClass: case Stmt::SubstNonTypeTemplateParmPackExprClass: case Stmt::FunctionParmPackExprClass: case Stmt::SEHTryStmtClass: case Stmt::SEHExceptStmtClass: case Stmt::SEHLeaveStmtClass: case Stmt::LambdaExprClass: case Stmt::SEHFinallyStmtClass: { const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); Engine.addAbortedBlock(node, currBldrCtx->getBlock()); break; } case Stmt::ParenExprClass: llvm_unreachable("ParenExprs already handled."); case Stmt::GenericSelectionExprClass: llvm_unreachable("GenericSelectionExprs already handled."); // Cases that should never be evaluated simply because they shouldn't // appear in the CFG. case Stmt::BreakStmtClass: case Stmt::CaseStmtClass: case Stmt::CompoundStmtClass: case Stmt::ContinueStmtClass: case Stmt::CXXForRangeStmtClass: case Stmt::DefaultStmtClass: case Stmt::DoStmtClass: case Stmt::ForStmtClass: case Stmt::GotoStmtClass: case Stmt::IfStmtClass: case Stmt::IndirectGotoStmtClass: case Stmt::LabelStmtClass: case Stmt::NoStmtClass: case Stmt::NullStmtClass: case Stmt::SwitchStmtClass: case Stmt::WhileStmtClass: case Expr::MSDependentExistsStmtClass: case Stmt::CapturedStmtClass: case Stmt::OMPParallelDirectiveClass: case Stmt::OMPSimdDirectiveClass: case Stmt::OMPForDirectiveClass: case Stmt::OMPSectionsDirectiveClass: case Stmt::OMPSectionDirectiveClass: case Stmt::OMPSingleDirectiveClass: case Stmt::OMPMasterDirectiveClass: case Stmt::OMPCriticalDirectiveClass: case Stmt::OMPParallelForDirectiveClass: case Stmt::OMPParallelSectionsDirectiveClass: case Stmt::OMPTaskDirectiveClass: case Stmt::OMPTaskyieldDirectiveClass: case Stmt::OMPBarrierDirectiveClass: case Stmt::OMPTaskwaitDirectiveClass: case Stmt::OMPFlushDirectiveClass: case Stmt::OMPOrderedDirectiveClass: case Stmt::OMPAtomicDirectiveClass: llvm_unreachable("Stmt should not be in analyzer evaluation loop"); case Stmt::ObjCSubscriptRefExprClass: case Stmt::ObjCPropertyRefExprClass: llvm_unreachable("These are handled by PseudoObjectExpr"); case Stmt::GNUNullExprClass: { // GNU __null is a pointer-width integer, not an actual pointer. ProgramStateRef state = Pred->getState(); state = state->BindExpr(S, Pred->getLocationContext(), svalBuilder.makeIntValWithPtrWidth(0, false)); Bldr.generateNode(S, Pred, state); break; } case Stmt::ObjCAtSynchronizedStmtClass: Bldr.takeNodes(Pred); VisitObjCAtSynchronizedStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ExprWithCleanupsClass: // Handled due to fully linearised CFG. break; case Stmt::CXXBindTemporaryExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet Next; VisitCXXBindTemporaryExpr(cast(S), PreVisit, Next); getCheckerManager().runCheckersForPostStmt(Dst, Next, S, *this); Bldr.addNodes(Dst); break; } // Cases not handled yet; but will handle some day. case Stmt::DesignatedInitExprClass: case Stmt::ExtVectorElementExprClass: case Stmt::ImaginaryLiteralClass: case Stmt::ObjCAtCatchStmtClass: case Stmt::ObjCAtFinallyStmtClass: case Stmt::ObjCAtTryStmtClass: case Stmt::ObjCAutoreleasePoolStmtClass: case Stmt::ObjCEncodeExprClass: case Stmt::ObjCIsaExprClass: case Stmt::ObjCProtocolExprClass: case Stmt::ObjCSelectorExprClass: case Stmt::ParenListExprClass: case Stmt::PredefinedExprClass: case Stmt::ShuffleVectorExprClass: case Stmt::ConvertVectorExprClass: case Stmt::VAArgExprClass: case Stmt::CUDAKernelCallExprClass: case Stmt::OpaqueValueExprClass: case Stmt::AsTypeExprClass: case Stmt::AtomicExprClass: // Fall through. // Cases we intentionally don't evaluate, since they don't need // to be explicitly evaluated. case Stmt::AddrLabelExprClass: case Stmt::AttributedStmtClass: case Stmt::IntegerLiteralClass: case Stmt::CharacterLiteralClass: case Stmt::ImplicitValueInitExprClass: case Stmt::CXXScalarValueInitExprClass: case Stmt::CXXBoolLiteralExprClass: case Stmt::ObjCBoolLiteralExprClass: case Stmt::FloatingLiteralClass: case Stmt::SizeOfPackExprClass: case Stmt::StringLiteralClass: case Stmt::ObjCStringLiteralClass: case Stmt::CXXPseudoDestructorExprClass: case Stmt::SubstNonTypeTemplateParmExprClass: case Stmt::CXXNullPtrLiteralExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDefaultArgExprClass: case Stmt::CXXDefaultInitExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(PreVisit, Tmp, *currBldrCtx); const Expr *ArgE; if (const CXXDefaultArgExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else if (const CXXDefaultInitExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else llvm_unreachable("unknown constant wrapper kind"); bool IsTemporary = false; if (const MaterializeTemporaryExpr *MTE = dyn_cast(ArgE)) { ArgE = MTE->GetTemporaryExpr(); IsTemporary = true; } Optional ConstantVal = svalBuilder.getConstantVal(ArgE); if (!ConstantVal) ConstantVal = UnknownVal(); const LocationContext *LCtx = Pred->getLocationContext(); for (ExplodedNodeSet::iterator I = PreVisit.begin(), E = PreVisit.end(); I != E; ++I) { ProgramStateRef State = (*I)->getState(); State = State->BindExpr(S, LCtx, *ConstantVal); if (IsTemporary) State = createTemporaryRegionIfNeeded(State, LCtx, cast(S), cast(S)); Bldr2.generateNode(S, *I, State); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } // Cases we evaluate as opaque expressions, conjuring a symbol. case Stmt::CXXStdInitializerListExprClass: case Expr::ObjCArrayLiteralClass: case Expr::ObjCDictionaryLiteralClass: case Expr::ObjCBoxedExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx); const Expr *Ex = cast(S); QualType resultType = Ex->getType(); for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); it != et; ++it) { ExplodedNode *N = *it; const LocationContext *LCtx = N->getLocationContext(); SVal result = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, resultType, currBldrCtx->blockCount()); ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); Bldr2.generateNode(S, N, state); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } case Stmt::ArraySubscriptExprClass: Bldr.takeNodes(Pred); VisitLvalArraySubscriptExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::GCCAsmStmtClass: Bldr.takeNodes(Pred); VisitGCCAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MSAsmStmtClass: Bldr.takeNodes(Pred); VisitMSAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BlockExprClass: Bldr.takeNodes(Pred); VisitBlockExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryOperatorClass: { const BinaryOperator* B = cast(S); if (B->isLogicalOp()) { Bldr.takeNodes(Pred); VisitLogicalExpr(B, Pred, Dst); Bldr.addNodes(Dst); break; } else if (B->getOpcode() == BO_Comma) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), state->getSVal(B->getRHS(), Pred->getLocationContext()))); break; } Bldr.takeNodes(Pred); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (B->isRelationalOp() || B->isEqualityOp())) { ExplodedNodeSet Tmp; VisitBinaryOperator(cast(S), Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast(S)); } else VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXOperatorCallExprClass: { const CXXOperatorCallExpr *OCE = cast(S); // For instance method operators, make sure the 'this' argument has a // valid region. const Decl *Callee = OCE->getCalleeDecl(); if (const CXXMethodDecl *MD = dyn_cast_or_null(Callee)) { if (MD->isInstance()) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); ProgramStateRef NewState = createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0)); if (NewState != State) { Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/nullptr, ProgramPoint::PreStmtKind); // Did we cache out? if (!Pred) break; } } } // FALLTHROUGH } case Stmt::CallExprClass: case Stmt::CXXMemberCallExprClass: case Stmt::UserDefinedLiteralClass: { Bldr.takeNodes(Pred); VisitCallExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXCatchStmtClass: { Bldr.takeNodes(Pred); VisitCXXCatchStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXTemporaryObjectExprClass: case Stmt::CXXConstructExprClass: { Bldr.takeNodes(Pred); VisitCXXConstructExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXNewExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PostVisit; VisitCXXNewExpr(cast(S), Pred, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDeleteExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; const CXXDeleteExpr *CDE = cast(S); getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); for (ExplodedNodeSet::iterator i = PreVisit.begin(), e = PreVisit.end(); i != e ; ++i) VisitCXXDeleteExpr(CDE, *i, Dst); Bldr.addNodes(Dst); break; } // FIXME: ChooseExpr is really a constant. We need to fix // the CFG do not model them as explicit control-flow. case Stmt::ChooseExprClass: { // __builtin_choose_expr Bldr.takeNodes(Pred); const ChooseExpr *C = cast(S); VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CompoundAssignOperatorClass: Bldr.takeNodes(Pred); VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::CompoundLiteralExprClass: Bldr.takeNodes(Pred); VisitCompoundLiteralExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryConditionalOperatorClass: case Stmt::ConditionalOperatorClass: { // '?' operator Bldr.takeNodes(Pred); const AbstractConditionalOperator *C = cast(S); VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXThisExprClass: Bldr.takeNodes(Pred); VisitCXXThisExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::DeclRefExprClass: { Bldr.takeNodes(Pred); const DeclRefExpr *DE = cast(S); VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::DeclStmtClass: Bldr.takeNodes(Pred); VisitDeclStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ImplicitCastExprClass: case Stmt::CStyleCastExprClass: case Stmt::CXXStaticCastExprClass: case Stmt::CXXDynamicCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::ObjCBridgedCastExprClass: { Bldr.takeNodes(Pred); const CastExpr *C = cast(S); // Handle the previsit checks. ExplodedNodeSet dstPrevisit; getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); // Handle the expression itself. ExplodedNodeSet dstExpr; for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), e = dstPrevisit.end(); i != e ; ++i) { VisitCast(C, C->getSubExpr(), *i, dstExpr); } // Handle the postvisit checks. getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); Bldr.addNodes(Dst); break; } case Expr::MaterializeTemporaryExprClass: { Bldr.takeNodes(Pred); const MaterializeTemporaryExpr *MTE = cast(S); CreateCXXTemporaryObject(MTE, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::InitListExprClass: Bldr.takeNodes(Pred); VisitInitListExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MemberExprClass: Bldr.takeNodes(Pred); VisitMemberExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCIvarRefExprClass: Bldr.takeNodes(Pred); VisitLvalObjCIvarRefExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCForCollectionStmtClass: Bldr.takeNodes(Pred); VisitObjCForCollectionStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCMessageExprClass: Bldr.takeNodes(Pred); VisitObjCMessage(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCAtThrowStmtClass: case Stmt::CXXThrowExprClass: // FIXME: This is not complete. We basically treat @@throw as // an abort. Bldr.generateSink(S, Pred, Pred->getState()); break; case Stmt::ReturnStmtClass: Bldr.takeNodes(Pred); VisitReturnStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::OffsetOfExprClass: Bldr.takeNodes(Pred); VisitOffsetOfExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::UnaryExprOrTypeTraitExprClass: Bldr.takeNodes(Pred); VisitUnaryExprOrTypeTraitExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::StmtExprClass: { const StmtExpr *SE = cast(S); if (SE->getSubStmt()->body_empty()) { // Empty statement expression. assert(SE->getType() == getContext().VoidTy && "Empty statement expression must have void type."); break; } if (Expr *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(SE, Pred, state->BindExpr(SE, Pred->getLocationContext(), state->getSVal(LastExpr, Pred->getLocationContext()))); } break; } case Stmt::UnaryOperatorClass: { Bldr.takeNodes(Pred); const UnaryOperator *U = cast(S); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) { ExplodedNodeSet Tmp; VisitUnaryOperator(U, Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, U); } else VisitUnaryOperator(U, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::PseudoObjectExprClass: { Bldr.takeNodes(Pred); ProgramStateRef state = Pred->getState(); const PseudoObjectExpr *PE = cast(S); if (const Expr *Result = PE->getResultExpr()) { SVal V = state->getSVal(Result, Pred->getLocationContext()); Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), V)); } else Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), UnknownVal())); Bldr.addNodes(Dst); break; } } } bool ExprEngine::replayWithoutInlining(ExplodedNode *N, const LocationContext *CalleeLC) { const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); assert(CalleeSF && CallerSF); ExplodedNode *BeforeProcessingCall = nullptr; const Stmt *CE = CalleeSF->getCallSite(); // Find the first node before we started processing the call expression. while (N) { ProgramPoint L = N->getLocation(); BeforeProcessingCall = N; N = N->pred_empty() ? nullptr : *(N->pred_begin()); // Skip the nodes corresponding to the inlined code. if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) continue; // We reached the caller. Find the node right before we started // processing the call. if (L.isPurgeKind()) continue; if (L.getAs()) continue; if (L.getAs()) continue; if (Optional SP = L.getAs()) if (SP->getStmt() == CE) continue; break; } if (!BeforeProcessingCall) return false; // TODO: Clean up the unneeded nodes. // Build an Epsilon node from which we will restart the analyzes. // Note that CE is permitted to be NULL! ProgramPoint NewNodeLoc = EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); // Add the special flag to GDM to signal retrying with no inlining. // Note, changing the state ensures that we are not going to cache out. ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); NewNodeState = NewNodeState->set(const_cast(CE)); // Make the new node a successor of BeforeProcessingCall. bool IsNew = false; ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); // We cached out at this point. Caching out is common due to us backtracking // from the inlined function, which might spawn several paths. if (!IsNew) return true; NewNode->addPredecessor(BeforeProcessingCall, G); // Add the new node to the work list. Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), CalleeSF->getIndex()); NumTimesRetriedWithoutInlining++; return true; } /// Block entrance. (Update counters). void ExprEngine::processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); // FIXME: Refactor this into a checker. if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) { static SimpleProgramPointTag tag(TagProviderName, "Block count exceeded"); const ExplodedNode *Sink = nodeBuilder.generateSink(Pred->getState(), Pred, &tag); // Check if we stopped at the top level function or not. // Root node should have the location context of the top most function. const LocationContext *CalleeLC = Pred->getLocation().getLocationContext(); const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const LocationContext *RootLC = (*G.roots_begin())->getLocation().getLocationContext(); if (RootLC->getCurrentStackFrame() != CalleeSF) { Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); // Re-run the call evaluation without inlining it, by storing the // no-inlining policy in the state and enqueuing the new work item on // the list. Replay should almost never fail. Use the stats to catch it // if it does. if ((!AMgr.options.NoRetryExhausted && replayWithoutInlining(Pred, CalleeLC))) return; NumMaxBlockCountReachedInInlined++; } else NumMaxBlockCountReached++; // Make sink nodes as exhausted(for stats) only if retry failed. Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); } } //===----------------------------------------------------------------------===// // Branch processing. //===----------------------------------------------------------------------===// /// RecoverCastedSymbol - A helper function for ProcessBranch that is used /// to try to recover some path-sensitivity for casts of symbolic /// integers that promote their values (which are currently not tracked well). /// This function returns the SVal bound to Condition->IgnoreCasts if all the // cast(s) did was sign-extend the original value. static SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx) { const Expr *Ex = dyn_cast(Condition); if (!Ex) return UnknownVal(); uint64_t bits = 0; bool bitsInit = false; while (const CastExpr *CE = dyn_cast(Ex)) { QualType T = CE->getType(); if (!T->isIntegralOrEnumerationType()) return UnknownVal(); uint64_t newBits = Ctx.getTypeSize(T); if (!bitsInit || newBits < bits) { bitsInit = true; bits = newBits; } Ex = CE->getSubExpr(); } // We reached a non-cast. Is it a symbolic value? QualType T = Ex->getType(); if (!bitsInit || !T->isIntegralOrEnumerationType() || Ctx.getTypeSize(T) > bits) return UnknownVal(); return state->getSVal(Ex, LCtx); } #ifndef NDEBUG static const Stmt *getRightmostLeaf(const Stmt *Condition) { while (Condition) { const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) { return Condition; } Condition = BO->getRHS()->IgnoreParens(); } return nullptr; } #endif // Returns the condition the branch at the end of 'B' depends on and whose value // has been evaluated within 'B'. // In most cases, the terminator condition of 'B' will be evaluated fully in // the last statement of 'B'; in those cases, the resolved condition is the // given 'Condition'. // If the condition of the branch is a logical binary operator tree, the CFG is // optimized: in that case, we know that the expression formed by all but the // rightmost leaf of the logical binary operator tree must be true, and thus // the branch condition is at this point equivalent to the truth value of that // rightmost leaf; the CFG block thus only evaluates this rightmost leaf // expression in its final statement. As the full condition in that case was // not evaluated, and is thus not in the SVal cache, we need to use that leaf // expression to evaluate the truth value of the condition in the current state // space. static const Stmt *ResolveCondition(const Stmt *Condition, const CFGBlock *B) { if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) return Condition; assert(!B->getTerminator().isTemporaryDtorsBranch() && "Temporary destructor branches handled by processBindTemporary."); // For logical operations, we still have the case where some branches // use the traditional "merge" approach and others sink the branch // directly into the basic blocks representing the logical operation. // We need to distinguish between those two cases here. // The invariants are still shifting, but it is possible that the // last element in a CFGBlock is not a CFGStmt. Look for the last // CFGStmt as the value of the condition. CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend(); for (; I != E; ++I) { CFGElement Elem = *I; Optional CS = Elem.getAs(); if (!CS) continue; const Stmt *LastStmt = CS->getStmt(); assert(LastStmt == Condition || LastStmt == getRightmostLeaf(Condition)); return LastStmt; } llvm_unreachable("could not resolve condition"); } void ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext& BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { assert((!Condition || !isa(Condition)) && "CXXBindTemporaryExprs are handled by processBindTemporary."); const LocationContext *LCtx = Pred->getLocationContext(); PrettyStackTraceLocationContext StackCrashInfo(LCtx); currBldrCtx = &BldCtx; // Check for NULL conditions; e.g. "for(;;)" if (!Condition) { BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); NullCondBldr.markInfeasible(false); NullCondBldr.generateNode(Pred->getState(), true, Pred); return; } if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); Condition = ResolveCondition(Condition, BldCtx.getBlock()); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), Condition->getLocStart(), "Error evaluating branch"); ExplodedNodeSet CheckersOutSet; getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, Pred, *this); // We generated only sinks. if (CheckersOutSet.empty()) return; BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); for (NodeBuilder::iterator I = CheckersOutSet.begin(), E = CheckersOutSet.end(); E != I; ++I) { ExplodedNode *PredI = *I; if (PredI->isSink()) continue; ProgramStateRef PrevState = PredI->getState(); SVal X = PrevState->getSVal(Condition, PredI->getLocationContext()); if (X.isUnknownOrUndef()) { // Give it a chance to recover from unknown. if (const Expr *Ex = dyn_cast(Condition)) { if (Ex->getType()->isIntegralOrEnumerationType()) { // Try to recover some path-sensitivity. Right now casts of symbolic // integers that promote their values are currently not tracked well. // If 'Condition' is such an expression, try and recover the // underlying value and use that instead. SVal recovered = RecoverCastedSymbol(getStateManager(), PrevState, Condition, PredI->getLocationContext(), getContext()); if (!recovered.isUnknown()) { X = recovered; } } } } // If the condition is still unknown, give up. if (X.isUnknownOrUndef()) { builder.generateNode(PrevState, true, PredI); builder.generateNode(PrevState, false, PredI); continue; } DefinedSVal V = X.castAs(); ProgramStateRef StTrue, StFalse; std::tie(StTrue, StFalse) = PrevState->assume(V); // Process the true branch. if (builder.isFeasible(true)) { if (StTrue) builder.generateNode(StTrue, true, PredI); else builder.markInfeasible(true); } // Process the false branch. if (builder.isFeasible(false)) { if (StFalse) builder.generateNode(StFalse, false, PredI); else builder.markInfeasible(false); } } currBldrCtx = nullptr; } /// The GDM component containing the set of global variables which have been /// previously initialized with explicit initializers. REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedGlobalsSet, llvm::ImmutableSet) void ExprEngine::processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, clang::ento::ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currBldrCtx = &BuilderCtx; const VarDecl *VD = cast(DS->getSingleDecl()); ProgramStateRef state = Pred->getState(); bool initHasRun = state->contains(VD); BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF); if (!initHasRun) { state = state->add(VD); } builder.generateNode(state, initHasRun, Pred); builder.markInfeasible(!initHasRun); currBldrCtx = nullptr; } /// processIndirectGoto - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a computed goto jump. void ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { ProgramStateRef state = builder.getState(); SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); // Three possibilities: // // (1) We know the computed label. // (2) The label is NULL (or some other constant), or Undefined. // (3) We have no clue about the label. Dispatch to all targets. // typedef IndirectGotoNodeBuilder::iterator iterator; if (Optional LV = V.getAs()) { const LabelDecl *L = LV->getLabel(); for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { if (I.getLabel() == L) { builder.generateNode(I, state); return; } } llvm_unreachable("No block with label."); } if (V.getAs() || V.getAs()) { // Dispatch to the first target and mark it as a sink. //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); // FIXME: add checker visit. // UndefBranches.insert(N); return; } // This is really a catch-all. We don't support symbolics yet. // FIXME: Implement dispatch for symbolic pointers. for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) builder.generateNode(I, state); } #if 0 static bool stackFrameDoesNotContainInitializedTemporaries(ExplodedNode &Pred) { const StackFrameContext* Frame = Pred.getStackFrame(); const llvm::ImmutableSet &Set = Pred.getState()->get(); return std::find_if(Set.begin(), Set.end(), [&](const CXXBindTemporaryContext &Ctx) { if (Ctx.second == Frame) { Ctx.first->dump(); llvm::errs() << "\n"; } return Ctx.second == Frame; }) == Set.end(); } #endif /// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path /// nodes when the control reaches the end of a function. void ExprEngine::processEndOfFunction(NodeBuilderContext& BC, ExplodedNode *Pred) { // FIXME: Assert that stackFrameDoesNotContainInitializedTemporaries(*Pred)). // We currently cannot enable this assert, as lifetime extended temporaries // are not modelled correctly. PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); StateMgr.EndPath(Pred->getState()); ExplodedNodeSet Dst; if (Pred->getLocationContext()->inTopFrame()) { // Remove dead symbols. ExplodedNodeSet AfterRemovedDead; removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead); // Notify checkers. for (ExplodedNodeSet::iterator I = AfterRemovedDead.begin(), E = AfterRemovedDead.end(); I != E; ++I) { getCheckerManager().runCheckersForEndFunction(BC, Dst, *I, *this); } } else { getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this); } Engine.enqueueEndOfFunction(Dst); } /// ProcessSwitch - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a switch statement. void ExprEngine::processSwitch(SwitchNodeBuilder& builder) { typedef SwitchNodeBuilder::iterator iterator; ProgramStateRef state = builder.getState(); const Expr *CondE = builder.getCondition(); SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); if (CondV_untested.isUndef()) { //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); // FIXME: add checker //UndefBranches.insert(N); return; } DefinedOrUnknownSVal CondV = CondV_untested.castAs(); ProgramStateRef DefaultSt = state; iterator I = builder.begin(), EI = builder.end(); bool defaultIsFeasible = I == EI; for ( ; I != EI; ++I) { // Successor may be pruned out during CFG construction. if (!I.getBlock()) continue; const CaseStmt *Case = I.getCase(); // Evaluate the LHS of the case value. llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); // Get the RHS of the case, if it exists. llvm::APSInt V2; if (const Expr *E = Case->getRHS()) V2 = E->EvaluateKnownConstInt(getContext()); else V2 = V1; // FIXME: Eventually we should replace the logic below with a range // comparison, rather than concretize the values within the range. // This should be easy once we have "ranges" for NonLVals. do { nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, CondV, CaseVal); // Now "assume" that the case matches. if (ProgramStateRef stateNew = state->assume(Res, true)) { builder.generateCaseStmtNode(I, stateNew); // If CondV evaluates to a constant, then we know that this // is the *only* case that we can take, so stop evaluating the // others. if (CondV.getAs()) return; } // Now "assume" that the case doesn't match. Add this state // to the default state (if it is feasible). if (DefaultSt) { if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { defaultIsFeasible = true; DefaultSt = stateNew; } else { defaultIsFeasible = false; DefaultSt = nullptr; } } // Concretize the next value in the range. if (V1 == V2) break; ++V1; assert (V1 <= V2); } while (true); } if (!defaultIsFeasible) return; // If we have switch(enum value), the default branch is not // feasible if all of the enum constants not covered by 'case:' statements // are not feasible values for the switch condition. // // Note that this isn't as accurate as it could be. Even if there isn't // a case for a particular enum value as long as that enum value isn't // feasible then it shouldn't be considered for making 'default:' reachable. const SwitchStmt *SS = builder.getSwitch(); const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); if (CondExpr->getType()->getAs()) { if (SS->isAllEnumCasesCovered()) return; } builder.generateDefaultCaseNode(DefaultSt); } //===----------------------------------------------------------------------===// // Transfer functions: Loads and stores. //===----------------------------------------------------------------------===// void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef state = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); if (const VarDecl *VD = dyn_cast(D)) { // C permits "extern void v", and if you cast the address to a valid type, // you can even do things with it. We simply pretend assert(Ex->isGLValue() || VD->getType()->isVoidType()); SVal V = state->getLValue(VD, Pred->getLocationContext()); // For references, the 'lvalue' is the pointer address stored in the // reference region. if (VD->getType()->isReferenceType()) { if (const MemRegion *R = V.getAsRegion()) V = state->getSVal(R); else V = UnknownVal(); } Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, ProgramPoint::PostLValueKind); return; } if (const EnumConstantDecl *ED = dyn_cast(D)) { assert(!Ex->isGLValue()); SVal V = svalBuilder.makeIntVal(ED->getInitVal()); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); return; } if (const FunctionDecl *FD = dyn_cast(D)) { SVal V = svalBuilder.getFunctionPointer(FD); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: Compute lvalue of field pointers-to-member. // Right now we just use a non-null void pointer, so that it gives proper // results in boolean contexts. SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy, currBldrCtx->blockCount()); state = state->assume(V.castAs(), true); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), nullptr, ProgramPoint::PostLValueKind); return; } llvm_unreachable("Support for this Decl not implemented."); } /// VisitArraySubscriptExpr - Transfer function for array accesses void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, ExplodedNode *Pred, ExplodedNodeSet &Dst){ const Expr *Base = A->getBase()->IgnoreParens(); const Expr *Idx = A->getIdx()->IgnoreParens(); ExplodedNodeSet checkerPreStmt; getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), ei = checkerPreStmt.end(); it != ei; ++it) { const LocationContext *LCtx = (*it)->getLocationContext(); ProgramStateRef state = (*it)->getState(); SVal V = state->getLValue(A->getType(), state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); assert(A->isGLValue()); Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), nullptr, ProgramPoint::PostLValueKind); } } /// VisitMemberExpr - Transfer function for member expressions. void ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst) { // FIXME: Prechecks eventually go in ::Visit(). ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, M, *this); ExplodedNodeSet EvalSet; ValueDecl *Member = M->getMemberDecl(); // Handle static member variables and enum constants accessed via // member syntax. if (isa(Member) || isa(Member)) { ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { VisitCommonDeclRefExpr(M, Member, Pred, EvalSet); } } else { StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); ExplodedNodeSet Tmp; for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef state = (*I)->getState(); const LocationContext *LCtx = (*I)->getLocationContext(); Expr *BaseExpr = M->getBase(); // Handle C++ method calls. if (const CXXMethodDecl *MD = dyn_cast(Member)) { if (MD->isInstance()) state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal MDVal = svalBuilder.getFunctionPointer(MD); state = state->BindExpr(M, LCtx, MDVal); Bldr.generateNode(M, *I, state); continue; } // Handle regular struct fields / member variables. state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal baseExprVal = state->getSVal(BaseExpr, LCtx); FieldDecl *field = cast(Member); SVal L = state->getLValue(field, baseExprVal); if (M->isGLValue() || M->getType()->isArrayType()) { // We special-case rvalues of array type because the analyzer cannot // reason about them, since we expect all regions to be wrapped in Locs. // We instead treat these as lvalues and assume that they will decay to // pointers as soon as they are used. if (!M->isGLValue()) { assert(M->getType()->isArrayType()); const ImplicitCastExpr *PE = dyn_cast((*I)->getParentMap().getParent(M)); if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) { llvm_unreachable("should always be wrapped in ArrayToPointerDecay"); } } if (field->getType()->isReferenceType()) { if (const MemRegion *R = L.getAsRegion()) L = state->getSVal(R); else L = UnknownVal(); } Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), nullptr, ProgramPoint::PostLValueKind); } else { Bldr.takeNodes(*I); evalLoad(Tmp, M, M, *I, state, L); Bldr.addNodes(Tmp); } } } getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, M, *this); } namespace { class CollectReachableSymbolsCallback : public SymbolVisitor { InvalidatedSymbols Symbols; public: CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) override { Symbols.insert(Sym); return true; } }; } // end anonymous namespace // A value escapes in three possible cases: // (1) We are binding to something that is not a memory region. // (2) We are binding to a MemrRegion that does not have stack storage. // (3) We are binding to a MemRegion with stack storage that the store // does not understand. ProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) { // Are we storing to something that causes the value to "escape"? bool escapes = true; // TODO: Move to StoreManager. if (Optional regionLoc = Loc.getAs()) { escapes = !regionLoc->getRegion()->hasStackStorage(); if (!escapes) { // To test (3), generate a new state with the binding added. If it is // the same state, then it escapes (since the store cannot represent // the binding). // Do this only if we know that the store is not supposed to generate the // same state. SVal StoredVal = State->getSVal(regionLoc->getRegion()); if (StoredVal != Val) escapes = (State == (State->bindLoc(*regionLoc, Val))); } } // If our store can represent the binding and we aren't storing to something // that doesn't have local storage then just return and have the simulation // state continue as is. if (!escapes) return State; // Otherwise, find all symbols referenced by 'val' that we are tracking // and stop tracking them. CollectReachableSymbolsCallback Scanner = State->scanReachableSymbols(Val); const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols(); State = getCheckerManager().runCheckersForPointerEscape(State, EscapedSymbols, /*CallEvent*/ nullptr, PSK_EscapeOnBind, nullptr); return State; } ProgramStateRef ExprEngine::notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef ExplicitRegions, ArrayRef Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) { if (!Invalidated || Invalidated->empty()) return State; if (!Call) return getCheckerManager().runCheckersForPointerEscape(State, *Invalidated, nullptr, PSK_EscapeOther, &ITraits); // If the symbols were invalidated by a call, we want to find out which ones // were invalidated directly due to being arguments to the call. InvalidatedSymbols SymbolsDirectlyInvalidated; for (ArrayRef::iterator I = ExplicitRegions.begin(), E = ExplicitRegions.end(); I != E; ++I) { if (const SymbolicRegion *R = (*I)->StripCasts()->getAs()) SymbolsDirectlyInvalidated.insert(R->getSymbol()); } InvalidatedSymbols SymbolsIndirectlyInvalidated; for (InvalidatedSymbols::const_iterator I=Invalidated->begin(), E = Invalidated->end(); I!=E; ++I) { SymbolRef sym = *I; if (SymbolsDirectlyInvalidated.count(sym)) continue; SymbolsIndirectlyInvalidated.insert(sym); } if (!SymbolsDirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsDirectlyInvalidated, Call, PSK_DirectEscapeOnCall, &ITraits); // Notify about the symbols that get indirectly invalidated by the call. if (!SymbolsIndirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsIndirectlyInvalidated, Call, PSK_IndirectEscapeOnCall, &ITraits); return State; } /// evalBind - Handle the semantics of binding a value to a specific location. /// This method is used by evalStore and (soon) VisitDeclStmt, and others. void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit, const ProgramPoint *PP) { const LocationContext *LC = Pred->getLocationContext(); PostStmt PS(StoreE, LC); if (!PP) PP = &PS; // Do a previsit of the bind. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, StoreE, *this, *PP); StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx); // If the location is not a 'Loc', it will already be handled by // the checkers. There is nothing left to do. if (!location.getAs()) { const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/nullptr, /*tag*/nullptr); ProgramStateRef state = Pred->getState(); state = processPointerEscapedOnBind(state, location, Val); Bldr.generateNode(L, state, Pred); return; } for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I!=E; ++I) { ExplodedNode *PredI = *I; ProgramStateRef state = PredI->getState(); state = processPointerEscapedOnBind(state, location, Val); // When binding the value, pass on the hint that this is a initialization. // For initializations, we do not need to inform clients of region // changes. state = state->bindLoc(location.castAs(), Val, /* notifyChanges = */ !atDeclInit); const MemRegion *LocReg = nullptr; if (Optional LocRegVal = location.getAs()) { LocReg = LocRegVal->getRegion(); } const ProgramPoint L = PostStore(StoreE, LC, LocReg, nullptr); Bldr.generateNode(L, state, PredI); } } /// evalStore - Handle the semantics of a store via an assignment. /// @@param Dst The node set to store generated state nodes /// @@param AssignE The assignment expression if the store happens in an /// assignment. /// @@param LocationE The location expression that is stored to. /// @@param state The current simulation state /// @@param location The location to store the value /// @@param Val The value to be stored void ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *LocationE, ExplodedNode *Pred, ProgramStateRef state, SVal location, SVal Val, const ProgramPointTag *tag) { // Proceed with the store. We use AssignE as the anchor for the PostStore // ProgramPoint if it is non-NULL, and LocationE otherwise. const Expr *StoreE = AssignE ? AssignE : LocationE; // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); if (Tmp.empty()) return; if (location.isUndef()) return; for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) evalBind(Dst, StoreE, *NI, location, Val, false); } void ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(!location.getAs() && "location cannot be a NonLoc."); // Are we loading from a region? This actually results in two loads; one // to fetch the address of the referenced value and one to fetch the // referenced value. if (const TypedValueRegion *TR = dyn_cast_or_null(location.getAsRegion())) { QualType ValTy = TR->getValueType(); if (const ReferenceType *RT = ValTy->getAs()) { static SimpleProgramPointTag loadReferenceTag(TagProviderName, "Load Reference"); ExplodedNodeSet Tmp; evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, location, &loadReferenceTag, getContext().getPointerType(RT->getPointeeType())); // Perform the load from the referenced value. for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { state = (*I)->getState(); location = state->getSVal(BoundEx, (*I)->getLocationContext()); evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); } return; } } evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); } void ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(NodeEx); assert(BoundEx); // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); if (Tmp.empty()) return; StmtNodeBuilder Bldr(Tmp, Dst, *currBldrCtx); if (location.isUndef()) return; // Proceed with the load. for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { state = (*NI)->getState(); const LocationContext *LCtx = (*NI)->getLocationContext(); SVal V = UnknownVal(); if (location.isValid()) { if (LoadTy.isNull()) LoadTy = BoundEx->getType(); V = state->getSVal(location.castAs(), LoadTy); } Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag, ProgramPoint::PostLoadKind); } } void ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *NodeEx, const Stmt *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, bool isLoad) { StmtNodeBuilder BldrTop(Pred, Dst, *currBldrCtx); // Early checks for performance reason. if (location.isUnknown()) { return; } ExplodedNodeSet Src; BldrTop.takeNodes(Pred); StmtNodeBuilder Bldr(Pred, Src, *currBldrCtx); if (Pred->getState() != state) { // Associate this new state with an ExplodedNode. // FIXME: If I pass null tag, the graph is incorrect, e.g for // int *p; // p = 0; // *p = 0xDEADBEEF; // "p = 0" is not noted as "Null pointer value stored to 'p'" but // instead "int *p" is noted as // "Variable 'p' initialized to a null pointer value" static SimpleProgramPointTag tag(TagProviderName, "Location"); Bldr.generateNode(NodeEx, Pred, state, &tag); } ExplodedNodeSet Tmp; getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, NodeEx, BoundEx, *this); BldrTop.addNodes(Tmp); } std::pair ExprEngine::geteagerlyAssumeBinOpBifurcationTags() { static SimpleProgramPointTag eagerlyAssumeBinOpBifurcationTrue(TagProviderName, "Eagerly Assume True"), eagerlyAssumeBinOpBifurcationFalse(TagProviderName, "Eagerly Assume False"); return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue, &eagerlyAssumeBinOpBifurcationFalse); } void ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex) { StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { ExplodedNode *Pred = *I; // Test if the previous node was as the same expression. This can happen // when the expression fails to evaluate to anything meaningful and // (as an optimization) we don't generate a node. ProgramPoint P = Pred->getLocation(); if (!P.getAs() || P.castAs().getStmt() != Ex) { continue; } ProgramStateRef state = Pred->getState(); SVal V = state->getSVal(Ex, Pred->getLocationContext()); Optional SEV = V.getAs(); if (SEV && SEV->isExpression()) { const std::pair &tags = geteagerlyAssumeBinOpBifurcationTags(); ProgramStateRef StateTrue, StateFalse; std::tie(StateTrue, StateFalse) = state->assume(*SEV); // First assume that the condition is true. if (StateTrue) { SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateTrue, tags.first); } // Next, assume that the condition is false. if (StateFalse) { SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateFalse, tags.second); } } } } void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); // We have processed both the inputs and the outputs. All of the outputs // should evaluate to Locs. Nuke all of their values. // FIXME: Some day in the future it would be nice to allow a "plug-in" // which interprets the inline asm and stores proper results in the // outputs. ProgramStateRef state = Pred->getState(); for (const Expr *O : A->outputs()) { SVal X = state->getSVal(O, Pred->getLocationContext()); assert (!X.getAs()); // Should be an Lval, or unknown, undef. if (Optional LV = X.getAs()) state = state->bindLoc(*LV, UnknownVal()); } Bldr.generateNode(A, Pred, state); } void ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(A, Pred, Pred->getState()); } //===----------------------------------------------------------------------===// // Visualization. //===----------------------------------------------------------------------===// #ifndef NDEBUG static ExprEngine* GraphPrintCheckerState; static SourceManager* GraphPrintSourceManager; namespace llvm { template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} // FIXME: Since we do not cache error nodes in ExprEngine now, this does not // work. static std::string getNodeAttributes(const ExplodedNode *N, void*) { #if 0 // FIXME: Replace with a general scheme to tell if the node is // an error node. if (GraphPrintCheckerState->isImplicitNullDeref(N) || GraphPrintCheckerState->isExplicitNullDeref(N) || GraphPrintCheckerState->isUndefDeref(N) || GraphPrintCheckerState->isUndefStore(N) || GraphPrintCheckerState->isUndefControlFlow(N) || GraphPrintCheckerState->isUndefResult(N) || GraphPrintCheckerState->isBadCall(N) || GraphPrintCheckerState->isUndefArg(N)) return "color=\"red\",style=\"filled\""; if (GraphPrintCheckerState->isNoReturnCall(N)) return "color=\"blue\",style=\"filled\""; #endif return ""; } static void printLocation(raw_ostream &Out, SourceLocation SLoc) { if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) << "\\l"; } } static std::string getNodeLabel(const ExplodedNode *N, void*){ std::string sbuf; llvm::raw_string_ostream Out(sbuf); // Program Location. ProgramPoint Loc = N->getLocation(); switch (Loc.getKind()) { case ProgramPoint::BlockEntranceKind: { Out << "Block Entrance: B" << Loc.castAs().getBlock()->getBlockID(); if (const NamedDecl *ND = dyn_cast(Loc.getLocationContext()->getDecl())) { Out << " ("; ND->printName(Out); Out << ")"; } break; } case ProgramPoint::BlockExitKind: assert (false); break; case ProgramPoint::CallEnterKind: Out << "CallEnter"; break; case ProgramPoint::CallExitBeginKind: Out << "CallExitBegin"; break; case ProgramPoint::CallExitEndKind: Out << "CallExitEnd"; break; case ProgramPoint::PostStmtPurgeDeadSymbolsKind: Out << "PostStmtPurgeDeadSymbols"; break; case ProgramPoint::PreStmtPurgeDeadSymbolsKind: Out << "PreStmtPurgeDeadSymbols"; break; case ProgramPoint::EpsilonKind: Out << "Epsilon Point"; break; case ProgramPoint::PreImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PreCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PostCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostInitializerKind: { Out << "PostInitializer: "; const CXXCtorInitializer *Init = Loc.castAs().getInitializer(); if (const FieldDecl *FD = Init->getAnyMember()) Out << *FD; else { QualType Ty = Init->getTypeSourceInfo()->getType(); Ty = Ty.getLocalUnqualifiedType(); LangOptions LO; // FIXME. Ty.print(Out, LO); } break; } case ProgramPoint::BlockEdgeKind: { const BlockEdge &E = Loc.castAs(); Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" << E.getDst()->getBlockID() << ')'; if (const Stmt *T = E.getSrc()->getTerminator()) { SourceLocation SLoc = T->getLocStart(); Out << "\\|Terminator: "; LangOptions LO; // FIXME. E.getSrc()->printTerminator(Out, LO); if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); } if (isa(T)) { const Stmt *Label = E.getDst()->getLabel(); if (Label) { if (const CaseStmt *C = dyn_cast(Label)) { Out << "\\lcase "; LangOptions LO; // FIXME. if (C->getLHS()) C->getLHS()->printPretty(Out, nullptr, PrintingPolicy(LO)); if (const Stmt *RHS = C->getRHS()) { Out << " .. "; RHS->printPretty(Out, nullptr, PrintingPolicy(LO)); } Out << ":"; } else { assert (isa(Label)); Out << "\\ldefault:"; } } else Out << "\\l(implicit) default:"; } else if (isa(T)) { // FIXME } else { Out << "\\lCondition: "; if (*E.getSrc()->succ_begin() == E.getDst()) Out << "true"; else Out << "false"; } Out << "\\l"; } #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isUndefControlFlow(N)) { Out << "\\|Control-flow based on\\lUndefined value.\\l"; } #endif break; } default: { const Stmt *S = Loc.castAs().getStmt(); assert(S != nullptr && "Expecting non-null Stmt"); Out << S->getStmtClassName() << ' ' << (const void*) S << ' '; LangOptions LO; // FIXME. S->printPretty(Out, nullptr, PrintingPolicy(LO)); printLocation(Out, S->getLocStart()); if (Loc.getAs()) Out << "\\lPreStmt\\l;"; else if (Loc.getAs()) Out << "\\lPostLoad\\l;"; else if (Loc.getAs()) Out << "\\lPostStore\\l"; else if (Loc.getAs()) Out << "\\lPostLValue\\l"; #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isImplicitNullDeref(N)) Out << "\\|Implicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isExplicitNullDeref(N)) Out << "\\|Explicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isUndefDeref(N)) Out << "\\|Dereference of undefialied value.\\l"; else if (GraphPrintCheckerState->isUndefStore(N)) Out << "\\|Store to Undefined Loc."; else if (GraphPrintCheckerState->isUndefResult(N)) Out << "\\|Result of operation is undefined."; else if (GraphPrintCheckerState->isNoReturnCall(N)) Out << "\\|Call to function marked \"noreturn\"."; else if (GraphPrintCheckerState->isBadCall(N)) Out << "\\|Call to NULL/Undefined."; else if (GraphPrintCheckerState->isUndefArg(N)) Out << "\\|Argument in call is undefined"; #endif break; } } ProgramStateRef state = N->getState(); Out << "\\|StateID: " << (const void*) state.get() << " NodeID: " << (const void*) N << "\\|"; state->printDOT(Out); Out << "\\l"; if (const ProgramPointTag *tag = Loc.getTag()) { Out << "\\|Tag: " << tag->getTagDescription(); Out << "\\l"; } return Out.str(); } }; } // end llvm namespace #endif #ifndef NDEBUG template ExplodedNode *GetGraphNode(ITERATOR I) { return *I; } template <> ExplodedNode* GetGraphNode::iterator> (llvm::DenseMap::iterator I) { return I->first; } #endif void ExprEngine::ViewGraph(bool trim) { #ifndef NDEBUG if (trim) { std::vector Src; // Flush any outstanding reports to make sure we cover all the nodes. // This does not cause them to get displayed. for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) const_cast(*I)->FlushReports(BR); // Iterate through the reports and get their nodes. for (BugReporter::EQClasses_iterator EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { ExplodedNode *N = const_cast(EI->begin()->getErrorNode()); if (N) Src.push_back(N); } ViewGraph(Src); } else { GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; } #endif } void ExprEngine::ViewGraph(ArrayRef Nodes) { #ifndef NDEBUG GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); std::unique_ptr TrimmedG(G.trim(Nodes)); if (!TrimmedG.get()) llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; else llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); GraphPrintCheckerState = nullptr; GraphPrintSourceManager = nullptr; #endif } @ 1.1.1.5.4.1 log @file ExprEngine.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:31 +0000 @ text @d1 2563 @ 1.1.1.5.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 2563 //=-- ExprEngine.cpp - Path-Sensitive Expression-Level Dataflow ---*- C++ -*-= // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines a meta-engine for path-sensitive dataflow analysis that // is built on GREngine, but provides the boilerplate to execute transfer // functions and build the ExplodedGraph at the expression level. // //===----------------------------------------------------------------------===// #define DEBUG_TYPE "ExprEngine" #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" #include "PrettyStackTraceLocationContext.h" #include "clang/AST/CharUnits.h" #include "clang/AST/ParentMap.h" #include "clang/AST/StmtCXX.h" #include "clang/AST/StmtObjC.h" #include "clang/Basic/Builtins.h" #include "clang/Basic/PrettyStackTrace.h" #include "clang/Basic/SourceManager.h" #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" #include "clang/StaticAnalyzer/Core/CheckerManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" #include "llvm/ADT/ImmutableList.h" #include "llvm/ADT/Statistic.h" #include "llvm/Support/raw_ostream.h" #ifndef NDEBUG #include "llvm/Support/GraphWriter.h" #endif using namespace clang; using namespace ento; using llvm::APSInt; STATISTIC(NumRemoveDeadBindings, "The # of times RemoveDeadBindings is called"); STATISTIC(NumMaxBlockCountReached, "The # of aborted paths due to reaching the maximum block count in " "a top level function"); STATISTIC(NumMaxBlockCountReachedInInlined, "The # of aborted paths due to reaching the maximum block count in " "an inlined function"); STATISTIC(NumTimesRetriedWithoutInlining, "The # of times we re-evaluated a call without inlining"); //===----------------------------------------------------------------------===// // Engine construction and deletion. //===----------------------------------------------------------------------===// static const char* TagProviderName = "ExprEngine"; ExprEngine::ExprEngine(AnalysisManager &mgr, bool gcEnabled, SetOfConstDecls *VisitedCalleesIn, FunctionSummariesTy *FS, InliningModes HowToInlineIn) : AMgr(mgr), AnalysisDeclContexts(mgr.getAnalysisDeclContextManager()), Engine(*this, FS), G(Engine.getGraph()), StateMgr(getContext(), mgr.getStoreManagerCreator(), mgr.getConstraintManagerCreator(), G.getAllocator(), this), SymMgr(StateMgr.getSymbolManager()), svalBuilder(StateMgr.getSValBuilder()), currStmtIdx(0), currBldrCtx(0), ObjCNoRet(mgr.getASTContext()), ObjCGCEnabled(gcEnabled), BR(mgr, *this), VisitedCallees(VisitedCalleesIn), HowToInline(HowToInlineIn) { unsigned TrimInterval = mgr.options.getGraphTrimInterval(); if (TrimInterval != 0) { // Enable eager node reclaimation when constructing the ExplodedGraph. G.enableNodeReclamation(TrimInterval); } } ExprEngine::~ExprEngine() { BR.FlushReports(); } //===----------------------------------------------------------------------===// // Utility methods. //===----------------------------------------------------------------------===// ProgramStateRef ExprEngine::getInitialState(const LocationContext *InitLoc) { ProgramStateRef state = StateMgr.getInitialState(InitLoc); const Decl *D = InitLoc->getDecl(); // Preconditions. // FIXME: It would be nice if we had a more general mechanism to add // such preconditions. Some day. do { if (const FunctionDecl *FD = dyn_cast(D)) { // Precondition: the first argument of 'main' is an integer guaranteed // to be > 0. const IdentifierInfo *II = FD->getIdentifier(); if (!II || !(II->getName() == "main" && FD->getNumParams() > 0)) break; const ParmVarDecl *PD = FD->getParamDecl(0); QualType T = PD->getType(); const BuiltinType *BT = dyn_cast(T); if (!BT || !BT->isInteger()) break; const MemRegion *R = state->getRegion(PD, InitLoc); if (!R) break; SVal V = state->getSVal(loc::MemRegionVal(R)); SVal Constraint_untested = evalBinOp(state, BO_GT, V, svalBuilder.makeZeroVal(T), svalBuilder.getConditionType()); Optional Constraint = Constraint_untested.getAs(); if (!Constraint) break; if (ProgramStateRef newState = state->assume(*Constraint, true)) state = newState; } break; } while (0); if (const ObjCMethodDecl *MD = dyn_cast(D)) { // Precondition: 'self' is always non-null upon entry to an Objective-C // method. const ImplicitParamDecl *SelfD = MD->getSelfDecl(); const MemRegion *R = state->getRegion(SelfD, InitLoc); SVal V = state->getSVal(loc::MemRegionVal(R)); if (Optional LV = V.getAs()) { // Assume that the pointer value in 'self' is non-null. state = state->assume(*LV, true); assert(state && "'self' cannot be null"); } } if (const CXXMethodDecl *MD = dyn_cast(D)) { if (!MD->isStatic()) { // Precondition: 'this' is always non-null upon entry to the // top-level function. This is our starting assumption for // analyzing an "open" program. const StackFrameContext *SFC = InitLoc->getCurrentStackFrame(); if (SFC->getParent() == 0) { loc::MemRegionVal L = svalBuilder.getCXXThis(MD, SFC); SVal V = state->getSVal(L); if (Optional LV = V.getAs()) { state = state->assume(*LV, true); assert(state && "'this' cannot be null"); } } } } return state; } ProgramStateRef ExprEngine::createTemporaryRegionIfNeeded(ProgramStateRef State, const LocationContext *LC, const Expr *Ex, const Expr *Result) { SVal V = State->getSVal(Ex, LC); if (!Result) { // If we don't have an explicit result expression, we're in "if needed" // mode. Only create a region if the current value is a NonLoc. if (!V.getAs()) return State; Result = Ex; } else { // We need to create a region no matter what. For sanity, make sure we don't // try to stuff a Loc into a non-pointer temporary region. assert(!V.getAs() || Loc::isLocType(Result->getType()) || Result->getType()->isMemberPointerType()); } ProgramStateManager &StateMgr = State->getStateManager(); MemRegionManager &MRMgr = StateMgr.getRegionManager(); StoreManager &StoreMgr = StateMgr.getStoreManager(); // We need to be careful about treating a derived type's value as // bindings for a base type. Unless we're creating a temporary pointer region, // start by stripping and recording base casts. SmallVector Casts; const Expr *Inner = Ex->IgnoreParens(); if (!Loc::isLocType(Result->getType())) { while (const CastExpr *CE = dyn_cast(Inner)) { if (CE->getCastKind() == CK_DerivedToBase || CE->getCastKind() == CK_UncheckedDerivedToBase) Casts.push_back(CE); else if (CE->getCastKind() != CK_NoOp) break; Inner = CE->getSubExpr()->IgnoreParens(); } } // Create a temporary object region for the inner expression (which may have // a more derived type) and bind the value into it. const TypedValueRegion *TR = NULL; if (const MaterializeTemporaryExpr *MT = dyn_cast(Result)) { StorageDuration SD = MT->getStorageDuration(); // If this object is bound to a reference with static storage duration, we // put it in a different region to prevent "address leakage" warnings. if (SD == SD_Static || SD == SD_Thread) TR = MRMgr.getCXXStaticTempObjectRegion(Inner); } if (!TR) TR = MRMgr.getCXXTempObjectRegion(Inner, LC); SVal Reg = loc::MemRegionVal(TR); if (V.isUnknown()) V = getSValBuilder().conjureSymbolVal(Result, LC, TR->getValueType(), currBldrCtx->blockCount()); State = State->bindLoc(Reg, V); // Re-apply the casts (from innermost to outermost) for type sanity. for (SmallVectorImpl::reverse_iterator I = Casts.rbegin(), E = Casts.rend(); I != E; ++I) { Reg = StoreMgr.evalDerivedToBase(Reg, *I); } State = State->BindExpr(Result, LC, Reg); return State; } //===----------------------------------------------------------------------===// // Top-level transfer function logic (Dispatcher). //===----------------------------------------------------------------------===// /// evalAssume - Called by ConstraintManager. Used to call checker-specific /// logic for handling assumptions on symbolic values. ProgramStateRef ExprEngine::processAssume(ProgramStateRef state, SVal cond, bool assumption) { return getCheckerManager().runCheckersForEvalAssume(state, cond, assumption); } bool ExprEngine::wantsRegionChangeUpdate(ProgramStateRef state) { return getCheckerManager().wantsRegionChangeUpdate(state); } ProgramStateRef ExprEngine::processRegionChanges(ProgramStateRef state, const InvalidatedSymbols *invalidated, ArrayRef Explicits, ArrayRef Regions, const CallEvent *Call) { return getCheckerManager().runCheckersForRegionChanges(state, invalidated, Explicits, Regions, Call); } void ExprEngine::printState(raw_ostream &Out, ProgramStateRef State, const char *NL, const char *Sep) { getCheckerManager().runCheckersForPrintState(Out, State, NL, Sep); } void ExprEngine::processEndWorklist(bool hasWorkRemaining) { getCheckerManager().runCheckersForEndAnalysis(G, BR, *this); } void ExprEngine::processCFGElement(const CFGElement E, ExplodedNode *Pred, unsigned StmtIdx, NodeBuilderContext *Ctx) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currStmtIdx = StmtIdx; currBldrCtx = Ctx; switch (E.getKind()) { case CFGElement::Statement: ProcessStmt(const_cast(E.castAs().getStmt()), Pred); return; case CFGElement::Initializer: ProcessInitializer(E.castAs().getInitializer(), Pred); return; case CFGElement::NewAllocator: ProcessNewAllocator(E.castAs().getAllocatorExpr(), Pred); return; case CFGElement::AutomaticObjectDtor: case CFGElement::DeleteDtor: case CFGElement::BaseDtor: case CFGElement::MemberDtor: case CFGElement::TemporaryDtor: ProcessImplicitDtor(E.castAs(), Pred); return; } } static bool shouldRemoveDeadBindings(AnalysisManager &AMgr, const CFGStmt S, const ExplodedNode *Pred, const LocationContext *LC) { // Are we never purging state values? if (AMgr.options.AnalysisPurgeOpt == PurgeNone) return false; // Is this the beginning of a basic block? if (Pred->getLocation().getAs()) return true; // Is this on a non-expression? if (!isa(S.getStmt())) return true; // Run before processing a call. if (CallEvent::isCallStmt(S.getStmt())) return true; // Is this an expression that is consumed by another expression? If so, // postpone cleaning out the state. ParentMap &PM = LC->getAnalysisDeclContext()->getParentMap(); return !PM.isConsumedExpr(cast(S.getStmt())); } void ExprEngine::removeDead(ExplodedNode *Pred, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt, ProgramPoint::Kind K) { assert((K == ProgramPoint::PreStmtPurgeDeadSymbolsKind || ReferenceStmt == 0 || isa(ReferenceStmt)) && "PostStmt is not generally supported by the SymbolReaper yet"); assert(LC && "Must pass the current (or expiring) LocationContext"); if (!DiagnosticStmt) { DiagnosticStmt = ReferenceStmt; assert(DiagnosticStmt && "Required for clearing a LocationContext"); } NumRemoveDeadBindings++; ProgramStateRef CleanedState = Pred->getState(); // LC is the location context being destroyed, but SymbolReaper wants a // location context that is still live. (If this is the top-level stack // frame, this will be null.) if (!ReferenceStmt) { assert(K == ProgramPoint::PostStmtPurgeDeadSymbolsKind && "Use PostStmtPurgeDeadSymbolsKind for clearing a LocationContext"); LC = LC->getParent(); } const StackFrameContext *SFC = LC ? LC->getCurrentStackFrame() : 0; SymbolReaper SymReaper(SFC, ReferenceStmt, SymMgr, getStoreManager()); getCheckerManager().runCheckersForLiveSymbols(CleanedState, SymReaper); // Create a state in which dead bindings are removed from the environment // and the store. TODO: The function should just return new env and store, // not a new state. CleanedState = StateMgr.removeDeadBindings(CleanedState, SFC, SymReaper); // Process any special transfer function for dead symbols. // A tag to track convenience transitions, which can be removed at cleanup. static SimpleProgramPointTag cleanupTag(TagProviderName, "Clean Node"); if (!SymReaper.hasDeadSymbols()) { // Generate a CleanedNode that has the environment and store cleaned // up. Since no symbols are dead, we can optimize and not clean out // the constraint manager. StmtNodeBuilder Bldr(Pred, Out, *currBldrCtx); Bldr.generateNode(DiagnosticStmt, Pred, CleanedState, &cleanupTag, K); } else { // Call checkers with the non-cleaned state so that they could query the // values of the soon to be dead symbols. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForDeadSymbols(CheckedSet, Pred, SymReaper, DiagnosticStmt, *this, K); // For each node in CheckedSet, generate CleanedNodes that have the // environment, the store, and the constraints cleaned up but have the // user-supplied states as the predecessors. StmtNodeBuilder Bldr(CheckedSet, Out, *currBldrCtx); for (ExplodedNodeSet::const_iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef CheckerState = (*I)->getState(); // The constraint manager has not been cleaned up yet, so clean up now. CheckerState = getConstraintManager().removeDeadBindings(CheckerState, SymReaper); assert(StateMgr.haveEqualEnvironments(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Environment as a part of " "checkDeadSymbols processing."); assert(StateMgr.haveEqualStores(CheckerState, Pred->getState()) && "Checkers are not allowed to modify the Store as a part of " "checkDeadSymbols processing."); // Create a state based on CleanedState with CheckerState GDM and // generate a transition to that state. ProgramStateRef CleanedCheckerSt = StateMgr.getPersistentStateWithGDM(CleanedState, CheckerState); Bldr.generateNode(DiagnosticStmt, *I, CleanedCheckerSt, &cleanupTag, K); } } } void ExprEngine::ProcessStmt(const CFGStmt S, ExplodedNode *Pred) { // Reclaim any unnecessary nodes in the ExplodedGraph. G.reclaimRecentlyAllocatedNodes(); const Stmt *currStmt = S.getStmt(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), currStmt->getLocStart(), "Error evaluating statement"); // Remove dead bindings and symbols. ExplodedNodeSet CleanedStates; if (shouldRemoveDeadBindings(AMgr, S, Pred, Pred->getLocationContext())){ removeDead(Pred, CleanedStates, currStmt, Pred->getLocationContext()); } else CleanedStates.Add(Pred); // Visit the statement. ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CleanedStates.begin(), E = CleanedStates.end(); I != E; ++I) { ExplodedNodeSet DstI; // Visit the statement. Visit(currStmt, *I, DstI); Dst.insert(DstI); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessInitializer(const CFGInitializer Init, ExplodedNode *Pred) { const CXXCtorInitializer *BMI = Init.getInitializer(); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), BMI->getSourceLocation(), "Error evaluating initializer"); // We don't clean up dead bindings here. const StackFrameContext *stackFrame = cast(Pred->getLocationContext()); const CXXConstructorDecl *decl = cast(stackFrame->getDecl()); ProgramStateRef State = Pred->getState(); SVal thisVal = State->getSVal(svalBuilder.getCXXThis(decl, stackFrame)); ExplodedNodeSet Tmp(Pred); SVal FieldLoc; // Evaluate the initializer, if necessary if (BMI->isAnyMemberInitializer()) { // Constructors build the object directly in the field, // but non-objects must be copied in from the initializer. const Expr *Init = BMI->getInit()->IgnoreImplicit(); if (!isa(Init)) { const ValueDecl *Field; if (BMI->isIndirectMemberInitializer()) { Field = BMI->getIndirectMember(); FieldLoc = State->getLValue(BMI->getIndirectMember(), thisVal); } else { Field = BMI->getMember(); FieldLoc = State->getLValue(BMI->getMember(), thisVal); } SVal InitVal; if (BMI->getNumArrayIndices() > 0) { // Handle arrays of trivial type. We can represent this with a // primitive load/copy from the base array region. const ArraySubscriptExpr *ASE; while ((ASE = dyn_cast(Init))) Init = ASE->getBase()->IgnoreImplicit(); SVal LValue = State->getSVal(Init, stackFrame); if (Optional LValueLoc = LValue.getAs()) InitVal = State->getSVal(*LValueLoc); // If we fail to get the value for some reason, use a symbolic value. if (InitVal.isUnknownOrUndef()) { SValBuilder &SVB = getSValBuilder(); InitVal = SVB.conjureSymbolVal(BMI->getInit(), stackFrame, Field->getType(), currBldrCtx->blockCount()); } } else { InitVal = State->getSVal(BMI->getInit(), stackFrame); } assert(Tmp.size() == 1 && "have not generated any new nodes yet"); assert(*Tmp.begin() == Pred && "have not generated any new nodes yet"); Tmp.clear(); PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); evalBind(Tmp, Init, Pred, FieldLoc, InitVal, /*isInit=*/true, &PP); } } else { assert(BMI->isBaseInitializer() || BMI->isDelegatingInitializer()); // We already did all the work when visiting the CXXConstructExpr. } // Construct PostInitializer nodes whether the state changed or not, // so that the diagnostics don't get confused. PostInitializer PP(BMI, FieldLoc.getAsRegion(), stackFrame); ExplodedNodeSet Dst; NodeBuilder Bldr(Tmp, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; ++I) { ExplodedNode *N = *I; Bldr.generateNode(PP, N->getState(), N); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred) { ExplodedNodeSet Dst; switch (D.getKind()) { case CFGElement::AutomaticObjectDtor: ProcessAutomaticObjDtor(D.castAs(), Pred, Dst); break; case CFGElement::BaseDtor: ProcessBaseDtor(D.castAs(), Pred, Dst); break; case CFGElement::MemberDtor: ProcessMemberDtor(D.castAs(), Pred, Dst); break; case CFGElement::TemporaryDtor: ProcessTemporaryDtor(D.castAs(), Pred, Dst); break; case CFGElement::DeleteDtor: ProcessDeleteDtor(D.castAs(), Pred, Dst); break; default: llvm_unreachable("Unexpected dtor kind."); } // Enqueue the new nodes onto the work list. Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred) { ExplodedNodeSet Dst; AnalysisManager &AMgr = getAnalysisManager(); AnalyzerOptions &Opts = AMgr.options; // TODO: We're not evaluating allocators for all cases just yet as // we're not handling the return value correctly, which causes false // positives when the alpha.cplusplus.NewDeleteLeaks check is on. if (Opts.mayInlineCXXAllocator()) VisitCXXNewAllocatorCall(NE, Pred, Dst); else { NodeBuilder Bldr(Pred, Dst, *currBldrCtx); const LocationContext *LCtx = Pred->getLocationContext(); PostImplicitCall PP(NE->getOperatorNew(), NE->getLocStart(), LCtx); Bldr.generateNode(PP, Pred->getState(), Pred); } Engine.enqueue(Dst, currBldrCtx->getBlock(), currStmtIdx); } void ExprEngine::ProcessAutomaticObjDtor(const CFGAutomaticObjDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const VarDecl *varDecl = Dtor.getVarDecl(); QualType varType = varDecl->getType(); ProgramStateRef state = Pred->getState(); SVal dest = state->getLValue(varDecl, Pred->getLocationContext()); const MemRegion *Region = dest.castAs().getRegion(); if (const ReferenceType *refType = varType->getAs()) { varType = refType->getPointeeType(); Region = state->getSVal(Region).getAsRegion(); } VisitCXXDestructor(varType, Region, Dtor.getTriggerStmt(), /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessDeleteDtor(const CFGDeleteDtor Dtor, ExplodedNode *Pred, ExplodedNodeSet &Dst) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDeleteExpr *DE = Dtor.getDeleteExpr(); const Stmt *Arg = DE->getArgument(); SVal ArgVal = State->getSVal(Arg, LCtx); // If the argument to delete is known to be a null value, // don't run destructor. if (State->isNull(ArgVal).isConstrainedTrue()) { QualType DTy = DE->getDestroyedType(); QualType BTy = getContext().getBaseElementType(DTy); const CXXRecordDecl *RD = BTy->getAsCXXRecordDecl(); const CXXDestructorDecl *Dtor = RD->getDestructor(); PostImplicitCall PP(Dtor, DE->getLocStart(), LCtx); NodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(PP, Pred->getState(), Pred); return; } VisitCXXDestructor(DE->getDestroyedType(), ArgVal.getAsRegion(), DE, /*IsBase=*/ false, Pred, Dst); } void ExprEngine::ProcessBaseDtor(const CFGBaseDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const LocationContext *LCtx = Pred->getLocationContext(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisPtr = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal ThisVal = Pred->getState()->getSVal(ThisPtr); // Create the base object region. const CXXBaseSpecifier *Base = D.getBaseSpecifier(); QualType BaseTy = Base->getType(); SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy, Base->isVirtual()); VisitCXXDestructor(BaseTy, BaseVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/ true, Pred, Dst); } void ExprEngine::ProcessMemberDtor(const CFGMemberDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { const FieldDecl *Member = D.getFieldDecl(); ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); const CXXDestructorDecl *CurDtor = cast(LCtx->getDecl()); Loc ThisVal = getSValBuilder().getCXXThis(CurDtor, LCtx->getCurrentStackFrame()); SVal FieldVal = State->getLValue(Member, State->getSVal(ThisVal).castAs()); VisitCXXDestructor(Member->getType(), FieldVal.castAs().getRegion(), CurDtor->getBody(), /*IsBase=*/false, Pred, Dst); } void ExprEngine::ProcessTemporaryDtor(const CFGTemporaryDtor D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { QualType varType = D.getBindTemporaryExpr()->getSubExpr()->getType(); // FIXME: Inlining of temporary destructors is not supported yet anyway, so we // just put a NULL region for now. This will need to be changed later. VisitCXXDestructor(varType, NULL, D.getBindTemporaryExpr(), /*IsBase=*/ false, Pred, Dst); } void ExprEngine::Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &DstTop) { PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), S->getLocStart(), "Error evaluating statement"); ExplodedNodeSet Dst; StmtNodeBuilder Bldr(Pred, DstTop, *currBldrCtx); assert(!isa(S) || S == cast(S)->IgnoreParens()); switch (S->getStmtClass()) { // C++ and ARC stuff we don't support yet. case Expr::ObjCIndirectCopyRestoreExprClass: case Stmt::CXXDependentScopeMemberExprClass: case Stmt::CXXTryStmtClass: case Stmt::CXXTypeidExprClass: case Stmt::CXXUuidofExprClass: case Stmt::MSPropertyRefExprClass: case Stmt::CXXUnresolvedConstructExprClass: case Stmt::DependentScopeDeclRefExprClass: case Stmt::TypeTraitExprClass: case Stmt::ArrayTypeTraitExprClass: case Stmt::ExpressionTraitExprClass: case Stmt::UnresolvedLookupExprClass: case Stmt::UnresolvedMemberExprClass: case Stmt::CXXNoexceptExprClass: case Stmt::PackExpansionExprClass: case Stmt::SubstNonTypeTemplateParmPackExprClass: case Stmt::FunctionParmPackExprClass: case Stmt::SEHTryStmtClass: case Stmt::SEHExceptStmtClass: case Stmt::LambdaExprClass: case Stmt::SEHFinallyStmtClass: { const ExplodedNode *node = Bldr.generateSink(S, Pred, Pred->getState()); Engine.addAbortedBlock(node, currBldrCtx->getBlock()); break; } case Stmt::ParenExprClass: llvm_unreachable("ParenExprs already handled."); case Stmt::GenericSelectionExprClass: llvm_unreachable("GenericSelectionExprs already handled."); // Cases that should never be evaluated simply because they shouldn't // appear in the CFG. case Stmt::BreakStmtClass: case Stmt::CaseStmtClass: case Stmt::CompoundStmtClass: case Stmt::ContinueStmtClass: case Stmt::CXXForRangeStmtClass: case Stmt::DefaultStmtClass: case Stmt::DoStmtClass: case Stmt::ForStmtClass: case Stmt::GotoStmtClass: case Stmt::IfStmtClass: case Stmt::IndirectGotoStmtClass: case Stmt::LabelStmtClass: case Stmt::NoStmtClass: case Stmt::NullStmtClass: case Stmt::SwitchStmtClass: case Stmt::WhileStmtClass: case Expr::MSDependentExistsStmtClass: case Stmt::CapturedStmtClass: case Stmt::OMPParallelDirectiveClass: case Stmt::OMPSimdDirectiveClass: llvm_unreachable("Stmt should not be in analyzer evaluation loop"); case Stmt::ObjCSubscriptRefExprClass: case Stmt::ObjCPropertyRefExprClass: llvm_unreachable("These are handled by PseudoObjectExpr"); case Stmt::GNUNullExprClass: { // GNU __null is a pointer-width integer, not an actual pointer. ProgramStateRef state = Pred->getState(); state = state->BindExpr(S, Pred->getLocationContext(), svalBuilder.makeIntValWithPtrWidth(0, false)); Bldr.generateNode(S, Pred, state); break; } case Stmt::ObjCAtSynchronizedStmtClass: Bldr.takeNodes(Pred); VisitObjCAtSynchronizedStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ExprWithCleanupsClass: // Handled due to fully linearised CFG. break; // Cases not handled yet; but will handle some day. case Stmt::DesignatedInitExprClass: case Stmt::ExtVectorElementExprClass: case Stmt::ImaginaryLiteralClass: case Stmt::ObjCAtCatchStmtClass: case Stmt::ObjCAtFinallyStmtClass: case Stmt::ObjCAtTryStmtClass: case Stmt::ObjCAutoreleasePoolStmtClass: case Stmt::ObjCEncodeExprClass: case Stmt::ObjCIsaExprClass: case Stmt::ObjCProtocolExprClass: case Stmt::ObjCSelectorExprClass: case Stmt::ParenListExprClass: case Stmt::PredefinedExprClass: case Stmt::ShuffleVectorExprClass: case Stmt::ConvertVectorExprClass: case Stmt::VAArgExprClass: case Stmt::CUDAKernelCallExprClass: case Stmt::OpaqueValueExprClass: case Stmt::AsTypeExprClass: case Stmt::AtomicExprClass: // Fall through. // Cases we intentionally don't evaluate, since they don't need // to be explicitly evaluated. case Stmt::AddrLabelExprClass: case Stmt::AttributedStmtClass: case Stmt::IntegerLiteralClass: case Stmt::CharacterLiteralClass: case Stmt::ImplicitValueInitExprClass: case Stmt::CXXScalarValueInitExprClass: case Stmt::CXXBoolLiteralExprClass: case Stmt::ObjCBoolLiteralExprClass: case Stmt::FloatingLiteralClass: case Stmt::SizeOfPackExprClass: case Stmt::StringLiteralClass: case Stmt::ObjCStringLiteralClass: case Stmt::CXXBindTemporaryExprClass: case Stmt::CXXPseudoDestructorExprClass: case Stmt::SubstNonTypeTemplateParmExprClass: case Stmt::CXXNullPtrLiteralExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); getCheckerManager().runCheckersForPostStmt(Dst, preVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDefaultArgExprClass: case Stmt::CXXDefaultInitExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(PreVisit, Tmp, *currBldrCtx); const Expr *ArgE; if (const CXXDefaultArgExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else if (const CXXDefaultInitExpr *DefE = dyn_cast(S)) ArgE = DefE->getExpr(); else llvm_unreachable("unknown constant wrapper kind"); bool IsTemporary = false; if (const MaterializeTemporaryExpr *MTE = dyn_cast(ArgE)) { ArgE = MTE->GetTemporaryExpr(); IsTemporary = true; } Optional ConstantVal = svalBuilder.getConstantVal(ArgE); if (!ConstantVal) ConstantVal = UnknownVal(); const LocationContext *LCtx = Pred->getLocationContext(); for (ExplodedNodeSet::iterator I = PreVisit.begin(), E = PreVisit.end(); I != E; ++I) { ProgramStateRef State = (*I)->getState(); State = State->BindExpr(S, LCtx, *ConstantVal); if (IsTemporary) State = createTemporaryRegionIfNeeded(State, LCtx, cast(S), cast(S)); Bldr2.generateNode(S, *I, State); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } // Cases we evaluate as opaque expressions, conjuring a symbol. case Stmt::CXXStdInitializerListExprClass: case Expr::ObjCArrayLiteralClass: case Expr::ObjCDictionaryLiteralClass: case Expr::ObjCBoxedExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet preVisit; getCheckerManager().runCheckersForPreStmt(preVisit, Pred, S, *this); ExplodedNodeSet Tmp; StmtNodeBuilder Bldr2(preVisit, Tmp, *currBldrCtx); const Expr *Ex = cast(S); QualType resultType = Ex->getType(); for (ExplodedNodeSet::iterator it = preVisit.begin(), et = preVisit.end(); it != et; ++it) { ExplodedNode *N = *it; const LocationContext *LCtx = N->getLocationContext(); SVal result = svalBuilder.conjureSymbolVal(0, Ex, LCtx, resultType, currBldrCtx->blockCount()); ProgramStateRef state = N->getState()->BindExpr(Ex, LCtx, result); Bldr2.generateNode(S, N, state); } getCheckerManager().runCheckersForPostStmt(Dst, Tmp, S, *this); Bldr.addNodes(Dst); break; } case Stmt::ArraySubscriptExprClass: Bldr.takeNodes(Pred); VisitLvalArraySubscriptExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::GCCAsmStmtClass: Bldr.takeNodes(Pred); VisitGCCAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MSAsmStmtClass: Bldr.takeNodes(Pred); VisitMSAsmStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BlockExprClass: Bldr.takeNodes(Pred); VisitBlockExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryOperatorClass: { const BinaryOperator* B = cast(S); if (B->isLogicalOp()) { Bldr.takeNodes(Pred); VisitLogicalExpr(B, Pred, Dst); Bldr.addNodes(Dst); break; } else if (B->getOpcode() == BO_Comma) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), state->getSVal(B->getRHS(), Pred->getLocationContext()))); break; } Bldr.takeNodes(Pred); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (B->isRelationalOp() || B->isEqualityOp())) { ExplodedNodeSet Tmp; VisitBinaryOperator(cast(S), Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, cast(S)); } else VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXOperatorCallExprClass: { const CXXOperatorCallExpr *OCE = cast(S); // For instance method operators, make sure the 'this' argument has a // valid region. const Decl *Callee = OCE->getCalleeDecl(); if (const CXXMethodDecl *MD = dyn_cast_or_null(Callee)) { if (MD->isInstance()) { ProgramStateRef State = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); ProgramStateRef NewState = createTemporaryRegionIfNeeded(State, LCtx, OCE->getArg(0)); if (NewState != State) { Pred = Bldr.generateNode(OCE, Pred, NewState, /*Tag=*/0, ProgramPoint::PreStmtKind); // Did we cache out? if (!Pred) break; } } } // FALLTHROUGH } case Stmt::CallExprClass: case Stmt::CXXMemberCallExprClass: case Stmt::UserDefinedLiteralClass: { Bldr.takeNodes(Pred); VisitCallExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXCatchStmtClass: { Bldr.takeNodes(Pred); VisitCXXCatchStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXTemporaryObjectExprClass: case Stmt::CXXConstructExprClass: { Bldr.takeNodes(Pred); VisitCXXConstructExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXNewExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PostVisit; VisitCXXNewExpr(cast(S), Pred, PostVisit); getCheckerManager().runCheckersForPostStmt(Dst, PostVisit, S, *this); Bldr.addNodes(Dst); break; } case Stmt::CXXDeleteExprClass: { Bldr.takeNodes(Pred); ExplodedNodeSet PreVisit; const CXXDeleteExpr *CDE = cast(S); getCheckerManager().runCheckersForPreStmt(PreVisit, Pred, S, *this); for (ExplodedNodeSet::iterator i = PreVisit.begin(), e = PreVisit.end(); i != e ; ++i) VisitCXXDeleteExpr(CDE, *i, Dst); Bldr.addNodes(Dst); break; } // FIXME: ChooseExpr is really a constant. We need to fix // the CFG do not model them as explicit control-flow. case Stmt::ChooseExprClass: { // __builtin_choose_expr Bldr.takeNodes(Pred); const ChooseExpr *C = cast(S); VisitGuardedExpr(C, C->getLHS(), C->getRHS(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CompoundAssignOperatorClass: Bldr.takeNodes(Pred); VisitBinaryOperator(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::CompoundLiteralExprClass: Bldr.takeNodes(Pred); VisitCompoundLiteralExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::BinaryConditionalOperatorClass: case Stmt::ConditionalOperatorClass: { // '?' operator Bldr.takeNodes(Pred); const AbstractConditionalOperator *C = cast(S); VisitGuardedExpr(C, C->getTrueExpr(), C->getFalseExpr(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::CXXThisExprClass: Bldr.takeNodes(Pred); VisitCXXThisExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::DeclRefExprClass: { Bldr.takeNodes(Pred); const DeclRefExpr *DE = cast(S); VisitCommonDeclRefExpr(DE, DE->getDecl(), Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::DeclStmtClass: Bldr.takeNodes(Pred); VisitDeclStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ImplicitCastExprClass: case Stmt::CStyleCastExprClass: case Stmt::CXXStaticCastExprClass: case Stmt::CXXDynamicCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::ObjCBridgedCastExprClass: { Bldr.takeNodes(Pred); const CastExpr *C = cast(S); // Handle the previsit checks. ExplodedNodeSet dstPrevisit; getCheckerManager().runCheckersForPreStmt(dstPrevisit, Pred, C, *this); // Handle the expression itself. ExplodedNodeSet dstExpr; for (ExplodedNodeSet::iterator i = dstPrevisit.begin(), e = dstPrevisit.end(); i != e ; ++i) { VisitCast(C, C->getSubExpr(), *i, dstExpr); } // Handle the postvisit checks. getCheckerManager().runCheckersForPostStmt(Dst, dstExpr, C, *this); Bldr.addNodes(Dst); break; } case Expr::MaterializeTemporaryExprClass: { Bldr.takeNodes(Pred); const MaterializeTemporaryExpr *MTE = cast(S); CreateCXXTemporaryObject(MTE, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::InitListExprClass: Bldr.takeNodes(Pred); VisitInitListExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::MemberExprClass: Bldr.takeNodes(Pred); VisitMemberExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCIvarRefExprClass: Bldr.takeNodes(Pred); VisitLvalObjCIvarRefExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCForCollectionStmtClass: Bldr.takeNodes(Pred); VisitObjCForCollectionStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCMessageExprClass: Bldr.takeNodes(Pred); VisitObjCMessage(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::ObjCAtThrowStmtClass: case Stmt::CXXThrowExprClass: // FIXME: This is not complete. We basically treat @@throw as // an abort. Bldr.generateSink(S, Pred, Pred->getState()); break; case Stmt::ReturnStmtClass: Bldr.takeNodes(Pred); VisitReturnStmt(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::OffsetOfExprClass: Bldr.takeNodes(Pred); VisitOffsetOfExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::UnaryExprOrTypeTraitExprClass: Bldr.takeNodes(Pred); VisitUnaryExprOrTypeTraitExpr(cast(S), Pred, Dst); Bldr.addNodes(Dst); break; case Stmt::StmtExprClass: { const StmtExpr *SE = cast(S); if (SE->getSubStmt()->body_empty()) { // Empty statement expression. assert(SE->getType() == getContext().VoidTy && "Empty statement expression must have void type."); break; } if (Expr *LastExpr = dyn_cast(*SE->getSubStmt()->body_rbegin())) { ProgramStateRef state = Pred->getState(); Bldr.generateNode(SE, Pred, state->BindExpr(SE, Pred->getLocationContext(), state->getSVal(LastExpr, Pred->getLocationContext()))); } break; } case Stmt::UnaryOperatorClass: { Bldr.takeNodes(Pred); const UnaryOperator *U = cast(S); if (AMgr.options.eagerlyAssumeBinOpBifurcation && (U->getOpcode() == UO_LNot)) { ExplodedNodeSet Tmp; VisitUnaryOperator(U, Pred, Tmp); evalEagerlyAssumeBinOpBifurcation(Dst, Tmp, U); } else VisitUnaryOperator(U, Pred, Dst); Bldr.addNodes(Dst); break; } case Stmt::PseudoObjectExprClass: { Bldr.takeNodes(Pred); ProgramStateRef state = Pred->getState(); const PseudoObjectExpr *PE = cast(S); if (const Expr *Result = PE->getResultExpr()) { SVal V = state->getSVal(Result, Pred->getLocationContext()); Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), V)); } else Bldr.generateNode(S, Pred, state->BindExpr(S, Pred->getLocationContext(), UnknownVal())); Bldr.addNodes(Dst); break; } } } bool ExprEngine::replayWithoutInlining(ExplodedNode *N, const LocationContext *CalleeLC) { const StackFrameContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const StackFrameContext *CallerSF = CalleeSF->getParent()->getCurrentStackFrame(); assert(CalleeSF && CallerSF); ExplodedNode *BeforeProcessingCall = 0; const Stmt *CE = CalleeSF->getCallSite(); // Find the first node before we started processing the call expression. while (N) { ProgramPoint L = N->getLocation(); BeforeProcessingCall = N; N = N->pred_empty() ? NULL : *(N->pred_begin()); // Skip the nodes corresponding to the inlined code. if (L.getLocationContext()->getCurrentStackFrame() != CallerSF) continue; // We reached the caller. Find the node right before we started // processing the call. if (L.isPurgeKind()) continue; if (L.getAs()) continue; if (L.getAs()) continue; if (Optional SP = L.getAs()) if (SP->getStmt() == CE) continue; break; } if (!BeforeProcessingCall) return false; // TODO: Clean up the unneeded nodes. // Build an Epsilon node from which we will restart the analyzes. // Note that CE is permitted to be NULL! ProgramPoint NewNodeLoc = EpsilonPoint(BeforeProcessingCall->getLocationContext(), CE); // Add the special flag to GDM to signal retrying with no inlining. // Note, changing the state ensures that we are not going to cache out. ProgramStateRef NewNodeState = BeforeProcessingCall->getState(); NewNodeState = NewNodeState->set(const_cast(CE)); // Make the new node a successor of BeforeProcessingCall. bool IsNew = false; ExplodedNode *NewNode = G.getNode(NewNodeLoc, NewNodeState, false, &IsNew); // We cached out at this point. Caching out is common due to us backtracking // from the inlined function, which might spawn several paths. if (!IsNew) return true; NewNode->addPredecessor(BeforeProcessingCall, G); // Add the new node to the work list. Engine.enqueueStmtNode(NewNode, CalleeSF->getCallSiteBlock(), CalleeSF->getIndex()); NumTimesRetriedWithoutInlining++; return true; } /// Block entrance. (Update counters). void ExprEngine::processCFGBlockEntrance(const BlockEdge &L, NodeBuilderWithSinks &nodeBuilder, ExplodedNode *Pred) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); // FIXME: Refactor this into a checker. if (nodeBuilder.getContext().blockCount() >= AMgr.options.maxBlockVisitOnPath) { static SimpleProgramPointTag tag(TagProviderName, "Block count exceeded"); const ExplodedNode *Sink = nodeBuilder.generateSink(Pred->getState(), Pred, &tag); // Check if we stopped at the top level function or not. // Root node should have the location context of the top most function. const LocationContext *CalleeLC = Pred->getLocation().getLocationContext(); const LocationContext *CalleeSF = CalleeLC->getCurrentStackFrame(); const LocationContext *RootLC = (*G.roots_begin())->getLocation().getLocationContext(); if (RootLC->getCurrentStackFrame() != CalleeSF) { Engine.FunctionSummaries->markReachedMaxBlockCount(CalleeSF->getDecl()); // Re-run the call evaluation without inlining it, by storing the // no-inlining policy in the state and enqueuing the new work item on // the list. Replay should almost never fail. Use the stats to catch it // if it does. if ((!AMgr.options.NoRetryExhausted && replayWithoutInlining(Pred, CalleeLC))) return; NumMaxBlockCountReachedInInlined++; } else NumMaxBlockCountReached++; // Make sink nodes as exhausted(for stats) only if retry failed. Engine.blocksExhausted.push_back(std::make_pair(L, Sink)); } } //===----------------------------------------------------------------------===// // Branch processing. //===----------------------------------------------------------------------===// /// RecoverCastedSymbol - A helper function for ProcessBranch that is used /// to try to recover some path-sensitivity for casts of symbolic /// integers that promote their values (which are currently not tracked well). /// This function returns the SVal bound to Condition->IgnoreCasts if all the // cast(s) did was sign-extend the original value. static SVal RecoverCastedSymbol(ProgramStateManager& StateMgr, ProgramStateRef state, const Stmt *Condition, const LocationContext *LCtx, ASTContext &Ctx) { const Expr *Ex = dyn_cast(Condition); if (!Ex) return UnknownVal(); uint64_t bits = 0; bool bitsInit = false; while (const CastExpr *CE = dyn_cast(Ex)) { QualType T = CE->getType(); if (!T->isIntegralOrEnumerationType()) return UnknownVal(); uint64_t newBits = Ctx.getTypeSize(T); if (!bitsInit || newBits < bits) { bitsInit = true; bits = newBits; } Ex = CE->getSubExpr(); } // We reached a non-cast. Is it a symbolic value? QualType T = Ex->getType(); if (!bitsInit || !T->isIntegralOrEnumerationType() || Ctx.getTypeSize(T) > bits) return UnknownVal(); return state->getSVal(Ex, LCtx); } static const Stmt *ResolveCondition(const Stmt *Condition, const CFGBlock *B) { if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); const BinaryOperator *BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) return Condition; // For logical operations, we still have the case where some branches // use the traditional "merge" approach and others sink the branch // directly into the basic blocks representing the logical operation. // We need to distinguish between those two cases here. // The invariants are still shifting, but it is possible that the // last element in a CFGBlock is not a CFGStmt. Look for the last // CFGStmt as the value of the condition. CFGBlock::const_reverse_iterator I = B->rbegin(), E = B->rend(); for (; I != E; ++I) { CFGElement Elem = *I; Optional CS = Elem.getAs(); if (!CS) continue; if (CS->getStmt() != Condition) break; return Condition; } assert(I != E); while (Condition) { BO = dyn_cast(Condition); if (!BO || !BO->isLogicalOp()) return Condition; Condition = BO->getRHS()->IgnoreParens(); } llvm_unreachable("could not resolve condition"); } void ExprEngine::processBranch(const Stmt *Condition, const Stmt *Term, NodeBuilderContext& BldCtx, ExplodedNode *Pred, ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { const LocationContext *LCtx = Pred->getLocationContext(); PrettyStackTraceLocationContext StackCrashInfo(LCtx); currBldrCtx = &BldCtx; // Check for NULL conditions; e.g. "for(;;)" if (!Condition) { BranchNodeBuilder NullCondBldr(Pred, Dst, BldCtx, DstT, DstF); NullCondBldr.markInfeasible(false); NullCondBldr.generateNode(Pred->getState(), true, Pred); return; } if (const Expr *Ex = dyn_cast(Condition)) Condition = Ex->IgnoreParens(); Condition = ResolveCondition(Condition, BldCtx.getBlock()); PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), Condition->getLocStart(), "Error evaluating branch"); ExplodedNodeSet CheckersOutSet; getCheckerManager().runCheckersForBranchCondition(Condition, CheckersOutSet, Pred, *this); // We generated only sinks. if (CheckersOutSet.empty()) return; BranchNodeBuilder builder(CheckersOutSet, Dst, BldCtx, DstT, DstF); for (NodeBuilder::iterator I = CheckersOutSet.begin(), E = CheckersOutSet.end(); E != I; ++I) { ExplodedNode *PredI = *I; if (PredI->isSink()) continue; ProgramStateRef PrevState = PredI->getState(); SVal X = PrevState->getSVal(Condition, PredI->getLocationContext()); if (X.isUnknownOrUndef()) { // Give it a chance to recover from unknown. if (const Expr *Ex = dyn_cast(Condition)) { if (Ex->getType()->isIntegralOrEnumerationType()) { // Try to recover some path-sensitivity. Right now casts of symbolic // integers that promote their values are currently not tracked well. // If 'Condition' is such an expression, try and recover the // underlying value and use that instead. SVal recovered = RecoverCastedSymbol(getStateManager(), PrevState, Condition, PredI->getLocationContext(), getContext()); if (!recovered.isUnknown()) { X = recovered; } } } } // If the condition is still unknown, give up. if (X.isUnknownOrUndef()) { builder.generateNode(PrevState, true, PredI); builder.generateNode(PrevState, false, PredI); continue; } DefinedSVal V = X.castAs(); ProgramStateRef StTrue, StFalse; tie(StTrue, StFalse) = PrevState->assume(V); // Process the true branch. if (builder.isFeasible(true)) { if (StTrue) builder.generateNode(StTrue, true, PredI); else builder.markInfeasible(true); } // Process the false branch. if (builder.isFeasible(false)) { if (StFalse) builder.generateNode(StFalse, false, PredI); else builder.markInfeasible(false); } } currBldrCtx = 0; } /// The GDM component containing the set of global variables which have been /// previously initialized with explicit initializers. REGISTER_TRAIT_WITH_PROGRAMSTATE(InitializedGlobalsSet, llvm::ImmutableSet) void ExprEngine::processStaticInitializer(const DeclStmt *DS, NodeBuilderContext &BuilderCtx, ExplodedNode *Pred, clang::ento::ExplodedNodeSet &Dst, const CFGBlock *DstT, const CFGBlock *DstF) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); currBldrCtx = &BuilderCtx; const VarDecl *VD = cast(DS->getSingleDecl()); ProgramStateRef state = Pred->getState(); bool initHasRun = state->contains(VD); BranchNodeBuilder builder(Pred, Dst, BuilderCtx, DstT, DstF); if (!initHasRun) { state = state->add(VD); } builder.generateNode(state, initHasRun, Pred); builder.markInfeasible(!initHasRun); currBldrCtx = 0; } /// processIndirectGoto - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a computed goto jump. void ExprEngine::processIndirectGoto(IndirectGotoNodeBuilder &builder) { ProgramStateRef state = builder.getState(); SVal V = state->getSVal(builder.getTarget(), builder.getLocationContext()); // Three possibilities: // // (1) We know the computed label. // (2) The label is NULL (or some other constant), or Undefined. // (3) We have no clue about the label. Dispatch to all targets. // typedef IndirectGotoNodeBuilder::iterator iterator; if (Optional LV = V.getAs()) { const LabelDecl *L = LV->getLabel(); for (iterator I = builder.begin(), E = builder.end(); I != E; ++I) { if (I.getLabel() == L) { builder.generateNode(I, state); return; } } llvm_unreachable("No block with label."); } if (V.getAs() || V.getAs()) { // Dispatch to the first target and mark it as a sink. //ExplodedNode* N = builder.generateNode(builder.begin(), state, true); // FIXME: add checker visit. // UndefBranches.insert(N); return; } // This is really a catch-all. We don't support symbolics yet. // FIXME: Implement dispatch for symbolic pointers. for (iterator I=builder.begin(), E=builder.end(); I != E; ++I) builder.generateNode(I, state); } /// ProcessEndPath - Called by CoreEngine. Used to generate end-of-path /// nodes when the control reaches the end of a function. void ExprEngine::processEndOfFunction(NodeBuilderContext& BC, ExplodedNode *Pred) { PrettyStackTraceLocationContext CrashInfo(Pred->getLocationContext()); StateMgr.EndPath(Pred->getState()); ExplodedNodeSet Dst; if (Pred->getLocationContext()->inTopFrame()) { // Remove dead symbols. ExplodedNodeSet AfterRemovedDead; removeDeadOnEndOfFunction(BC, Pred, AfterRemovedDead); // Notify checkers. for (ExplodedNodeSet::iterator I = AfterRemovedDead.begin(), E = AfterRemovedDead.end(); I != E; ++I) { getCheckerManager().runCheckersForEndFunction(BC, Dst, *I, *this); } } else { getCheckerManager().runCheckersForEndFunction(BC, Dst, Pred, *this); } Engine.enqueueEndOfFunction(Dst); } /// ProcessSwitch - Called by CoreEngine. Used to generate successor /// nodes by processing the 'effects' of a switch statement. void ExprEngine::processSwitch(SwitchNodeBuilder& builder) { typedef SwitchNodeBuilder::iterator iterator; ProgramStateRef state = builder.getState(); const Expr *CondE = builder.getCondition(); SVal CondV_untested = state->getSVal(CondE, builder.getLocationContext()); if (CondV_untested.isUndef()) { //ExplodedNode* N = builder.generateDefaultCaseNode(state, true); // FIXME: add checker //UndefBranches.insert(N); return; } DefinedOrUnknownSVal CondV = CondV_untested.castAs(); ProgramStateRef DefaultSt = state; iterator I = builder.begin(), EI = builder.end(); bool defaultIsFeasible = I == EI; for ( ; I != EI; ++I) { // Successor may be pruned out during CFG construction. if (!I.getBlock()) continue; const CaseStmt *Case = I.getCase(); // Evaluate the LHS of the case value. llvm::APSInt V1 = Case->getLHS()->EvaluateKnownConstInt(getContext()); assert(V1.getBitWidth() == getContext().getTypeSize(CondE->getType())); // Get the RHS of the case, if it exists. llvm::APSInt V2; if (const Expr *E = Case->getRHS()) V2 = E->EvaluateKnownConstInt(getContext()); else V2 = V1; // FIXME: Eventually we should replace the logic below with a range // comparison, rather than concretize the values within the range. // This should be easy once we have "ranges" for NonLVals. do { nonloc::ConcreteInt CaseVal(getBasicVals().getValue(V1)); DefinedOrUnknownSVal Res = svalBuilder.evalEQ(DefaultSt ? DefaultSt : state, CondV, CaseVal); // Now "assume" that the case matches. if (ProgramStateRef stateNew = state->assume(Res, true)) { builder.generateCaseStmtNode(I, stateNew); // If CondV evaluates to a constant, then we know that this // is the *only* case that we can take, so stop evaluating the // others. if (CondV.getAs()) return; } // Now "assume" that the case doesn't match. Add this state // to the default state (if it is feasible). if (DefaultSt) { if (ProgramStateRef stateNew = DefaultSt->assume(Res, false)) { defaultIsFeasible = true; DefaultSt = stateNew; } else { defaultIsFeasible = false; DefaultSt = NULL; } } // Concretize the next value in the range. if (V1 == V2) break; ++V1; assert (V1 <= V2); } while (true); } if (!defaultIsFeasible) return; // If we have switch(enum value), the default branch is not // feasible if all of the enum constants not covered by 'case:' statements // are not feasible values for the switch condition. // // Note that this isn't as accurate as it could be. Even if there isn't // a case for a particular enum value as long as that enum value isn't // feasible then it shouldn't be considered for making 'default:' reachable. const SwitchStmt *SS = builder.getSwitch(); const Expr *CondExpr = SS->getCond()->IgnoreParenImpCasts(); if (CondExpr->getType()->getAs()) { if (SS->isAllEnumCasesCovered()) return; } builder.generateDefaultCaseNode(DefaultSt); } //===----------------------------------------------------------------------===// // Transfer functions: Loads and stores. //===----------------------------------------------------------------------===// void ExprEngine::VisitCommonDeclRefExpr(const Expr *Ex, const NamedDecl *D, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); ProgramStateRef state = Pred->getState(); const LocationContext *LCtx = Pred->getLocationContext(); if (const VarDecl *VD = dyn_cast(D)) { // C permits "extern void v", and if you cast the address to a valid type, // you can even do things with it. We simply pretend assert(Ex->isGLValue() || VD->getType()->isVoidType()); SVal V = state->getLValue(VD, Pred->getLocationContext()); // For references, the 'lvalue' is the pointer address stored in the // reference region. if (VD->getType()->isReferenceType()) { if (const MemRegion *R = V.getAsRegion()) V = state->getSVal(R); else V = UnknownVal(); } Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } if (const EnumConstantDecl *ED = dyn_cast(D)) { assert(!Ex->isGLValue()); SVal V = svalBuilder.makeIntVal(ED->getInitVal()); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V)); return; } if (const FunctionDecl *FD = dyn_cast(D)) { SVal V = svalBuilder.getFunctionPointer(FD); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } if (isa(D)) { // FIXME: Compute lvalue of field pointers-to-member. // Right now we just use a non-null void pointer, so that it gives proper // results in boolean contexts. SVal V = svalBuilder.conjureSymbolVal(Ex, LCtx, getContext().VoidPtrTy, currBldrCtx->blockCount()); state = state->assume(V.castAs(), true); Bldr.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V), 0, ProgramPoint::PostLValueKind); return; } llvm_unreachable("Support for this Decl not implemented."); } /// VisitArraySubscriptExpr - Transfer function for array accesses void ExprEngine::VisitLvalArraySubscriptExpr(const ArraySubscriptExpr *A, ExplodedNode *Pred, ExplodedNodeSet &Dst){ const Expr *Base = A->getBase()->IgnoreParens(); const Expr *Idx = A->getIdx()->IgnoreParens(); ExplodedNodeSet checkerPreStmt; getCheckerManager().runCheckersForPreStmt(checkerPreStmt, Pred, A, *this); StmtNodeBuilder Bldr(checkerPreStmt, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator it = checkerPreStmt.begin(), ei = checkerPreStmt.end(); it != ei; ++it) { const LocationContext *LCtx = (*it)->getLocationContext(); ProgramStateRef state = (*it)->getState(); SVal V = state->getLValue(A->getType(), state->getSVal(Idx, LCtx), state->getSVal(Base, LCtx)); assert(A->isGLValue()); Bldr.generateNode(A, *it, state->BindExpr(A, LCtx, V), 0, ProgramPoint::PostLValueKind); } } /// VisitMemberExpr - Transfer function for member expressions. void ExprEngine::VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred, ExplodedNodeSet &Dst) { // FIXME: Prechecks eventually go in ::Visit(). ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, M, *this); ExplodedNodeSet EvalSet; ValueDecl *Member = M->getMemberDecl(); // Handle static member variables and enum constants accessed via // member syntax. if (isa(Member) || isa(Member)) { ExplodedNodeSet Dst; for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { VisitCommonDeclRefExpr(M, Member, Pred, EvalSet); } } else { StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); ExplodedNodeSet Tmp; for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I != E; ++I) { ProgramStateRef state = (*I)->getState(); const LocationContext *LCtx = (*I)->getLocationContext(); Expr *BaseExpr = M->getBase(); // Handle C++ method calls. if (const CXXMethodDecl *MD = dyn_cast(Member)) { if (MD->isInstance()) state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal MDVal = svalBuilder.getFunctionPointer(MD); state = state->BindExpr(M, LCtx, MDVal); Bldr.generateNode(M, *I, state); continue; } // Handle regular struct fields / member variables. state = createTemporaryRegionIfNeeded(state, LCtx, BaseExpr); SVal baseExprVal = state->getSVal(BaseExpr, LCtx); FieldDecl *field = cast(Member); SVal L = state->getLValue(field, baseExprVal); if (M->isGLValue() || M->getType()->isArrayType()) { // We special-case rvalues of array type because the analyzer cannot // reason about them, since we expect all regions to be wrapped in Locs. // We instead treat these as lvalues and assume that they will decay to // pointers as soon as they are used. if (!M->isGLValue()) { assert(M->getType()->isArrayType()); const ImplicitCastExpr *PE = dyn_cast((*I)->getParentMap().getParent(M)); if (!PE || PE->getCastKind() != CK_ArrayToPointerDecay) { llvm_unreachable("should always be wrapped in ArrayToPointerDecay"); L = UnknownVal(); } } if (field->getType()->isReferenceType()) { if (const MemRegion *R = L.getAsRegion()) L = state->getSVal(R); else L = UnknownVal(); } Bldr.generateNode(M, *I, state->BindExpr(M, LCtx, L), 0, ProgramPoint::PostLValueKind); } else { Bldr.takeNodes(*I); evalLoad(Tmp, M, M, *I, state, L); Bldr.addNodes(Tmp); } } } getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, M, *this); } namespace { class CollectReachableSymbolsCallback : public SymbolVisitor { InvalidatedSymbols Symbols; public: CollectReachableSymbolsCallback(ProgramStateRef State) {} const InvalidatedSymbols &getSymbols() const { return Symbols; } bool VisitSymbol(SymbolRef Sym) { Symbols.insert(Sym); return true; } }; } // end anonymous namespace // A value escapes in three possible cases: // (1) We are binding to something that is not a memory region. // (2) We are binding to a MemrRegion that does not have stack storage. // (3) We are binding to a MemRegion with stack storage that the store // does not understand. ProgramStateRef ExprEngine::processPointerEscapedOnBind(ProgramStateRef State, SVal Loc, SVal Val) { // Are we storing to something that causes the value to "escape"? bool escapes = true; // TODO: Move to StoreManager. if (Optional regionLoc = Loc.getAs()) { escapes = !regionLoc->getRegion()->hasStackStorage(); if (!escapes) { // To test (3), generate a new state with the binding added. If it is // the same state, then it escapes (since the store cannot represent // the binding). // Do this only if we know that the store is not supposed to generate the // same state. SVal StoredVal = State->getSVal(regionLoc->getRegion()); if (StoredVal != Val) escapes = (State == (State->bindLoc(*regionLoc, Val))); } } // If our store can represent the binding and we aren't storing to something // that doesn't have local storage then just return and have the simulation // state continue as is. if (!escapes) return State; // Otherwise, find all symbols referenced by 'val' that we are tracking // and stop tracking them. CollectReachableSymbolsCallback Scanner = State->scanReachableSymbols(Val); const InvalidatedSymbols &EscapedSymbols = Scanner.getSymbols(); State = getCheckerManager().runCheckersForPointerEscape(State, EscapedSymbols, /*CallEvent*/ 0, PSK_EscapeOnBind, 0); return State; } ProgramStateRef ExprEngine::notifyCheckersOfPointerEscape(ProgramStateRef State, const InvalidatedSymbols *Invalidated, ArrayRef ExplicitRegions, ArrayRef Regions, const CallEvent *Call, RegionAndSymbolInvalidationTraits &ITraits) { if (!Invalidated || Invalidated->empty()) return State; if (!Call) return getCheckerManager().runCheckersForPointerEscape(State, *Invalidated, 0, PSK_EscapeOther, &ITraits); // If the symbols were invalidated by a call, we want to find out which ones // were invalidated directly due to being arguments to the call. InvalidatedSymbols SymbolsDirectlyInvalidated; for (ArrayRef::iterator I = ExplicitRegions.begin(), E = ExplicitRegions.end(); I != E; ++I) { if (const SymbolicRegion *R = (*I)->StripCasts()->getAs()) SymbolsDirectlyInvalidated.insert(R->getSymbol()); } InvalidatedSymbols SymbolsIndirectlyInvalidated; for (InvalidatedSymbols::const_iterator I=Invalidated->begin(), E = Invalidated->end(); I!=E; ++I) { SymbolRef sym = *I; if (SymbolsDirectlyInvalidated.count(sym)) continue; SymbolsIndirectlyInvalidated.insert(sym); } if (!SymbolsDirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsDirectlyInvalidated, Call, PSK_DirectEscapeOnCall, &ITraits); // Notify about the symbols that get indirectly invalidated by the call. if (!SymbolsIndirectlyInvalidated.empty()) State = getCheckerManager().runCheckersForPointerEscape(State, SymbolsIndirectlyInvalidated, Call, PSK_IndirectEscapeOnCall, &ITraits); return State; } /// evalBind - Handle the semantics of binding a value to a specific location. /// This method is used by evalStore and (soon) VisitDeclStmt, and others. void ExprEngine::evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit, const ProgramPoint *PP) { const LocationContext *LC = Pred->getLocationContext(); PostStmt PS(StoreE, LC); if (!PP) PP = &PS; // Do a previsit of the bind. ExplodedNodeSet CheckedSet; getCheckerManager().runCheckersForBind(CheckedSet, Pred, location, Val, StoreE, *this, *PP); StmtNodeBuilder Bldr(CheckedSet, Dst, *currBldrCtx); // If the location is not a 'Loc', it will already be handled by // the checkers. There is nothing left to do. if (!location.getAs()) { const ProgramPoint L = PostStore(StoreE, LC, /*Loc*/0, /*tag*/0); ProgramStateRef state = Pred->getState(); state = processPointerEscapedOnBind(state, location, Val); Bldr.generateNode(L, state, Pred); return; } for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); I!=E; ++I) { ExplodedNode *PredI = *I; ProgramStateRef state = PredI->getState(); state = processPointerEscapedOnBind(state, location, Val); // When binding the value, pass on the hint that this is a initialization. // For initializations, we do not need to inform clients of region // changes. state = state->bindLoc(location.castAs(), Val, /* notifyChanges = */ !atDeclInit); const MemRegion *LocReg = 0; if (Optional LocRegVal = location.getAs()) { LocReg = LocRegVal->getRegion(); } const ProgramPoint L = PostStore(StoreE, LC, LocReg, 0); Bldr.generateNode(L, state, PredI); } } /// evalStore - Handle the semantics of a store via an assignment. /// @@param Dst The node set to store generated state nodes /// @@param AssignE The assignment expression if the store happens in an /// assignment. /// @@param LocationE The location expression that is stored to. /// @@param state The current simulation state /// @@param location The location to store the value /// @@param Val The value to be stored void ExprEngine::evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *LocationE, ExplodedNode *Pred, ProgramStateRef state, SVal location, SVal Val, const ProgramPointTag *tag) { // Proceed with the store. We use AssignE as the anchor for the PostStore // ProgramPoint if it is non-NULL, and LocationE otherwise. const Expr *StoreE = AssignE ? AssignE : LocationE; // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, AssignE, LocationE, Pred, state, location, tag, false); if (Tmp.empty()) return; if (location.isUndef()) return; for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) evalBind(Dst, StoreE, *NI, location, Val, false); } void ExprEngine::evalLoad(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(!location.getAs() && "location cannot be a NonLoc."); // Are we loading from a region? This actually results in two loads; one // to fetch the address of the referenced value and one to fetch the // referenced value. if (const TypedValueRegion *TR = dyn_cast_or_null(location.getAsRegion())) { QualType ValTy = TR->getValueType(); if (const ReferenceType *RT = ValTy->getAs()) { static SimpleProgramPointTag loadReferenceTag(TagProviderName, "Load Reference"); ExplodedNodeSet Tmp; evalLoadCommon(Tmp, NodeEx, BoundEx, Pred, state, location, &loadReferenceTag, getContext().getPointerType(RT->getPointeeType())); // Perform the load from the referenced value. for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end() ; I!=E; ++I) { state = (*I)->getState(); location = state->getSVal(BoundEx, (*I)->getLocationContext()); evalLoadCommon(Dst, NodeEx, BoundEx, *I, state, location, tag, LoadTy); } return; } } evalLoadCommon(Dst, NodeEx, BoundEx, Pred, state, location, tag, LoadTy); } void ExprEngine::evalLoadCommon(ExplodedNodeSet &Dst, const Expr *NodeEx, const Expr *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, QualType LoadTy) { assert(NodeEx); assert(BoundEx); // Evaluate the location (checks for bad dereferences). ExplodedNodeSet Tmp; evalLocation(Tmp, NodeEx, BoundEx, Pred, state, location, tag, true); if (Tmp.empty()) return; StmtNodeBuilder Bldr(Tmp, Dst, *currBldrCtx); if (location.isUndef()) return; // Proceed with the load. for (ExplodedNodeSet::iterator NI=Tmp.begin(), NE=Tmp.end(); NI!=NE; ++NI) { state = (*NI)->getState(); const LocationContext *LCtx = (*NI)->getLocationContext(); SVal V = UnknownVal(); if (location.isValid()) { if (LoadTy.isNull()) LoadTy = BoundEx->getType(); V = state->getSVal(location.castAs(), LoadTy); } Bldr.generateNode(NodeEx, *NI, state->BindExpr(BoundEx, LCtx, V), tag, ProgramPoint::PostLoadKind); } } void ExprEngine::evalLocation(ExplodedNodeSet &Dst, const Stmt *NodeEx, const Stmt *BoundEx, ExplodedNode *Pred, ProgramStateRef state, SVal location, const ProgramPointTag *tag, bool isLoad) { StmtNodeBuilder BldrTop(Pred, Dst, *currBldrCtx); // Early checks for performance reason. if (location.isUnknown()) { return; } ExplodedNodeSet Src; BldrTop.takeNodes(Pred); StmtNodeBuilder Bldr(Pred, Src, *currBldrCtx); if (Pred->getState() != state) { // Associate this new state with an ExplodedNode. // FIXME: If I pass null tag, the graph is incorrect, e.g for // int *p; // p = 0; // *p = 0xDEADBEEF; // "p = 0" is not noted as "Null pointer value stored to 'p'" but // instead "int *p" is noted as // "Variable 'p' initialized to a null pointer value" static SimpleProgramPointTag tag(TagProviderName, "Location"); Bldr.generateNode(NodeEx, Pred, state, &tag); } ExplodedNodeSet Tmp; getCheckerManager().runCheckersForLocation(Tmp, Src, location, isLoad, NodeEx, BoundEx, *this); BldrTop.addNodes(Tmp); } std::pair ExprEngine::geteagerlyAssumeBinOpBifurcationTags() { static SimpleProgramPointTag eagerlyAssumeBinOpBifurcationTrue(TagProviderName, "Eagerly Assume True"), eagerlyAssumeBinOpBifurcationFalse(TagProviderName, "Eagerly Assume False"); return std::make_pair(&eagerlyAssumeBinOpBifurcationTrue, &eagerlyAssumeBinOpBifurcationFalse); } void ExprEngine::evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src, const Expr *Ex) { StmtNodeBuilder Bldr(Src, Dst, *currBldrCtx); for (ExplodedNodeSet::iterator I=Src.begin(), E=Src.end(); I!=E; ++I) { ExplodedNode *Pred = *I; // Test if the previous node was as the same expression. This can happen // when the expression fails to evaluate to anything meaningful and // (as an optimization) we don't generate a node. ProgramPoint P = Pred->getLocation(); if (!P.getAs() || P.castAs().getStmt() != Ex) { continue; } ProgramStateRef state = Pred->getState(); SVal V = state->getSVal(Ex, Pred->getLocationContext()); Optional SEV = V.getAs(); if (SEV && SEV->isExpression()) { const std::pair &tags = geteagerlyAssumeBinOpBifurcationTags(); ProgramStateRef StateTrue, StateFalse; tie(StateTrue, StateFalse) = state->assume(*SEV); // First assume that the condition is true. if (StateTrue) { SVal Val = svalBuilder.makeIntVal(1U, Ex->getType()); StateTrue = StateTrue->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateTrue, tags.first); } // Next, assume that the condition is false. if (StateFalse) { SVal Val = svalBuilder.makeIntVal(0U, Ex->getType()); StateFalse = StateFalse->BindExpr(Ex, Pred->getLocationContext(), Val); Bldr.generateNode(Ex, Pred, StateFalse, tags.second); } } } } void ExprEngine::VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); // We have processed both the inputs and the outputs. All of the outputs // should evaluate to Locs. Nuke all of their values. // FIXME: Some day in the future it would be nice to allow a "plug-in" // which interprets the inline asm and stores proper results in the // outputs. ProgramStateRef state = Pred->getState(); for (GCCAsmStmt::const_outputs_iterator OI = A->begin_outputs(), OE = A->end_outputs(); OI != OE; ++OI) { SVal X = state->getSVal(*OI, Pred->getLocationContext()); assert (!X.getAs()); // Should be an Lval, or unknown, undef. if (Optional LV = X.getAs()) state = state->bindLoc(*LV, UnknownVal()); } Bldr.generateNode(A, Pred, state); } void ExprEngine::VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred, ExplodedNodeSet &Dst) { StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); Bldr.generateNode(A, Pred, Pred->getState()); } //===----------------------------------------------------------------------===// // Visualization. //===----------------------------------------------------------------------===// #ifndef NDEBUG static ExprEngine* GraphPrintCheckerState; static SourceManager* GraphPrintSourceManager; namespace llvm { template<> struct DOTGraphTraits : public DefaultDOTGraphTraits { DOTGraphTraits (bool isSimple=false) : DefaultDOTGraphTraits(isSimple) {} // FIXME: Since we do not cache error nodes in ExprEngine now, this does not // work. static std::string getNodeAttributes(const ExplodedNode *N, void*) { #if 0 // FIXME: Replace with a general scheme to tell if the node is // an error node. if (GraphPrintCheckerState->isImplicitNullDeref(N) || GraphPrintCheckerState->isExplicitNullDeref(N) || GraphPrintCheckerState->isUndefDeref(N) || GraphPrintCheckerState->isUndefStore(N) || GraphPrintCheckerState->isUndefControlFlow(N) || GraphPrintCheckerState->isUndefResult(N) || GraphPrintCheckerState->isBadCall(N) || GraphPrintCheckerState->isUndefArg(N)) return "color=\"red\",style=\"filled\""; if (GraphPrintCheckerState->isNoReturnCall(N)) return "color=\"blue\",style=\"filled\""; #endif return ""; } static void printLocation(raw_ostream &Out, SourceLocation SLoc) { if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc) << "\\l"; } } static std::string getNodeLabel(const ExplodedNode *N, void*){ std::string sbuf; llvm::raw_string_ostream Out(sbuf); // Program Location. ProgramPoint Loc = N->getLocation(); switch (Loc.getKind()) { case ProgramPoint::BlockEntranceKind: { Out << "Block Entrance: B" << Loc.castAs().getBlock()->getBlockID(); if (const NamedDecl *ND = dyn_cast(Loc.getLocationContext()->getDecl())) { Out << " ("; ND->printName(Out); Out << ")"; } break; } case ProgramPoint::BlockExitKind: assert (false); break; case ProgramPoint::CallEnterKind: Out << "CallEnter"; break; case ProgramPoint::CallExitBeginKind: Out << "CallExitBegin"; break; case ProgramPoint::CallExitEndKind: Out << "CallExitEnd"; break; case ProgramPoint::PostStmtPurgeDeadSymbolsKind: Out << "PostStmtPurgeDeadSymbols"; break; case ProgramPoint::PreStmtPurgeDeadSymbolsKind: Out << "PreStmtPurgeDeadSymbols"; break; case ProgramPoint::EpsilonKind: Out << "Epsilon Point"; break; case ProgramPoint::PreImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PreCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostImplicitCallKind: { ImplicitCallPoint PC = Loc.castAs(); Out << "PostCall: "; // FIXME: Get proper printing options. PC.getDecl()->print(Out, LangOptions()); printLocation(Out, PC.getLocation()); break; } case ProgramPoint::PostInitializerKind: { Out << "PostInitializer: "; const CXXCtorInitializer *Init = Loc.castAs().getInitializer(); if (const FieldDecl *FD = Init->getAnyMember()) Out << *FD; else { QualType Ty = Init->getTypeSourceInfo()->getType(); Ty = Ty.getLocalUnqualifiedType(); LangOptions LO; // FIXME. Ty.print(Out, LO); } break; } case ProgramPoint::BlockEdgeKind: { const BlockEdge &E = Loc.castAs(); Out << "Edge: (B" << E.getSrc()->getBlockID() << ", B" << E.getDst()->getBlockID() << ')'; if (const Stmt *T = E.getSrc()->getTerminator()) { SourceLocation SLoc = T->getLocStart(); Out << "\\|Terminator: "; LangOptions LO; // FIXME. E.getSrc()->printTerminator(Out, LO); if (SLoc.isFileID()) { Out << "\\lline=" << GraphPrintSourceManager->getExpansionLineNumber(SLoc) << " col=" << GraphPrintSourceManager->getExpansionColumnNumber(SLoc); } if (isa(T)) { const Stmt *Label = E.getDst()->getLabel(); if (Label) { if (const CaseStmt *C = dyn_cast(Label)) { Out << "\\lcase "; LangOptions LO; // FIXME. C->getLHS()->printPretty(Out, 0, PrintingPolicy(LO)); if (const Stmt *RHS = C->getRHS()) { Out << " .. "; RHS->printPretty(Out, 0, PrintingPolicy(LO)); } Out << ":"; } else { assert (isa(Label)); Out << "\\ldefault:"; } } else Out << "\\l(implicit) default:"; } else if (isa(T)) { // FIXME } else { Out << "\\lCondition: "; if (*E.getSrc()->succ_begin() == E.getDst()) Out << "true"; else Out << "false"; } Out << "\\l"; } #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isUndefControlFlow(N)) { Out << "\\|Control-flow based on\\lUndefined value.\\l"; } #endif break; } default: { const Stmt *S = Loc.castAs().getStmt(); Out << S->getStmtClassName() << ' ' << (const void*) S << ' '; LangOptions LO; // FIXME. S->printPretty(Out, 0, PrintingPolicy(LO)); printLocation(Out, S->getLocStart()); if (Loc.getAs()) Out << "\\lPreStmt\\l;"; else if (Loc.getAs()) Out << "\\lPostLoad\\l;"; else if (Loc.getAs()) Out << "\\lPostStore\\l"; else if (Loc.getAs()) Out << "\\lPostLValue\\l"; #if 0 // FIXME: Replace with a general scheme to determine // the name of the check. if (GraphPrintCheckerState->isImplicitNullDeref(N)) Out << "\\|Implicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isExplicitNullDeref(N)) Out << "\\|Explicit-Null Dereference.\\l"; else if (GraphPrintCheckerState->isUndefDeref(N)) Out << "\\|Dereference of undefialied value.\\l"; else if (GraphPrintCheckerState->isUndefStore(N)) Out << "\\|Store to Undefined Loc."; else if (GraphPrintCheckerState->isUndefResult(N)) Out << "\\|Result of operation is undefined."; else if (GraphPrintCheckerState->isNoReturnCall(N)) Out << "\\|Call to function marked \"noreturn\"."; else if (GraphPrintCheckerState->isBadCall(N)) Out << "\\|Call to NULL/Undefined."; else if (GraphPrintCheckerState->isUndefArg(N)) Out << "\\|Argument in call is undefined"; #endif break; } } ProgramStateRef state = N->getState(); Out << "\\|StateID: " << (const void*) state.getPtr() << " NodeID: " << (const void*) N << "\\|"; state->printDOT(Out); Out << "\\l"; if (const ProgramPointTag *tag = Loc.getTag()) { Out << "\\|Tag: " << tag->getTagDescription(); Out << "\\l"; } return Out.str(); } }; } // end llvm namespace #endif #ifndef NDEBUG template ExplodedNode *GetGraphNode(ITERATOR I) { return *I; } template <> ExplodedNode* GetGraphNode::iterator> (llvm::DenseMap::iterator I) { return I->first; } #endif void ExprEngine::ViewGraph(bool trim) { #ifndef NDEBUG if (trim) { std::vector Src; // Flush any outstanding reports to make sure we cover all the nodes. // This does not cause them to get displayed. for (BugReporter::iterator I=BR.begin(), E=BR.end(); I!=E; ++I) const_cast(*I)->FlushReports(BR); // Iterate through the reports and get their nodes. for (BugReporter::EQClasses_iterator EI = BR.EQClasses_begin(), EE = BR.EQClasses_end(); EI != EE; ++EI) { ExplodedNode *N = const_cast(EI->begin()->getErrorNode()); if (N) Src.push_back(N); } ViewGraph(Src); } else { GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); llvm::ViewGraph(*G.roots_begin(), "ExprEngine"); GraphPrintCheckerState = NULL; GraphPrintSourceManager = NULL; } #endif } void ExprEngine::ViewGraph(ArrayRef Nodes) { #ifndef NDEBUG GraphPrintCheckerState = this; GraphPrintSourceManager = &getContext().getSourceManager(); OwningPtr TrimmedG(G.trim(Nodes)); if (!TrimmedG.get()) llvm::errs() << "warning: Trimmed ExplodedGraph is empty.\n"; else llvm::ViewGraph(*TrimmedG->roots_begin(), "TrimmedExprEngine"); GraphPrintCheckerState = NULL; GraphPrintSourceManager = NULL; #endif } @