1 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines the C++ expression evaluation engine.
12 //===----------------------------------------------------------------------===//
14 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
15 #include "clang/Analysis/ConstructionContext.h"
16 #include "clang/AST/DeclCXX.h"
17 #include "clang/AST/StmtCXX.h"
18 #include "clang/AST/ParentMap.h"
19 #include "clang/Basic/PrettyStackTrace.h"
20 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
21 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
22 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
24 using namespace clang;
27 void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
29 ExplodedNodeSet &Dst) {
30 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
31 const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
32 ProgramStateRef state = Pred->getState();
33 const LocationContext *LCtx = Pred->getLocationContext();
35 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
36 Bldr.generateNode(ME, Pred, state);
39 // FIXME: This is the sort of code that should eventually live in a Core
40 // checker rather than as a special case in ExprEngine.
41 void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
42 const CallEvent &Call) {
44 bool AlwaysReturnsLValue;
45 const CXXRecordDecl *ThisRD = nullptr;
46 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
47 assert(Ctor->getDecl()->isTrivial());
48 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
49 ThisVal = Ctor->getCXXThisVal();
50 ThisRD = Ctor->getDecl()->getParent();
51 AlwaysReturnsLValue = false;
53 assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
54 assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
56 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
57 ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent();
58 AlwaysReturnsLValue = true;
62 if (ThisRD->isEmpty()) {
63 // Do nothing for empty classes. Otherwise it'd retrieve an UnknownVal
64 // and bind it and RegionStore would think that the actual value
65 // in this region at this offset is unknown.
69 const LocationContext *LCtx = Pred->getLocationContext();
74 SVal V = Call.getArgSVal(0);
76 // If the value being copied is not unknown, load from its location to get
77 // an aggregate rvalue.
78 if (Optional<Loc> L = V.getAs<Loc>())
79 V = Pred->getState()->getSVal(*L);
81 assert(V.isUnknownOrUndef());
83 const Expr *CallExpr = Call.getOriginExpr();
84 evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
86 PostStmt PS(CallExpr, LCtx);
87 for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
89 ProgramStateRef State = (*I)->getState();
90 if (AlwaysReturnsLValue)
91 State = State->BindExpr(CallExpr, LCtx, ThisVal);
93 State = bindReturnValue(Call, LCtx, State);
94 Bldr.generateNode(PS, State, *I);
99 SVal ExprEngine::makeZeroElementRegion(ProgramStateRef State, SVal LValue,
100 QualType &Ty, bool &IsArray) {
101 SValBuilder &SVB = State->getStateManager().getSValBuilder();
102 ASTContext &Ctx = SVB.getContext();
104 while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
105 Ty = AT->getElementType();
106 LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
113 std::pair<ProgramStateRef, SVal> ExprEngine::prepareForObjectConstruction(
114 const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
115 const ConstructionContext *CC, EvalCallOptions &CallOpts) {
116 SValBuilder &SVB = getSValBuilder();
117 MemRegionManager &MRMgr = SVB.getRegionManager();
118 ASTContext &ACtx = SVB.getContext();
120 // See if we're constructing an existing region by looking at the
121 // current construction context.
123 switch (CC->getKind()) {
124 case ConstructionContext::CXX17ElidedCopyVariableKind:
125 case ConstructionContext::SimpleVariableKind: {
126 const auto *DSCC = cast<VariableConstructionContext>(CC);
127 const auto *DS = DSCC->getDeclStmt();
128 const auto *Var = cast<VarDecl>(DS->getSingleDecl());
129 SVal LValue = State->getLValue(Var, LCtx);
130 QualType Ty = Var->getType();
132 makeZeroElementRegion(State, LValue, Ty, CallOpts.IsArrayCtorOrDtor);
134 addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, LValue);
135 return std::make_pair(State, LValue);
137 case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
138 case ConstructionContext::SimpleConstructorInitializerKind: {
139 const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
140 const auto *Init = ICC->getCXXCtorInitializer();
141 assert(Init->isAnyMemberInitializer());
142 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
144 SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
145 SVal ThisVal = State->getSVal(ThisPtr);
147 const ValueDecl *Field;
149 if (Init->isIndirectMemberInitializer()) {
150 Field = Init->getIndirectMember();
151 FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
153 Field = Init->getMember();
154 FieldVal = State->getLValue(Init->getMember(), ThisVal);
157 QualType Ty = Field->getType();
158 FieldVal = makeZeroElementRegion(State, FieldVal, Ty,
159 CallOpts.IsArrayCtorOrDtor);
160 State = addObjectUnderConstruction(State, Init, LCtx, FieldVal);
161 return std::make_pair(State, FieldVal);
163 case ConstructionContext::NewAllocatedObjectKind: {
164 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
165 const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
166 const auto *NE = NECC->getCXXNewExpr();
167 SVal V = *getObjectUnderConstruction(State, NE, LCtx);
168 if (const SubRegion *MR =
169 dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
171 // TODO: In fact, we need to call the constructor for every
172 // allocated element, not just the first one!
173 CallOpts.IsArrayCtorOrDtor = true;
174 return std::make_pair(
175 State, loc::MemRegionVal(getStoreManager().GetElementZeroRegion(
176 MR, NE->getType()->getPointeeType())));
178 return std::make_pair(State, V);
180 // TODO: Detect when the allocator returns a null pointer.
181 // Constructor shall not be called in this case.
185 case ConstructionContext::SimpleReturnedValueKind:
186 case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
187 // The temporary is to be managed by the parent stack frame.
188 // So build it in the parent stack frame if we're not in the
189 // top frame of the analysis.
190 const StackFrameContext *SFC = LCtx->getStackFrame();
191 if (const LocationContext *CallerLCtx = SFC->getParent()) {
192 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
193 .getAs<CFGCXXRecordTypedCall>();
195 // We were unable to find the correct construction context for the
196 // call in the parent stack frame. This is equivalent to not being
197 // able to find construction context at all.
200 return prepareForObjectConstruction(
201 cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
202 RTC->getConstructionContext(), CallOpts);
204 // We are on the top frame of the analysis. We do not know where is the
205 // object returned to. Conjure a symbolic region for the return value.
206 // TODO: We probably need a new MemRegion kind to represent the storage
207 // of that SymbolicRegion, so that we cound produce a fancy symbol
208 // instead of an anonymous conjured symbol.
209 // TODO: Do we need to track the region to avoid having it dead
210 // too early? It does die too early, at least in C++17, but because
211 // putting anything into a SymbolicRegion causes an immediate escape,
212 // it doesn't cause any leak false positives.
213 const auto *RCC = cast<ReturnedValueConstructionContext>(CC);
214 // Make sure that this doesn't coincide with any other symbol
215 // conjured for the returned expression.
216 static const int TopLevelSymRegionTag = 0;
217 const Expr *RetE = RCC->getReturnStmt()->getRetValue();
218 assert(RetE && "Void returns should not have a construction context");
219 QualType ReturnTy = RetE->getType();
220 QualType RegionTy = ACtx.getPointerType(ReturnTy);
221 SVal V = SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC,
222 RegionTy, currBldrCtx->blockCount());
223 return std::make_pair(State, V);
225 llvm_unreachable("Unhandled return value construction context!");
227 case ConstructionContext::ElidedTemporaryObjectKind: {
228 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
229 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
230 const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
231 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
232 const CXXConstructExpr *CE = TCC->getConstructorAfterElision();
234 // Support pre-C++17 copy elision. We'll have the elidable copy
235 // constructor in the AST and in the CFG, but we'll skip it
236 // and construct directly into the final object. This call
237 // also sets the CallOpts flags for us.
239 // If the elided copy/move constructor is not supported, there's still
240 // benefit in trying to model the non-elided constructor.
241 // Stash our state before trying to elide, as it'll get overwritten.
242 ProgramStateRef PreElideState = State;
243 EvalCallOptions PreElideCallOpts = CallOpts;
245 std::tie(State, V) = prepareForObjectConstruction(
246 CE, State, LCtx, TCC->getConstructionContextAfterElision(), CallOpts);
248 // FIXME: This definition of "copy elision has not failed" is unreliable.
249 // It doesn't indicate that the constructor will actually be inlined
250 // later; it is still up to evalCall() to decide.
251 if (!CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion) {
252 // Remember that we've elided the constructor.
253 State = addObjectUnderConstruction(State, CE, LCtx, V);
255 // Remember that we've elided the destructor.
257 State = elideDestructor(State, BTE, LCtx);
259 // Instead of materialization, shamelessly return
260 // the final object destination.
262 State = addObjectUnderConstruction(State, MTE, LCtx, V);
264 return std::make_pair(State, V);
266 // Copy elision failed. Revert the changes and proceed as if we have
267 // a simple temporary.
268 State = PreElideState;
269 CallOpts = PreElideCallOpts;
273 case ConstructionContext::SimpleTemporaryObjectKind: {
274 const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
275 const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
276 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
277 SVal V = UnknownVal();
280 if (const ValueDecl *VD = MTE->getExtendingDecl()) {
281 assert(MTE->getStorageDuration() != SD_FullExpression);
282 if (!VD->getType()->isReferenceType()) {
283 // We're lifetime-extended by a surrounding aggregate.
284 // Automatic destructors aren't quite working in this case
285 // on the CFG side. We should warn the caller about that.
286 // FIXME: Is there a better way to retrieve this information from
287 // the MaterializeTemporaryExpr?
288 CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true;
292 if (MTE->getStorageDuration() == SD_Static ||
293 MTE->getStorageDuration() == SD_Thread)
294 V = loc::MemRegionVal(MRMgr.getCXXStaticTempObjectRegion(E));
298 V = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
301 State = addObjectUnderConstruction(State, BTE, LCtx, V);
304 State = addObjectUnderConstruction(State, MTE, LCtx, V);
306 CallOpts.IsTemporaryCtorOrDtor = true;
307 return std::make_pair(State, V);
309 case ConstructionContext::ArgumentKind: {
310 // Arguments are technically temporaries.
311 CallOpts.IsTemporaryCtorOrDtor = true;
313 const auto *ACC = cast<ArgumentConstructionContext>(CC);
314 const Expr *E = ACC->getCallLikeExpr();
315 unsigned Idx = ACC->getIndex();
316 const CXXBindTemporaryExpr *BTE = ACC->getCXXBindTemporaryExpr();
318 CallEventManager &CEMgr = getStateManager().getCallEventManager();
319 SVal V = UnknownVal();
320 auto getArgLoc = [&](CallEventRef<> Caller) -> Optional<SVal> {
321 const LocationContext *FutureSFC = Caller->getCalleeStackFrame();
322 // Return early if we are unable to reliably foresee
323 // the future stack frame.
327 // This should be equivalent to Caller->getDecl() for now, but
328 // FutureSFC->getDecl() is likely to support better stuff (like
329 // virtual functions) earlier.
330 const Decl *CalleeD = FutureSFC->getDecl();
332 // FIXME: Support for variadic arguments is not implemented here yet.
333 if (CallEvent::isVariadic(CalleeD))
336 // Operator arguments do not correspond to operator parameters
337 // because this-argument is implemented as a normal argument in
338 // operator call expressions but not in operator declarations.
339 const VarRegion *VR = Caller->getParameterLocation(
340 *Caller->getAdjustedParameterIndex(Idx));
344 return loc::MemRegionVal(VR);
347 if (const auto *CE = dyn_cast<CallExpr>(E)) {
348 CallEventRef<> Caller = CEMgr.getSimpleCall(CE, State, LCtx);
349 if (auto OptV = getArgLoc(Caller))
353 State = addObjectUnderConstruction(State, {CE, Idx}, LCtx, V);
354 } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(E)) {
355 // Don't bother figuring out the target region for the future
356 // constructor because we won't need it.
357 CallEventRef<> Caller =
358 CEMgr.getCXXConstructorCall(CCE, /*Target=*/nullptr, State, LCtx);
359 if (auto OptV = getArgLoc(Caller))
363 State = addObjectUnderConstruction(State, {CCE, Idx}, LCtx, V);
364 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(E)) {
365 CallEventRef<> Caller = CEMgr.getObjCMethodCall(ME, State, LCtx);
366 if (auto OptV = getArgLoc(Caller))
370 State = addObjectUnderConstruction(State, {ME, Idx}, LCtx, V);
373 assert(!V.isUnknown());
376 State = addObjectUnderConstruction(State, BTE, LCtx, V);
378 return std::make_pair(State, V);
382 // If we couldn't find an existing region to construct into, assume we're
383 // constructing a temporary. Notify the caller of our failure.
384 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
385 return std::make_pair(
386 State, loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx)));
389 void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
391 ExplodedNodeSet &destNodes) {
392 const LocationContext *LCtx = Pred->getLocationContext();
393 ProgramStateRef State = Pred->getState();
395 SVal Target = UnknownVal();
397 if (Optional<SVal> ElidedTarget =
398 getObjectUnderConstruction(State, CE, LCtx)) {
399 // We've previously modeled an elidable constructor by pretending that it in
400 // fact constructs into the correct target. This constructor can therefore
402 Target = *ElidedTarget;
403 StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
404 State = finishObjectConstruction(State, CE, LCtx);
405 if (auto L = Target.getAs<Loc>())
406 State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
407 Bldr.generateNode(CE, Pred, State);
411 // FIXME: Handle arrays, which run the same constructor for every element.
412 // For now, we just run the first constructor (which should still invalidate
413 // the entire array).
415 EvalCallOptions CallOpts;
416 auto C = getCurrentCFGElement().getAs<CFGConstructor>();
417 assert(C || getCurrentCFGElement().getAs<CFGStmt>());
418 const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
420 switch (CE->getConstructionKind()) {
421 case CXXConstructExpr::CK_Complete: {
422 std::tie(State, Target) =
423 prepareForObjectConstruction(CE, State, LCtx, CC, CallOpts);
426 case CXXConstructExpr::CK_VirtualBase:
427 // Make sure we are not calling virtual base class initializers twice.
428 // Only the most-derived object should initialize virtual base classes.
429 if (const Stmt *Outer = LCtx->getStackFrame()->getCallSite()) {
430 const CXXConstructExpr *OuterCtor = dyn_cast<CXXConstructExpr>(Outer);
432 switch (OuterCtor->getConstructionKind()) {
433 case CXXConstructExpr::CK_NonVirtualBase:
434 case CXXConstructExpr::CK_VirtualBase:
438 case CXXConstructExpr::CK_Complete:
439 case CXXConstructExpr::CK_Delegating:
445 case CXXConstructExpr::CK_NonVirtualBase:
446 // In C++17, classes with non-virtual bases may be aggregates, so they would
447 // be initialized as aggregates without a constructor call, so we may have
448 // a base class constructed directly into an initializer list without
449 // having the derived-class constructor call on the previous stack frame.
450 // Initializer lists may be nested into more initializer lists that
451 // correspond to surrounding aggregate initializations.
452 // FIXME: For now this code essentially bails out. We need to find the
453 // correct target region and set it.
454 // FIXME: Instead of relying on the ParentMap, we should have the
455 // trigger-statement (InitListExpr in this case) passed down from CFG or
456 // otherwise always available during construction.
457 if (dyn_cast_or_null<InitListExpr>(LCtx->getParentMap().getParent(CE))) {
458 MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
459 Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(CE, LCtx));
460 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
464 case CXXConstructExpr::CK_Delegating: {
465 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
466 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
467 LCtx->getStackFrame());
468 SVal ThisVal = State->getSVal(ThisPtr);
470 if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
473 // Cast to the base type.
475 (CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase);
476 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
484 if (State != Pred->getState()) {
485 static SimpleProgramPointTag T("ExprEngine",
486 "Prepare for object construction");
487 ExplodedNodeSet DstPrepare;
488 StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
489 BldrPrepare.generateNode(CE, Pred, State, &T, ProgramPoint::PreStmtKind);
490 assert(DstPrepare.size() <= 1);
491 if (DstPrepare.size() == 0)
493 Pred = *BldrPrepare.begin();
496 CallEventManager &CEMgr = getStateManager().getCallEventManager();
497 CallEventRef<CXXConstructorCall> Call =
498 CEMgr.getCXXConstructorCall(CE, Target.getAsRegion(), State, LCtx);
500 ExplodedNodeSet DstPreVisit;
501 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
503 // FIXME: Is it possible and/or useful to do this before PreStmt?
504 ExplodedNodeSet PreInitialized;
506 StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
507 for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
508 E = DstPreVisit.end();
510 ProgramStateRef State = (*I)->getState();
511 if (CE->requiresZeroInitialization()) {
512 // FIXME: Once we properly handle constructors in new-expressions, we'll
513 // need to invalidate the region before setting a default value, to make
514 // sure there aren't any lingering bindings around. This probably needs
515 // to happen regardless of whether or not the object is zero-initialized
516 // to handle random fields of a placement-initialized object picking up
517 // old bindings. We might only want to do it when we need to, though.
518 // FIXME: This isn't actually correct for arrays -- we need to zero-
519 // initialize the entire array, not just the first element -- but our
520 // handling of arrays everywhere else is weak as well, so this shouldn't
521 // actually make things worse. Placement new makes this tricky as well,
522 // since it's then possible to be initializing one part of a multi-
523 // dimensional array.
524 State = State->bindDefaultZero(Target, LCtx);
527 Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
528 ProgramPoint::PreStmtKind);
532 ExplodedNodeSet DstPreCall;
533 getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
536 ExplodedNodeSet DstEvaluated;
537 StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
539 if (CE->getConstructor()->isTrivial() &&
540 CE->getConstructor()->isCopyOrMoveConstructor() &&
541 !CallOpts.IsArrayCtorOrDtor) {
542 // FIXME: Handle other kinds of trivial constructors as well.
543 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
545 performTrivialCopy(Bldr, *I, *Call);
548 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
550 defaultEvalCall(Bldr, *I, *Call, CallOpts);
553 // If the CFG was constructed without elements for temporary destructors
554 // and the just-called constructor created a temporary object then
555 // stop exploration if the temporary object has a noreturn constructor.
556 // This can lose coverage because the destructor, if it were present
557 // in the CFG, would be called at the end of the full expression or
558 // later (for life-time extended temporaries) -- but avoids infeasible
559 // paths when no-return temporary destructors are used for assertions.
560 const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
561 if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
562 const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
563 if (Target && isa<CXXTempObjectRegion>(Target) &&
564 Call->getDecl()->getParent()->isAnyDestructorNoReturn()) {
566 // If we've inlined the constructor, then DstEvaluated would be empty.
567 // In this case we still want a sink, which could be implemented
568 // in processCallExit. But we don't have that implemented at the moment,
569 // so if you hit this assertion, see if you can avoid inlining
570 // the respective constructor when analyzer-config cfg-temporary-dtors
572 // Otherwise there's nothing wrong with inlining such constructor.
573 assert(!DstEvaluated.empty() &&
574 "We should not have inlined this constructor!");
576 for (ExplodedNode *N : DstEvaluated) {
577 Bldr.generateSink(CE, N, N->getState());
580 // There is no need to run the PostCall and PostStmt checker
581 // callbacks because we just generated sinks on all nodes in th
587 ExplodedNodeSet DstPostArgumentCleanup;
588 for (auto I : DstEvaluated)
589 finishArgumentConstruction(DstPostArgumentCleanup, I, *Call);
591 // If there were other constructors called for object-type arguments
592 // of this constructor, clean them up.
593 ExplodedNodeSet DstPostCall;
594 getCheckerManager().runCheckersForPostCall(DstPostCall,
595 DstPostArgumentCleanup,
597 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
600 void ExprEngine::VisitCXXDestructor(QualType ObjectType,
601 const MemRegion *Dest,
605 ExplodedNodeSet &Dst,
606 const EvalCallOptions &CallOpts) {
607 const LocationContext *LCtx = Pred->getLocationContext();
608 ProgramStateRef State = Pred->getState();
610 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
611 assert(RecordDecl && "Only CXXRecordDecls should have destructors");
612 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
614 CallEventManager &CEMgr = getStateManager().getCallEventManager();
615 CallEventRef<CXXDestructorCall> Call =
616 CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
618 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
619 Call->getSourceRange().getBegin(),
620 "Error evaluating destructor");
622 ExplodedNodeSet DstPreCall;
623 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
626 ExplodedNodeSet DstInvalidated;
627 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
628 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
630 defaultEvalCall(Bldr, *I, *Call, CallOpts);
632 ExplodedNodeSet DstPostCall;
633 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
637 void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
639 ExplodedNodeSet &Dst) {
640 ProgramStateRef State = Pred->getState();
641 const LocationContext *LCtx = Pred->getLocationContext();
642 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
644 "Error evaluating New Allocator Call");
645 CallEventManager &CEMgr = getStateManager().getCallEventManager();
646 CallEventRef<CXXAllocatorCall> Call =
647 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
649 ExplodedNodeSet DstPreCall;
650 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
653 ExplodedNodeSet DstPostCall;
654 StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
655 for (auto I : DstPreCall) {
656 // FIXME: Provide evalCall for checkers?
657 defaultEvalCall(CallBldr, I, *Call);
659 // If the call is inlined, DstPostCall will be empty and we bail out now.
661 // Store return value of operator new() for future use, until the actual
662 // CXXNewExpr gets processed.
663 ExplodedNodeSet DstPostValue;
664 StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
665 for (auto I : DstPostCall) {
666 // FIXME: Because CNE serves as the "call site" for the allocator (due to
667 // lack of a better expression in the AST), the conjured return value symbol
668 // is going to be of the same type (C++ object pointer type). Technically
669 // this is not correct because the operator new's prototype always says that
670 // it returns a 'void *'. So we should change the type of the symbol,
671 // and then evaluate the cast over the symbolic pointer from 'void *' to
672 // the object pointer type. But without changing the symbol's type it
673 // is breaking too much to evaluate the no-op symbolic cast over it, so we
675 ProgramStateRef State = I->getState();
676 SVal RetVal = State->getSVal(CNE, LCtx);
678 // If this allocation function is not declared as non-throwing, failures
679 // /must/ be signalled by exceptions, and thus the return value will never
680 // be NULL. -fno-exceptions does not influence this semantics.
681 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
682 // where new can return NULL. If we end up supporting that option, we can
683 // consider adding a check for it here.
684 // C++11 [basic.stc.dynamic.allocation]p3.
685 if (const FunctionDecl *FD = CNE->getOperatorNew()) {
686 QualType Ty = FD->getType();
687 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
688 if (!ProtoType->isNothrow())
689 State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true);
692 ValueBldr.generateNode(
693 CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
696 ExplodedNodeSet DstPostPostCallCallback;
697 getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
698 DstPostValue, *Call, *this);
699 for (auto I : DstPostPostCallCallback) {
700 getCheckerManager().runCheckersForNewAllocator(
701 CNE, *getObjectUnderConstruction(I->getState(), CNE, LCtx), Dst, I,
706 void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
707 ExplodedNodeSet &Dst) {
708 // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
709 // Also, we need to decide how allocators actually work -- they're not
710 // really part of the CXXNewExpr because they happen BEFORE the
711 // CXXConstructExpr subexpression. See PR12014 for some discussion.
713 unsigned blockCount = currBldrCtx->blockCount();
714 const LocationContext *LCtx = Pred->getLocationContext();
715 SVal symVal = UnknownVal();
716 FunctionDecl *FD = CNE->getOperatorNew();
718 bool IsStandardGlobalOpNewFunction =
719 FD->isReplaceableGlobalAllocationFunction();
721 ProgramStateRef State = Pred->getState();
723 // Retrieve the stored operator new() return value.
724 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
725 symVal = *getObjectUnderConstruction(State, CNE, LCtx);
726 State = finishObjectConstruction(State, CNE, LCtx);
729 // We assume all standard global 'operator new' functions allocate memory in
730 // heap. We realize this is an approximation that might not correctly model
731 // a custom global allocator.
732 if (symVal.isUnknown()) {
733 if (IsStandardGlobalOpNewFunction)
734 symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
736 symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
740 CallEventManager &CEMgr = getStateManager().getCallEventManager();
741 CallEventRef<CXXAllocatorCall> Call =
742 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
744 if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
745 // Invalidate placement args.
746 // FIXME: Once we figure out how we want allocators to work,
747 // we should be using the usual pre-/(default-)eval-/post-call checks here.
748 State = Call->invalidateRegions(blockCount);
752 // If this allocation function is not declared as non-throwing, failures
753 // /must/ be signalled by exceptions, and thus the return value will never
754 // be NULL. -fno-exceptions does not influence this semantics.
755 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
756 // where new can return NULL. If we end up supporting that option, we can
757 // consider adding a check for it here.
758 // C++11 [basic.stc.dynamic.allocation]p3.
760 QualType Ty = FD->getType();
761 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
762 if (!ProtoType->isNothrow())
763 if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
764 State = State->assume(*dSymVal, true);
768 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
770 SVal Result = symVal;
772 if (CNE->isArray()) {
773 // FIXME: allocating an array requires simulating the constructors.
774 // For now, just return a symbolicated region.
775 if (const SubRegion *NewReg =
776 dyn_cast_or_null<SubRegion>(symVal.getAsRegion())) {
777 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
778 const ElementRegion *EleReg =
779 getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
780 Result = loc::MemRegionVal(EleReg);
782 State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
783 Bldr.generateNode(CNE, Pred, State);
787 // FIXME: Once we have proper support for CXXConstructExprs inside
788 // CXXNewExpr, we need to make sure that the constructed object is not
789 // immediately invalidated here. (The placement call should happen before
790 // the constructor call anyway.)
791 if (FD && FD->isReservedGlobalPlacementOperator()) {
792 // Non-array placement new should always return the placement location.
793 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
794 Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
795 CNE->getPlacementArg(0)->getType());
798 // Bind the address of the object, then check to see if we cached out.
799 State = State->BindExpr(CNE, LCtx, Result);
800 ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
804 // If the type is not a record, we won't have a CXXConstructExpr as an
805 // initializer. Copy the value over.
806 if (const Expr *Init = CNE->getInitializer()) {
807 if (!isa<CXXConstructExpr>(Init)) {
808 assert(Bldr.getResults().size() == 1);
809 Bldr.takeNodes(NewN);
810 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
811 /*FirstInit=*/IsStandardGlobalOpNewFunction);
816 void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
817 ExplodedNode *Pred, ExplodedNodeSet &Dst) {
818 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
819 ProgramStateRef state = Pred->getState();
820 Bldr.generateNode(CDE, Pred, state);
823 void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
825 ExplodedNodeSet &Dst) {
826 const VarDecl *VD = CS->getExceptionDecl();
832 const LocationContext *LCtx = Pred->getLocationContext();
833 SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
834 currBldrCtx->blockCount());
835 ProgramStateRef state = Pred->getState();
836 state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
838 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
839 Bldr.generateNode(CS, Pred, state);
842 void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
843 ExplodedNodeSet &Dst) {
844 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
846 // Get the this object region from StoreManager.
847 const LocationContext *LCtx = Pred->getLocationContext();
849 svalBuilder.getRegionManager().getCXXThisRegion(
850 getContext().getCanonicalType(TE->getType()),
853 ProgramStateRef state = Pred->getState();
854 SVal V = state->getSVal(loc::MemRegionVal(R));
855 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
858 void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
859 ExplodedNodeSet &Dst) {
860 const LocationContext *LocCtxt = Pred->getLocationContext();
862 // Get the region of the lambda itself.
863 const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
865 SVal V = loc::MemRegionVal(R);
867 ProgramStateRef State = Pred->getState();
869 // If we created a new MemRegion for the lambda, we should explicitly bind
871 CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin();
872 for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
873 e = LE->capture_init_end();
874 i != e; ++i, ++CurField) {
875 FieldDecl *FieldForCapture = *CurField;
876 SVal FieldLoc = State->getLValue(FieldForCapture, V);
879 if (!FieldForCapture->hasCapturedVLAType()) {
881 assert(InitExpr && "Capture missing initialization expression");
882 InitVal = State->getSVal(InitExpr, LocCtxt);
884 // The field stores the length of a captured variable-length array.
885 // These captures don't have initialization expressions; instead we
886 // get the length from the VLAType size expression.
887 Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
888 InitVal = State->getSVal(SizeExpr, LocCtxt);
891 State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
894 // Decay the Loc into an RValue, because there might be a
895 // MaterializeTemporaryExpr node above this one which expects the bound value
897 SVal LambdaRVal = State->getSVal(R);
900 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
901 // FIXME: is this the right program point kind?
902 Bldr.generateNode(LE, Pred,
903 State->BindExpr(LE, LocCtxt, LambdaRVal),
904 nullptr, ProgramPoint::PostLValueKind);
906 // FIXME: Move all post/pre visits to ::Visit().
907 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);