1 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This file defines the C++ expression evaluation engine.
12 //===----------------------------------------------------------------------===//
14 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
15 #include "clang/AST/DeclCXX.h"
16 #include "clang/AST/StmtCXX.h"
17 #include "clang/Basic/PrettyStackTrace.h"
18 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
20 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22 using namespace clang;
25 void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
27 ExplodedNodeSet &Dst) {
28 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29 const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30 ProgramStateRef state = Pred->getState();
31 const LocationContext *LCtx = Pred->getLocationContext();
33 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
34 Bldr.generateNode(ME, Pred, state);
37 // FIXME: This is the sort of code that should eventually live in a Core
38 // checker rather than as a special case in ExprEngine.
39 void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
40 const CallEvent &Call) {
42 bool AlwaysReturnsLValue;
43 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
44 assert(Ctor->getDecl()->isTrivial());
45 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
46 ThisVal = Ctor->getCXXThisVal();
47 AlwaysReturnsLValue = false;
49 assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
50 assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
52 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
53 AlwaysReturnsLValue = true;
56 const LocationContext *LCtx = Pred->getLocationContext();
61 SVal V = Call.getArgSVal(0);
63 // If the value being copied is not unknown, load from its location to get
64 // an aggregate rvalue.
65 if (Optional<Loc> L = V.getAs<Loc>())
66 V = Pred->getState()->getSVal(*L);
68 assert(V.isUnknownOrUndef());
70 const Expr *CallExpr = Call.getOriginExpr();
71 evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
73 PostStmt PS(CallExpr, LCtx);
74 for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
76 ProgramStateRef State = (*I)->getState();
77 if (AlwaysReturnsLValue)
78 State = State->BindExpr(CallExpr, LCtx, ThisVal);
80 State = bindReturnValue(Call, LCtx, State);
81 Bldr.generateNode(PS, State, *I);
86 /// Returns a region representing the first element of a (possibly
87 /// multi-dimensional) array.
89 /// On return, \p Ty will be set to the base type of the array.
91 /// If the type is not an array type at all, the original value is returned.
92 static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
94 SValBuilder &SVB = State->getStateManager().getSValBuilder();
95 ASTContext &Ctx = SVB.getContext();
97 while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
98 Ty = AT->getElementType();
99 LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
107 ExprEngine::getRegionForConstructedObject(const CXXConstructExpr *CE,
108 ExplodedNode *Pred) {
109 const LocationContext *LCtx = Pred->getLocationContext();
110 ProgramStateRef State = Pred->getState();
112 // See if we're constructing an existing region by looking at the next
113 // element in the CFG.
115 if (auto Elem = findElementDirectlyInitializedByCurrentConstructor()) {
116 if (Optional<CFGStmt> StmtElem = Elem->getAs<CFGStmt>()) {
117 auto *DS = cast<DeclStmt>(StmtElem->getStmt());
118 if (const auto *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
119 if (Var->getInit() && Var->getInit()->IgnoreImplicit() == CE) {
120 SVal LValue = State->getLValue(Var, LCtx);
121 QualType Ty = Var->getType();
122 LValue = makeZeroElementRegion(State, LValue, Ty);
123 return LValue.getAsRegion();
126 } else if (Optional<CFGInitializer> InitElem = Elem->getAs<CFGInitializer>()) {
127 const CXXCtorInitializer *Init = InitElem->getInitializer();
128 assert(Init->isAnyMemberInitializer());
129 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
131 getSValBuilder().getCXXThis(CurCtor, LCtx->getCurrentStackFrame());
132 SVal ThisVal = State->getSVal(ThisPtr);
134 const ValueDecl *Field;
136 if (Init->isIndirectMemberInitializer()) {
137 Field = Init->getIndirectMember();
138 FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
140 Field = Init->getMember();
141 FieldVal = State->getLValue(Init->getMember(), ThisVal);
144 QualType Ty = Field->getType();
145 FieldVal = makeZeroElementRegion(State, FieldVal, Ty);
146 return FieldVal.getAsRegion();
149 // FIXME: This will eventually need to handle new-expressions as well.
150 // Don't forget to update the pre-constructor initialization code in
151 // ExprEngine::VisitCXXConstructExpr.
153 // If we couldn't find an existing region to construct into, assume we're
154 // constructing a temporary.
155 MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
156 return MRMgr.getCXXTempObjectRegion(CE, LCtx);
159 /// Returns true if the initializer for \Elem can be a direct
161 static bool canHaveDirectConstructor(CFGElement Elem){
162 // DeclStmts and CXXCtorInitializers for fields can be directly constructed.
164 if (Optional<CFGStmt> StmtElem = Elem.getAs<CFGStmt>()) {
165 if (isa<DeclStmt>(StmtElem->getStmt())) {
170 if (Elem.getKind() == CFGElement::Initializer) {
178 ExprEngine::findElementDirectlyInitializedByCurrentConstructor() {
179 const NodeBuilderContext &CurrBldrCtx = getBuilderContext();
180 // See if we're constructing an existing region by looking at the next
181 // element in the CFG.
182 const CFGBlock *B = CurrBldrCtx.getBlock();
183 assert(isa<CXXConstructExpr>(((*B)[currStmtIdx]).castAs<CFGStmt>().getStmt()));
184 unsigned int NextStmtIdx = currStmtIdx + 1;
185 if (NextStmtIdx >= B->size())
188 CFGElement Next = (*B)[NextStmtIdx];
190 // Is this a destructor? If so, we might be in the middle of an assignment
191 // to a local or member: look ahead one more element to see what we find.
192 while (Next.getAs<CFGImplicitDtor>() && NextStmtIdx + 1 < B->size()) {
194 Next = (*B)[NextStmtIdx];
197 if (canHaveDirectConstructor(Next))
203 const CXXConstructExpr *
204 ExprEngine::findDirectConstructorForCurrentCFGElement() {
205 // Go backward in the CFG to see if the previous element (ignoring
206 // destructors) was a CXXConstructExpr. If so, that constructor
207 // was constructed directly into an existing region.
208 // This process is essentially the inverse of that performed in
209 // findElementDirectlyInitializedByCurrentConstructor().
210 if (currStmtIdx == 0)
213 const CFGBlock *B = getBuilderContext().getBlock();
214 assert(canHaveDirectConstructor((*B)[currStmtIdx]));
216 unsigned int PreviousStmtIdx = currStmtIdx - 1;
217 CFGElement Previous = (*B)[PreviousStmtIdx];
219 while (Previous.getAs<CFGImplicitDtor>() && PreviousStmtIdx > 0) {
221 Previous = (*B)[PreviousStmtIdx];
224 if (Optional<CFGStmt> PrevStmtElem = Previous.getAs<CFGStmt>()) {
225 if (auto *CtorExpr = dyn_cast<CXXConstructExpr>(PrevStmtElem->getStmt())) {
233 void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
235 ExplodedNodeSet &destNodes) {
236 const LocationContext *LCtx = Pred->getLocationContext();
237 ProgramStateRef State = Pred->getState();
239 const MemRegion *Target = nullptr;
241 // FIXME: Handle arrays, which run the same constructor for every element.
242 // For now, we just run the first constructor (which should still invalidate
243 // the entire array).
245 switch (CE->getConstructionKind()) {
246 case CXXConstructExpr::CK_Complete: {
247 Target = getRegionForConstructedObject(CE, Pred);
250 case CXXConstructExpr::CK_VirtualBase:
251 // Make sure we are not calling virtual base class initializers twice.
252 // Only the most-derived object should initialize virtual base classes.
253 if (const Stmt *Outer = LCtx->getCurrentStackFrame()->getCallSite()) {
254 const CXXConstructExpr *OuterCtor = dyn_cast<CXXConstructExpr>(Outer);
256 switch (OuterCtor->getConstructionKind()) {
257 case CXXConstructExpr::CK_NonVirtualBase:
258 case CXXConstructExpr::CK_VirtualBase:
262 case CXXConstructExpr::CK_Complete:
263 case CXXConstructExpr::CK_Delegating:
269 case CXXConstructExpr::CK_NonVirtualBase:
270 case CXXConstructExpr::CK_Delegating: {
271 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
272 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
273 LCtx->getCurrentStackFrame());
274 SVal ThisVal = State->getSVal(ThisPtr);
276 if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
277 Target = ThisVal.getAsRegion();
279 // Cast to the base type.
281 (CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase);
282 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
284 Target = BaseVal.getAsRegion();
290 CallEventManager &CEMgr = getStateManager().getCallEventManager();
291 CallEventRef<CXXConstructorCall> Call =
292 CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
294 ExplodedNodeSet DstPreVisit;
295 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
297 ExplodedNodeSet PreInitialized;
299 StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
300 if (CE->requiresZeroInitialization()) {
301 // Type of the zero doesn't matter.
302 SVal ZeroVal = svalBuilder.makeZeroVal(getContext().CharTy);
304 for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
305 E = DstPreVisit.end();
307 ProgramStateRef State = (*I)->getState();
308 // FIXME: Once we properly handle constructors in new-expressions, we'll
309 // need to invalidate the region before setting a default value, to make
310 // sure there aren't any lingering bindings around. This probably needs
311 // to happen regardless of whether or not the object is zero-initialized
312 // to handle random fields of a placement-initialized object picking up
313 // old bindings. We might only want to do it when we need to, though.
314 // FIXME: This isn't actually correct for arrays -- we need to zero-
315 // initialize the entire array, not just the first element -- but our
316 // handling of arrays everywhere else is weak as well, so this shouldn't
317 // actually make things worse. Placement new makes this tricky as well,
318 // since it's then possible to be initializing one part of a multi-
319 // dimensional array.
320 State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal);
321 Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
322 ProgramPoint::PreStmtKind);
327 ExplodedNodeSet DstPreCall;
328 getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
331 ExplodedNodeSet DstEvaluated;
332 StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
334 bool IsArray = isa<ElementRegion>(Target);
335 if (CE->getConstructor()->isTrivial() &&
336 CE->getConstructor()->isCopyOrMoveConstructor() &&
338 // FIXME: Handle other kinds of trivial constructors as well.
339 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
341 performTrivialCopy(Bldr, *I, *Call);
344 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
346 defaultEvalCall(Bldr, *I, *Call);
349 // If the CFG was contructed without elements for temporary destructors
350 // and the just-called constructor created a temporary object then
351 // stop exploration if the temporary object has a noreturn constructor.
352 // This can lose coverage because the destructor, if it were present
353 // in the CFG, would be called at the end of the full expression or
354 // later (for life-time extended temporaries) -- but avoids infeasible
355 // paths when no-return temporary destructors are used for assertions.
356 const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
357 if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
358 const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
359 if (Target && isa<CXXTempObjectRegion>(Target) &&
360 Call->getDecl()->getParent()->isAnyDestructorNoReturn()) {
362 for (ExplodedNode *N : DstEvaluated) {
363 Bldr.generateSink(CE, N, N->getState());
366 // There is no need to run the PostCall and PostStmtchecker
367 // callbacks because we just generated sinks on all nodes in th
373 ExplodedNodeSet DstPostCall;
374 getCheckerManager().runCheckersForPostCall(DstPostCall, DstEvaluated,
376 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
379 void ExprEngine::VisitCXXDestructor(QualType ObjectType,
380 const MemRegion *Dest,
384 ExplodedNodeSet &Dst) {
385 const LocationContext *LCtx = Pred->getLocationContext();
386 ProgramStateRef State = Pred->getState();
388 // FIXME: We need to run the same destructor on every element of the array.
389 // This workaround will just run the first destructor (which will still
390 // invalidate the entire array).
391 SVal DestVal = UnknownVal();
393 DestVal = loc::MemRegionVal(Dest);
394 DestVal = makeZeroElementRegion(State, DestVal, ObjectType);
395 Dest = DestVal.getAsRegion();
397 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
398 assert(RecordDecl && "Only CXXRecordDecls should have destructors");
399 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
401 CallEventManager &CEMgr = getStateManager().getCallEventManager();
402 CallEventRef<CXXDestructorCall> Call =
403 CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
405 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
406 Call->getSourceRange().getBegin(),
407 "Error evaluating destructor");
409 ExplodedNodeSet DstPreCall;
410 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
413 ExplodedNodeSet DstInvalidated;
414 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
415 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
417 defaultEvalCall(Bldr, *I, *Call);
419 ExplodedNodeSet DstPostCall;
420 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
424 void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
426 ExplodedNodeSet &Dst) {
427 ProgramStateRef State = Pred->getState();
428 const LocationContext *LCtx = Pred->getLocationContext();
429 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
431 "Error evaluating New Allocator Call");
432 CallEventManager &CEMgr = getStateManager().getCallEventManager();
433 CallEventRef<CXXAllocatorCall> Call =
434 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
436 ExplodedNodeSet DstPreCall;
437 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
440 ExplodedNodeSet DstInvalidated;
441 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
442 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
444 defaultEvalCall(Bldr, *I, *Call);
445 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
450 void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
451 ExplodedNodeSet &Dst) {
452 // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
453 // Also, we need to decide how allocators actually work -- they're not
454 // really part of the CXXNewExpr because they happen BEFORE the
455 // CXXConstructExpr subexpression. See PR12014 for some discussion.
457 unsigned blockCount = currBldrCtx->blockCount();
458 const LocationContext *LCtx = Pred->getLocationContext();
459 DefinedOrUnknownSVal symVal = UnknownVal();
460 FunctionDecl *FD = CNE->getOperatorNew();
462 bool IsStandardGlobalOpNewFunction = false;
463 if (FD && !isa<CXXMethodDecl>(FD) && !FD->isVariadic()) {
464 if (FD->getNumParams() == 2) {
465 QualType T = FD->getParamDecl(1)->getType();
466 if (const IdentifierInfo *II = T.getBaseTypeIdentifier())
467 // NoThrow placement new behaves as a standard new.
468 IsStandardGlobalOpNewFunction = II->getName().equals("nothrow_t");
471 // Placement forms are considered non-standard.
472 IsStandardGlobalOpNewFunction = (FD->getNumParams() == 1);
475 // We assume all standard global 'operator new' functions allocate memory in
476 // heap. We realize this is an approximation that might not correctly model
477 // a custom global allocator.
478 if (IsStandardGlobalOpNewFunction)
479 symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
481 symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
484 ProgramStateRef State = Pred->getState();
485 CallEventManager &CEMgr = getStateManager().getCallEventManager();
486 CallEventRef<CXXAllocatorCall> Call =
487 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
489 // Invalidate placement args.
490 // FIXME: Once we figure out how we want allocators to work,
491 // we should be using the usual pre-/(default-)eval-/post-call checks here.
492 State = Call->invalidateRegions(blockCount);
496 // If this allocation function is not declared as non-throwing, failures
497 // /must/ be signalled by exceptions, and thus the return value will never be
498 // NULL. -fno-exceptions does not influence this semantics.
499 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
500 // where new can return NULL. If we end up supporting that option, we can
501 // consider adding a check for it here.
502 // C++11 [basic.stc.dynamic.allocation]p3.
504 QualType Ty = FD->getType();
505 if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>())
506 if (!ProtoType->isNothrow(getContext()))
507 State = State->assume(symVal, true);
510 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
512 if (CNE->isArray()) {
513 // FIXME: allocating an array requires simulating the constructors.
514 // For now, just return a symbolicated region.
515 const MemRegion *NewReg = symVal.castAs<loc::MemRegionVal>().getRegion();
516 QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
517 const ElementRegion *EleReg =
518 getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
519 State = State->BindExpr(CNE, Pred->getLocationContext(),
520 loc::MemRegionVal(EleReg));
521 Bldr.generateNode(CNE, Pred, State);
525 // FIXME: Once we have proper support for CXXConstructExprs inside
526 // CXXNewExpr, we need to make sure that the constructed object is not
527 // immediately invalidated here. (The placement call should happen before
528 // the constructor call anyway.)
529 SVal Result = symVal;
530 if (FD && FD->isReservedGlobalPlacementOperator()) {
531 // Non-array placement new should always return the placement location.
532 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
533 Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
534 CNE->getPlacementArg(0)->getType());
537 // Bind the address of the object, then check to see if we cached out.
538 State = State->BindExpr(CNE, LCtx, Result);
539 ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
543 // If the type is not a record, we won't have a CXXConstructExpr as an
544 // initializer. Copy the value over.
545 if (const Expr *Init = CNE->getInitializer()) {
546 if (!isa<CXXConstructExpr>(Init)) {
547 assert(Bldr.getResults().size() == 1);
548 Bldr.takeNodes(NewN);
549 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
550 /*FirstInit=*/IsStandardGlobalOpNewFunction);
555 void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
556 ExplodedNode *Pred, ExplodedNodeSet &Dst) {
557 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
558 ProgramStateRef state = Pred->getState();
559 Bldr.generateNode(CDE, Pred, state);
562 void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
564 ExplodedNodeSet &Dst) {
565 const VarDecl *VD = CS->getExceptionDecl();
571 const LocationContext *LCtx = Pred->getLocationContext();
572 SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
573 currBldrCtx->blockCount());
574 ProgramStateRef state = Pred->getState();
575 state = state->bindLoc(state->getLValue(VD, LCtx), V);
577 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
578 Bldr.generateNode(CS, Pred, state);
581 void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
582 ExplodedNodeSet &Dst) {
583 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
585 // Get the this object region from StoreManager.
586 const LocationContext *LCtx = Pred->getLocationContext();
588 svalBuilder.getRegionManager().getCXXThisRegion(
589 getContext().getCanonicalType(TE->getType()),
592 ProgramStateRef state = Pred->getState();
593 SVal V = state->getSVal(loc::MemRegionVal(R));
594 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
597 void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
598 ExplodedNodeSet &Dst) {
599 const LocationContext *LocCtxt = Pred->getLocationContext();
601 // Get the region of the lambda itself.
602 const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
604 SVal V = loc::MemRegionVal(R);
606 ProgramStateRef State = Pred->getState();
608 // If we created a new MemRegion for the lambda, we should explicitly bind
610 CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin();
611 for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
612 e = LE->capture_init_end();
613 i != e; ++i, ++CurField) {
614 FieldDecl *FieldForCapture = *CurField;
615 SVal FieldLoc = State->getLValue(FieldForCapture, V);
618 if (!FieldForCapture->hasCapturedVLAType()) {
620 assert(InitExpr && "Capture missing initialization expression");
621 InitVal = State->getSVal(InitExpr, LocCtxt);
623 // The field stores the length of a captured variable-length array.
624 // These captures don't have initialization expressions; instead we
625 // get the length from the VLAType size expression.
626 Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
627 InitVal = State->getSVal(SizeExpr, LocCtxt);
630 State = State->bindLoc(FieldLoc, InitVal);
633 // Decay the Loc into an RValue, because there might be a
634 // MaterializeTemporaryExpr node above this one which expects the bound value
636 SVal LambdaRVal = State->getSVal(R);
639 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
640 // FIXME: is this the right program point kind?
641 Bldr.generateNode(LE, Pred,
642 State->BindExpr(LE, LocCtxt, LambdaRVal),
643 nullptr, ProgramPoint::PostLValueKind);
645 // FIXME: Move all post/pre visits to ::Visit().
646 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);