ExprEngineC.cpp revision 353358
1//=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file defines ExprEngine's support for C expressions. 10// 11//===----------------------------------------------------------------------===// 12 13#include "clang/AST/ExprCXX.h" 14#include "clang/AST/DeclCXX.h" 15#include "clang/StaticAnalyzer/Core/CheckerManager.h" 16#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17 18using namespace clang; 19using namespace ento; 20using llvm::APSInt; 21 22/// Optionally conjure and return a symbol for offset when processing 23/// an expression \p Expression. 24/// If \p Other is a location, conjure a symbol for \p Symbol 25/// (offset) if it is unknown so that memory arithmetic always 26/// results in an ElementRegion. 27/// \p Count The number of times the current basic block was visited. 28static SVal conjureOffsetSymbolOnLocation( 29 SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder, 30 unsigned Count, const LocationContext *LCtx) { 31 QualType Ty = Expression->getType(); 32 if (Other.getAs<Loc>() && 33 Ty->isIntegralOrEnumerationType() && 34 Symbol.isUnknown()) { 35 return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count); 36 } 37 return Symbol; 38} 39 40void ExprEngine::VisitBinaryOperator(const BinaryOperator* B, 41 ExplodedNode *Pred, 42 ExplodedNodeSet &Dst) { 43 44 Expr *LHS = B->getLHS()->IgnoreParens(); 45 Expr *RHS = B->getRHS()->IgnoreParens(); 46 47 // FIXME: Prechecks eventually go in ::Visit(). 48 ExplodedNodeSet CheckedSet; 49 ExplodedNodeSet Tmp2; 50 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this); 51 52 // With both the LHS and RHS evaluated, process the operation itself. 53 for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end(); 54 it != ei; ++it) { 55 56 ProgramStateRef state = (*it)->getState(); 57 const LocationContext *LCtx = (*it)->getLocationContext(); 58 SVal LeftV = state->getSVal(LHS, LCtx); 59 SVal RightV = state->getSVal(RHS, LCtx); 60 61 BinaryOperator::Opcode Op = B->getOpcode(); 62 63 if (Op == BO_Assign) { 64 // EXPERIMENTAL: "Conjured" symbols. 65 // FIXME: Handle structs. 66 if (RightV.isUnknown()) { 67 unsigned Count = currBldrCtx->blockCount(); 68 RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, 69 Count); 70 } 71 // Simulate the effects of a "store": bind the value of the RHS 72 // to the L-Value represented by the LHS. 73 SVal ExprVal = B->isGLValue() ? LeftV : RightV; 74 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal), 75 LeftV, RightV); 76 continue; 77 } 78 79 if (!B->isAssignmentOp()) { 80 StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx); 81 82 if (B->isAdditiveOp()) { 83 // TODO: This can be removed after we enable history tracking with 84 // SymSymExpr. 85 unsigned Count = currBldrCtx->blockCount(); 86 RightV = conjureOffsetSymbolOnLocation( 87 RightV, LeftV, RHS, svalBuilder, Count, LCtx); 88 LeftV = conjureOffsetSymbolOnLocation( 89 LeftV, RightV, LHS, svalBuilder, Count, LCtx); 90 } 91 92 // Although we don't yet model pointers-to-members, we do need to make 93 // sure that the members of temporaries have a valid 'this' pointer for 94 // other checks. 95 if (B->getOpcode() == BO_PtrMemD) 96 state = createTemporaryRegionIfNeeded(state, LCtx, LHS); 97 98 // Process non-assignments except commas or short-circuited 99 // logical expressions (LAnd and LOr). 100 SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); 101 if (!Result.isUnknown()) { 102 state = state->BindExpr(B, LCtx, Result); 103 } else { 104 // If we cannot evaluate the operation escape the operands. 105 state = escapeValue(state, LeftV, PSK_EscapeOther); 106 state = escapeValue(state, RightV, PSK_EscapeOther); 107 } 108 109 Bldr.generateNode(B, *it, state); 110 continue; 111 } 112 113 assert (B->isCompoundAssignmentOp()); 114 115 switch (Op) { 116 default: 117 llvm_unreachable("Invalid opcode for compound assignment."); 118 case BO_MulAssign: Op = BO_Mul; break; 119 case BO_DivAssign: Op = BO_Div; break; 120 case BO_RemAssign: Op = BO_Rem; break; 121 case BO_AddAssign: Op = BO_Add; break; 122 case BO_SubAssign: Op = BO_Sub; break; 123 case BO_ShlAssign: Op = BO_Shl; break; 124 case BO_ShrAssign: Op = BO_Shr; break; 125 case BO_AndAssign: Op = BO_And; break; 126 case BO_XorAssign: Op = BO_Xor; break; 127 case BO_OrAssign: Op = BO_Or; break; 128 } 129 130 // Perform a load (the LHS). This performs the checks for 131 // null dereferences, and so on. 132 ExplodedNodeSet Tmp; 133 SVal location = LeftV; 134 evalLoad(Tmp, B, LHS, *it, state, location); 135 136 for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; 137 ++I) { 138 139 state = (*I)->getState(); 140 const LocationContext *LCtx = (*I)->getLocationContext(); 141 SVal V = state->getSVal(LHS, LCtx); 142 143 // Get the computation type. 144 QualType CTy = 145 cast<CompoundAssignOperator>(B)->getComputationResultType(); 146 CTy = getContext().getCanonicalType(CTy); 147 148 QualType CLHSTy = 149 cast<CompoundAssignOperator>(B)->getComputationLHSType(); 150 CLHSTy = getContext().getCanonicalType(CLHSTy); 151 152 QualType LTy = getContext().getCanonicalType(LHS->getType()); 153 154 // Promote LHS. 155 V = svalBuilder.evalCast(V, CLHSTy, LTy); 156 157 // Compute the result of the operation. 158 SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), 159 B->getType(), CTy); 160 161 // EXPERIMENTAL: "Conjured" symbols. 162 // FIXME: Handle structs. 163 164 SVal LHSVal; 165 166 if (Result.isUnknown()) { 167 // The symbolic value is actually for the type of the left-hand side 168 // expression, not the computation type, as this is the value the 169 // LValue on the LHS will bind to. 170 LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy, 171 currBldrCtx->blockCount()); 172 // However, we need to convert the symbol to the computation type. 173 Result = svalBuilder.evalCast(LHSVal, CTy, LTy); 174 } 175 else { 176 // The left-hand side may bind to a different value then the 177 // computation type. 178 LHSVal = svalBuilder.evalCast(Result, LTy, CTy); 179 } 180 181 // In C++, assignment and compound assignment operators return an 182 // lvalue. 183 if (B->isGLValue()) 184 state = state->BindExpr(B, LCtx, location); 185 else 186 state = state->BindExpr(B, LCtx, Result); 187 188 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal); 189 } 190 } 191 192 // FIXME: postvisits eventually go in ::Visit() 193 getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this); 194} 195 196void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 197 ExplodedNodeSet &Dst) { 198 199 CanQualType T = getContext().getCanonicalType(BE->getType()); 200 201 const BlockDecl *BD = BE->getBlockDecl(); 202 // Get the value of the block itself. 203 SVal V = svalBuilder.getBlockPointer(BD, T, 204 Pred->getLocationContext(), 205 currBldrCtx->blockCount()); 206 207 ProgramStateRef State = Pred->getState(); 208 209 // If we created a new MemRegion for the block, we should explicitly bind 210 // the captured variables. 211 if (const BlockDataRegion *BDR = 212 dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { 213 214 BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(), 215 E = BDR->referenced_vars_end(); 216 217 auto CI = BD->capture_begin(); 218 auto CE = BD->capture_end(); 219 for (; I != E; ++I) { 220 const VarRegion *capturedR = I.getCapturedRegion(); 221 const VarRegion *originalR = I.getOriginalRegion(); 222 223 // If the capture had a copy expression, use the result of evaluating 224 // that expression, otherwise use the original value. 225 // We rely on the invariant that the block declaration's capture variables 226 // are a prefix of the BlockDataRegion's referenced vars (which may include 227 // referenced globals, etc.) to enable fast lookup of the capture for a 228 // given referenced var. 229 const Expr *copyExpr = nullptr; 230 if (CI != CE) { 231 assert(CI->getVariable() == capturedR->getDecl()); 232 copyExpr = CI->getCopyExpr(); 233 CI++; 234 } 235 236 if (capturedR != originalR) { 237 SVal originalV; 238 const LocationContext *LCtx = Pred->getLocationContext(); 239 if (copyExpr) { 240 originalV = State->getSVal(copyExpr, LCtx); 241 } else { 242 originalV = State->getSVal(loc::MemRegionVal(originalR)); 243 } 244 State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx); 245 } 246 } 247 } 248 249 ExplodedNodeSet Tmp; 250 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx); 251 Bldr.generateNode(BE, Pred, 252 State->BindExpr(BE, Pred->getLocationContext(), V), 253 nullptr, ProgramPoint::PostLValueKind); 254 255 // FIXME: Move all post/pre visits to ::Visit(). 256 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this); 257} 258 259ProgramStateRef ExprEngine::handleLValueBitCast( 260 ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx, 261 QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr, 262 ExplodedNode* Pred) { 263 if (T->isLValueReferenceType()) { 264 assert(!CastE->getType()->isLValueReferenceType()); 265 ExTy = getContext().getLValueReferenceType(ExTy); 266 } else if (T->isRValueReferenceType()) { 267 assert(!CastE->getType()->isRValueReferenceType()); 268 ExTy = getContext().getRValueReferenceType(ExTy); 269 } 270 // Delegate to SValBuilder to process. 271 SVal OrigV = state->getSVal(Ex, LCtx); 272 SVal V = svalBuilder.evalCast(OrigV, T, ExTy); 273 // Negate the result if we're treating the boolean as a signed i1 274 if (CastE->getCastKind() == CK_BooleanToSignedIntegral) 275 V = evalMinus(V); 276 state = state->BindExpr(CastE, LCtx, V); 277 if (V.isUnknown() && !OrigV.isUnknown()) { 278 state = escapeValue(state, OrigV, PSK_EscapeOther); 279 } 280 Bldr.generateNode(CastE, Pred, state); 281 282 return state; 283} 284 285ProgramStateRef ExprEngine::handleLVectorSplat( 286 ProgramStateRef state, const LocationContext* LCtx, const CastExpr* CastE, 287 StmtNodeBuilder &Bldr, ExplodedNode* Pred) { 288 // Recover some path sensitivity by conjuring a new value. 289 QualType resultType = CastE->getType(); 290 if (CastE->isGLValue()) 291 resultType = getContext().getPointerType(resultType); 292 SVal result = svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, 293 resultType, 294 currBldrCtx->blockCount()); 295 state = state->BindExpr(CastE, LCtx, result); 296 Bldr.generateNode(CastE, Pred, state); 297 298 return state; 299} 300 301void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 302 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 303 304 ExplodedNodeSet dstPreStmt; 305 getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this); 306 307 if (CastE->getCastKind() == CK_LValueToRValue) { 308 for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 309 I!=E; ++I) { 310 ExplodedNode *subExprNode = *I; 311 ProgramStateRef state = subExprNode->getState(); 312 const LocationContext *LCtx = subExprNode->getLocationContext(); 313 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx)); 314 } 315 return; 316 } 317 318 // All other casts. 319 QualType T = CastE->getType(); 320 QualType ExTy = Ex->getType(); 321 322 if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) 323 T = ExCast->getTypeAsWritten(); 324 325 StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx); 326 for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 327 I != E; ++I) { 328 329 Pred = *I; 330 ProgramStateRef state = Pred->getState(); 331 const LocationContext *LCtx = Pred->getLocationContext(); 332 333 switch (CastE->getCastKind()) { 334 case CK_LValueToRValue: 335 llvm_unreachable("LValueToRValue casts handled earlier."); 336 case CK_ToVoid: 337 continue; 338 // The analyzer doesn't do anything special with these casts, 339 // since it understands retain/release semantics already. 340 case CK_ARCProduceObject: 341 case CK_ARCConsumeObject: 342 case CK_ARCReclaimReturnedObject: 343 case CK_ARCExtendBlockObject: // Fall-through. 344 case CK_CopyAndAutoreleaseBlockObject: 345 // The analyser can ignore atomic casts for now, although some future 346 // checkers may want to make certain that you're not modifying the same 347 // value through atomic and nonatomic pointers. 348 case CK_AtomicToNonAtomic: 349 case CK_NonAtomicToAtomic: 350 // True no-ops. 351 case CK_NoOp: 352 case CK_ConstructorConversion: 353 case CK_UserDefinedConversion: 354 case CK_FunctionToPointerDecay: 355 case CK_BuiltinFnToFnPtr: { 356 // Copy the SVal of Ex to CastE. 357 ProgramStateRef state = Pred->getState(); 358 const LocationContext *LCtx = Pred->getLocationContext(); 359 SVal V = state->getSVal(Ex, LCtx); 360 state = state->BindExpr(CastE, LCtx, V); 361 Bldr.generateNode(CastE, Pred, state); 362 continue; 363 } 364 case CK_MemberPointerToBoolean: 365 case CK_PointerToBoolean: { 366 SVal V = state->getSVal(Ex, LCtx); 367 auto PTMSV = V.getAs<nonloc::PointerToMember>(); 368 if (PTMSV) 369 V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy); 370 if (V.isUndef() || PTMSV) { 371 state = state->BindExpr(CastE, LCtx, V); 372 Bldr.generateNode(CastE, Pred, state); 373 continue; 374 } 375 // Explicitly proceed with default handler for this case cascade. 376 state = 377 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 378 continue; 379 } 380 case CK_Dependent: 381 case CK_ArrayToPointerDecay: 382 case CK_BitCast: 383 case CK_LValueToRValueBitCast: 384 case CK_AddressSpaceConversion: 385 case CK_BooleanToSignedIntegral: 386 case CK_IntegralToPointer: 387 case CK_PointerToIntegral: { 388 SVal V = state->getSVal(Ex, LCtx); 389 if (V.getAs<nonloc::PointerToMember>()) { 390 state = state->BindExpr(CastE, LCtx, UnknownVal()); 391 Bldr.generateNode(CastE, Pred, state); 392 continue; 393 } 394 // Explicitly proceed with default handler for this case cascade. 395 state = 396 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 397 continue; 398 } 399 case CK_IntegralToBoolean: 400 case CK_IntegralToFloating: 401 case CK_FloatingToIntegral: 402 case CK_FloatingToBoolean: 403 case CK_FloatingCast: 404 case CK_FloatingRealToComplex: 405 case CK_FloatingComplexToReal: 406 case CK_FloatingComplexToBoolean: 407 case CK_FloatingComplexCast: 408 case CK_FloatingComplexToIntegralComplex: 409 case CK_IntegralRealToComplex: 410 case CK_IntegralComplexToReal: 411 case CK_IntegralComplexToBoolean: 412 case CK_IntegralComplexCast: 413 case CK_IntegralComplexToFloatingComplex: 414 case CK_CPointerToObjCPointerCast: 415 case CK_BlockPointerToObjCPointerCast: 416 case CK_AnyPointerToBlockPointerCast: 417 case CK_ObjCObjectLValueCast: 418 case CK_ZeroToOCLOpaqueType: 419 case CK_IntToOCLSampler: 420 case CK_LValueBitCast: 421 case CK_FixedPointCast: 422 case CK_FixedPointToBoolean: 423 case CK_FixedPointToIntegral: 424 case CK_IntegralToFixedPoint: { 425 state = 426 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 427 continue; 428 } 429 case CK_IntegralCast: { 430 // Delegate to SValBuilder to process. 431 SVal V = state->getSVal(Ex, LCtx); 432 V = svalBuilder.evalIntegralCast(state, V, T, ExTy); 433 state = state->BindExpr(CastE, LCtx, V); 434 Bldr.generateNode(CastE, Pred, state); 435 continue; 436 } 437 case CK_DerivedToBase: 438 case CK_UncheckedDerivedToBase: { 439 // For DerivedToBase cast, delegate to the store manager. 440 SVal val = state->getSVal(Ex, LCtx); 441 val = getStoreManager().evalDerivedToBase(val, CastE); 442 state = state->BindExpr(CastE, LCtx, val); 443 Bldr.generateNode(CastE, Pred, state); 444 continue; 445 } 446 // Handle C++ dyn_cast. 447 case CK_Dynamic: { 448 SVal val = state->getSVal(Ex, LCtx); 449 450 // Compute the type of the result. 451 QualType resultType = CastE->getType(); 452 if (CastE->isGLValue()) 453 resultType = getContext().getPointerType(resultType); 454 455 bool Failed = false; 456 457 // Check if the value being cast evaluates to 0. 458 if (val.isZeroConstant()) 459 Failed = true; 460 // Else, evaluate the cast. 461 else 462 val = getStoreManager().attemptDownCast(val, T, Failed); 463 464 if (Failed) { 465 if (T->isReferenceType()) { 466 // A bad_cast exception is thrown if input value is a reference. 467 // Currently, we model this, by generating a sink. 468 Bldr.generateSink(CastE, Pred, state); 469 continue; 470 } else { 471 // If the cast fails on a pointer, bind to 0. 472 state = state->BindExpr(CastE, LCtx, svalBuilder.makeNull()); 473 } 474 } else { 475 // If we don't know if the cast succeeded, conjure a new symbol. 476 if (val.isUnknown()) { 477 DefinedOrUnknownSVal NewSym = 478 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 479 currBldrCtx->blockCount()); 480 state = state->BindExpr(CastE, LCtx, NewSym); 481 } else 482 // Else, bind to the derived region value. 483 state = state->BindExpr(CastE, LCtx, val); 484 } 485 Bldr.generateNode(CastE, Pred, state); 486 continue; 487 } 488 case CK_BaseToDerived: { 489 SVal val = state->getSVal(Ex, LCtx); 490 QualType resultType = CastE->getType(); 491 if (CastE->isGLValue()) 492 resultType = getContext().getPointerType(resultType); 493 494 bool Failed = false; 495 496 if (!val.isConstant()) { 497 val = getStoreManager().attemptDownCast(val, T, Failed); 498 } 499 500 // Failed to cast or the result is unknown, fall back to conservative. 501 if (Failed || val.isUnknown()) { 502 val = 503 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 504 currBldrCtx->blockCount()); 505 } 506 state = state->BindExpr(CastE, LCtx, val); 507 Bldr.generateNode(CastE, Pred, state); 508 continue; 509 } 510 case CK_NullToPointer: { 511 SVal V = svalBuilder.makeNull(); 512 state = state->BindExpr(CastE, LCtx, V); 513 Bldr.generateNode(CastE, Pred, state); 514 continue; 515 } 516 case CK_NullToMemberPointer: { 517 SVal V = svalBuilder.getMemberPointer(nullptr); 518 state = state->BindExpr(CastE, LCtx, V); 519 Bldr.generateNode(CastE, Pred, state); 520 continue; 521 } 522 case CK_DerivedToBaseMemberPointer: 523 case CK_BaseToDerivedMemberPointer: 524 case CK_ReinterpretMemberPointer: { 525 SVal V = state->getSVal(Ex, LCtx); 526 if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) { 527 SVal CastedPTMSV = svalBuilder.makePointerToMember( 528 getBasicVals().accumCXXBase( 529 llvm::make_range<CastExpr::path_const_iterator>( 530 CastE->path_begin(), CastE->path_end()), *PTMSV)); 531 state = state->BindExpr(CastE, LCtx, CastedPTMSV); 532 Bldr.generateNode(CastE, Pred, state); 533 continue; 534 } 535 // Explicitly proceed with default handler for this case cascade. 536 state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred); 537 continue; 538 } 539 // Various C++ casts that are not handled yet. 540 case CK_ToUnion: 541 case CK_VectorSplat: { 542 state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred); 543 continue; 544 } 545 } 546 } 547} 548 549void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, 550 ExplodedNode *Pred, 551 ExplodedNodeSet &Dst) { 552 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 553 554 ProgramStateRef State = Pred->getState(); 555 const LocationContext *LCtx = Pred->getLocationContext(); 556 557 const Expr *Init = CL->getInitializer(); 558 SVal V = State->getSVal(CL->getInitializer(), LCtx); 559 560 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) { 561 // No work needed. Just pass the value up to this expression. 562 } else { 563 assert(isa<InitListExpr>(Init)); 564 Loc CLLoc = State->getLValue(CL, LCtx); 565 State = State->bindLoc(CLLoc, V, LCtx); 566 567 if (CL->isGLValue()) 568 V = CLLoc; 569 } 570 571 B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V)); 572} 573 574void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 575 ExplodedNodeSet &Dst) { 576 // Assumption: The CFG has one DeclStmt per Decl. 577 const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin()); 578 579 if (!VD) { 580 //TODO:AZ: remove explicit insertion after refactoring is done. 581 Dst.insert(Pred); 582 return; 583 } 584 585 // FIXME: all pre/post visits should eventually be handled by ::Visit(). 586 ExplodedNodeSet dstPreVisit; 587 getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this); 588 589 ExplodedNodeSet dstEvaluated; 590 StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx); 591 for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end(); 592 I!=E; ++I) { 593 ExplodedNode *N = *I; 594 ProgramStateRef state = N->getState(); 595 const LocationContext *LC = N->getLocationContext(); 596 597 // Decls without InitExpr are not initialized explicitly. 598 if (const Expr *InitEx = VD->getInit()) { 599 600 // Note in the state that the initialization has occurred. 601 ExplodedNode *UpdatedN = N; 602 SVal InitVal = state->getSVal(InitEx, LC); 603 604 assert(DS->isSingleDecl()); 605 if (getObjectUnderConstruction(state, DS, LC)) { 606 state = finishObjectConstruction(state, DS, LC); 607 // We constructed the object directly in the variable. 608 // No need to bind anything. 609 B.generateNode(DS, UpdatedN, state); 610 } else { 611 // Recover some path-sensitivity if a scalar value evaluated to 612 // UnknownVal. 613 if (InitVal.isUnknown()) { 614 QualType Ty = InitEx->getType(); 615 if (InitEx->isGLValue()) { 616 Ty = getContext().getPointerType(Ty); 617 } 618 619 InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty, 620 currBldrCtx->blockCount()); 621 } 622 623 624 B.takeNodes(UpdatedN); 625 ExplodedNodeSet Dst2; 626 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true); 627 B.addNodes(Dst2); 628 } 629 } 630 else { 631 B.generateNode(DS, N, state); 632 } 633 } 634 635 getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this); 636} 637 638void ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, 639 ExplodedNodeSet &Dst) { 640 // This method acts upon CFG elements for logical operators && and || 641 // and attaches the value (true or false) to them as expressions. 642 // It doesn't produce any state splits. 643 // If we made it that far, we're past the point when we modeled the short 644 // circuit. It means that we should have precise knowledge about whether 645 // we've short-circuited. If we did, we already know the value we need to 646 // bind. If we didn't, the value of the RHS (casted to the boolean type) 647 // is the answer. 648 // Currently this method tries to figure out whether we've short-circuited 649 // by looking at the ExplodedGraph. This method is imperfect because there 650 // could inevitably have been merges that would have resulted in multiple 651 // potential path traversal histories. We bail out when we fail. 652 // Due to this ambiguity, a more reliable solution would have been to 653 // track the short circuit operation history path-sensitively until 654 // we evaluate the respective logical operator. 655 assert(B->getOpcode() == BO_LAnd || 656 B->getOpcode() == BO_LOr); 657 658 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 659 ProgramStateRef state = Pred->getState(); 660 661 if (B->getType()->isVectorType()) { 662 // FIXME: We do not model vector arithmetic yet. When adding support for 663 // that, note that the CFG-based reasoning below does not apply, because 664 // logical operators on vectors are not short-circuit. Currently they are 665 // modeled as short-circuit in Clang CFG but this is incorrect. 666 // Do not set the value for the expression. It'd be UnknownVal by default. 667 Bldr.generateNode(B, Pred, state); 668 return; 669 } 670 671 ExplodedNode *N = Pred; 672 while (!N->getLocation().getAs<BlockEntrance>()) { 673 ProgramPoint P = N->getLocation(); 674 assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>()); 675 (void) P; 676 if (N->pred_size() != 1) { 677 // We failed to track back where we came from. 678 Bldr.generateNode(B, Pred, state); 679 return; 680 } 681 N = *N->pred_begin(); 682 } 683 684 if (N->pred_size() != 1) { 685 // We failed to track back where we came from. 686 Bldr.generateNode(B, Pred, state); 687 return; 688 } 689 690 N = *N->pred_begin(); 691 BlockEdge BE = N->getLocation().castAs<BlockEdge>(); 692 SVal X; 693 694 // Determine the value of the expression by introspecting how we 695 // got this location in the CFG. This requires looking at the previous 696 // block we were in and what kind of control-flow transfer was involved. 697 const CFGBlock *SrcBlock = BE.getSrc(); 698 // The only terminator (if there is one) that makes sense is a logical op. 699 CFGTerminator T = SrcBlock->getTerminator(); 700 if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) { 701 (void) Term; 702 assert(Term->isLogicalOp()); 703 assert(SrcBlock->succ_size() == 2); 704 // Did we take the true or false branch? 705 unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0; 706 X = svalBuilder.makeIntVal(constant, B->getType()); 707 } 708 else { 709 // If there is no terminator, by construction the last statement 710 // in SrcBlock is the value of the enclosing expression. 711 // However, we still need to constrain that value to be 0 or 1. 712 assert(!SrcBlock->empty()); 713 CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>(); 714 const Expr *RHS = cast<Expr>(Elem.getStmt()); 715 SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext()); 716 717 if (RHSVal.isUndef()) { 718 X = RHSVal; 719 } else { 720 // We evaluate "RHSVal != 0" expression which result in 0 if the value is 721 // known to be false, 1 if the value is known to be true and a new symbol 722 // when the assumption is unknown. 723 nonloc::ConcreteInt Zero(getBasicVals().getValue(0, B->getType())); 724 X = evalBinOp(N->getState(), BO_NE, 725 svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()), 726 Zero, B->getType()); 727 } 728 } 729 Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X)); 730} 731 732void ExprEngine::VisitInitListExpr(const InitListExpr *IE, 733 ExplodedNode *Pred, 734 ExplodedNodeSet &Dst) { 735 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 736 737 ProgramStateRef state = Pred->getState(); 738 const LocationContext *LCtx = Pred->getLocationContext(); 739 QualType T = getContext().getCanonicalType(IE->getType()); 740 unsigned NumInitElements = IE->getNumInits(); 741 742 if (!IE->isGLValue() && !IE->isTransparent() && 743 (T->isArrayType() || T->isRecordType() || T->isVectorType() || 744 T->isAnyComplexType())) { 745 llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList(); 746 747 // Handle base case where the initializer has no elements. 748 // e.g: static int* myArray[] = {}; 749 if (NumInitElements == 0) { 750 SVal V = svalBuilder.makeCompoundVal(T, vals); 751 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 752 return; 753 } 754 755 for (InitListExpr::const_reverse_iterator it = IE->rbegin(), 756 ei = IE->rend(); it != ei; ++it) { 757 SVal V = state->getSVal(cast<Expr>(*it), LCtx); 758 vals = getBasicVals().prependSVal(V, vals); 759 } 760 761 B.generateNode(IE, Pred, 762 state->BindExpr(IE, LCtx, 763 svalBuilder.makeCompoundVal(T, vals))); 764 return; 765 } 766 767 // Handle scalars: int{5} and int{} and GLvalues. 768 // Note, if the InitListExpr is a GLvalue, it means that there is an address 769 // representing it, so it must have a single init element. 770 assert(NumInitElements <= 1); 771 772 SVal V; 773 if (NumInitElements == 0) 774 V = getSValBuilder().makeZeroVal(T); 775 else 776 V = state->getSVal(IE->getInit(0), LCtx); 777 778 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 779} 780 781void ExprEngine::VisitGuardedExpr(const Expr *Ex, 782 const Expr *L, 783 const Expr *R, 784 ExplodedNode *Pred, 785 ExplodedNodeSet &Dst) { 786 assert(L && R); 787 788 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 789 ProgramStateRef state = Pred->getState(); 790 const LocationContext *LCtx = Pred->getLocationContext(); 791 const CFGBlock *SrcBlock = nullptr; 792 793 // Find the predecessor block. 794 ProgramStateRef SrcState = state; 795 for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) { 796 ProgramPoint PP = N->getLocation(); 797 if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) { 798 // If the state N has multiple predecessors P, it means that successors 799 // of P are all equivalent. 800 // In turn, that means that all nodes at P are equivalent in terms 801 // of observable behavior at N, and we can follow any of them. 802 // FIXME: a more robust solution which does not walk up the tree. 803 continue; 804 } 805 SrcBlock = PP.castAs<BlockEdge>().getSrc(); 806 SrcState = N->getState(); 807 break; 808 } 809 810 assert(SrcBlock && "missing function entry"); 811 812 // Find the last expression in the predecessor block. That is the 813 // expression that is used for the value of the ternary expression. 814 bool hasValue = false; 815 SVal V; 816 817 for (CFGElement CE : llvm::reverse(*SrcBlock)) { 818 if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) { 819 const Expr *ValEx = cast<Expr>(CS->getStmt()); 820 ValEx = ValEx->IgnoreParens(); 821 822 // For GNU extension '?:' operator, the left hand side will be an 823 // OpaqueValueExpr, so get the underlying expression. 824 if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L)) 825 L = OpaqueEx->getSourceExpr(); 826 827 // If the last expression in the predecessor block matches true or false 828 // subexpression, get its the value. 829 if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) { 830 hasValue = true; 831 V = SrcState->getSVal(ValEx, LCtx); 832 } 833 break; 834 } 835 } 836 837 if (!hasValue) 838 V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, 839 currBldrCtx->blockCount()); 840 841 // Generate a new node with the binding from the appropriate path. 842 B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true)); 843} 844 845void ExprEngine:: 846VisitOffsetOfExpr(const OffsetOfExpr *OOE, 847 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 848 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 849 Expr::EvalResult Result; 850 if (OOE->EvaluateAsInt(Result, getContext())) { 851 APSInt IV = Result.Val.getInt(); 852 assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); 853 assert(OOE->getType()->isBuiltinType()); 854 assert(OOE->getType()->getAs<BuiltinType>()->isInteger()); 855 assert(IV.isSigned() == OOE->getType()->isSignedIntegerType()); 856 SVal X = svalBuilder.makeIntVal(IV); 857 B.generateNode(OOE, Pred, 858 Pred->getState()->BindExpr(OOE, Pred->getLocationContext(), 859 X)); 860 } 861 // FIXME: Handle the case where __builtin_offsetof is not a constant. 862} 863 864 865void ExprEngine:: 866VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, 867 ExplodedNode *Pred, 868 ExplodedNodeSet &Dst) { 869 // FIXME: Prechecks eventually go in ::Visit(). 870 ExplodedNodeSet CheckedSet; 871 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this); 872 873 ExplodedNodeSet EvalSet; 874 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 875 876 QualType T = Ex->getTypeOfArgument(); 877 878 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 879 I != E; ++I) { 880 if (Ex->getKind() == UETT_SizeOf) { 881 if (!T->isIncompleteType() && !T->isConstantSizeType()) { 882 assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); 883 884 // FIXME: Add support for VLA type arguments and VLA expressions. 885 // When that happens, we should probably refactor VLASizeChecker's code. 886 continue; 887 } else if (T->getAs<ObjCObjectType>()) { 888 // Some code tries to take the sizeof an ObjCObjectType, relying that 889 // the compiler has laid out its representation. Just report Unknown 890 // for these. 891 continue; 892 } 893 } 894 895 APSInt Value = Ex->EvaluateKnownConstInt(getContext()); 896 CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue()); 897 898 ProgramStateRef state = (*I)->getState(); 899 state = state->BindExpr(Ex, (*I)->getLocationContext(), 900 svalBuilder.makeIntVal(amt.getQuantity(), 901 Ex->getType())); 902 Bldr.generateNode(Ex, *I, state); 903 } 904 905 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this); 906} 907 908void ExprEngine::handleUOExtension(ExplodedNodeSet::iterator I, 909 const UnaryOperator *U, 910 StmtNodeBuilder &Bldr) { 911 // FIXME: We can probably just have some magic in Environment::getSVal() 912 // that propagates values, instead of creating a new node here. 913 // 914 // Unary "+" is a no-op, similar to a parentheses. We still have places 915 // where it may be a block-level expression, so we need to 916 // generate an extra node that just propagates the value of the 917 // subexpression. 918 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 919 ProgramStateRef state = (*I)->getState(); 920 const LocationContext *LCtx = (*I)->getLocationContext(); 921 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, 922 state->getSVal(Ex, LCtx))); 923} 924 925void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, ExplodedNode *Pred, 926 ExplodedNodeSet &Dst) { 927 // FIXME: Prechecks eventually go in ::Visit(). 928 ExplodedNodeSet CheckedSet; 929 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this); 930 931 ExplodedNodeSet EvalSet; 932 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 933 934 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 935 I != E; ++I) { 936 switch (U->getOpcode()) { 937 default: { 938 Bldr.takeNodes(*I); 939 ExplodedNodeSet Tmp; 940 VisitIncrementDecrementOperator(U, *I, Tmp); 941 Bldr.addNodes(Tmp); 942 break; 943 } 944 case UO_Real: { 945 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 946 947 // FIXME: We don't have complex SValues yet. 948 if (Ex->getType()->isAnyComplexType()) { 949 // Just report "Unknown." 950 break; 951 } 952 953 // For all other types, UO_Real is an identity operation. 954 assert (U->getType() == Ex->getType()); 955 ProgramStateRef state = (*I)->getState(); 956 const LocationContext *LCtx = (*I)->getLocationContext(); 957 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, 958 state->getSVal(Ex, LCtx))); 959 break; 960 } 961 962 case UO_Imag: { 963 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 964 // FIXME: We don't have complex SValues yet. 965 if (Ex->getType()->isAnyComplexType()) { 966 // Just report "Unknown." 967 break; 968 } 969 // For all other types, UO_Imag returns 0. 970 ProgramStateRef state = (*I)->getState(); 971 const LocationContext *LCtx = (*I)->getLocationContext(); 972 SVal X = svalBuilder.makeZeroVal(Ex->getType()); 973 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X)); 974 break; 975 } 976 977 case UO_AddrOf: { 978 // Process pointer-to-member address operation. 979 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 980 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) { 981 const ValueDecl *VD = DRE->getDecl(); 982 983 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) { 984 ProgramStateRef State = (*I)->getState(); 985 const LocationContext *LCtx = (*I)->getLocationContext(); 986 SVal SV = svalBuilder.getMemberPointer(cast<DeclaratorDecl>(VD)); 987 Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV)); 988 break; 989 } 990 } 991 // Explicitly proceed with default handler for this case cascade. 992 handleUOExtension(I, U, Bldr); 993 break; 994 } 995 case UO_Plus: 996 assert(!U->isGLValue()); 997 LLVM_FALLTHROUGH; 998 case UO_Deref: 999 case UO_Extension: { 1000 handleUOExtension(I, U, Bldr); 1001 break; 1002 } 1003 1004 case UO_LNot: 1005 case UO_Minus: 1006 case UO_Not: { 1007 assert (!U->isGLValue()); 1008 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1009 ProgramStateRef state = (*I)->getState(); 1010 const LocationContext *LCtx = (*I)->getLocationContext(); 1011 1012 // Get the value of the subexpression. 1013 SVal V = state->getSVal(Ex, LCtx); 1014 1015 if (V.isUnknownOrUndef()) { 1016 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V)); 1017 break; 1018 } 1019 1020 switch (U->getOpcode()) { 1021 default: 1022 llvm_unreachable("Invalid Opcode."); 1023 case UO_Not: 1024 // FIXME: Do we need to handle promotions? 1025 state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>())); 1026 break; 1027 case UO_Minus: 1028 // FIXME: Do we need to handle promotions? 1029 state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>())); 1030 break; 1031 case UO_LNot: 1032 // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." 1033 // 1034 // Note: technically we do "E == 0", but this is the same in the 1035 // transfer functions as "0 == E". 1036 SVal Result; 1037 if (Optional<Loc> LV = V.getAs<Loc>()) { 1038 Loc X = svalBuilder.makeNullWithType(Ex->getType()); 1039 Result = evalBinOp(state, BO_EQ, *LV, X, U->getType()); 1040 } else if (Ex->getType()->isFloatingType()) { 1041 // FIXME: handle floating point types. 1042 Result = UnknownVal(); 1043 } else { 1044 nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); 1045 Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X, 1046 U->getType()); 1047 } 1048 1049 state = state->BindExpr(U, LCtx, Result); 1050 break; 1051 } 1052 Bldr.generateNode(U, *I, state); 1053 break; 1054 } 1055 } 1056 } 1057 1058 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this); 1059} 1060 1061void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U, 1062 ExplodedNode *Pred, 1063 ExplodedNodeSet &Dst) { 1064 // Handle ++ and -- (both pre- and post-increment). 1065 assert (U->isIncrementDecrementOp()); 1066 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1067 1068 const LocationContext *LCtx = Pred->getLocationContext(); 1069 ProgramStateRef state = Pred->getState(); 1070 SVal loc = state->getSVal(Ex, LCtx); 1071 1072 // Perform a load. 1073 ExplodedNodeSet Tmp; 1074 evalLoad(Tmp, U, Ex, Pred, state, loc); 1075 1076 ExplodedNodeSet Dst2; 1077 StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx); 1078 for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) { 1079 1080 state = (*I)->getState(); 1081 assert(LCtx == (*I)->getLocationContext()); 1082 SVal V2_untested = state->getSVal(Ex, LCtx); 1083 1084 // Propagate unknown and undefined values. 1085 if (V2_untested.isUnknownOrUndef()) { 1086 state = state->BindExpr(U, LCtx, V2_untested); 1087 1088 // Perform the store, so that the uninitialized value detection happens. 1089 Bldr.takeNodes(*I); 1090 ExplodedNodeSet Dst3; 1091 evalStore(Dst3, U, Ex, *I, state, loc, V2_untested); 1092 Bldr.addNodes(Dst3); 1093 1094 continue; 1095 } 1096 DefinedSVal V2 = V2_untested.castAs<DefinedSVal>(); 1097 1098 // Handle all other values. 1099 BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub; 1100 1101 // If the UnaryOperator has non-location type, use its type to create the 1102 // constant value. If the UnaryOperator has location type, create the 1103 // constant with int type and pointer width. 1104 SVal RHS; 1105 SVal Result; 1106 1107 if (U->getType()->isAnyPointerType()) 1108 RHS = svalBuilder.makeArrayIndex(1); 1109 else if (U->getType()->isIntegralOrEnumerationType()) 1110 RHS = svalBuilder.makeIntVal(1, U->getType()); 1111 else 1112 RHS = UnknownVal(); 1113 1114 // The use of an operand of type bool with the ++ operators is deprecated 1115 // but valid until C++17. And if the operand of the ++ operator is of type 1116 // bool, it is set to true until C++17. Note that for '_Bool', it is also 1117 // set to true when it encounters ++ operator. 1118 if (U->getType()->isBooleanType() && U->isIncrementOp()) 1119 Result = svalBuilder.makeTruthVal(true, U->getType()); 1120 else 1121 Result = evalBinOp(state, Op, V2, RHS, U->getType()); 1122 1123 // Conjure a new symbol if necessary to recover precision. 1124 if (Result.isUnknown()){ 1125 DefinedOrUnknownSVal SymVal = 1126 svalBuilder.conjureSymbolVal(nullptr, U, LCtx, 1127 currBldrCtx->blockCount()); 1128 Result = SymVal; 1129 1130 // If the value is a location, ++/-- should always preserve 1131 // non-nullness. Check if the original value was non-null, and if so 1132 // propagate that constraint. 1133 if (Loc::isLocType(U->getType())) { 1134 DefinedOrUnknownSVal Constraint = 1135 svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); 1136 1137 if (!state->assume(Constraint, true)) { 1138 // It isn't feasible for the original value to be null. 1139 // Propagate this constraint. 1140 Constraint = svalBuilder.evalEQ(state, SymVal, 1141 svalBuilder.makeZeroVal(U->getType())); 1142 1143 state = state->assume(Constraint, false); 1144 assert(state); 1145 } 1146 } 1147 } 1148 1149 // Since the lvalue-to-rvalue conversion is explicit in the AST, 1150 // we bind an l-value if the operator is prefix and an lvalue (in C++). 1151 if (U->isGLValue()) 1152 state = state->BindExpr(U, LCtx, loc); 1153 else 1154 state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result); 1155 1156 // Perform the store. 1157 Bldr.takeNodes(*I); 1158 ExplodedNodeSet Dst3; 1159 evalStore(Dst3, U, Ex, *I, state, loc, Result); 1160 Bldr.addNodes(Dst3); 1161 } 1162 Dst.insert(Dst2); 1163} 1164