ExprEngineCXX.cpp revision 360784
1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// This file defines the C++ expression evaluation engine. 10// 11//===----------------------------------------------------------------------===// 12 13#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 14#include "clang/Analysis/ConstructionContext.h" 15#include "clang/AST/DeclCXX.h" 16#include "clang/AST/StmtCXX.h" 17#include "clang/AST/ParentMap.h" 18#include "clang/Basic/PrettyStackTrace.h" 19#include "clang/StaticAnalyzer/Core/CheckerManager.h" 20#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" 21#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 22 23using namespace clang; 24using namespace ento; 25 26void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, 27 ExplodedNode *Pred, 28 ExplodedNodeSet &Dst) { 29 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 30 const Expr *tempExpr = ME->getSubExpr()->IgnoreParens(); 31 ProgramStateRef state = Pred->getState(); 32 const LocationContext *LCtx = Pred->getLocationContext(); 33 34 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME); 35 Bldr.generateNode(ME, Pred, state); 36} 37 38// FIXME: This is the sort of code that should eventually live in a Core 39// checker rather than as a special case in ExprEngine. 40void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred, 41 const CallEvent &Call) { 42 SVal ThisVal; 43 bool AlwaysReturnsLValue; 44 const CXXRecordDecl *ThisRD = nullptr; 45 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) { 46 assert(Ctor->getDecl()->isTrivial()); 47 assert(Ctor->getDecl()->isCopyOrMoveConstructor()); 48 ThisVal = Ctor->getCXXThisVal(); 49 ThisRD = Ctor->getDecl()->getParent(); 50 AlwaysReturnsLValue = false; 51 } else { 52 assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial()); 53 assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() == 54 OO_Equal); 55 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal(); 56 ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent(); 57 AlwaysReturnsLValue = true; 58 } 59 60 assert(ThisRD); 61 if (ThisRD->isEmpty()) { 62 // Do nothing for empty classes. Otherwise it'd retrieve an UnknownVal 63 // and bind it and RegionStore would think that the actual value 64 // in this region at this offset is unknown. 65 return; 66 } 67 68 const LocationContext *LCtx = Pred->getLocationContext(); 69 70 ExplodedNodeSet Dst; 71 Bldr.takeNodes(Pred); 72 73 SVal V = Call.getArgSVal(0); 74 75 // If the value being copied is not unknown, load from its location to get 76 // an aggregate rvalue. 77 if (Optional<Loc> L = V.getAs<Loc>()) 78 V = Pred->getState()->getSVal(*L); 79 else 80 assert(V.isUnknownOrUndef()); 81 82 const Expr *CallExpr = Call.getOriginExpr(); 83 evalBind(Dst, CallExpr, Pred, ThisVal, V, true); 84 85 PostStmt PS(CallExpr, LCtx); 86 for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end(); 87 I != E; ++I) { 88 ProgramStateRef State = (*I)->getState(); 89 if (AlwaysReturnsLValue) 90 State = State->BindExpr(CallExpr, LCtx, ThisVal); 91 else 92 State = bindReturnValue(Call, LCtx, State); 93 Bldr.generateNode(PS, State, *I); 94 } 95} 96 97 98SVal ExprEngine::makeZeroElementRegion(ProgramStateRef State, SVal LValue, 99 QualType &Ty, bool &IsArray) { 100 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 101 ASTContext &Ctx = SVB.getContext(); 102 103 while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) { 104 Ty = AT->getElementType(); 105 LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue); 106 IsArray = true; 107 } 108 109 return LValue; 110} 111 112std::pair<ProgramStateRef, SVal> ExprEngine::prepareForObjectConstruction( 113 const Expr *E, ProgramStateRef State, const LocationContext *LCtx, 114 const ConstructionContext *CC, EvalCallOptions &CallOpts) { 115 SValBuilder &SVB = getSValBuilder(); 116 MemRegionManager &MRMgr = SVB.getRegionManager(); 117 ASTContext &ACtx = SVB.getContext(); 118 119 // See if we're constructing an existing region by looking at the 120 // current construction context. 121 if (CC) { 122 switch (CC->getKind()) { 123 case ConstructionContext::CXX17ElidedCopyVariableKind: 124 case ConstructionContext::SimpleVariableKind: { 125 const auto *DSCC = cast<VariableConstructionContext>(CC); 126 const auto *DS = DSCC->getDeclStmt(); 127 const auto *Var = cast<VarDecl>(DS->getSingleDecl()); 128 SVal LValue = State->getLValue(Var, LCtx); 129 QualType Ty = Var->getType(); 130 LValue = 131 makeZeroElementRegion(State, LValue, Ty, CallOpts.IsArrayCtorOrDtor); 132 State = 133 addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, LValue); 134 return std::make_pair(State, LValue); 135 } 136 case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind: 137 case ConstructionContext::SimpleConstructorInitializerKind: { 138 const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC); 139 const auto *Init = ICC->getCXXCtorInitializer(); 140 assert(Init->isAnyMemberInitializer()); 141 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 142 Loc ThisPtr = 143 SVB.getCXXThis(CurCtor, LCtx->getStackFrame()); 144 SVal ThisVal = State->getSVal(ThisPtr); 145 146 const ValueDecl *Field; 147 SVal FieldVal; 148 if (Init->isIndirectMemberInitializer()) { 149 Field = Init->getIndirectMember(); 150 FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal); 151 } else { 152 Field = Init->getMember(); 153 FieldVal = State->getLValue(Init->getMember(), ThisVal); 154 } 155 156 QualType Ty = Field->getType(); 157 FieldVal = makeZeroElementRegion(State, FieldVal, Ty, 158 CallOpts.IsArrayCtorOrDtor); 159 State = addObjectUnderConstruction(State, Init, LCtx, FieldVal); 160 return std::make_pair(State, FieldVal); 161 } 162 case ConstructionContext::NewAllocatedObjectKind: { 163 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) { 164 const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC); 165 const auto *NE = NECC->getCXXNewExpr(); 166 SVal V = *getObjectUnderConstruction(State, NE, LCtx); 167 if (const SubRegion *MR = 168 dyn_cast_or_null<SubRegion>(V.getAsRegion())) { 169 if (NE->isArray()) { 170 // TODO: In fact, we need to call the constructor for every 171 // allocated element, not just the first one! 172 CallOpts.IsArrayCtorOrDtor = true; 173 return std::make_pair( 174 State, loc::MemRegionVal(getStoreManager().GetElementZeroRegion( 175 MR, NE->getType()->getPointeeType()))); 176 } 177 return std::make_pair(State, V); 178 } 179 // TODO: Detect when the allocator returns a null pointer. 180 // Constructor shall not be called in this case. 181 } 182 break; 183 } 184 case ConstructionContext::SimpleReturnedValueKind: 185 case ConstructionContext::CXX17ElidedCopyReturnedValueKind: { 186 // The temporary is to be managed by the parent stack frame. 187 // So build it in the parent stack frame if we're not in the 188 // top frame of the analysis. 189 const StackFrameContext *SFC = LCtx->getStackFrame(); 190 if (const LocationContext *CallerLCtx = SFC->getParent()) { 191 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()] 192 .getAs<CFGCXXRecordTypedCall>(); 193 if (!RTC) { 194 // We were unable to find the correct construction context for the 195 // call in the parent stack frame. This is equivalent to not being 196 // able to find construction context at all. 197 break; 198 } 199 if (isa<BlockInvocationContext>(CallerLCtx)) { 200 // Unwrap block invocation contexts. They're mostly part of 201 // the current stack frame. 202 CallerLCtx = CallerLCtx->getParent(); 203 assert(!isa<BlockInvocationContext>(CallerLCtx)); 204 } 205 return prepareForObjectConstruction( 206 cast<Expr>(SFC->getCallSite()), State, CallerLCtx, 207 RTC->getConstructionContext(), CallOpts); 208 } else { 209 // We are on the top frame of the analysis. We do not know where is the 210 // object returned to. Conjure a symbolic region for the return value. 211 // TODO: We probably need a new MemRegion kind to represent the storage 212 // of that SymbolicRegion, so that we cound produce a fancy symbol 213 // instead of an anonymous conjured symbol. 214 // TODO: Do we need to track the region to avoid having it dead 215 // too early? It does die too early, at least in C++17, but because 216 // putting anything into a SymbolicRegion causes an immediate escape, 217 // it doesn't cause any leak false positives. 218 const auto *RCC = cast<ReturnedValueConstructionContext>(CC); 219 // Make sure that this doesn't coincide with any other symbol 220 // conjured for the returned expression. 221 static const int TopLevelSymRegionTag = 0; 222 const Expr *RetE = RCC->getReturnStmt()->getRetValue(); 223 assert(RetE && "Void returns should not have a construction context"); 224 QualType ReturnTy = RetE->getType(); 225 QualType RegionTy = ACtx.getPointerType(ReturnTy); 226 SVal V = SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC, 227 RegionTy, currBldrCtx->blockCount()); 228 return std::make_pair(State, V); 229 } 230 llvm_unreachable("Unhandled return value construction context!"); 231 } 232 case ConstructionContext::ElidedTemporaryObjectKind: { 233 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors); 234 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC); 235 const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr(); 236 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr(); 237 const CXXConstructExpr *CE = TCC->getConstructorAfterElision(); 238 239 // Support pre-C++17 copy elision. We'll have the elidable copy 240 // constructor in the AST and in the CFG, but we'll skip it 241 // and construct directly into the final object. This call 242 // also sets the CallOpts flags for us. 243 SVal V; 244 // If the elided copy/move constructor is not supported, there's still 245 // benefit in trying to model the non-elided constructor. 246 // Stash our state before trying to elide, as it'll get overwritten. 247 ProgramStateRef PreElideState = State; 248 EvalCallOptions PreElideCallOpts = CallOpts; 249 250 std::tie(State, V) = prepareForObjectConstruction( 251 CE, State, LCtx, TCC->getConstructionContextAfterElision(), CallOpts); 252 253 // FIXME: This definition of "copy elision has not failed" is unreliable. 254 // It doesn't indicate that the constructor will actually be inlined 255 // later; it is still up to evalCall() to decide. 256 if (!CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion) { 257 // Remember that we've elided the constructor. 258 State = addObjectUnderConstruction(State, CE, LCtx, V); 259 260 // Remember that we've elided the destructor. 261 if (BTE) 262 State = elideDestructor(State, BTE, LCtx); 263 264 // Instead of materialization, shamelessly return 265 // the final object destination. 266 if (MTE) 267 State = addObjectUnderConstruction(State, MTE, LCtx, V); 268 269 return std::make_pair(State, V); 270 } else { 271 // Copy elision failed. Revert the changes and proceed as if we have 272 // a simple temporary. 273 State = PreElideState; 274 CallOpts = PreElideCallOpts; 275 } 276 LLVM_FALLTHROUGH; 277 } 278 case ConstructionContext::SimpleTemporaryObjectKind: { 279 const auto *TCC = cast<TemporaryObjectConstructionContext>(CC); 280 const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr(); 281 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr(); 282 SVal V = UnknownVal(); 283 284 if (MTE) { 285 if (const ValueDecl *VD = MTE->getExtendingDecl()) { 286 assert(MTE->getStorageDuration() != SD_FullExpression); 287 if (!VD->getType()->isReferenceType()) { 288 // We're lifetime-extended by a surrounding aggregate. 289 // Automatic destructors aren't quite working in this case 290 // on the CFG side. We should warn the caller about that. 291 // FIXME: Is there a better way to retrieve this information from 292 // the MaterializeTemporaryExpr? 293 CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true; 294 } 295 } 296 297 if (MTE->getStorageDuration() == SD_Static || 298 MTE->getStorageDuration() == SD_Thread) 299 V = loc::MemRegionVal(MRMgr.getCXXStaticTempObjectRegion(E)); 300 } 301 302 if (V.isUnknown()) 303 V = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx)); 304 305 if (BTE) 306 State = addObjectUnderConstruction(State, BTE, LCtx, V); 307 308 if (MTE) 309 State = addObjectUnderConstruction(State, MTE, LCtx, V); 310 311 CallOpts.IsTemporaryCtorOrDtor = true; 312 return std::make_pair(State, V); 313 } 314 case ConstructionContext::ArgumentKind: { 315 // Arguments are technically temporaries. 316 CallOpts.IsTemporaryCtorOrDtor = true; 317 318 const auto *ACC = cast<ArgumentConstructionContext>(CC); 319 const Expr *E = ACC->getCallLikeExpr(); 320 unsigned Idx = ACC->getIndex(); 321 const CXXBindTemporaryExpr *BTE = ACC->getCXXBindTemporaryExpr(); 322 323 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 324 SVal V = UnknownVal(); 325 auto getArgLoc = [&](CallEventRef<> Caller) -> Optional<SVal> { 326 const LocationContext *FutureSFC = 327 Caller->getCalleeStackFrame(currBldrCtx->blockCount()); 328 // Return early if we are unable to reliably foresee 329 // the future stack frame. 330 if (!FutureSFC) 331 return None; 332 333 // This should be equivalent to Caller->getDecl() for now, but 334 // FutureSFC->getDecl() is likely to support better stuff (like 335 // virtual functions) earlier. 336 const Decl *CalleeD = FutureSFC->getDecl(); 337 338 // FIXME: Support for variadic arguments is not implemented here yet. 339 if (CallEvent::isVariadic(CalleeD)) 340 return None; 341 342 // Operator arguments do not correspond to operator parameters 343 // because this-argument is implemented as a normal argument in 344 // operator call expressions but not in operator declarations. 345 const VarRegion *VR = Caller->getParameterLocation( 346 *Caller->getAdjustedParameterIndex(Idx), currBldrCtx->blockCount()); 347 if (!VR) 348 return None; 349 350 return loc::MemRegionVal(VR); 351 }; 352 353 if (const auto *CE = dyn_cast<CallExpr>(E)) { 354 CallEventRef<> Caller = CEMgr.getSimpleCall(CE, State, LCtx); 355 if (auto OptV = getArgLoc(Caller)) 356 V = *OptV; 357 else 358 break; 359 State = addObjectUnderConstruction(State, {CE, Idx}, LCtx, V); 360 } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(E)) { 361 // Don't bother figuring out the target region for the future 362 // constructor because we won't need it. 363 CallEventRef<> Caller = 364 CEMgr.getCXXConstructorCall(CCE, /*Target=*/nullptr, State, LCtx); 365 if (auto OptV = getArgLoc(Caller)) 366 V = *OptV; 367 else 368 break; 369 State = addObjectUnderConstruction(State, {CCE, Idx}, LCtx, V); 370 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(E)) { 371 CallEventRef<> Caller = CEMgr.getObjCMethodCall(ME, State, LCtx); 372 if (auto OptV = getArgLoc(Caller)) 373 V = *OptV; 374 else 375 break; 376 State = addObjectUnderConstruction(State, {ME, Idx}, LCtx, V); 377 } 378 379 assert(!V.isUnknown()); 380 381 if (BTE) 382 State = addObjectUnderConstruction(State, BTE, LCtx, V); 383 384 return std::make_pair(State, V); 385 } 386 } 387 } 388 // If we couldn't find an existing region to construct into, assume we're 389 // constructing a temporary. Notify the caller of our failure. 390 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; 391 return std::make_pair( 392 State, loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx))); 393} 394 395void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE, 396 ExplodedNode *Pred, 397 ExplodedNodeSet &destNodes) { 398 const LocationContext *LCtx = Pred->getLocationContext(); 399 ProgramStateRef State = Pred->getState(); 400 401 SVal Target = UnknownVal(); 402 403 if (Optional<SVal> ElidedTarget = 404 getObjectUnderConstruction(State, CE, LCtx)) { 405 // We've previously modeled an elidable constructor by pretending that it in 406 // fact constructs into the correct target. This constructor can therefore 407 // be skipped. 408 Target = *ElidedTarget; 409 StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx); 410 State = finishObjectConstruction(State, CE, LCtx); 411 if (auto L = Target.getAs<Loc>()) 412 State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType())); 413 Bldr.generateNode(CE, Pred, State); 414 return; 415 } 416 417 // FIXME: Handle arrays, which run the same constructor for every element. 418 // For now, we just run the first constructor (which should still invalidate 419 // the entire array). 420 421 EvalCallOptions CallOpts; 422 auto C = getCurrentCFGElement().getAs<CFGConstructor>(); 423 assert(C || getCurrentCFGElement().getAs<CFGStmt>()); 424 const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr; 425 426 switch (CE->getConstructionKind()) { 427 case CXXConstructExpr::CK_Complete: { 428 std::tie(State, Target) = 429 prepareForObjectConstruction(CE, State, LCtx, CC, CallOpts); 430 break; 431 } 432 case CXXConstructExpr::CK_VirtualBase: { 433 // Make sure we are not calling virtual base class initializers twice. 434 // Only the most-derived object should initialize virtual base classes. 435 const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>( 436 LCtx->getStackFrame()->getCallSite()); 437 assert( 438 (!OuterCtor || 439 OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || 440 OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && 441 ("This virtual base should have already been initialized by " 442 "the most derived class!")); 443 (void)OuterCtor; 444 LLVM_FALLTHROUGH; 445 } 446 case CXXConstructExpr::CK_NonVirtualBase: 447 // In C++17, classes with non-virtual bases may be aggregates, so they would 448 // be initialized as aggregates without a constructor call, so we may have 449 // a base class constructed directly into an initializer list without 450 // having the derived-class constructor call on the previous stack frame. 451 // Initializer lists may be nested into more initializer lists that 452 // correspond to surrounding aggregate initializations. 453 // FIXME: For now this code essentially bails out. We need to find the 454 // correct target region and set it. 455 // FIXME: Instead of relying on the ParentMap, we should have the 456 // trigger-statement (InitListExpr in this case) passed down from CFG or 457 // otherwise always available during construction. 458 if (dyn_cast_or_null<InitListExpr>(LCtx->getParentMap().getParent(CE))) { 459 MemRegionManager &MRMgr = getSValBuilder().getRegionManager(); 460 Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(CE, LCtx)); 461 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; 462 break; 463 } 464 LLVM_FALLTHROUGH; 465 case CXXConstructExpr::CK_Delegating: { 466 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl()); 467 Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor, 468 LCtx->getStackFrame()); 469 SVal ThisVal = State->getSVal(ThisPtr); 470 471 if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) { 472 Target = ThisVal; 473 } else { 474 // Cast to the base type. 475 bool IsVirtual = 476 (CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase); 477 SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(), 478 IsVirtual); 479 Target = BaseVal; 480 } 481 break; 482 } 483 } 484 485 if (State != Pred->getState()) { 486 static SimpleProgramPointTag T("ExprEngine", 487 "Prepare for object construction"); 488 ExplodedNodeSet DstPrepare; 489 StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx); 490 BldrPrepare.generateNode(CE, Pred, State, &T, ProgramPoint::PreStmtKind); 491 assert(DstPrepare.size() <= 1); 492 if (DstPrepare.size() == 0) 493 return; 494 Pred = *BldrPrepare.begin(); 495 } 496 497 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 498 CallEventRef<CXXConstructorCall> Call = 499 CEMgr.getCXXConstructorCall(CE, Target.getAsRegion(), State, LCtx); 500 501 ExplodedNodeSet DstPreVisit; 502 getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this); 503 504 // FIXME: Is it possible and/or useful to do this before PreStmt? 505 ExplodedNodeSet PreInitialized; 506 { 507 StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx); 508 for (ExplodedNodeSet::iterator I = DstPreVisit.begin(), 509 E = DstPreVisit.end(); 510 I != E; ++I) { 511 ProgramStateRef State = (*I)->getState(); 512 if (CE->requiresZeroInitialization()) { 513 // FIXME: Once we properly handle constructors in new-expressions, we'll 514 // need to invalidate the region before setting a default value, to make 515 // sure there aren't any lingering bindings around. This probably needs 516 // to happen regardless of whether or not the object is zero-initialized 517 // to handle random fields of a placement-initialized object picking up 518 // old bindings. We might only want to do it when we need to, though. 519 // FIXME: This isn't actually correct for arrays -- we need to zero- 520 // initialize the entire array, not just the first element -- but our 521 // handling of arrays everywhere else is weak as well, so this shouldn't 522 // actually make things worse. Placement new makes this tricky as well, 523 // since it's then possible to be initializing one part of a multi- 524 // dimensional array. 525 State = State->bindDefaultZero(Target, LCtx); 526 } 527 528 Bldr.generateNode(CE, *I, State, /*tag=*/nullptr, 529 ProgramPoint::PreStmtKind); 530 } 531 } 532 533 ExplodedNodeSet DstPreCall; 534 getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized, 535 *Call, *this); 536 537 ExplodedNodeSet DstEvaluated; 538 StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx); 539 540 if (CE->getConstructor()->isTrivial() && 541 CE->getConstructor()->isCopyOrMoveConstructor() && 542 !CallOpts.IsArrayCtorOrDtor) { 543 // FIXME: Handle other kinds of trivial constructors as well. 544 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 545 I != E; ++I) 546 performTrivialCopy(Bldr, *I, *Call); 547 548 } else { 549 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 550 I != E; ++I) 551 defaultEvalCall(Bldr, *I, *Call, CallOpts); 552 } 553 554 // If the CFG was constructed without elements for temporary destructors 555 // and the just-called constructor created a temporary object then 556 // stop exploration if the temporary object has a noreturn constructor. 557 // This can lose coverage because the destructor, if it were present 558 // in the CFG, would be called at the end of the full expression or 559 // later (for life-time extended temporaries) -- but avoids infeasible 560 // paths when no-return temporary destructors are used for assertions. 561 const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext(); 562 if (!ADC->getCFGBuildOptions().AddTemporaryDtors) { 563 const MemRegion *Target = Call->getCXXThisVal().getAsRegion(); 564 if (Target && isa<CXXTempObjectRegion>(Target) && 565 Call->getDecl()->getParent()->isAnyDestructorNoReturn()) { 566 567 // If we've inlined the constructor, then DstEvaluated would be empty. 568 // In this case we still want a sink, which could be implemented 569 // in processCallExit. But we don't have that implemented at the moment, 570 // so if you hit this assertion, see if you can avoid inlining 571 // the respective constructor when analyzer-config cfg-temporary-dtors 572 // is set to false. 573 // Otherwise there's nothing wrong with inlining such constructor. 574 assert(!DstEvaluated.empty() && 575 "We should not have inlined this constructor!"); 576 577 for (ExplodedNode *N : DstEvaluated) { 578 Bldr.generateSink(CE, N, N->getState()); 579 } 580 581 // There is no need to run the PostCall and PostStmt checker 582 // callbacks because we just generated sinks on all nodes in th 583 // frontier. 584 return; 585 } 586 } 587 588 ExplodedNodeSet DstPostArgumentCleanup; 589 for (auto I : DstEvaluated) 590 finishArgumentConstruction(DstPostArgumentCleanup, I, *Call); 591 592 // If there were other constructors called for object-type arguments 593 // of this constructor, clean them up. 594 ExplodedNodeSet DstPostCall; 595 getCheckerManager().runCheckersForPostCall(DstPostCall, 596 DstPostArgumentCleanup, 597 *Call, *this); 598 getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this); 599} 600 601void ExprEngine::VisitCXXDestructor(QualType ObjectType, 602 const MemRegion *Dest, 603 const Stmt *S, 604 bool IsBaseDtor, 605 ExplodedNode *Pred, 606 ExplodedNodeSet &Dst, 607 EvalCallOptions &CallOpts) { 608 assert(S && "A destructor without a trigger!"); 609 const LocationContext *LCtx = Pred->getLocationContext(); 610 ProgramStateRef State = Pred->getState(); 611 612 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl(); 613 assert(RecordDecl && "Only CXXRecordDecls should have destructors"); 614 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor(); 615 // FIXME: There should always be a Decl, otherwise the destructor call 616 // shouldn't have been added to the CFG in the first place. 617 if (!DtorDecl) { 618 // Skip the invalid destructor. We cannot simply return because 619 // it would interrupt the analysis instead. 620 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor"); 621 // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway. 622 PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx, &T); 623 NodeBuilder Bldr(Pred, Dst, *currBldrCtx); 624 Bldr.generateNode(PP, Pred->getState(), Pred); 625 return; 626 } 627 628 if (!Dest) { 629 // We're trying to destroy something that is not a region. This may happen 630 // for a variety of reasons (unknown target region, concrete integer instead 631 // of target region, etc.). The current code makes an attempt to recover. 632 // FIXME: We probably don't really need to recover when we're dealing 633 // with concrete integers specifically. 634 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true; 635 if (const Expr *E = dyn_cast_or_null<Expr>(S)) { 636 Dest = MRMgr.getCXXTempObjectRegion(E, Pred->getLocationContext()); 637 } else { 638 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor"); 639 NodeBuilder Bldr(Pred, Dst, *currBldrCtx); 640 Bldr.generateSink(Pred->getLocation().withTag(&T), 641 Pred->getState(), Pred); 642 return; 643 } 644 } 645 646 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 647 CallEventRef<CXXDestructorCall> Call = 648 CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx); 649 650 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 651 Call->getSourceRange().getBegin(), 652 "Error evaluating destructor"); 653 654 ExplodedNodeSet DstPreCall; 655 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, 656 *Call, *this); 657 658 ExplodedNodeSet DstInvalidated; 659 StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx); 660 for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end(); 661 I != E; ++I) 662 defaultEvalCall(Bldr, *I, *Call, CallOpts); 663 664 getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated, 665 *Call, *this); 666} 667 668void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, 669 ExplodedNode *Pred, 670 ExplodedNodeSet &Dst) { 671 ProgramStateRef State = Pred->getState(); 672 const LocationContext *LCtx = Pred->getLocationContext(); 673 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(), 674 CNE->getBeginLoc(), 675 "Error evaluating New Allocator Call"); 676 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 677 CallEventRef<CXXAllocatorCall> Call = 678 CEMgr.getCXXAllocatorCall(CNE, State, LCtx); 679 680 ExplodedNodeSet DstPreCall; 681 getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, 682 *Call, *this); 683 684 ExplodedNodeSet DstPostCall; 685 StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx); 686 for (auto I : DstPreCall) { 687 // FIXME: Provide evalCall for checkers? 688 defaultEvalCall(CallBldr, I, *Call); 689 } 690 // If the call is inlined, DstPostCall will be empty and we bail out now. 691 692 // Store return value of operator new() for future use, until the actual 693 // CXXNewExpr gets processed. 694 ExplodedNodeSet DstPostValue; 695 StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx); 696 for (auto I : DstPostCall) { 697 // FIXME: Because CNE serves as the "call site" for the allocator (due to 698 // lack of a better expression in the AST), the conjured return value symbol 699 // is going to be of the same type (C++ object pointer type). Technically 700 // this is not correct because the operator new's prototype always says that 701 // it returns a 'void *'. So we should change the type of the symbol, 702 // and then evaluate the cast over the symbolic pointer from 'void *' to 703 // the object pointer type. But without changing the symbol's type it 704 // is breaking too much to evaluate the no-op symbolic cast over it, so we 705 // skip it for now. 706 ProgramStateRef State = I->getState(); 707 SVal RetVal = State->getSVal(CNE, LCtx); 708 709 // If this allocation function is not declared as non-throwing, failures 710 // /must/ be signalled by exceptions, and thus the return value will never 711 // be NULL. -fno-exceptions does not influence this semantics. 712 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case 713 // where new can return NULL. If we end up supporting that option, we can 714 // consider adding a check for it here. 715 // C++11 [basic.stc.dynamic.allocation]p3. 716 if (const FunctionDecl *FD = CNE->getOperatorNew()) { 717 QualType Ty = FD->getType(); 718 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>()) 719 if (!ProtoType->isNothrow()) 720 State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true); 721 } 722 723 ValueBldr.generateNode( 724 CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal)); 725 } 726 727 ExplodedNodeSet DstPostPostCallCallback; 728 getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback, 729 DstPostValue, *Call, *this); 730 for (auto I : DstPostPostCallCallback) { 731 getCheckerManager().runCheckersForNewAllocator( 732 CNE, *getObjectUnderConstruction(I->getState(), CNE, LCtx), Dst, I, 733 *this); 734 } 735} 736 737void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, 738 ExplodedNodeSet &Dst) { 739 // FIXME: Much of this should eventually migrate to CXXAllocatorCall. 740 // Also, we need to decide how allocators actually work -- they're not 741 // really part of the CXXNewExpr because they happen BEFORE the 742 // CXXConstructExpr subexpression. See PR12014 for some discussion. 743 744 unsigned blockCount = currBldrCtx->blockCount(); 745 const LocationContext *LCtx = Pred->getLocationContext(); 746 SVal symVal = UnknownVal(); 747 FunctionDecl *FD = CNE->getOperatorNew(); 748 749 bool IsStandardGlobalOpNewFunction = 750 FD->isReplaceableGlobalAllocationFunction(); 751 752 ProgramStateRef State = Pred->getState(); 753 754 // Retrieve the stored operator new() return value. 755 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) { 756 symVal = *getObjectUnderConstruction(State, CNE, LCtx); 757 State = finishObjectConstruction(State, CNE, LCtx); 758 } 759 760 // We assume all standard global 'operator new' functions allocate memory in 761 // heap. We realize this is an approximation that might not correctly model 762 // a custom global allocator. 763 if (symVal.isUnknown()) { 764 if (IsStandardGlobalOpNewFunction) 765 symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount); 766 else 767 symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(), 768 blockCount); 769 } 770 771 CallEventManager &CEMgr = getStateManager().getCallEventManager(); 772 CallEventRef<CXXAllocatorCall> Call = 773 CEMgr.getCXXAllocatorCall(CNE, State, LCtx); 774 775 if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) { 776 // Invalidate placement args. 777 // FIXME: Once we figure out how we want allocators to work, 778 // we should be using the usual pre-/(default-)eval-/post-call checkers 779 // here. 780 State = Call->invalidateRegions(blockCount); 781 if (!State) 782 return; 783 784 // If this allocation function is not declared as non-throwing, failures 785 // /must/ be signalled by exceptions, and thus the return value will never 786 // be NULL. -fno-exceptions does not influence this semantics. 787 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case 788 // where new can return NULL. If we end up supporting that option, we can 789 // consider adding a check for it here. 790 // C++11 [basic.stc.dynamic.allocation]p3. 791 if (FD) { 792 QualType Ty = FD->getType(); 793 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>()) 794 if (!ProtoType->isNothrow()) 795 if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>()) 796 State = State->assume(*dSymVal, true); 797 } 798 } 799 800 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 801 802 SVal Result = symVal; 803 804 if (CNE->isArray()) { 805 // FIXME: allocating an array requires simulating the constructors. 806 // For now, just return a symbolicated region. 807 if (const auto *NewReg = cast_or_null<SubRegion>(symVal.getAsRegion())) { 808 QualType ObjTy = CNE->getType()->getPointeeType(); 809 const ElementRegion *EleReg = 810 getStoreManager().GetElementZeroRegion(NewReg, ObjTy); 811 Result = loc::MemRegionVal(EleReg); 812 } 813 State = State->BindExpr(CNE, Pred->getLocationContext(), Result); 814 Bldr.generateNode(CNE, Pred, State); 815 return; 816 } 817 818 // FIXME: Once we have proper support for CXXConstructExprs inside 819 // CXXNewExpr, we need to make sure that the constructed object is not 820 // immediately invalidated here. (The placement call should happen before 821 // the constructor call anyway.) 822 if (FD && FD->isReservedGlobalPlacementOperator()) { 823 // Non-array placement new should always return the placement location. 824 SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx); 825 Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(), 826 CNE->getPlacementArg(0)->getType()); 827 } 828 829 // Bind the address of the object, then check to see if we cached out. 830 State = State->BindExpr(CNE, LCtx, Result); 831 ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State); 832 if (!NewN) 833 return; 834 835 // If the type is not a record, we won't have a CXXConstructExpr as an 836 // initializer. Copy the value over. 837 if (const Expr *Init = CNE->getInitializer()) { 838 if (!isa<CXXConstructExpr>(Init)) { 839 assert(Bldr.getResults().size() == 1); 840 Bldr.takeNodes(NewN); 841 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx), 842 /*FirstInit=*/IsStandardGlobalOpNewFunction); 843 } 844 } 845} 846 847void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, 848 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 849 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 850 ProgramStateRef state = Pred->getState(); 851 Bldr.generateNode(CDE, Pred, state); 852} 853 854void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, 855 ExplodedNode *Pred, 856 ExplodedNodeSet &Dst) { 857 const VarDecl *VD = CS->getExceptionDecl(); 858 if (!VD) { 859 Dst.Add(Pred); 860 return; 861 } 862 863 const LocationContext *LCtx = Pred->getLocationContext(); 864 SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(), 865 currBldrCtx->blockCount()); 866 ProgramStateRef state = Pred->getState(); 867 state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx); 868 869 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 870 Bldr.generateNode(CS, Pred, state); 871} 872 873void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, 874 ExplodedNodeSet &Dst) { 875 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 876 877 // Get the this object region from StoreManager. 878 const LocationContext *LCtx = Pred->getLocationContext(); 879 const MemRegion *R = 880 svalBuilder.getRegionManager().getCXXThisRegion( 881 getContext().getCanonicalType(TE->getType()), 882 LCtx); 883 884 ProgramStateRef state = Pred->getState(); 885 SVal V = state->getSVal(loc::MemRegionVal(R)); 886 Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V)); 887} 888 889void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, 890 ExplodedNodeSet &Dst) { 891 const LocationContext *LocCtxt = Pred->getLocationContext(); 892 893 // Get the region of the lambda itself. 894 const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion( 895 LE, LocCtxt); 896 SVal V = loc::MemRegionVal(R); 897 898 ProgramStateRef State = Pred->getState(); 899 900 // If we created a new MemRegion for the lambda, we should explicitly bind 901 // the captures. 902 CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin(); 903 for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(), 904 e = LE->capture_init_end(); 905 i != e; ++i, ++CurField) { 906 FieldDecl *FieldForCapture = *CurField; 907 SVal FieldLoc = State->getLValue(FieldForCapture, V); 908 909 SVal InitVal; 910 if (!FieldForCapture->hasCapturedVLAType()) { 911 Expr *InitExpr = *i; 912 assert(InitExpr && "Capture missing initialization expression"); 913 InitVal = State->getSVal(InitExpr, LocCtxt); 914 } else { 915 // The field stores the length of a captured variable-length array. 916 // These captures don't have initialization expressions; instead we 917 // get the length from the VLAType size expression. 918 Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr(); 919 InitVal = State->getSVal(SizeExpr, LocCtxt); 920 } 921 922 State = State->bindLoc(FieldLoc, InitVal, LocCtxt); 923 } 924 925 // Decay the Loc into an RValue, because there might be a 926 // MaterializeTemporaryExpr node above this one which expects the bound value 927 // to be an RValue. 928 SVal LambdaRVal = State->getSVal(R); 929 930 ExplodedNodeSet Tmp; 931 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx); 932 // FIXME: is this the right program point kind? 933 Bldr.generateNode(LE, Pred, 934 State->BindExpr(LE, LocCtxt, LambdaRVal), 935 nullptr, ProgramPoint::PostLValueKind); 936 937 // FIXME: Move all post/pre visits to ::Visit(). 938 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this); 939} 940