24 using namespace clang;
35 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
44 bool AlwaysReturnsLValue;
47 assert(Ctor->getDecl()->isTrivial());
48 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
49 ThisVal = Ctor->getCXXThisVal();
51 AlwaysReturnsLValue =
false;
54 assert(cast<CXXMethodDecl>(Call.
getDecl())->getOverloadedOperator() ==
56 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
57 ThisRD = cast<CXXMethodDecl>(Call.
getDecl())->getParent();
58 AlwaysReturnsLValue =
true;
84 evalBind(Dst, CallExpr, Pred, ThisVal, V,
true);
90 if (AlwaysReturnsLValue)
91 State = State->BindExpr(CallExpr, LCtx, ThisVal);
101 SValBuilder &SVB = State->getStateManager().getSValBuilder();
105 Ty = AT->getElementType();
113 std::pair<ProgramStateRef, SVal> ExprEngine::prepareForObjectConstruction(
124 const auto *DSCC = cast<VariableConstructionContext>(CC);
125 const auto *DS = DSCC->getDeclStmt();
126 const auto *Var = cast<VarDecl>(DS->getSingleDecl());
127 SVal LValue = State->getLValue(Var, LCtx);
132 addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, LValue);
133 return std::make_pair(State, LValue);
137 const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
138 const auto *Init = ICC->getCXXCtorInitializer();
139 assert(Init->isAnyMemberInitializer());
143 SVal ThisVal = State->getSVal(ThisPtr);
147 if (Init->isIndirectMemberInitializer()) {
148 Field = Init->getIndirectMember();
149 FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
151 Field = Init->getMember();
152 FieldVal = State->getLValue(Init->getMember(), ThisVal);
156 FieldVal = makeZeroElementRegion(State, FieldVal, Ty,
158 State = addObjectUnderConstruction(State, Init, LCtx, FieldVal);
159 return std::make_pair(State, FieldVal);
163 const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
164 const auto *NE = NECC->getCXXNewExpr();
172 return std::make_pair(
174 MR, NE->getType()->getPointeeType())));
176 return std::make_pair(State, V);
198 return prepareForObjectConstruction(
200 RTC->getConstructionContext(), CallOpts);
208 return std::make_pair(State, V);
210 llvm_unreachable(
"Unhandled return value construction context!");
214 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
230 std::tie(State, V) = prepareForObjectConstruction(
231 CE, State, LCtx, TCC->getConstructionContextAfterElision(), CallOpts);
238 State = addObjectUnderConstruction(State, CE, LCtx, V);
242 State = elideDestructor(State, BTE, LCtx);
247 State = addObjectUnderConstruction(State, MTE, LCtx, V);
249 return std::make_pair(State, V);
253 State = PreElideState;
254 CallOpts = PreElideCallOpts;
259 const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
267 if (!VD->getType()->isReferenceType()) {
286 State = addObjectUnderConstruction(State, BTE, LCtx, V);
289 State = addObjectUnderConstruction(State, MTE, LCtx, V);
292 return std::make_pair(State, V);
303 return std::make_pair(
320 Target = *ElidedTarget;
322 State = finishObjectConstruction(State, CE, LCtx);
324 State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->
getType()));
340 std::tie(State, Target) =
341 prepareForObjectConstruction(CE, State, LCtx, CC, CallOpts);
386 SVal ThisVal = State->getSVal(ThisPtr);
404 "Prepare for object construction");
408 assert(DstPrepare.
size() <= 1);
409 if (DstPrepare.
size() == 0)
411 Pred = *BldrPrepare.
begin();
426 E = DstPreVisit.
end();
442 State = State->bindDefaultZero(Target, LCtx);
463 performTrivialCopy(Bldr, *I, *Call);
480 const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
481 if (Target && isa<CXXTempObjectRegion>(Target) &&
482 Call->getDecl()->getParent()->isAnyDestructorNoReturn()) {
491 assert(!DstEvaluated.
empty() &&
492 "We should not have inlined this constructor!");
522 assert(RecordDecl &&
"Only CXXRecordDecls should have destructors");
530 Call->getSourceRange().getBegin(),
531 "Error evaluating destructor");
555 "Error evaluating New Allocator Call");
558 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
566 for (
auto I : DstPreCall) {
576 for (
auto I : DstPostCall) {
587 SVal RetVal = State->getSVal(CNE, LCtx);
599 if (!ProtoType->isNothrow())
604 CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
609 DstPostValue, *Call, *
this);
610 for (
auto I : DstPostPostCallCallback) {
624 unsigned blockCount = currBldrCtx->
blockCount();
629 bool IsStandardGlobalOpNewFunction =
637 State = finishObjectConstruction(State, CNE, LCtx);
644 if (IsStandardGlobalOpNewFunction)
659 State = Call->invalidateRegions(blockCount);
673 if (!ProtoType->isNothrow())
675 State = State->assume(*dSymVal,
true);
681 SVal Result = symVal;
687 dyn_cast_or_null<SubRegion>(symVal.
getAsRegion())) {
710 State = State->BindExpr(CNE, LCtx, Result);
718 if (!isa<CXXConstructExpr>(Init)) {
721 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
722 IsStandardGlobalOpNewFunction);
747 state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
766 Bldr.
generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
785 i != e; ++i, ++CurField) {
787 SVal FieldLoc = State->getLValue(FieldForCapture, V);
792 assert(InitExpr &&
"Capture missing initialization expression");
793 InitVal = State->getSVal(InitExpr, LocCtxt);
799 InitVal = State->getSVal(SizeExpr, LocCtxt);
802 State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
808 SVal LambdaRVal = State->getSVal(R);
814 State->BindExpr(LE, LocCtxt, LambdaRVal),
bool hasCapturedVLAType() const
Determine whether this member captures the variable length array type.
Represents a function declaration or definition.
bool isReservedGlobalPlacementOperator() const
Determines whether this operator new or delete is one of the reserved global placement operators: voi...
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
PointerType - C99 6.7.5.1 - Pointer Declarators.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
ImplTy::iterator iterator
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
SourceLocation getStartLoc() const LLVM_READONLY
Stmt - This represents one statement.
This builder class is useful for generating nodes that resulted from visiting a statement.
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
FunctionDecl * getOperatorNew() const
Manages the lifetime of CallEvent objects.
bool requiresZeroInitialization() const
Whether this construction first requires zero-initialization before the initializer is called...
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Stmt * getParent(Stmt *) const
Hints for figuring out of a call should be inlined during evalCall().
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Represents a call to a C++ constructor.
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
void takeNodes(const ExplodedNodeSet &S)
Represents a variable declaration or definition.
const T * getAs() const
Member-template getAs<specific type>'.
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object's ConstructionContext, retrieve such object's location.
const ElementRegion * GetElementZeroRegion(const SubRegion *R, QualType T)
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CXXRecordDecl * getLambdaClass() const
Retrieve the class that corresponds to the lambda.
Represents a function call that returns a C++ object by value.
Represents a struct/union/class.
bool isEmpty() const
Determine whether this is an empty class in the sense of (C++11 [meta.unary.prop]).
Expr * GetTemporaryExpr() const
Retrieve the temporary-generating subexpression whose value will be materialized into a glvalue...
MemRegionManager & getRegionManager()
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Represents a member of a struct/union/class.
AnalysisDeclContext contains the context data for the function or method under analysis.
Expr * getPlacementArg(unsigned i)
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool isReplaceableGlobalAllocationFunction(bool *IsAligned=nullptr) const
Determines whether this function is one of the replaceable global allocation functions: void *operato...
ExplodedNode * generateSink(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
capture_init_iterator capture_init_begin()
Retrieve the first initialization argument for this lambda expression (which initializes the first ca...
Expr * getInitializer()
The initializer of this new-expression.
const LocationContext * getLocationContext() const
const LocationContext * getParent() const
If a crash happens while one of these objects are live, the message is printed out along with the spe...
Expr * getSizeExpr() const
field_iterator field_begin() const
Represents binding an expression to a temporary.
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
Represents the this expression in C++.
const CFGBlock * getCallSiteBlock() const
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
CheckerManager & getCheckerManager() const
const ValueDecl * getExtendingDecl() const
Get the declaration which triggered the lifetime-extension of this temporary, if any.
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Represents a prototype with parameter type info, e.g.
const Stmt * getCallSite() const
CXXConstructorDecl * getConstructor() const
Get the constructor that this expression will (ultimately) call.
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Expr - This represents one expression.
bool isCopyOrMoveConstructor(unsigned &TypeQuals) const
Determine whether this is a copy or move constructor.
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents a C++ destructor within a class.
AnalyzerOptions & getAnalyzerOptions() override
VarDecl * getExceptionDecl() const
This is the simplest builder which generates nodes in the ExplodedGraph.
Represents C++ constructor call.
void Add(ExplodedNode *N)
const ExplodedNodeSet & getResults()
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
DeclContext * getParent()
getParent - Returns the containing DeclContext.
StorageDuration getStorageDuration() const
Retrieve the storage duration for the materialized temporary.
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
ParentMap & getParentMap() const
NonLoc makeZeroArrayIndex()
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
void runCheckersForNewAllocator(const CXXNewExpr *NE, SVal Target, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
const MemRegion * getAsRegion() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
const VariableArrayType * getCapturedVLAType() const
Get the captured variable length array type.
CallEventManager & getCallEventManager()
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
Represents a static or instance method of a struct/union/class.
ASTContext & getContext()
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
const CXXThisRegion * getCXXThisRegion(QualType thisPointerTy, const LocationContext *LC)
getCXXThisRegion - Retrieve the [artificial] region associated with the parameter 'this'...
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Dataflow Directional Tag Classes.
CFG::BuildOptions & getCFGBuildOptions()
Return the build options used to construct the CFG.
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
StoreManager & getStoreManager()
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst, const EvalCallOptions &Options)
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
Represents an abstract call to a function or method along a particular path.
ProgramStateManager & getStateManager() override
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
const Decl * getDecl() const
const CXXTempObjectRegion * getCXXStaticTempObjectRegion(const Expr *Ex)
Create a CXXTempObjectRegion for temporaries which are lifetime-extended by static references...
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
SubRegion - A region that subsets another larger region.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
unsigned getIndex() const
const StackFrameContext * getStackFrame() const
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
ConstructionContext's subclasses describe different ways of constructing an object in C++...
bool shouldElideConstructors()
Returns true if elidable C++ copy-constructors and move-constructors should be actually elided during...
Represents a C++ struct/union/class.
bool isTrivial(const SExpr *E)
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
CXXCatchStmt - This represents a C++ catch block.
Full-expression storage duration (for temporaries).
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
iterator begin()
Iterators through the results frontier.
ElementRegin is used to represent both array elements and casts.
capture_init_iterator capture_init_end()
Retrieve the iterator pointing one past the last initialization argument for this lambda expression...
Expr *const * const_capture_init_iterator
Const iterator that walks over the capture initialization arguments.
bool mayInlineCXXAllocator()
Returns whether or not allocator call may be considered for inlining.
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
AnalysisDeclContext * getAnalysisDeclContext() const
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Represents a call to a C++ constructor.
bool isUnknownOrUndef() const
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
ConstructionKind getConstructionKind() const
Determine whether this constructor is actually constructing a base class (rather than a complete obje...