/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

Bug Summary

File:	build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
Warning:	line 305, column 33 Called C++ object pointer is null

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name ExprEngineCXX.cpp -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -analyzer-config-compatibility-mode=true -mrelocation-model pic -pic-level 2 -mframe-pointer=none -relaxed-aliasing -fmath-errno -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -ffunction-sections -fdata-sections -fcoverage-compilation-dir=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/build-llvm -resource-dir /usr/lib/llvm-16/lib/clang/16.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I tools/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/include -I tools/clang/include -I include -I /build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/llvm/include -D _FORTIFY_SOURCE=2 -D NDEBUG -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/x86_64-linux-gnu/c++/10 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../include/c++/10/backward -internal-isystem /usr/lib/llvm-16/lib/clang/16.0.0/include -internal-isystem /usr/local/include -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/10/../../../../x86_64-linux-gnu/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -fmacro-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/build-llvm=build-llvm -fmacro-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/= -fcoverage-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/build-llvm=build-llvm -fcoverage-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/= -O3 -Wno-unused-command-line-argument -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-class-memaccess -Wno-redundant-move -Wno-pessimizing-move -Wno-noexcept-type -Wno-comment -Wno-misleading-indentation -std=c++17 -fdeprecated-macro -fdebug-compilation-dir=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/build-llvm -fdebug-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/build-llvm=build-llvm -fdebug-prefix-map=/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/= -ferror-limit 19 -fvisibility-inlines-hidden -stack-protector 2 -fgnuc-version=4.2.1 -fcolor-diagnostics -vectorize-loops -vectorize-slp -analyzer-output=html -analyzer-config stable-report-filename=true -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /tmp/scan-build-2022-09-04-125545-48738-1 -x c++ /build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

→

1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9//  This file defines the C++ expression evaluation engine.
10//
11//===----------------------------------------------------------------------===//

13#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
14#include "clang/Analysis/ConstructionContext.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/StmtCXX.h"
17#include "clang/AST/ParentMap.h"
18#include "clang/Basic/PrettyStackTrace.h"
19#include "clang/StaticAnalyzer/Core/CheckerManager.h"
20#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"

23using namespace clang;
24using namespace ento;

26void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
                                        ExplodedNode *Pred,
                                        ExplodedNodeSet &Dst) {
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
const Expr *tempExpr = ME->getSubExpr()->IgnoreParens();
ProgramStateRef state = Pred->getState();
const LocationContext *LCtx = Pred->getLocationContext();

state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
Bldr.generateNode(ME, Pred, state);
36}

38// FIXME: This is the sort of code that should eventually live in a Core
39// checker rather than as a special case in ExprEngine.
40void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
                                  const CallEvent &Call) {
SVal ThisVal;
bool AlwaysReturnsLValue;
const CXXRecordDecl *ThisRD = nullptr;
if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
  assert(Ctor->getDecl()->isTrivial())(static_cast <bool> (Ctor->getDecl()->isTrivial()
) ? void (0) : __assert_fail ("Ctor->getDecl()->isTrivial()"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 46, __extension__
 __PRETTY_FUNCTION__));
  assert(Ctor->getDecl()->isCopyOrMoveConstructor())(static_cast <bool> (Ctor->getDecl()->isCopyOrMoveConstructor
()) ? void (0) : __assert_fail ("Ctor->getDecl()->isCopyOrMoveConstructor()"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 47, __extension__
 __PRETTY_FUNCTION__));
  ThisVal = Ctor->getCXXThisVal();
  ThisRD = Ctor->getDecl()->getParent();
  AlwaysReturnsLValue = false;
} else {
  assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial())(static_cast <bool> (cast<CXXMethodDecl>(Call.getDecl
())->isTrivial()) ? void (0) : __assert_fail ("cast<CXXMethodDecl>(Call.getDecl())->isTrivial()"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 52, __extension__
 __PRETTY_FUNCTION__));
  assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==(static_cast <bool> (cast<CXXMethodDecl>(Call.getDecl
())->getOverloadedOperator() == OO_Equal) ? void (0) : __assert_fail
 ("cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() == OO_Equal"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 54, __extension__
 __PRETTY_FUNCTION__))
         OO_Equal)(static_cast <bool> (cast<CXXMethodDecl>(Call.getDecl
())->getOverloadedOperator() == OO_Equal) ? void (0) : __assert_fail
 ("cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() == OO_Equal"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 54, __extension__
 __PRETTY_FUNCTION__));
  ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
  ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent();
  AlwaysReturnsLValue = true;
}

assert(ThisRD)(static_cast <bool> (ThisRD) ? void (0) : __assert_fail
 ("ThisRD", "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp"
, 60, __extension__ __PRETTY_FUNCTION__));
if (ThisRD->isEmpty()) {
  // Do nothing for empty classes. Otherwise it'd retrieve an UnknownVal
  // and bind it and RegionStore would think that the actual value
  // in this region at this offset is unknown.
  return;
}

const LocationContext *LCtx = Pred->getLocationContext();

ExplodedNodeSet Dst;
Bldr.takeNodes(Pred);

SVal V = Call.getArgSVal(0);

// If the value being copied is not unknown, load from its location to get
// an aggregate rvalue.
if (Optional<Loc> L = V.getAs<Loc>())
  V = Pred->getState()->getSVal(*L);
else
  assert(V.isUnknownOrUndef())(static_cast <bool> (V.isUnknownOrUndef()) ? void (0) :
 __assert_fail ("V.isUnknownOrUndef()", "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp"
, 80, __extension__ __PRETTY_FUNCTION__));

const Expr *CallExpr = Call.getOriginExpr();
evalBind(Dst, CallExpr, Pred, ThisVal, V, true);

PostStmt PS(CallExpr, LCtx);
for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
     I != E; ++I) {
  ProgramStateRef State = (*I)->getState();
  if (AlwaysReturnsLValue)
    State = State->BindExpr(CallExpr, LCtx, ThisVal);
  else
    State = bindReturnValue(Call, LCtx, State);
  Bldr.generateNode(PS, State, *I);
}
95}

97SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
                                 QualType &Ty, bool &IsArray, unsigned Idx) {
SValBuilder &SVB = State->getStateManager().getSValBuilder();
ASTContext &Ctx = SVB.getContext();

if (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
  while (AT) {
    Ty = AT->getElementType();
    AT = dyn_cast<ArrayType>(AT->getElementType());
  }
  LValue = State->getLValue(Ty, SVB.makeArrayIndex(Idx), LValue);
  IsArray = true;
}

return LValue;
112}

114SVal ExprEngine::computeObjectUnderConstruction(
  const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
  const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx) {
SValBuilder &SVB = getSValBuilder();
MemRegionManager &MRMgr = SVB.getRegionManager();
ASTContext &ACtx = SVB.getContext();

// Compute the target region by exploring the construction context.
if (CC19.1
'CC' is non-null
1
'CC' is non-null
) {
20
←
Taking true branch→
27
←
Assuming 'CC' is non-null→
28
←
Taking true branch→
  switch (CC->getKind()) {
21
←
Control jumps to 'case ElidedTemporaryObjectKind:'  at line 239→
29
←
Control jumps to 'case LambdaCaptureKind:'  at line 294→
  case ConstructionContext::CXX17ElidedCopyVariableKind:
  case ConstructionContext::SimpleVariableKind: {
    const auto *DSCC = cast<VariableConstructionContext>(CC);
    const auto *DS = DSCC->getDeclStmt();
    const auto *Var = cast<VarDecl>(DS->getSingleDecl());
    QualType Ty = Var->getType();
    return makeElementRegion(State, State->getLValue(Var, LCtx), Ty,
                             CallOpts.IsArrayCtorOrDtor, Idx);
  }
  case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
  case ConstructionContext::SimpleConstructorInitializerKind: {
    const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
    const auto *Init = ICC->getCXXCtorInitializer();
    const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
    Loc ThisPtr = SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
    SVal ThisVal = State->getSVal(ThisPtr);
    if (Init->isBaseInitializer()) {
      const auto *ThisReg = cast<SubRegion>(ThisVal.getAsRegion());
      const CXXRecordDecl *BaseClass =
        Init->getBaseClass()->getAsCXXRecordDecl();
      const auto *BaseReg =
        MRMgr.getCXXBaseObjectRegion(BaseClass, ThisReg,
                                     Init->isBaseVirtual());
      return SVB.makeLoc(BaseReg);
    }
    if (Init->isDelegatingInitializer())
      return ThisVal;

    const ValueDecl *Field;
    SVal FieldVal;
    if (Init->isIndirectMemberInitializer()) {
      Field = Init->getIndirectMember();
      FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
    } else {
      Field = Init->getMember();
      FieldVal = State->getLValue(Init->getMember(), ThisVal);
    }

    QualType Ty = Field->getType();
    return makeElementRegion(State, FieldVal, Ty, CallOpts.IsArrayCtorOrDtor,
                             Idx);
  }
  case ConstructionContext::NewAllocatedObjectKind: {
    if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
      const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
      const auto *NE = NECC->getCXXNewExpr();
      SVal V = *getObjectUnderConstruction(State, NE, LCtx);
      if (const SubRegion *MR =
              dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
        if (NE->isArray()) {
          CallOpts.IsArrayCtorOrDtor = true;

          auto Ty = NE->getType()->getPointeeType();
          while (const auto *AT = getContext().getAsArrayType(Ty))
            Ty = AT->getElementType();

          auto R = MRMgr.getElementRegion(Ty, svalBuilder.makeArrayIndex(Idx),
                                          MR, SVB.getContext());

          return loc::MemRegionVal(R);
        }
        return  V;
      }
      // TODO: Detect when the allocator returns a null pointer.
      // Constructor shall not be called in this case.
    }
    break;
  }
  case ConstructionContext::SimpleReturnedValueKind:
  case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
    // The temporary is to be managed by the parent stack frame.
    // So build it in the parent stack frame if we're not in the
    // top frame of the analysis.
    const StackFrameContext *SFC = LCtx->getStackFrame();
    if (const LocationContext *CallerLCtx = SFC->getParent()) {
      auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
                     .getAs<CFGCXXRecordTypedCall>();
      if (!RTC) {
        // We were unable to find the correct construction context for the
        // call in the parent stack frame. This is equivalent to not being
        // able to find construction context at all.
        break;
      }
      if (isa<BlockInvocationContext>(CallerLCtx)) {
        // Unwrap block invocation contexts. They're mostly part of
        // the current stack frame.
        CallerLCtx = CallerLCtx->getParent();
        assert(!isa<BlockInvocationContext>(CallerLCtx))(static_cast <bool> (!isa<BlockInvocationContext>
(CallerLCtx)) ? void (0) : __assert_fail ("!isa<BlockInvocationContext>(CallerLCtx)"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 211, __extension__
 __PRETTY_FUNCTION__));
      }
      return computeObjectUnderConstruction(
          cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
          RTC->getConstructionContext(), CallOpts);
    } else {
      // We are on the top frame of the analysis. We do not know where is the
      // object returned to. Conjure a symbolic region for the return value.
      // TODO: We probably need a new MemRegion kind to represent the storage
      // of that SymbolicRegion, so that we cound produce a fancy symbol
      // instead of an anonymous conjured symbol.
      // TODO: Do we need to track the region to avoid having it dead
      // too early? It does die too early, at least in C++17, but because
      // putting anything into a SymbolicRegion causes an immediate escape,
      // it doesn't cause any leak false positives.
      const auto *RCC = cast<ReturnedValueConstructionContext>(CC);
      // Make sure that this doesn't coincide with any other symbol
      // conjured for the returned expression.
      static const int TopLevelSymRegionTag = 0;
      const Expr *RetE = RCC->getReturnStmt()->getRetValue();
      assert(RetE && "Void returns should not have a construction context")(static_cast <bool> (RetE && "Void returns should not have a construction context"
) ? void (0) : __assert_fail ("RetE && \"Void returns should not have a construction context\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 231, __extension__
 __PRETTY_FUNCTION__));
      QualType ReturnTy = RetE->getType();
      QualType RegionTy = ACtx.getPointerType(ReturnTy);
      return SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC, RegionTy,
                                  currBldrCtx->blockCount());
    }
    llvm_unreachable("Unhandled return value construction context!")::llvm::llvm_unreachable_internal("Unhandled return value construction context!"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 237);
  }
  case ConstructionContext::ElidedTemporaryObjectKind: {
    assert(AMgr.getAnalyzerOptions().ShouldElideConstructors)(static_cast <bool> (AMgr.getAnalyzerOptions().ShouldElideConstructors
) ? void (0) : __assert_fail ("AMgr.getAnalyzerOptions().ShouldElideConstructors"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 240, __extension__
 __PRETTY_FUNCTION__));
22
←
Assuming field 'ShouldElideConstructors' is true→
23
←
'?' condition is true→
    const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
24
←
'CC' is a 'CastReturnType'→

    // Support pre-C++17 copy elision. We'll have the elidable copy
    // constructor in the AST and in the CFG, but we'll skip it
    // and construct directly into the final object. This call
    // also sets the CallOpts flags for us.
    // If the elided copy/move constructor is not supported, there's still
    // benefit in trying to model the non-elided constructor.
    // Stash our state before trying to elide, as it'll get overwritten.
    ProgramStateRef PreElideState = State;
    EvalCallOptions PreElideCallOpts = CallOpts;

    SVal V = computeObjectUnderConstruction(
26
←
Calling 'ExprEngine::computeObjectUnderConstruction'→
        TCC->getConstructorAfterElision(), State, LCtx,
25
←
Passing value via 1st parameter 'E'→
        TCC->getConstructionContextAfterElision(), CallOpts);

    // FIXME: This definition of "copy elision has not failed" is unreliable.
    // It doesn't indicate that the constructor will actually be inlined
    // later; this is still up to evalCall() to decide.
    if (!CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion)
      return V;

    // Copy elision failed. Revert the changes and proceed as if we have
    // a simple temporary.
    CallOpts = PreElideCallOpts;
    CallOpts.IsElidableCtorThatHasNotBeenElided = true;
    [[fallthrough]];
  }
  case ConstructionContext::SimpleTemporaryObjectKind: {
    const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
    const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();

    CallOpts.IsTemporaryCtorOrDtor = true;
    if (MTE) {
      if (const ValueDecl *VD = MTE->getExtendingDecl()) {
        assert(MTE->getStorageDuration() != SD_FullExpression)(static_cast <bool> (MTE->getStorageDuration() != SD_FullExpression
) ? void (0) : __assert_fail ("MTE->getStorageDuration() != SD_FullExpression"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 276, __extension__
 __PRETTY_FUNCTION__));
        if (!VD->getType()->isReferenceType()) {
          // We're lifetime-extended by a surrounding aggregate.
          // Automatic destructors aren't quite working in this case
          // on the CFG side. We should warn the caller about that.
          // FIXME: Is there a better way to retrieve this information from
          // the MaterializeTemporaryExpr?
          CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true;
        }
      }

      if (MTE->getStorageDuration() == SD_Static ||
          MTE->getStorageDuration() == SD_Thread)
        return loc::MemRegionVal(MRMgr.getCXXStaticTempObjectRegion(E));
    }

    return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
  }
  case ConstructionContext::LambdaCaptureKind: {
    CallOpts.IsTemporaryCtorOrDtor = true;

    const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
30
←
'CC' is a 'CastReturnType'→

    SVal Base = loc::MemRegionVal(
        MRMgr.getCXXTempObjectRegion(LCC->getInitializer(), LCtx));

    const auto *CE = dyn_cast_or_null<CXXConstructExpr>(E);
31
←
Assuming null pointer is passed into cast→
    if (getIndexOfElementToConstruct(State, CE, LCtx)) {
32
←
Assuming the condition is true→
33
←
Taking true branch→
      CallOpts.IsArrayCtorOrDtor = true;
      Base = State->getLValue(E->getType(), svalBuilder.makeArrayIndex(Idx),
34
←
Called C++ object pointer is null
                              Base);
    }

    return Base;
  }
  case ConstructionContext::ArgumentKind: {
    // Arguments are technically temporaries.
    CallOpts.IsTemporaryCtorOrDtor = true;

    const auto *ACC = cast<ArgumentConstructionContext>(CC);
    const Expr *E = ACC->getCallLikeExpr();
    unsigned Idx = ACC->getIndex();

    CallEventManager &CEMgr = getStateManager().getCallEventManager();
    auto getArgLoc = [&](CallEventRef<> Caller) -> Optional<SVal> {
      const LocationContext *FutureSFC =
          Caller->getCalleeStackFrame(currBldrCtx->blockCount());
      // Return early if we are unable to reliably foresee
      // the future stack frame.
      if (!FutureSFC)
        return None;

      // This should be equivalent to Caller->getDecl() for now, but
      // FutureSFC->getDecl() is likely to support better stuff (like
      // virtual functions) earlier.
      const Decl *CalleeD = FutureSFC->getDecl();

      // FIXME: Support for variadic arguments is not implemented here yet.
      if (CallEvent::isVariadic(CalleeD))
        return None;

      // Operator arguments do not correspond to operator parameters
      // because this-argument is implemented as a normal argument in
      // operator call expressions but not in operator declarations.
      const TypedValueRegion *TVR = Caller->getParameterLocation(
          *Caller->getAdjustedParameterIndex(Idx), currBldrCtx->blockCount());
      if (!TVR)
        return None;

      return loc::MemRegionVal(TVR);
    };

    if (const auto *CE = dyn_cast<CallExpr>(E)) {
      CallEventRef<> Caller = CEMgr.getSimpleCall(CE, State, LCtx);
      if (Optional<SVal> V = getArgLoc(Caller))
        return *V;
      else
        break;
    } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(E)) {
      // Don't bother figuring out the target region for the future
      // constructor because we won't need it.
      CallEventRef<> Caller =
          CEMgr.getCXXConstructorCall(CCE, /*Target=*/nullptr, State, LCtx);
      if (Optional<SVal> V = getArgLoc(Caller))
        return *V;
      else
        break;
    } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(E)) {
      CallEventRef<> Caller = CEMgr.getObjCMethodCall(ME, State, LCtx);
      if (Optional<SVal> V = getArgLoc(Caller))
        return *V;
      else
        break;
    }
  }
  } // switch (CC->getKind())
}

// If we couldn't find an existing region to construct into, assume we're
// constructing a temporary. Notify the caller of our failure.
CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
378}

380ProgramStateRef ExprEngine::updateObjectsUnderConstruction(
  SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
  const ConstructionContext *CC, const EvalCallOptions &CallOpts) {
if (CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion) {
  // Sounds like we failed to find the target region and therefore
  // copy elision failed. There's nothing we can do about it here.
  return State;
}

// See if we're constructing an existing region by looking at the
// current construction context.
assert(CC && "Computed target region without construction context?")(static_cast <bool> (CC && "Computed target region without construction context?"
) ? void (0) : __assert_fail ("CC && \"Computed target region without construction context?\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 391, __extension__
 __PRETTY_FUNCTION__));
switch (CC->getKind()) {
case ConstructionContext::CXX17ElidedCopyVariableKind:
case ConstructionContext::SimpleVariableKind: {
  const auto *DSCC = cast<VariableConstructionContext>(CC);
  return addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, V);
  }
  case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
  case ConstructionContext::SimpleConstructorInitializerKind: {
    const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
    const auto *Init = ICC->getCXXCtorInitializer();
    // Base and delegating initializers handled above
    assert(Init->isAnyMemberInitializer() &&(static_cast <bool> (Init->isAnyMemberInitializer() &&
 "Base and delegating initializers should have been handled by"
 "computeObjectUnderConstruction()") ? void (0) : __assert_fail
 ("Init->isAnyMemberInitializer() && \"Base and delegating initializers should have been handled by\" \"computeObjectUnderConstruction()\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 405, __extension__
 __PRETTY_FUNCTION__))
           "Base and delegating initializers should have been handled by"(static_cast <bool> (Init->isAnyMemberInitializer() &&
 "Base and delegating initializers should have been handled by"
 "computeObjectUnderConstruction()") ? void (0) : __assert_fail
 ("Init->isAnyMemberInitializer() && \"Base and delegating initializers should have been handled by\" \"computeObjectUnderConstruction()\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 405, __extension__
 __PRETTY_FUNCTION__))
           "computeObjectUnderConstruction()")(static_cast <bool> (Init->isAnyMemberInitializer() &&
 "Base and delegating initializers should have been handled by"
 "computeObjectUnderConstruction()") ? void (0) : __assert_fail
 ("Init->isAnyMemberInitializer() && \"Base and delegating initializers should have been handled by\" \"computeObjectUnderConstruction()\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 405, __extension__
 __PRETTY_FUNCTION__));
    return addObjectUnderConstruction(State, Init, LCtx, V);
  }
  case ConstructionContext::NewAllocatedObjectKind: {
    return State;
  }
  case ConstructionContext::SimpleReturnedValueKind:
  case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
    const StackFrameContext *SFC = LCtx->getStackFrame();
    const LocationContext *CallerLCtx = SFC->getParent();
    if (!CallerLCtx) {
      // No extra work is necessary in top frame.
      return State;
    }

    auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
                   .getAs<CFGCXXRecordTypedCall>();
    assert(RTC && "Could not have had a target region without it")(static_cast <bool> (RTC && "Could not have had a target region without it"
) ? void (0) : __assert_fail ("RTC && \"Could not have had a target region without it\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 422, __extension__
 __PRETTY_FUNCTION__));
    if (isa<BlockInvocationContext>(CallerLCtx)) {
      // Unwrap block invocation contexts. They're mostly part of
      // the current stack frame.
      CallerLCtx = CallerLCtx->getParent();
      assert(!isa<BlockInvocationContext>(CallerLCtx))(static_cast <bool> (!isa<BlockInvocationContext>
(CallerLCtx)) ? void (0) : __assert_fail ("!isa<BlockInvocationContext>(CallerLCtx)"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 427, __extension__
 __PRETTY_FUNCTION__));
    }

    return updateObjectsUnderConstruction(V,
        cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
        RTC->getConstructionContext(), CallOpts);
  }
  case ConstructionContext::ElidedTemporaryObjectKind: {
    assert(AMgr.getAnalyzerOptions().ShouldElideConstructors)(static_cast <bool> (AMgr.getAnalyzerOptions().ShouldElideConstructors
) ? void (0) : __assert_fail ("AMgr.getAnalyzerOptions().ShouldElideConstructors"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 435, __extension__
 __PRETTY_FUNCTION__));
    if (!CallOpts.IsElidableCtorThatHasNotBeenElided) {
      const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
      State = updateObjectsUnderConstruction(
          V, TCC->getConstructorAfterElision(), State, LCtx,
          TCC->getConstructionContextAfterElision(), CallOpts);

      // Remember that we've elided the constructor.
      State = addObjectUnderConstruction(
          State, TCC->getConstructorAfterElision(), LCtx, V);

      // Remember that we've elided the destructor.
      if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
        State = elideDestructor(State, BTE, LCtx);

      // Instead of materialization, shamelessly return
      // the final object destination.
      if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
        State = addObjectUnderConstruction(State, MTE, LCtx, V);

      return State;
    }
    // If we decided not to elide the constructor, proceed as if
    // it's a simple temporary.
    [[fallthrough]];
  }
  case ConstructionContext::SimpleTemporaryObjectKind: {
    const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
    if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
      State = addObjectUnderConstruction(State, BTE, LCtx, V);

    if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
      State = addObjectUnderConstruction(State, MTE, LCtx, V);

    return State;
  }
  case ConstructionContext::LambdaCaptureKind: {
    const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);

    // If we capture and array, we want to store the super region, not a
    // sub-region.
    if (const auto *EL = dyn_cast_or_null<ElementRegion>(V.getAsRegion()))
      V = loc::MemRegionVal(EL->getSuperRegion());

    return addObjectUnderConstruction(
        State, {LCC->getLambdaExpr(), LCC->getIndex()}, LCtx, V);
  }
  case ConstructionContext::ArgumentKind: {
    const auto *ACC = cast<ArgumentConstructionContext>(CC);
    if (const auto *BTE = ACC->getCXXBindTemporaryExpr())
      State = addObjectUnderConstruction(State, BTE, LCtx, V);

    return addObjectUnderConstruction(
        State, {ACC->getCallLikeExpr(), ACC->getIndex()}, LCtx, V);
  }
}
llvm_unreachable("Unhandled construction context!")::llvm::llvm_unreachable_internal("Unhandled construction context!"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 491);
492}

494static ProgramStateRef
495bindRequiredArrayElementToEnvironment(ProgramStateRef State,
                                    const ArrayInitLoopExpr *AILE,
                                    const LocationContext *LCtx, SVal Idx) {
// The ctor in this case is guaranteed to be a copy ctor, otherwise we hit a
// compile time error.
//
//  -ArrayInitLoopExpr                <-- we're here
//   |-OpaqueValueExpr
//   | `-DeclRefExpr                  <-- match this
//   `-CXXConstructExpr
//     `-ImplicitCastExpr
//       `-ArraySubscriptExpr
//         |-ImplicitCastExpr
//         | `-OpaqueValueExpr
//         |   `-DeclRefExpr
//         `-ArrayInitIndexExpr
//
// The resulting expression might look like the one below in an implicit
// copy/move ctor.
//
//   ArrayInitLoopExpr                <-- we're here
//   |-OpaqueValueExpr
//   | `-MemberExpr                   <-- match this
//   |  (`-CXXStaticCastExpr)         <-- move ctor only
//   |     `-DeclRefExpr
//   `-CXXConstructExpr
//     `-ArraySubscriptExpr
//       |-ImplicitCastExpr
//       | `-OpaqueValueExpr
//       |   `-MemberExpr
//       |     `-DeclRefExpr
//       `-ArrayInitIndexExpr
//
// The resulting expression for a multidimensional array.
// ArrayInitLoopExpr                  <-- we're here
// |-OpaqueValueExpr
// | `-DeclRefExpr                    <-- match this
// `-ArrayInitLoopExpr
//   |-OpaqueValueExpr
//   | `-ArraySubscriptExpr
//   |   |-ImplicitCastExpr
//   |   | `-OpaqueValueExpr
//   |   |   `-DeclRefExpr
//   |   `-ArrayInitIndexExpr
//   `-CXXConstructExpr             <-- extract this
//     ` ...

const auto *OVESrc = AILE->getCommonExpr()->getSourceExpr();

// HACK: There is no way we can put the index of the array element into the
// CFG unless we unroll the loop, so we manually select and bind the required
// parameter to the environment.
const auto *CE =
    cast<CXXConstructExpr>(extractElementInitializerFromNestedAILE(AILE));

SVal Base = UnknownVal();
if (const auto *ME = dyn_cast<MemberExpr>(OVESrc))
  Base = State->getSVal(ME, LCtx);
else if (const auto *DRE = dyn_cast<DeclRefExpr>(OVESrc))
  Base = State->getLValue(cast<VarDecl>(DRE->getDecl()), LCtx);
else
  llvm_unreachable("ArrayInitLoopExpr contains unexpected source expression")::llvm::llvm_unreachable_internal("ArrayInitLoopExpr contains unexpected source expression"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 556);

SVal NthElem = State->getLValue(CE->getType(), Idx, Base);

return State->BindExpr(CE->getArg(0), LCtx, NthElem);
561}

563void ExprEngine::handleConstructor(const Expr *E,
                                 ExplodedNode *Pred,
                                 ExplodedNodeSet &destNodes) {
const auto *CE = dyn_cast<CXXConstructExpr>(E);
1
Assuming 'E' is a 'CastReturnType'→
const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(E);
2
←
Assuming 'E' is not a 'CastReturnType'→
assert(CE || CIE)(static_cast <bool> (CE || CIE) ? void (0) : __assert_fail
 ("CE || CIE", "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp"
, 568, __extension__ __PRETTY_FUNCTION__));
3
←
'?' condition is true→

const LocationContext *LCtx = Pred->getLocationContext();
ProgramStateRef State = Pred->getState();

SVal Target = UnknownVal();

if (CE3.1
'CE' is non-null
1
'CE' is non-null
) {
4
←
Taking true branch→
  if (Optional<SVal> ElidedTarget =
5
←
Assuming the condition is false→
6
←
Taking false branch→
          getObjectUnderConstruction(State, CE, LCtx)) {
    // We've previously modeled an elidable constructor by pretending that it
    // in fact constructs into the correct target. This constructor can
    // therefore be skipped.
    Target = *ElidedTarget;
    StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
    State = finishObjectConstruction(State, CE, LCtx);
    if (auto L = Target.getAs<Loc>())
      State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
    Bldr.generateNode(CE, Pred, State);
    return;
  }
}

EvalCallOptions CallOpts;
auto C = getCurrentCFGElement().getAs<CFGConstructor>();
assert(C || getCurrentCFGElement().getAs<CFGStmt>())(static_cast <bool> (C || getCurrentCFGElement().getAs<
CFGStmt>()) ? void (0) : __assert_fail ("C || getCurrentCFGElement().getAs<CFGStmt>()"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 593, __extension__
 __PRETTY_FUNCTION__));
7
←
Assuming the condition is true→
8
←
'?' condition is true→
const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
9
←
'?' condition is true→

const CXXConstructExpr::ConstructionKind CK =
    CE9.1
'CE' is non-null
1
'CE' is non-null
 ? CE->getConstructionKind() : CIE->getConstructionKind();
10
←
'?' condition is true→
switch (CK) {
11
←
Control jumps to 'case CK_Complete:'  at line 599→
case CXXConstructExpr::CK_Complete: {
  // Inherited constructors are always base class constructors.
  assert(CE && !CIE && "A complete constructor is inherited?!")(static_cast <bool> (CE && !CIE && "A complete constructor is inherited?!"
) ? void (0) : __assert_fail ("CE && !CIE && \"A complete constructor is inherited?!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 601, __extension__
 __PRETTY_FUNCTION__));
12
←
'?' condition is true→

  // If the ctor is part of an ArrayInitLoopExpr, we want to handle it
  // differently.
  auto *AILE = CC ? CC->getArrayInitLoop() : nullptr;
13
←
Assuming 'CC' is non-null→
14
←
'?' condition is true→

  unsigned Idx = 0;
  if (CE->getType()->isArrayType() || AILE) {
15
←
Assuming the condition is false→
16
←
Taking false branch→

    auto isZeroSizeArray = [&] {
      uint64_t Size = 1;

      if (const auto *CAT = dyn_cast<ConstantArrayType>(CE->getType()))
        Size = getContext().getConstantArrayElementCount(CAT);
      else if (AILE)
        Size = getContext().getArrayInitLoopExprElementCount(AILE);

      return Size == 0;
    };

    // No element construction will happen in a 0 size array.
    if (isZeroSizeArray()) {
      StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
      static SimpleProgramPointTag T{"ExprEngine",
                                     "Skipping 0 size array construction"};
      Bldr.generateNode(CE, Pred, State, &T);
      return;
    }

    Idx = getIndexOfElementToConstruct(State, CE, LCtx).value_or(0u);
    State = setIndexOfElementToConstruct(State, CE, LCtx, Idx + 1);
  }

  if (AILE16.1
'AILE' is null
1
'AILE' is null
) {
17
←
Taking false branch→
    // Only set this once even though we loop through it multiple times.
    if (!getPendingInitLoop(State, CE, LCtx))
      State = setPendingInitLoop(
          State, CE, LCtx,
          getContext().getArrayInitLoopExprElementCount(AILE));

    State = bindRequiredArrayElementToEnvironment(
        State, AILE, LCtx, svalBuilder.makeArrayIndex(Idx));
  }

  // The target region is found from construction context.
  std::tie(State, Target) =
      handleConstructionContext(CE, State, LCtx, CC, CallOpts, Idx);
18
←
Calling 'ExprEngine::handleConstructionContext'→
  break;
}
case CXXConstructExpr::CK_VirtualBase: {
  // Make sure we are not calling virtual base class initializers twice.
  // Only the most-derived object should initialize virtual base classes.
  const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
      LCtx->getStackFrame()->getCallSite());
  assert((static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__))
      (!OuterCtor ||(static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__))
       OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete ||(static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__))
       OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) &&(static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__))
      ("This virtual base should have already been initialized by "(static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__))
       "the most derived class!"))(static_cast <bool> ((!OuterCtor || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind
() == CXXConstructExpr::CK_Delegating) && ("This virtual base should have already been initialized by "
 "the most derived class!")) ? void (0) : __assert_fail ("(!OuterCtor || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete || OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) && (\"This virtual base should have already been initialized by \" \"the most derived class!\")"
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 660, __extension__
 __PRETTY_FUNCTION__));
  (void)OuterCtor;
  [[fallthrough]];
}
case CXXConstructExpr::CK_NonVirtualBase:
  // In C++17, classes with non-virtual bases may be aggregates, so they would
  // be initialized as aggregates without a constructor call, so we may have
  // a base class constructed directly into an initializer list without
  // having the derived-class constructor call on the previous stack frame.
  // Initializer lists may be nested into more initializer lists that
  // correspond to surrounding aggregate initializations.
  // FIXME: For now this code essentially bails out. We need to find the
  // correct target region and set it.
  // FIXME: Instead of relying on the ParentMap, we should have the
  // trigger-statement (InitListExpr in this case) passed down from CFG or
  // otherwise always available during construction.
  if (isa_and_nonnull<InitListExpr>(LCtx->getParentMap().getParent(E))) {
    MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
    Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
    CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
    break;
  }
  [[fallthrough]];
case CXXConstructExpr::CK_Delegating: {
  const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
  Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
                                            LCtx->getStackFrame());
  SVal ThisVal = State->getSVal(ThisPtr);

  if (CK == CXXConstructExpr::CK_Delegating) {
    Target = ThisVal;
  } else {
    // Cast to the base type.
    bool IsVirtual = (CK == CXXConstructExpr::CK_VirtualBase);
    SVal BaseVal =
        getStoreManager().evalDerivedToBase(ThisVal, E->getType(), IsVirtual);
    Target = BaseVal;
  }
  break;
}
}

if (State != Pred->getState()) {
  static SimpleProgramPointTag T("ExprEngine",
                                 "Prepare for object construction");
  ExplodedNodeSet DstPrepare;
  StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
  BldrPrepare.generateNode(E, Pred, State, &T, ProgramPoint::PreStmtKind);
  assert(DstPrepare.size() <= 1)(static_cast <bool> (DstPrepare.size() <= 1) ? void (
0) : __assert_fail ("DstPrepare.size() <= 1", "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp"
, 708, __extension__ __PRETTY_FUNCTION__));
  if (DstPrepare.size() == 0)
    return;
  Pred = *BldrPrepare.begin();
}

const MemRegion *TargetRegion = Target.getAsRegion();
CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<> Call =
    CIE ? (CallEventRef<>)CEMgr.getCXXInheritedConstructorCall(
              CIE, TargetRegion, State, LCtx)
        : (CallEventRef<>)CEMgr.getCXXConstructorCall(
              CE, TargetRegion, State, LCtx);

ExplodedNodeSet DstPreVisit;
getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, E, *this);

ExplodedNodeSet PreInitialized;
if (CE) {
  // FIXME: Is it possible and/or useful to do this before PreStmt?
  StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
  for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
                                 E = DstPreVisit.end();
       I != E; ++I) {
    ProgramStateRef State = (*I)->getState();
    if (CE->requiresZeroInitialization()) {
      // FIXME: Once we properly handle constructors in new-expressions, we'll
      // need to invalidate the region before setting a default value, to make
      // sure there aren't any lingering bindings around. This probably needs
      // to happen regardless of whether or not the object is zero-initialized
      // to handle random fields of a placement-initialized object picking up
      // old bindings. We might only want to do it when we need to, though.
      // FIXME: This isn't actually correct for arrays -- we need to zero-
      // initialize the entire array, not just the first element -- but our
      // handling of arrays everywhere else is weak as well, so this shouldn't
      // actually make things worse. Placement new makes this tricky as well,
      // since it's then possible to be initializing one part of a multi-
      // dimensional array.
      State = State->bindDefaultZero(Target, LCtx);
    }

    Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
                      ProgramPoint::PreStmtKind);
  }
} else {
  PreInitialized = DstPreVisit;
}

ExplodedNodeSet DstPreCall;
getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
                                          *Call, *this);

ExplodedNodeSet DstEvaluated;

if (CE && CE->getConstructor()->isTrivial() &&
    CE->getConstructor()->isCopyOrMoveConstructor() &&
    !CallOpts.IsArrayCtorOrDtor) {
  StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
  // FIXME: Handle other kinds of trivial constructors as well.
  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
       I != E; ++I)
    performTrivialCopy(Bldr, *I, *Call);

} else {
  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
       I != E; ++I)
    getCheckerManager().runCheckersForEvalCall(DstEvaluated, *I, *Call, *this,
                                               CallOpts);
}

// If the CFG was constructed without elements for temporary destructors
// and the just-called constructor created a temporary object then
// stop exploration if the temporary object has a noreturn constructor.
// This can lose coverage because the destructor, if it were present
// in the CFG, would be called at the end of the full expression or
// later (for life-time extended temporaries) -- but avoids infeasible
// paths when no-return temporary destructors are used for assertions.
ExplodedNodeSet DstEvaluatedPostProcessed;
StmtNodeBuilder Bldr(DstEvaluated, DstEvaluatedPostProcessed, *currBldrCtx);
const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
  if (llvm::isa_and_nonnull<CXXTempObjectRegion>(TargetRegion) &&
      cast<CXXConstructorDecl>(Call->getDecl())
          ->getParent()
          ->isAnyDestructorNoReturn()) {

    // If we've inlined the constructor, then DstEvaluated would be empty.
    // In this case we still want a sink, which could be implemented
    // in processCallExit. But we don't have that implemented at the moment,
    // so if you hit this assertion, see if you can avoid inlining
    // the respective constructor when analyzer-config cfg-temporary-dtors
    // is set to false.
    // Otherwise there's nothing wrong with inlining such constructor.
    assert(!DstEvaluated.empty() &&(static_cast <bool> (!DstEvaluated.empty() && "We should not have inlined this constructor!"
) ? void (0) : __assert_fail ("!DstEvaluated.empty() && \"We should not have inlined this constructor!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 802, __extension__
 __PRETTY_FUNCTION__))
           "We should not have inlined this constructor!")(static_cast <bool> (!DstEvaluated.empty() && "We should not have inlined this constructor!"
) ? void (0) : __assert_fail ("!DstEvaluated.empty() && \"We should not have inlined this constructor!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 802, __extension__
 __PRETTY_FUNCTION__));

    for (ExplodedNode *N : DstEvaluated) {
      Bldr.generateSink(E, N, N->getState());
    }

    // There is no need to run the PostCall and PostStmt checker
    // callbacks because we just generated sinks on all nodes in th
    // frontier.
    return;
  }
}

ExplodedNodeSet DstPostArgumentCleanup;
for (ExplodedNode *I : DstEvaluatedPostProcessed)
  finishArgumentConstruction(DstPostArgumentCleanup, I, *Call);

// If there were other constructors called for object-type arguments
// of this constructor, clean them up.
ExplodedNodeSet DstPostCall;
getCheckerManager().runCheckersForPostCall(DstPostCall,
                                           DstPostArgumentCleanup,
                                           *Call, *this);
getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, E, *this);
826}

828void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
                                     ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst) {
handleConstructor(CE, Pred, Dst);
832}

834void ExprEngine::VisitCXXInheritedCtorInitExpr(
  const CXXInheritedCtorInitExpr *CE, ExplodedNode *Pred,
  ExplodedNodeSet &Dst) {
handleConstructor(CE, Pred, Dst);
838}

840void ExprEngine::VisitCXXDestructor(QualType ObjectType,
                                  const MemRegion *Dest,
                                  const Stmt *S,
                                  bool IsBaseDtor,
                                  ExplodedNode *Pred,
                                  ExplodedNodeSet &Dst,
                                  EvalCallOptions &CallOpts) {
assert(S && "A destructor without a trigger!")(static_cast <bool> (S && "A destructor without a trigger!"
) ? void (0) : __assert_fail ("S && \"A destructor without a trigger!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 847, __extension__
 __PRETTY_FUNCTION__));
const LocationContext *LCtx = Pred->getLocationContext();
ProgramStateRef State = Pred->getState();

const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
assert(RecordDecl && "Only CXXRecordDecls should have destructors")(static_cast <bool> (RecordDecl && "Only CXXRecordDecls should have destructors"
) ? void (0) : __assert_fail ("RecordDecl && \"Only CXXRecordDecls should have destructors\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 852, __extension__
 __PRETTY_FUNCTION__));
const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
// FIXME: There should always be a Decl, otherwise the destructor call
// shouldn't have been added to the CFG in the first place.
if (!DtorDecl) {
  // Skip the invalid destructor. We cannot simply return because
  // it would interrupt the analysis instead.
  static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
  // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway.
  PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx, &T);
  NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
  Bldr.generateNode(PP, Pred->getState(), Pred);
  return;
}

if (!Dest) {
  // We're trying to destroy something that is not a region. This may happen
  // for a variety of reasons (unknown target region, concrete integer instead
  // of target region, etc.). The current code makes an attempt to recover.
  // FIXME: We probably don't really need to recover when we're dealing
  // with concrete integers specifically.
  CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
  if (const Expr *E = dyn_cast_or_null<Expr>(S)) {
    Dest = MRMgr.getCXXTempObjectRegion(E, Pred->getLocationContext());
  } else {
    static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
    NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
    Bldr.generateSink(Pred->getLocation().withTag(&T),
                      Pred->getState(), Pred);
    return;
  }
}

CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<CXXDestructorCall> Call =
    CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);

PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                              Call->getSourceRange().getBegin(),
                              "Error evaluating destructor");

ExplodedNodeSet DstPreCall;
getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
                                          *Call, *this);

ExplodedNodeSet DstInvalidated;
StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
     I != E; ++I)
  defaultEvalCall(Bldr, *I, *Call, CallOpts);

getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
                                           *Call, *this);
905}

907void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
                                        ExplodedNode *Pred,
                                        ExplodedNodeSet &Dst) {
ProgramStateRef State = Pred->getState();
const LocationContext *LCtx = Pred->getLocationContext();
PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
                              CNE->getBeginLoc(),
                              "Error evaluating New Allocator Call");
CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<CXXAllocatorCall> Call =
  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);

ExplodedNodeSet DstPreCall;
getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
                                          *Call, *this);

ExplodedNodeSet DstPostCall;
StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
for (ExplodedNode *I : DstPreCall) {
  // FIXME: Provide evalCall for checkers?
  defaultEvalCall(CallBldr, I, *Call);
}
// If the call is inlined, DstPostCall will be empty and we bail out now.

// Store return value of operator new() for future use, until the actual
// CXXNewExpr gets processed.
ExplodedNodeSet DstPostValue;
StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
for (ExplodedNode *I : DstPostCall) {
  // FIXME: Because CNE serves as the "call site" for the allocator (due to
  // lack of a better expression in the AST), the conjured return value symbol
  // is going to be of the same type (C++ object pointer type). Technically
  // this is not correct because the operator new's prototype always says that
  // it returns a 'void *'. So we should change the type of the symbol,
  // and then evaluate the cast over the symbolic pointer from 'void *' to
  // the object pointer type. But without changing the symbol's type it
  // is breaking too much to evaluate the no-op symbolic cast over it, so we
  // skip it for now.
  ProgramStateRef State = I->getState();
  SVal RetVal = State->getSVal(CNE, LCtx);

  // If this allocation function is not declared as non-throwing, failures
  // /must/ be signalled by exceptions, and thus the return value will never
  // be NULL. -fno-exceptions does not influence this semantics.
  // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
  // where new can return NULL. If we end up supporting that option, we can
  // consider adding a check for it here.
  // C++11 [basic.stc.dynamic.allocation]p3.
  if (const FunctionDecl *FD = CNE->getOperatorNew()) {
    QualType Ty = FD->getType();
    if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
      if (!ProtoType->isNothrow())
        State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true);
  }

  ValueBldr.generateNode(
      CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
}

ExplodedNodeSet DstPostPostCallCallback;
getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
                                           DstPostValue, *Call, *this);
for (ExplodedNode *I : DstPostPostCallCallback) {
  getCheckerManager().runCheckersForNewAllocator(*Call, Dst, I, *this);
}
972}

974void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst) {
// FIXME: Much of this should eventually migrate to CXXAllocatorCall.
// Also, we need to decide how allocators actually work -- they're not
// really part of the CXXNewExpr because they happen BEFORE the
// CXXConstructExpr subexpression. See PR12014 for some discussion.

unsigned blockCount = currBldrCtx->blockCount();
const LocationContext *LCtx = Pred->getLocationContext();
SVal symVal = UnknownVal();
FunctionDecl *FD = CNE->getOperatorNew();

bool IsStandardGlobalOpNewFunction =
    FD->isReplaceableGlobalAllocationFunction();

ProgramStateRef State = Pred->getState();

// Retrieve the stored operator new() return value.
if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
  symVal = *getObjectUnderConstruction(State, CNE, LCtx);
  State = finishObjectConstruction(State, CNE, LCtx);
}

// We assume all standard global 'operator new' functions allocate memory in
// heap. We realize this is an approximation that might not correctly model
// a custom global allocator.
if (symVal.isUnknown()) {
  if (IsStandardGlobalOpNewFunction)
    symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
  else
    symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
                                          blockCount);
}

CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<CXXAllocatorCall> Call =
  CEMgr.getCXXAllocatorCall(CNE, State, LCtx);

if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
  // Invalidate placement args.
  // FIXME: Once we figure out how we want allocators to work,
  // we should be using the usual pre-/(default-)eval-/post-call checkers
  // here.
  State = Call->invalidateRegions(blockCount);
  if (!State)
    return;

  // If this allocation function is not declared as non-throwing, failures
  // /must/ be signalled by exceptions, and thus the return value will never
  // be NULL. -fno-exceptions does not influence this semantics.
  // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
  // where new can return NULL. If we end up supporting that option, we can
  // consider adding a check for it here.
  // C++11 [basic.stc.dynamic.allocation]p3.
  if (const auto *ProtoType = FD->getType()->getAs<FunctionProtoType>())
    if (!ProtoType->isNothrow())
      if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
        State = State->assume(*dSymVal, true);
}

StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);

SVal Result = symVal;

if (CNE->isArray()) {

  if (const auto *NewReg = cast_or_null<SubRegion>(symVal.getAsRegion())) {
    // If each element is initialized by their default constructor, the field
    // values are properly placed inside the required region, however if an
    // initializer list is used, this doesn't happen automatically.
    auto *Init = CNE->getInitializer();
    bool isInitList = isa_and_nonnull<InitListExpr>(Init);

    QualType ObjTy =
        isInitList ? Init->getType() : CNE->getType()->getPointeeType();
    const ElementRegion *EleReg =
        MRMgr.getElementRegion(ObjTy, svalBuilder.makeArrayIndex(0), NewReg,
                               svalBuilder.getContext());
    Result = loc::MemRegionVal(EleReg);

    // If the array is list initialized, we bind the initializer list to the
    // memory region here, otherwise we would lose it.
    if (isInitList) {
      Bldr.takeNodes(Pred);
      Pred = Bldr.generateNode(CNE, Pred, State);

      SVal V = State->getSVal(Init, LCtx);
      ExplodedNodeSet evaluated;
      evalBind(evaluated, CNE, Pred, Result, V, true);

      Bldr.takeNodes(Pred);
      Bldr.addNodes(evaluated);

      Pred = *evaluated.begin();
      State = Pred->getState();
    }
  }

  State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
  Bldr.generateNode(CNE, Pred, State);
  return;
}

// FIXME: Once we have proper support for CXXConstructExprs inside
// CXXNewExpr, we need to make sure that the constructed object is not
// immediately invalidated here. (The placement call should happen before
// the constructor call anyway.)
if (FD->isReservedGlobalPlacementOperator()) {
  // Non-array placement new should always return the placement location.
  SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
  Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
                                CNE->getPlacementArg(0)->getType());
}

// Bind the address of the object, then check to see if we cached out.
State = State->BindExpr(CNE, LCtx, Result);
ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
if (!NewN)
  return;

// If the type is not a record, we won't have a CXXConstructExpr as an
// initializer. Copy the value over.
if (const Expr *Init = CNE->getInitializer()) {
  if (!isa<CXXConstructExpr>(Init)) {
    assert(Bldr.getResults().size() == 1)(static_cast <bool> (Bldr.getResults().size() == 1) ? void
 (0) : __assert_fail ("Bldr.getResults().size() == 1", "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp"
, 1098, __extension__ __PRETTY_FUNCTION__));
    Bldr.takeNodes(NewN);
    evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
             /*FirstInit=*/IsStandardGlobalOpNewFunction);
  }
}
1104}

1106void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
                                  ExplodedNode *Pred, ExplodedNodeSet &Dst) {

CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<CXXDeallocatorCall> Call = CEMgr.getCXXDeallocatorCall(
    CDE, Pred->getState(), Pred->getLocationContext());

ExplodedNodeSet DstPreCall;
getCheckerManager().runCheckersForPreCall(DstPreCall, Pred, *Call, *this);
ExplodedNodeSet DstPostCall;

if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
  StmtNodeBuilder Bldr(DstPreCall, DstPostCall, *currBldrCtx);
  for (ExplodedNode *I : DstPreCall) {
    defaultEvalCall(Bldr, I, *Call);
  }
} else {
  DstPostCall = DstPreCall;
}
getCheckerManager().runCheckersForPostCall(Dst, DstPostCall, *Call, *this);
1126}

1128void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
                                 ExplodedNodeSet &Dst) {
const VarDecl *VD = CS->getExceptionDecl();
if (!VD) {
  Dst.Add(Pred);
  return;
}

const LocationContext *LCtx = Pred->getLocationContext();
SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
                                      currBldrCtx->blockCount());
ProgramStateRef state = Pred->getState();
state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);

StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
Bldr.generateNode(CS, Pred, state);
1144}

1146void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
                                  ExplodedNodeSet &Dst) {
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);

// Get the this object region from StoreManager.
const LocationContext *LCtx = Pred->getLocationContext();
const MemRegion *R =
  svalBuilder.getRegionManager().getCXXThisRegion(
                                getContext().getCanonicalType(TE->getType()),
                                                  LCtx);

ProgramStateRef state = Pred->getState();
SVal V = state->getSVal(loc::MemRegionVal(R));
Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
1160}

1162void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
                               ExplodedNodeSet &Dst) {
const LocationContext *LocCtxt = Pred->getLocationContext();

// Get the region of the lambda itself.
const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
    LE, LocCtxt);
SVal V = loc::MemRegionVal(R);

ProgramStateRef State = Pred->getState();

// If we created a new MemRegion for the lambda, we should explicitly bind
// the captures.
unsigned Idx = 0;
CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin();
for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
                                             e = LE->capture_init_end();
     i != e; ++i, ++CurField, ++Idx) {
  FieldDecl *FieldForCapture = *CurField;
  SVal FieldLoc = State->getLValue(FieldForCapture, V);

  SVal InitVal;
  if (!FieldForCapture->hasCapturedVLAType()) {
    const Expr *InitExpr = *i;

    assert(InitExpr && "Capture missing initialization expression")(static_cast <bool> (InitExpr && "Capture missing initialization expression"
) ? void (0) : __assert_fail ("InitExpr && \"Capture missing initialization expression\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 1187, __extension__
 __PRETTY_FUNCTION__));

    // Capturing a 0 length array is a no-op, so we ignore it to get a more
    // accurate analysis. If it's not ignored, it would set the default
    // binding of the lambda to 'Unknown', which can lead to falsely detecting
    // 'Uninitialized' values as 'Unknown' and not reporting a warning.
    const auto FTy = FieldForCapture->getType();
    if (FTy->isConstantArrayType() &&
        getContext().getConstantArrayElementCount(
            getContext().getAsConstantArrayType(FTy)) == 0)
      continue;

    // With C++17 copy elision the InitExpr can be anything, so instead of
    // pattern matching all cases, we simple check if the current field is
    // under construction or not, regardless what it's InitExpr is.
    if (const auto OUC =
            getObjectUnderConstruction(State, {LE, Idx}, LocCtxt)) {
      InitVal = State->getSVal(OUC->getAsRegion());

      State = finishObjectConstruction(State, {LE, Idx}, LocCtxt);
    } else
      InitVal = State->getSVal(InitExpr, LocCtxt);

  } else {

    assert(!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) &&(static_cast <bool> (!getObjectUnderConstruction(State,
 {LE, Idx}, LocCtxt) && "VLA capture by value is a compile time error!"
) ? void (0) : __assert_fail ("!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) && \"VLA capture by value is a compile time error!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 1213, __extension__
 __PRETTY_FUNCTION__))
           "VLA capture by value is a compile time error!")(static_cast <bool> (!getObjectUnderConstruction(State,
 {LE, Idx}, LocCtxt) && "VLA capture by value is a compile time error!"
) ? void (0) : __assert_fail ("!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) && \"VLA capture by value is a compile time error!\""
, "clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp", 1213, __extension__
 __PRETTY_FUNCTION__));

    // The field stores the length of a captured variable-length array.
    // These captures don't have initialization expressions; instead we
    // get the length from the VLAType size expression.
    Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
    InitVal = State->getSVal(SizeExpr, LocCtxt);
  }

  State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
}

// Decay the Loc into an RValue, because there might be a
// MaterializeTemporaryExpr node above this one which expects the bound value
// to be an RValue.
SVal LambdaRVal = State->getSVal(R);

ExplodedNodeSet Tmp;
StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
// FIXME: is this the right program point kind?
Bldr.generateNode(LE, Pred,
                  State->BindExpr(LE, LocCtxt, LambdaRVal),
                  nullptr, ProgramPoint::PostLValueKind);

// FIXME: Move all post/pre visits to ::Visit().
getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);
1239}

←

/build/llvm-toolchain-snapshot-16~++20220904122748+c444af1c20b3/clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

1//===- ExprEngine.h - Path-Sensitive Expression-Level Dataflow --*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9//  This file defines a meta-engine for path-sensitive dataflow analysis that
10//  is built on CoreEngine, but provides the boilerplate to execute transfer
11//  functions and build the ExplodedGraph at the expression level.
12//
13//===----------------------------------------------------------------------===//

15#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H
16#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H

18#include "clang/AST/Expr.h"
19#include "clang/AST/Type.h"
20#include "clang/Analysis/CFG.h"
21#include "clang/Analysis/DomainSpecific/ObjCNoReturn.h"
22#include "clang/Analysis/ProgramPoint.h"
23#include "clang/Basic/LLVM.h"
24#include "clang/StaticAnalyzer/Core/CheckerManager.h"
25#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
26#include "clang/StaticAnalyzer/Core/BugReporter/BugReporterVisitors.h"
27#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
28#include "clang/StaticAnalyzer/Core/PathSensitive/CoreEngine.h"
29#include "clang/StaticAnalyzer/Core/PathSensitive/FunctionSummary.h"
30#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
31#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
32#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
33#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
34#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
35#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
36#include "clang/StaticAnalyzer/Core/PathSensitive/WorkList.h"
37#include "llvm/ADT/ArrayRef.h"
38#include <cassert>
39#include <utility>

41namespace clang {

43class AnalysisDeclContextManager;
44class AnalyzerOptions;
45class ASTContext;
46class CFGBlock;
47class CFGElement;
48class ConstructionContext;
49class CXXBindTemporaryExpr;
50class CXXCatchStmt;
51class CXXConstructExpr;
52class CXXDeleteExpr;
53class CXXNewExpr;
54class CXXThisExpr;
55class Decl;
56class DeclStmt;
57class GCCAsmStmt;
58class LambdaExpr;
59class LocationContext;
60class MaterializeTemporaryExpr;
61class MSAsmStmt;
62class NamedDecl;
63class ObjCAtSynchronizedStmt;
64class ObjCForCollectionStmt;
65class ObjCIvarRefExpr;
66class ObjCMessageExpr;
67class ReturnStmt;
68class Stmt;

70namespace cross_tu {

72class CrossTranslationUnitContext;

74} // namespace cross_tu

76namespace ento {

78class AnalysisManager;
79class BasicValueFactory;
80class CallEvent;
81class CheckerManager;
82class ConstraintManager;
83class ExplodedNodeSet;
84class ExplodedNode;
85class IndirectGotoNodeBuilder;
86class MemRegion;
87struct NodeBuilderContext;
88class NodeBuilderWithSinks;
89class ProgramState;
90class ProgramStateManager;
91class RegionAndSymbolInvalidationTraits;
92class SymbolManager;
93class SwitchNodeBuilder;

95/// Hints for figuring out of a call should be inlined during evalCall().
96struct EvalCallOptions {
/// This call is a constructor or a destructor for which we do not currently
/// compute the this-region correctly.
bool IsCtorOrDtorWithImproperlyModeledTargetRegion = false;

/// This call is a constructor or a destructor for a single element within
/// an array, a part of array construction or destruction.
bool IsArrayCtorOrDtor = false;

/// This call is a constructor or a destructor of a temporary value.
bool IsTemporaryCtorOrDtor = false;

/// This call is a constructor for a temporary that is lifetime-extended
/// by binding it to a reference-type field within an aggregate,
/// for example 'A { const C &c; }; A a = { C() };'
bool IsTemporaryLifetimeExtendedViaAggregate = false;

/// This call is a pre-C++17 elidable constructor that we failed to elide
/// because we failed to compute the target region into which
/// this constructor would have been ultimately elided. Analysis that
/// we perform in this case is still correct but it behaves differently,
/// as if copy elision is disabled.
bool IsElidableCtorThatHasNotBeenElided = false;

EvalCallOptions() {}
121};

123class ExprEngine {
void anchor();

126public:
/// The modes of inlining, which override the default analysis-wide settings.
enum InliningModes {
  /// Follow the default settings for inlining callees.
  Inline_Regular = 0,

  /// Do minimal inlining of callees.
  Inline_Minimal = 0x1
};

136private:
cross_tu::CrossTranslationUnitContext &CTU;
bool IsCTUEnabled;

AnalysisManager &AMgr;

AnalysisDeclContextManager &AnalysisDeclContexts;

CoreEngine Engine;

/// G - the simulation graph.
ExplodedGraph &G;

/// StateMgr - Object that manages the data for all created states.
ProgramStateManager StateMgr;

/// SymMgr - Object that manages the symbol information.
SymbolManager &SymMgr;

/// MRMgr - MemRegionManager object that creates memory regions.
MemRegionManager &MRMgr;

/// svalBuilder - SValBuilder object that creates SVals from expressions.
SValBuilder &svalBuilder;

unsigned int currStmtIdx = 0;
const NodeBuilderContext *currBldrCtx = nullptr;

/// Helper object to determine if an Objective-C message expression
/// implicitly never returns.
ObjCNoReturn ObjCNoRet;

/// The BugReporter associated with this engine.  It is important that
/// this object be placed at the very end of member variables so that its
/// destructor is called before the rest of the ExprEngine is destroyed.
PathSensitiveBugReporter BR;

/// The functions which have been analyzed through inlining. This is owned by
/// AnalysisConsumer. It can be null.
SetOfConstDecls *VisitedCallees;

/// The flag, which specifies the mode of inlining for the engine.
InliningModes HowToInline;

180public:
ExprEngine(cross_tu::CrossTranslationUnitContext &CTU, AnalysisManager &mgr,
           SetOfConstDecls *VisitedCalleesIn,
           FunctionSummariesTy *FS, InliningModes HowToInlineIn);

virtual ~ExprEngine() = default;

/// Returns true if there is still simulation state on the worklist.
bool ExecuteWorkList(const LocationContext *L, unsigned Steps = 150000) {
  return Engine.ExecuteWorkList(L, Steps, nullptr);
}

/// Execute the work list with an initial state. Nodes that reaches the exit
/// of the function are added into the Dst set, which represent the exit
/// state of the function call. Returns true if there is still simulation
/// state on the worklist.
bool ExecuteWorkListWithInitialState(const LocationContext *L, unsigned Steps,
                                     ProgramStateRef InitState,
                                     ExplodedNodeSet &Dst) {
  return Engine.ExecuteWorkListWithInitialState(L, Steps, InitState, Dst);
}

/// getContext - Return the ASTContext associated with this analysis.
ASTContext &getContext() const { return AMgr.getASTContext(); }

AnalysisManager &getAnalysisManager() { return AMgr; }

AnalysisDeclContextManager &getAnalysisDeclContextManager() {
  return AMgr.getAnalysisDeclContextManager();
}

CheckerManager &getCheckerManager() const {
  return *AMgr.getCheckerManager();
}

SValBuilder &getSValBuilder() { return svalBuilder; }

BugReporter &getBugReporter() { return BR; }

cross_tu::CrossTranslationUnitContext *
getCrossTranslationUnitContext() {
  return &CTU;
}

const NodeBuilderContext &getBuilderContext() {
  assert(currBldrCtx)(static_cast <bool> (currBldrCtx) ? void (0) : __assert_fail
 ("currBldrCtx", "clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
, 225, __extension__ __PRETTY_FUNCTION__));
  return *currBldrCtx;
}

const Stmt *getStmt() const;

const LocationContext *getRootLocationContext() const {
  assert(G.roots_begin() != G.roots_end())(static_cast <bool> (G.roots_begin() != G.roots_end()) ?
 void (0) : __assert_fail ("G.roots_begin() != G.roots_end()"
, "clang/include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
, 232, __extension__ __PRETTY_FUNCTION__));
  return (*G.roots_begin())->getLocation().getLocationContext();
}

void GenerateAutoTransition(ExplodedNode *N);
void enqueueEndOfPath(ExplodedNodeSet &S);
void GenerateCallExitNode(ExplodedNode *N);


/// Dump graph to the specified filename.
/// If filename is empty, generate a temporary one.
/// \return The filename the graph is written into.
std::string DumpGraph(bool trim = false, StringRef Filename="");

/// Dump the graph consisting of the given nodes to a specified filename.
/// Generate a temporary filename if it's not provided.
/// \return The filename the graph is written into.
std::string DumpGraph(ArrayRef<const ExplodedNode *> Nodes,
                      StringRef Filename = "");

/// Visualize the ExplodedGraph created by executing the simulation.
void ViewGraph(bool trim = false);

/// Visualize a trimmed ExplodedGraph that only contains paths to the given
/// nodes.
void ViewGraph(ArrayRef<const ExplodedNode *> Nodes);

/// getInitialState - Return the initial state used for the root vertex
///  in the ExplodedGraph.
ProgramStateRef getInitialState(const LocationContext *InitLoc);

ExplodedGraph &getGraph() { return G; }
const ExplodedGraph &getGraph() const { return G; }

/// Run the analyzer's garbage collection - remove dead symbols and
/// bindings from the state.
///
/// Checkers can participate in this process with two callbacks:
/// \c checkLiveSymbols and \c checkDeadSymbols. See the CheckerDocumentation
/// class for more information.
///
/// \param Node The predecessor node, from which the processing should start.
/// \param Out The returned set of output nodes.
/// \param ReferenceStmt The statement which is about to be processed.
///        Everything needed for this statement should be considered live.
///        A null statement means that everything in child LocationContexts
///        is dead.
/// \param LC The location context of the \p ReferenceStmt. A null location
///        context means that we have reached the end of analysis and that
///        all statements and local variables should be considered dead.
/// \param DiagnosticStmt Used as a location for any warnings that should
///        occur while removing the dead (e.g. leaks). By default, the
///        \p ReferenceStmt is used.
/// \param K Denotes whether this is a pre- or post-statement purge. This
///        must only be ProgramPoint::PostStmtPurgeDeadSymbolsKind if an
///        entire location context is being cleared, in which case the
///        \p ReferenceStmt must either be a ReturnStmt or \c NULL. Otherwise,
///        it must be ProgramPoint::PreStmtPurgeDeadSymbolsKind (the default)
///        and \p ReferenceStmt must be valid (non-null).
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out,
          const Stmt *ReferenceStmt, const LocationContext *LC,
          const Stmt *DiagnosticStmt = nullptr,
          ProgramPoint::Kind K = ProgramPoint::PreStmtPurgeDeadSymbolsKind);

/// processCFGElement - Called by CoreEngine. Used to generate new successor
///  nodes by processing the 'effects' of a CFG element.
void processCFGElement(const CFGElement E, ExplodedNode *Pred,
                       unsigned StmtIdx, NodeBuilderContext *Ctx);

void ProcessStmt(const Stmt *S, ExplodedNode *Pred);

void ProcessLoopExit(const Stmt* S, ExplodedNode *Pred);

void ProcessInitializer(const CFGInitializer I, ExplodedNode *Pred);

void ProcessImplicitDtor(const CFGImplicitDtor D, ExplodedNode *Pred);

void ProcessNewAllocator(const CXXNewExpr *NE, ExplodedNode *Pred);

void ProcessAutomaticObjDtor(const CFGAutomaticObjDtor D,
                             ExplodedNode *Pred, ExplodedNodeSet &Dst);
void ProcessDeleteDtor(const CFGDeleteDtor D,
                       ExplodedNode *Pred, ExplodedNodeSet &Dst);
void ProcessBaseDtor(const CFGBaseDtor D,
                     ExplodedNode *Pred, ExplodedNodeSet &Dst);
void ProcessMemberDtor(const CFGMemberDtor D,
                       ExplodedNode *Pred, ExplodedNodeSet &Dst);
void ProcessTemporaryDtor(const CFGTemporaryDtor D,
                          ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// Called by CoreEngine when processing the entrance of a CFGBlock.
void processCFGBlockEntrance(const BlockEdge &L,
                             NodeBuilderWithSinks &nodeBuilder,
                             ExplodedNode *Pred);

/// ProcessBranch - Called by CoreEngine.  Used to generate successor
///  nodes by processing the 'effects' of a branch condition.
void processBranch(const Stmt *Condition,
                   NodeBuilderContext& BuilderCtx,
                   ExplodedNode *Pred,
                   ExplodedNodeSet &Dst,
                   const CFGBlock *DstT,
                   const CFGBlock *DstF);

/// Called by CoreEngine.
/// Used to generate successor nodes for temporary destructors depending
/// on whether the corresponding constructor was visited.
void processCleanupTemporaryBranch(const CXXBindTemporaryExpr *BTE,
                                   NodeBuilderContext &BldCtx,
                                   ExplodedNode *Pred, ExplodedNodeSet &Dst,
                                   const CFGBlock *DstT,
                                   const CFGBlock *DstF);

/// Called by CoreEngine.  Used to processing branching behavior
/// at static initializers.
void processStaticInitializer(const DeclStmt *DS,
                              NodeBuilderContext& BuilderCtx,
                              ExplodedNode *Pred,
                              ExplodedNodeSet &Dst,
                              const CFGBlock *DstT,
                              const CFGBlock *DstF);

/// processIndirectGoto - Called by CoreEngine.  Used to generate successor
///  nodes by processing the 'effects' of a computed goto jump.
void processIndirectGoto(IndirectGotoNodeBuilder& builder);

/// ProcessSwitch - Called by CoreEngine.  Used to generate successor
///  nodes by processing the 'effects' of a switch statement.
void processSwitch(SwitchNodeBuilder& builder);

/// Called by CoreEngine.  Used to notify checkers that processing a
/// function has begun. Called for both inlined and and top-level functions.
void processBeginOfFunction(NodeBuilderContext &BC,
                            ExplodedNode *Pred, ExplodedNodeSet &Dst,
                            const BlockEdge &L);

/// Called by CoreEngine.  Used to notify checkers that processing a
/// function has ended. Called for both inlined and and top-level functions.
void processEndOfFunction(NodeBuilderContext& BC,
                          ExplodedNode *Pred,
                          const ReturnStmt *RS = nullptr);

/// Remove dead bindings/symbols before exiting a function.
void removeDeadOnEndOfFunction(NodeBuilderContext& BC,
                               ExplodedNode *Pred,
                               ExplodedNodeSet &Dst);

/// Generate the entry node of the callee.
void processCallEnter(NodeBuilderContext& BC, CallEnter CE,
                      ExplodedNode *Pred);

/// Generate the sequence of nodes that simulate the call exit and the post
/// visit for CallExpr.
void processCallExit(ExplodedNode *Pred);

/// Called by CoreEngine when the analysis worklist has terminated.
void processEndWorklist();

/// evalAssume - Callback function invoked by the ConstraintManager when
///  making assumptions about state values.
ProgramStateRef processAssume(ProgramStateRef state, SVal cond,
                              bool assumption);

/// processRegionChanges - Called by ProgramStateManager whenever a change is made
///  to the store. Used to update checkers that track region values.
ProgramStateRef
processRegionChanges(ProgramStateRef state,
                     const InvalidatedSymbols *invalidated,
                     ArrayRef<const MemRegion *> ExplicitRegions,
                     ArrayRef<const MemRegion *> Regions,
                     const LocationContext *LCtx,
                     const CallEvent *Call);

inline ProgramStateRef
processRegionChange(ProgramStateRef state,
                    const MemRegion* MR,
                    const LocationContext *LCtx) {
  return processRegionChanges(state, nullptr, MR, MR, LCtx, nullptr);
}

/// printJson - Called by ProgramStateManager to print checker-specific data.
void printJson(raw_ostream &Out, ProgramStateRef State,
               const LocationContext *LCtx, const char *NL,
               unsigned int Space, bool IsDot) const;

ProgramStateManager &getStateManager() { return StateMgr; }

StoreManager &getStoreManager() { return StateMgr.getStoreManager(); }

ConstraintManager &getConstraintManager() {
  return StateMgr.getConstraintManager();
}

// FIXME: Remove when we migrate over to just using SValBuilder.
BasicValueFactory &getBasicVals() {
  return StateMgr.getBasicVals();
}

SymbolManager &getSymbolManager() { return SymMgr; }
MemRegionManager &getRegionManager() { return MRMgr; }

DataTag::Factory &getDataTags() { return Engine.getDataTags(); }

// Functions for external checking of whether we have unfinished work
bool wasBlocksExhausted() const { return Engine.wasBlocksExhausted(); }
bool hasEmptyWorkList() const { return !Engine.getWorkList()->hasWork(); }
bool hasWorkRemaining() const { return Engine.hasWorkRemaining(); }

const CoreEngine &getCoreEngine() const { return Engine; }

442public:
/// Visit - Transfer function logic for all statements.  Dispatches to
///  other functions that handle specific kinds of statements.
void Visit(const Stmt *S, ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// VisitArrayInitLoopExpr - Transfer function for array init loop.
void VisitArrayInitLoopExpr(const ArrayInitLoopExpr *Ex, ExplodedNode *Pred,
                            ExplodedNodeSet &Dst);

/// VisitArraySubscriptExpr - Transfer function for array accesses.
void VisitArraySubscriptExpr(const ArraySubscriptExpr *Ex,
                             ExplodedNode *Pred,
                             ExplodedNodeSet &Dst);

/// VisitGCCAsmStmt - Transfer function logic for inline asm.
void VisitGCCAsmStmt(const GCCAsmStmt *A, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

/// VisitMSAsmStmt - Transfer function logic for MS inline asm.
void VisitMSAsmStmt(const MSAsmStmt *A, ExplodedNode *Pred,
                    ExplodedNodeSet &Dst);

/// VisitBlockExpr - Transfer function logic for BlockExprs.
void VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred,
                    ExplodedNodeSet &Dst);

/// VisitLambdaExpr - Transfer function logic for LambdaExprs.
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

/// VisitBinaryOperator - Transfer function logic for binary operators.
void VisitBinaryOperator(const BinaryOperator* B, ExplodedNode *Pred,
                         ExplodedNodeSet &Dst);


/// VisitCall - Transfer function for function calls.
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
                   ExplodedNodeSet &Dst);

/// VisitCast - Transfer function logic for all casts (implicit and explicit).
void VisitCast(const CastExpr *CastE, const Expr *Ex, ExplodedNode *Pred,
               ExplodedNodeSet &Dst);

/// VisitCompoundLiteralExpr - Transfer function logic for compound literals.
void VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL,
                              ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// Transfer function logic for DeclRefExprs and BlockDeclRefExprs.
void VisitCommonDeclRefExpr(const Expr *DR, const NamedDecl *D,
                            ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// VisitDeclStmt - Transfer function logic for DeclStmts.
void VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred,
                   ExplodedNodeSet &Dst);

/// VisitGuardedExpr - Transfer function logic for ?, __builtin_choose
void VisitGuardedExpr(const Expr *Ex, const Expr *L, const Expr *R,
                      ExplodedNode *Pred, ExplodedNodeSet &Dst);

void VisitInitListExpr(const InitListExpr *E, ExplodedNode *Pred,
                       ExplodedNodeSet &Dst);

/// VisitLogicalExpr - Transfer function logic for '&&', '||'
void VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred,
                      ExplodedNodeSet &Dst);

/// VisitMemberExpr - Transfer function for member expressions.
void VisitMemberExpr(const MemberExpr *M, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

/// VisitAtomicExpr - Transfer function for builtin atomic expressions
void VisitAtomicExpr(const AtomicExpr *E, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

/// Transfer function logic for ObjCAtSynchronizedStmts.
void VisitObjCAtSynchronizedStmt(const ObjCAtSynchronizedStmt *S,
                                 ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// Transfer function logic for computing the lvalue of an Objective-C ivar.
void VisitLvalObjCIvarRefExpr(const ObjCIvarRefExpr *DR, ExplodedNode *Pred,
                              ExplodedNodeSet &Dst);

/// VisitObjCForCollectionStmt - Transfer function logic for
///  ObjCForCollectionStmt.
void VisitObjCForCollectionStmt(const ObjCForCollectionStmt *S,
                                ExplodedNode *Pred, ExplodedNodeSet &Dst);

void VisitObjCMessage(const ObjCMessageExpr *ME, ExplodedNode *Pred,
                      ExplodedNodeSet &Dst);

/// VisitReturnStmt - Transfer function logic for return statements.
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

/// VisitOffsetOfExpr - Transfer function for offsetof.
void VisitOffsetOfExpr(const OffsetOfExpr *Ex, ExplodedNode *Pred,
                       ExplodedNodeSet &Dst);

/// VisitUnaryExprOrTypeTraitExpr - Transfer function for sizeof.
void VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex,
                                   ExplodedNode *Pred, ExplodedNodeSet &Dst);

/// VisitUnaryOperator - Transfer function logic for unary operators.
void VisitUnaryOperator(const UnaryOperator* B, ExplodedNode *Pred,
                        ExplodedNodeSet &Dst);

/// Handle ++ and -- (both pre- and post-increment).
void VisitIncrementDecrementOperator(const UnaryOperator* U,
                                     ExplodedNode *Pred,
                                     ExplodedNodeSet &Dst);

void VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE,
                               ExplodedNodeSet &PreVisit,
                               ExplodedNodeSet &Dst);

void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
                       ExplodedNodeSet &Dst);

void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
                      ExplodedNodeSet & Dst);

void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred,
                           ExplodedNodeSet &Dst);

void VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E,
                                   ExplodedNode *Pred, ExplodedNodeSet &Dst);

void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
                        const Stmt *S, bool IsBaseDtor,
                        ExplodedNode *Pred, ExplodedNodeSet &Dst,
                        EvalCallOptions &Options);

void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
                              ExplodedNode *Pred,
                              ExplodedNodeSet &Dst);

void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
                     ExplodedNodeSet &Dst);

void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred,
                        ExplodedNodeSet &Dst);

/// Create a C++ temporary object for an rvalue.
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
                              ExplodedNode *Pred,
                              ExplodedNodeSet &Dst);

/// evalEagerlyAssumeBinOpBifurcation - Given the nodes in 'Src', eagerly assume symbolic
///  expressions of the form 'x != 0' and generate new nodes (stored in Dst)
///  with those assumptions.
void evalEagerlyAssumeBinOpBifurcation(ExplodedNodeSet &Dst, ExplodedNodeSet &Src,
                       const Expr *Ex);

static std::pair<const ProgramPointTag *, const ProgramPointTag *>
  geteagerlyAssumeBinOpBifurcationTags();

ProgramStateRef handleLValueBitCast(ProgramStateRef state, const Expr *Ex,
                                    const LocationContext *LCtx, QualType T,
                                    QualType ExTy, const CastExpr *CastE,
                                    StmtNodeBuilder &Bldr,
                                    ExplodedNode *Pred);

ProgramStateRef handleLVectorSplat(ProgramStateRef state,
                                   const LocationContext *LCtx,
                                   const CastExpr *CastE,
                                   StmtNodeBuilder &Bldr,
                                   ExplodedNode *Pred);

void handleUOExtension(ExplodedNodeSet::iterator I,
                       const UnaryOperator* U,
                       StmtNodeBuilder &Bldr);

614public:
SVal evalBinOp(ProgramStateRef ST, BinaryOperator::Opcode Op,
               SVal LHS, SVal RHS, QualType T) {
  return svalBuilder.evalBinOp(ST, Op, LHS, RHS, T);
}

/// Retreives which element is being constructed in a non-POD type array.
static Optional<unsigned>
getIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
                             const LocationContext *LCtx);

/// Retreives which element is being destructed in a non-POD type array.
static Optional<unsigned>
getPendingArrayDestruction(ProgramStateRef State,
                           const LocationContext *LCtx);

/// Retreives the size of the array in the pending ArrayInitLoopExpr.
static Optional<unsigned> getPendingInitLoop(ProgramStateRef State,
                                             const CXXConstructExpr *E,
                                             const LocationContext *LCtx);

/// By looking at a certain item that may be potentially part of an object's
/// ConstructionContext, retrieve such object's location. A particular
/// statement can be transparently passed as \p Item in most cases.
static Optional<SVal>
getObjectUnderConstruction(ProgramStateRef State,
                           const ConstructionContextItem &Item,
                           const LocationContext *LC);

/// Call PointerEscape callback when a value escapes as a result of bind.
ProgramStateRef processPointerEscapedOnBind(
    ProgramStateRef State, ArrayRef<std::pair<SVal, SVal>> LocAndVals,
    const LocationContext *LCtx, PointerEscapeKind Kind,
    const CallEvent *Call);

/// Call PointerEscape callback when a value escapes as a result of
/// region invalidation.
/// \param[in] ITraits Specifies invalidation traits for regions/symbols.
ProgramStateRef notifyCheckersOfPointerEscape(
                         ProgramStateRef State,
                         const InvalidatedSymbols *Invalidated,
                         ArrayRef<const MemRegion *> ExplicitRegions,
                         const CallEvent *Call,
                         RegionAndSymbolInvalidationTraits &ITraits);

659private:
/// evalBind - Handle the semantics of binding a value to a specific location.
///  This method is used by evalStore, VisitDeclStmt, and others.
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred,
              SVal location, SVal Val, bool atDeclInit = false,
              const ProgramPoint *PP = nullptr);

ProgramStateRef
processPointerEscapedOnBind(ProgramStateRef State,
                            SVal Loc, SVal Val,
                            const LocationContext *LCtx);

/// A simple wrapper when you only need to notify checkers of pointer-escape
/// of some values.
ProgramStateRef escapeValues(ProgramStateRef State, ArrayRef<SVal> Vs,
                             PointerEscapeKind K,
                             const CallEvent *Call = nullptr) const;

677public:
// FIXME: 'tag' should be removed, and a LocationContext should be used
// instead.
// FIXME: Comment on the meaning of the arguments, when 'St' may not
// be the same as Pred->state, and when 'location' may not be the
// same as state->getLValue(Ex).
/// Simulate a read of the result of Ex.
void evalLoad(ExplodedNodeSet &Dst,
              const Expr *NodeEx,  /* Eventually will be a CFGStmt */
              const Expr *BoundExpr,
              ExplodedNode *Pred,
              ProgramStateRef St,
              SVal location,
              const ProgramPointTag *tag = nullptr,
              QualType LoadTy = QualType());

// FIXME: 'tag' should be removed, and a LocationContext should be used
// instead.
void evalStore(ExplodedNodeSet &Dst, const Expr *AssignE, const Expr *StoreE,
               ExplodedNode *Pred, ProgramStateRef St, SVal TargetLV, SVal Val,
               const ProgramPointTag *tag = nullptr);

/// Return the CFG element corresponding to the worklist element
/// that is currently being processed by ExprEngine.
CFGElement getCurrentCFGElement() {
  return (*currBldrCtx->getBlock())[currStmtIdx];
}

/// Create a new state in which the call return value is binded to the
/// call origin expression.
ProgramStateRef bindReturnValue(const CallEvent &Call,
                                const LocationContext *LCtx,
                                ProgramStateRef State);

/// Evaluate a call, running pre- and post-call checkers and allowing checkers
/// to be responsible for handling the evaluation of the call itself.
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
              const CallEvent &Call);

/// Default implementation of call evaluation.
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred,
                     const CallEvent &Call,
                     const EvalCallOptions &CallOpts = {});

/// Find location of the object that is being constructed by a given
/// constructor. This should ideally always succeed but due to not being
/// fully implemented it sometimes indicates that it failed via its
/// out-parameter CallOpts; in such cases a fake temporary region is
/// returned, which is better than nothing but does not represent
/// the actual behavior of the program. The Idx parameter is used if we
/// construct an array of objects. In that case it points to the index
/// of the continuous memory region.
/// E.g.:
/// For `int arr[4]` this index can be 0,1,2,3.
/// For `int arr2[3][3]` this index can be 0,1,...,7,8.
/// A multi-dimensional array is also a continuous memory location in a
/// row major order, so for arr[0][0] Idx is 0 and for arr[2][2] Idx is 8.
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State,
                                    const LocationContext *LCtx,
                                    const ConstructionContext *CC,
                                    EvalCallOptions &CallOpts,
                                    unsigned Idx = 0);

/// Update the program state with all the path-sensitive information
/// that's necessary to perform construction of an object with a given
/// syntactic construction context. V and CallOpts have to be obtained from
/// computeObjectUnderConstruction() invoked with the same set of
/// the remaining arguments (E, State, LCtx, CC).
ProgramStateRef updateObjectsUnderConstruction(
    SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
    const ConstructionContext *CC, const EvalCallOptions &CallOpts);

/// A convenient wrapper around computeObjectUnderConstruction
/// and updateObjectsUnderConstruction.
std::pair<ProgramStateRef, SVal>
handleConstructionContext(const Expr *E, ProgramStateRef State,
                          const LocationContext *LCtx,
                          const ConstructionContext *CC,
                          EvalCallOptions &CallOpts, unsigned Idx = 0) {

  SVal V = computeObjectUnderConstruction(E, State, LCtx, CC, CallOpts, Idx);
19
←
Calling 'ExprEngine::computeObjectUnderConstruction'→
  State = updateObjectsUnderConstruction(V, E, State, LCtx, CC, CallOpts);

  return std::make_pair(State, V);
}

763private:
ProgramStateRef finishArgumentConstruction(ProgramStateRef State,
                                           const CallEvent &Call);
void finishArgumentConstruction(ExplodedNodeSet &Dst, ExplodedNode *Pred,
                                const CallEvent &Call);

void evalLoadCommon(ExplodedNodeSet &Dst,
                    const Expr *NodeEx,  /* Eventually will be a CFGStmt */
                    const Expr *BoundEx,
                    ExplodedNode *Pred,
                    ProgramStateRef St,
                    SVal location,
                    const ProgramPointTag *tag,
                    QualType LoadTy);

void evalLocation(ExplodedNodeSet &Dst,
                  const Stmt *NodeEx, /* This will eventually be a CFGStmt */
                  const Stmt *BoundEx,
                  ExplodedNode *Pred,
                  ProgramStateRef St,
                  SVal location,
                  bool isLoad);

/// Count the stack depth and determine if the call is recursive.
void examineStackFrames(const Decl *D, const LocationContext *LCtx,
                        bool &IsRecursive, unsigned &StackDepth);

enum CallInlinePolicy {
  CIP_Allowed,
  CIP_DisallowedOnce,
  CIP_DisallowedAlways
};

/// See if a particular call should be inlined, by only looking
/// at the call event and the current state of analysis.
CallInlinePolicy mayInlineCallKind(const CallEvent &Call,
                                   const ExplodedNode *Pred,
                                   AnalyzerOptions &Opts,
                                   const EvalCallOptions &CallOpts);

/// See if the given AnalysisDeclContext is built for a function that we
/// should always inline simply because it's small enough.
/// Apart from "small" functions, we also have "large" functions
/// (cf. isLarge()), some of which are huge (cf. isHuge()), and we classify
/// the remaining functions as "medium".
bool isSmall(AnalysisDeclContext *ADC) const;

/// See if the given AnalysisDeclContext is built for a function that we
/// should inline carefully because it looks pretty large.
bool isLarge(AnalysisDeclContext *ADC) const;

/// See if the given AnalysisDeclContext is built for a function that we
/// should never inline because it's legit gigantic.
bool isHuge(AnalysisDeclContext *ADC) const;

/// See if the given AnalysisDeclContext is built for a function that we
/// should inline, just by looking at the declaration of the function.
bool mayInlineDecl(AnalysisDeclContext *ADC) const;

/// Checks our policies and decides weither the given call should be inlined.
bool shouldInlineCall(const CallEvent &Call, const Decl *D,
                      const ExplodedNode *Pred,
                      const EvalCallOptions &CallOpts = {});

/// Checks whether our policies allow us to inline a non-POD type array
/// construction.
bool shouldInlineArrayConstruction(const ProgramStateRef State,
                                   const CXXConstructExpr *CE,
                                   const LocationContext *LCtx);

/// Checks whether our policies allow us to inline a non-POD type array
/// destruction.
/// \param Size The size of the array.
bool shouldInlineArrayDestruction(uint64_t Size);

/// Prepares the program state for array destruction. If no error happens
/// the function binds a 'PendingArrayDestruction' entry to the state, which
/// it returns along with the index. If any error happens (we fail to read
/// the size, the index would be -1, etc.) the function will return the
/// original state along with an index of 0. The actual element count of the
/// array can be accessed by the optional 'ElementCountVal' parameter. \param
/// State The program state. \param Region The memory region where the array
/// is stored. \param ElementTy The type an element in the array. \param LCty
/// The location context. \param ElementCountVal A pointer to an optional
/// SVal. If specified, the size of the array will be returned in it. It can
/// be Unknown.
std::pair<ProgramStateRef, uint64_t> prepareStateForArrayDestruction(
    const ProgramStateRef State, const MemRegion *Region,
    const QualType &ElementTy, const LocationContext *LCtx,
    SVal *ElementCountVal = nullptr);

/// Checks whether we construct an array of non-POD type, and decides if the
/// constructor should be inkoved once again.
bool shouldRepeatCtorCall(ProgramStateRef State, const CXXConstructExpr *E,
                          const LocationContext *LCtx);

void inlineCall(WorkList *WList, const CallEvent &Call, const Decl *D,
                NodeBuilder &Bldr, ExplodedNode *Pred, ProgramStateRef State);

void ctuBifurcate(const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
                  ExplodedNode *Pred, ProgramStateRef State);

/// Returns true if the CTU analysis is running its second phase.
bool isSecondPhaseCTU() { return IsCTUEnabled && !Engine.getCTUWorkList(); }

/// Conservatively evaluate call by invalidating regions and binding
/// a conjured return value.
void conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
                          ExplodedNode *Pred, ProgramStateRef State);

/// Either inline or process the call conservatively (or both), based
/// on DynamicDispatchBifurcation data.
void BifurcateCall(const MemRegion *BifurReg,
                   const CallEvent &Call, const Decl *D, NodeBuilder &Bldr,
                   ExplodedNode *Pred);

bool replayWithoutInlining(ExplodedNode *P, const LocationContext *CalleeLC);

/// Models a trivial copy or move constructor or trivial assignment operator
/// call with a simple bind.
void performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
                        const CallEvent &Call);

/// If the value of the given expression \p InitWithAdjustments is a NonLoc,
/// copy it into a new temporary object region, and replace the value of the
/// expression with that.
///
/// If \p Result is provided, the new region will be bound to this expression
/// instead of \p InitWithAdjustments.
///
/// Returns the temporary region with adjustments into the optional
/// OutRegionWithAdjustments out-parameter if a new region was indeed needed,
/// otherwise sets it to nullptr.
ProgramStateRef createTemporaryRegionIfNeeded(
    ProgramStateRef State, const LocationContext *LC,
    const Expr *InitWithAdjustments, const Expr *Result = nullptr,
    const SubRegion **OutRegionWithAdjustments = nullptr);

/// Returns a region representing the `Idx`th element of a (possibly
/// multi-dimensional) array, for the purposes of element construction or
/// destruction.
///
/// On return, \p Ty will be set to the base type of the array.
///
/// If the type is not an array type at all, the original value is returned.
/// Otherwise the "IsArray" flag is set.
static SVal makeElementRegion(ProgramStateRef State, SVal LValue,
                              QualType &Ty, bool &IsArray, unsigned Idx = 0);

/// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
/// block to find the constructor expression that directly constructed into
/// the storage for this statement. Returns null if the constructor for this
/// statement created a temporary object region rather than directly
/// constructing into an existing region.
const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();

/// Common code that handles either a CXXConstructExpr or a
/// CXXInheritedCtorInitExpr.
void handleConstructor(const Expr *E, ExplodedNode *Pred,
                       ExplodedNodeSet &Dst);

924public:
/// Note whether this loop has any more iteratios to model. These methods are
/// essentially an interface for a GDM trait. Further reading in
/// ExprEngine::VisitObjCForCollectionStmt().
[[nodiscard]] static ProgramStateRef
setWhetherHasMoreIteration(ProgramStateRef State,
                           const ObjCForCollectionStmt *O,
                           const LocationContext *LC, bool HasMoreIteraton);

[[nodiscard]] static ProgramStateRef
removeIterationState(ProgramStateRef State, const ObjCForCollectionStmt *O,
                     const LocationContext *LC);

[[nodiscard]] static bool hasMoreIteration(ProgramStateRef State,
                                           const ObjCForCollectionStmt *O,
                                           const LocationContext *LC);

941private:
/// Assuming we construct an array of non-POD types, this method allows us
/// to store which element is to be constructed next.
static ProgramStateRef
setIndexOfElementToConstruct(ProgramStateRef State, const CXXConstructExpr *E,
                             const LocationContext *LCtx, unsigned Idx);

static ProgramStateRef
removeIndexOfElementToConstruct(ProgramStateRef State,
                                const CXXConstructExpr *E,
                                const LocationContext *LCtx);

/// Assuming we destruct an array of non-POD types, this method allows us
/// to store which element is to be destructed next.
static ProgramStateRef setPendingArrayDestruction(ProgramStateRef State,
                                                  const LocationContext *LCtx,
                                                  unsigned Idx);

static ProgramStateRef
removePendingArrayDestruction(ProgramStateRef State,
                              const LocationContext *LCtx);

/// Sets the size of the array in a pending ArrayInitLoopExpr.
static ProgramStateRef setPendingInitLoop(ProgramStateRef State,
                                          const CXXConstructExpr *E,
                                          const LocationContext *LCtx,
                                          unsigned Idx);

static ProgramStateRef removePendingInitLoop(ProgramStateRef State,
                                             const CXXConstructExpr *E,
                                             const LocationContext *LCtx);

/// Store the location of a C++ object corresponding to a statement
/// until the statement is actually encountered. For example, if a DeclStmt
/// has CXXConstructExpr as its initializer, the object would be considered
/// to be "under construction" between CXXConstructExpr and DeclStmt.
/// This allows, among other things, to keep bindings to variable's fields
/// made within the constructor alive until its declaration actually
/// goes into scope.
static ProgramStateRef
addObjectUnderConstruction(ProgramStateRef State,
                           const ConstructionContextItem &Item,
                           const LocationContext *LC, SVal V);

/// Mark the object sa fully constructed, cleaning up the state trait
/// that tracks objects under construction.
static ProgramStateRef
finishObjectConstruction(ProgramStateRef State,
                         const ConstructionContextItem &Item,
                         const LocationContext *LC);

/// If the given expression corresponds to a temporary that was used for
/// passing into an elidable copy/move constructor and that constructor
/// was actually elided, track that we also need to elide the destructor.
static ProgramStateRef elideDestructor(ProgramStateRef State,
                                       const CXXBindTemporaryExpr *BTE,
                                       const LocationContext *LC);

/// Stop tracking the destructor that corresponds to an elided constructor.
static ProgramStateRef
cleanupElidedDestructor(ProgramStateRef State,
                        const CXXBindTemporaryExpr *BTE,
                        const LocationContext *LC);

/// Returns true if the given expression corresponds to a temporary that
/// was constructed for passing into an elidable copy/move constructor
/// and that constructor was actually elided.
static bool isDestructorElided(ProgramStateRef State,
                               const CXXBindTemporaryExpr *BTE,
                               const LocationContext *LC);

/// Check if all objects under construction have been fully constructed
/// for the given context range (including FromLC, not including ToLC).
/// This is useful for assertions. Also checks if elided destructors
/// were cleaned up.
static bool areAllObjectsFullyConstructed(ProgramStateRef State,
                                          const LocationContext *FromLC,
                                          const LocationContext *ToLC);
1019};

1021/// Traits for storing the call processing policy inside GDM.
1022/// The GDM stores the corresponding CallExpr pointer.
1023// FIXME: This does not use the nice trait macros because it must be accessible
1024// from multiple translation units.
1025struct ReplayWithoutInlining{};
1026template <>
1027struct ProgramStateTrait<ReplayWithoutInlining> :
public ProgramStatePartialTrait<const void*> {
static void *GDMIndex();
1030};

1032} // namespace ento

1034} // namespace clang

1036#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_EXPRENGINE_H