1 //===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 //  This file defines the C++ expression evaluation engine.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/StaticAnalyzer/Core/CheckerManager.h"
15 #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
16 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
17 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
18 #include "clang/AST/DeclCXX.h"
19 #include "clang/AST/StmtCXX.h"
20 #include "clang/Basic/PrettyStackTrace.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
25 void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
26                                           ExplodedNode *Pred,
27                                           ExplodedNodeSet &Dst) {
28   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
29   const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
30   ProgramStateRef state = Pred->getState();
31   const LocationContext *LCtx = Pred->getLocationContext();
32 
33   // Bind the temporary object to the value of the expression. Then bind
34   // the expression to the location of the object.
35   SVal V = state->getSVal(tempExpr, LCtx);
36 
37   // If the object is a record, the constructor will have already created
38   // a temporary object region. If it is not, we need to copy the value over.
39   if (!ME->getType()->isRecordType()) {
40     const MemRegion *R =
41       svalBuilder.getRegionManager().getCXXTempObjectRegion(ME, LCtx);
42 
43     SVal L = loc::MemRegionVal(R);
44     state = state->bindLoc(L, V);
45     V = L;
46   }
47 
48   Bldr.generateNode(ME, Pred, state->BindExpr(ME, LCtx, V));
49 }
50 
51 void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
52                                        ExplodedNode *Pred,
53                                        ExplodedNodeSet &destNodes) {
54   const LocationContext *LCtx = Pred->getLocationContext();
55   ProgramStateRef State = Pred->getState();
56 
57   const MemRegion *Target = 0;
58 
59   switch (CE->getConstructionKind()) {
60   case CXXConstructExpr::CK_Complete: {
61     // See if we're constructing an existing region by looking at the next
62     // element in the CFG.
63     const CFGBlock *B = currBldrCtx->getBlock();
64     if (currStmtIdx + 1 < B->size()) {
65       CFGElement Next = (*B)[currStmtIdx+1];
66 
67       // Is this a constructor for a local variable?
68       if (const CFGStmt *StmtElem = dyn_cast<CFGStmt>(&Next)) {
69         if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
70           if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
71             if (Var->getInit()->IgnoreImplicit() == CE) {
72               QualType Ty = Var->getType();
73               if (const ArrayType *AT = getContext().getAsArrayType(Ty)) {
74                 // FIXME: Handle arrays, which run the same constructor for
75                 // every element. This workaround will just run the first
76                 // constructor (which should still invalidate the entire array).
77                 SVal Base = State->getLValue(Var, LCtx);
78                 Target = State->getLValue(AT->getElementType(),
79                                           getSValBuilder().makeZeroArrayIndex(),
80                                           Base).getAsRegion();
81               } else {
82                 Target = State->getLValue(Var, LCtx).getAsRegion();
83               }
84             }
85           }
86         }
87       }
88 
89       // Is this a constructor for a member?
90       if (const CFGInitializer *InitElem = dyn_cast<CFGInitializer>(&Next)) {
91         const CXXCtorInitializer *Init = InitElem->getInitializer();
92         assert(Init->isAnyMemberInitializer());
93 
94         const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
95         Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
96                                                   LCtx->getCurrentStackFrame());
97         SVal ThisVal = State->getSVal(ThisPtr);
98 
99         if (Init->isIndirectMemberInitializer()) {
100           SVal Field = State->getLValue(Init->getIndirectMember(), ThisVal);
101           Target = Field.getAsRegion();
102         } else {
103           SVal Field = State->getLValue(Init->getMember(), ThisVal);
104           Target = Field.getAsRegion();
105         }
106       }
107 
108       // FIXME: This will eventually need to handle new-expressions as well.
109     }
110 
111     // If we couldn't find an existing region to construct into, assume we're
112     // constructing a temporary.
113     if (!Target) {
114       MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
115       Target = MRMgr.getCXXTempObjectRegion(CE, LCtx);
116     }
117 
118     break;
119   }
120   case CXXConstructExpr::CK_NonVirtualBase:
121   case CXXConstructExpr::CK_VirtualBase:
122   case CXXConstructExpr::CK_Delegating: {
123     const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
124     Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
125                                               LCtx->getCurrentStackFrame());
126     SVal ThisVal = State->getSVal(ThisPtr);
127 
128     if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
129       Target = ThisVal.getAsRegion();
130     } else {
131       // Cast to the base type.
132       QualType BaseTy = CE->getType();
133       SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, BaseTy);
134       Target = BaseVal.getAsRegion();
135     }
136     break;
137   }
138   }
139 
140   CallEventManager &CEMgr = getStateManager().getCallEventManager();
141   CallEventRef<CXXConstructorCall> Call =
142     CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
143 
144   ExplodedNodeSet DstPreVisit;
145   getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
146   ExplodedNodeSet DstPreCall;
147   getCheckerManager().runCheckersForPreCall(DstPreCall, DstPreVisit,
148                                             *Call, *this);
149 
150   ExplodedNodeSet DstInvalidated;
151   StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
152   for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
153        I != E; ++I)
154     defaultEvalCall(Bldr, *I, *Call);
155 
156   ExplodedNodeSet DstPostCall;
157   getCheckerManager().runCheckersForPostCall(DstPostCall, DstInvalidated,
158                                              *Call, *this);
159   getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
160 }
161 
162 void ExprEngine::VisitCXXDestructor(QualType ObjectType,
163                                     const MemRegion *Dest,
164                                     const Stmt *S,
165                                     ExplodedNode *Pred,
166                                     ExplodedNodeSet &Dst) {
167   const LocationContext *LCtx = Pred->getLocationContext();
168   ProgramStateRef State = Pred->getState();
169 
170   // FIXME: We need to run the same destructor on every element of the array.
171   // This workaround will just run the first destructor (which will still
172   // invalidate the entire array).
173   if (const ArrayType *AT = getContext().getAsArrayType(ObjectType)) {
174     ObjectType = AT->getElementType();
175     Dest = State->getLValue(ObjectType, getSValBuilder().makeZeroArrayIndex(),
176                             loc::MemRegionVal(Dest)).getAsRegion();
177   }
178 
179   const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
180   assert(RecordDecl && "Only CXXRecordDecls should have destructors");
181   const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
182 
183   CallEventManager &CEMgr = getStateManager().getCallEventManager();
184   CallEventRef<CXXDestructorCall> Call =
185     CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, State, LCtx);
186 
187   PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
188                                 Call->getSourceRange().getBegin(),
189                                 "Error evaluating destructor");
190 
191   ExplodedNodeSet DstPreCall;
192   getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
193                                             *Call, *this);
194 
195   ExplodedNodeSet DstInvalidated;
196   StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
197   for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
198        I != E; ++I)
199     defaultEvalCall(Bldr, *I, *Call);
200 
201   ExplodedNodeSet DstPostCall;
202   getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
203                                              *Call, *this);
204 }
205 
206 void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
207                                    ExplodedNodeSet &Dst) {
208   // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
209   // Also, we need to decide how allocators actually work -- they're not
210   // really part of the CXXNewExpr because they happen BEFORE the
211   // CXXConstructExpr subexpression. See PR12014 for some discussion.
212   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
213 
214   unsigned blockCount = currBldrCtx->blockCount();
215   const LocationContext *LCtx = Pred->getLocationContext();
216   DefinedOrUnknownSVal symVal = svalBuilder.conjureSymbolVal(0, CNE, LCtx,
217                                                              CNE->getType(),
218                                                              blockCount);
219   ProgramStateRef State = Pred->getState();
220 
221   CallEventManager &CEMgr = getStateManager().getCallEventManager();
222   CallEventRef<CXXAllocatorCall> Call =
223     CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
224 
225   // Invalidate placement args.
226   // FIXME: Once we figure out how we want allocators to work,
227   // we should be using the usual pre-/(default-)eval-/post-call checks here.
228   State = Call->invalidateRegions(blockCount);
229 
230   if (CNE->isArray()) {
231     // FIXME: allocating an array requires simulating the constructors.
232     // For now, just return a symbolicated region.
233     const MemRegion *NewReg = cast<loc::MemRegionVal>(symVal).getRegion();
234     QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
235     const ElementRegion *EleReg =
236       getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
237     State = State->BindExpr(CNE, Pred->getLocationContext(),
238                             loc::MemRegionVal(EleReg));
239     Bldr.generateNode(CNE, Pred, State);
240     return;
241   }
242 
243   // FIXME: Once we have proper support for CXXConstructExprs inside
244   // CXXNewExpr, we need to make sure that the constructed object is not
245   // immediately invalidated here. (The placement call should happen before
246   // the constructor call anyway.)
247   FunctionDecl *FD = CNE->getOperatorNew();
248   if (FD && FD->isReservedGlobalPlacementOperator()) {
249     // Non-array placement new should always return the placement location.
250     SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
251     State = State->BindExpr(CNE, LCtx, PlacementLoc);
252   } else {
253     State = State->BindExpr(CNE, LCtx, symVal);
254   }
255 
256   // If the type is not a record, we won't have a CXXConstructExpr as an
257   // initializer. Copy the value over.
258   if (const Expr *Init = CNE->getInitializer()) {
259     if (!isa<CXXConstructExpr>(Init)) {
260       QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
261       (void)ObjTy;
262       assert(!ObjTy->isRecordType());
263       SVal Location = State->getSVal(CNE, LCtx);
264       if (isa<Loc>(Location))
265         State = State->bindLoc(cast<Loc>(Location), State->getSVal(Init, LCtx));
266     }
267   }
268 
269   Bldr.generateNode(CNE, Pred, State);
270 }
271 
272 void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
273                                     ExplodedNode *Pred, ExplodedNodeSet &Dst) {
274   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
275   ProgramStateRef state = Pred->getState();
276   Bldr.generateNode(CDE, Pred, state);
277 }
278 
279 void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
280                                    ExplodedNode *Pred,
281                                    ExplodedNodeSet &Dst) {
282   const VarDecl *VD = CS->getExceptionDecl();
283   if (!VD) {
284     Dst.Add(Pred);
285     return;
286   }
287 
288   const LocationContext *LCtx = Pred->getLocationContext();
289   SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
290                                         currBldrCtx->blockCount());
291   ProgramStateRef state = Pred->getState();
292   state = state->bindLoc(state->getLValue(VD, LCtx), V);
293 
294   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
295   Bldr.generateNode(CS, Pred, state);
296 }
297 
298 void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
299                                     ExplodedNodeSet &Dst) {
300   StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
301 
302   // Get the this object region from StoreManager.
303   const LocationContext *LCtx = Pred->getLocationContext();
304   const MemRegion *R =
305     svalBuilder.getRegionManager().getCXXThisRegion(
306                                   getContext().getCanonicalType(TE->getType()),
307                                                     LCtx);
308 
309   ProgramStateRef state = Pred->getState();
310   SVal V = state->getSVal(loc::MemRegionVal(R));
311   Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
312 }
313