Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCXX.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines the C++ expression evaluation engine.
10
//
11
//===----------------------------------------------------------------------===//
12
13
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
14
#include "clang/Analysis/ConstructionContext.h"
15
#include "clang/AST/DeclCXX.h"
16
#include "clang/AST/StmtCXX.h"
17
#include "clang/AST/ParentMap.h"
18
#include "clang/Basic/PrettyStackTrace.h"
19
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
20
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
21
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22
23
using namespace clang;
24
using namespace ento;
25
26
void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
27
                                          ExplodedNode *Pred,
28
4.54k
                                          ExplodedNodeSet &Dst) {
29
4.54k
  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
30
4.54k
  const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
31
4.54k
  ProgramStateRef state = Pred->getState();
32
4.54k
  const LocationContext *LCtx = Pred->getLocationContext();
33
4.54k
34
4.54k
  state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
35
4.54k
  Bldr.generateNode(ME, Pred, state);
36
4.54k
}
37
38
// FIXME: This is the sort of code that should eventually live in a Core
39
// checker rather than as a special case in ExprEngine.
40
void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
41
11.8k
                                    const CallEvent &Call) {
42
11.8k
  SVal ThisVal;
43
11.8k
  bool AlwaysReturnsLValue;
44
11.8k
  const CXXRecordDecl *ThisRD = nullptr;
45
11.8k
  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
46
11.7k
    assert(Ctor->getDecl()->isTrivial());
47
11.7k
    assert(Ctor->getDecl()->isCopyOrMoveConstructor());
48
11.7k
    ThisVal = Ctor->getCXXThisVal();
49
11.7k
    ThisRD = Ctor->getDecl()->getParent();
50
11.7k
    AlwaysReturnsLValue = false;
51
11.7k
  } else {
52
121
    assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
53
121
    assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
54
121
           OO_Equal);
55
121
    ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
56
121
    ThisRD = cast<CXXMethodDecl>(Call.getDecl())->getParent();
57
121
    AlwaysReturnsLValue = true;
58
121
  }
59
11.8k
60
11.8k
  assert(ThisRD);
61
11.8k
  if (ThisRD->isEmpty()) {
62
1.72k
    // Do nothing for empty classes. Otherwise it'd retrieve an UnknownVal
63
1.72k
    // and bind it and RegionStore would think that the actual value
64
1.72k
    // in this region at this offset is unknown.
65
1.72k
    return;
66
1.72k
  }
67
10.1k
68
10.1k
  const LocationContext *LCtx = Pred->getLocationContext();
69
10.1k
70
10.1k
  ExplodedNodeSet Dst;
71
10.1k
  Bldr.takeNodes(Pred);
72
10.1k
73
10.1k
  SVal V = Call.getArgSVal(0);
74
10.1k
75
10.1k
  // If the value being copied is not unknown, load from its location to get
76
10.1k
  // an aggregate rvalue.
77
10.1k
  if (Optional<Loc> L = V.getAs<Loc>())
78
10.1k
    V = Pred->getState()->getSVal(*L);
79
10.1k
  else
80
10.1k
    assert(V.isUnknownOrUndef());
81
10.1k
82
10.1k
  const Expr *CallExpr = Call.getOriginExpr();
83
10.1k
  evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
84
10.1k
85
10.1k
  PostStmt PS(CallExpr, LCtx);
86
10.1k
  for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
87
20.2k
       I != E; 
++I10.1k
) {
88
10.1k
    ProgramStateRef State = (*I)->getState();
89
10.1k
    if (AlwaysReturnsLValue)
90
90
      State = State->BindExpr(CallExpr, LCtx, ThisVal);
91
10.0k
    else
92
10.0k
      State = bindReturnValue(Call, LCtx, State);
93
10.1k
    Bldr.generateNode(PS, State, *I);
94
10.1k
  }
95
10.1k
}
96
97
98
SVal ExprEngine::makeZeroElementRegion(ProgramStateRef State, SVal LValue,
99
7.91k
                                       QualType &Ty, bool &IsArray) {
100
7.91k
  SValBuilder &SVB = State->getStateManager().getSValBuilder();
101
7.91k
  ASTContext &Ctx = SVB.getContext();
102
7.91k
103
8.02k
  while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
104
109
    Ty = AT->getElementType();
105
109
    LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
106
109
    IsArray = true;
107
109
  }
108
7.91k
109
7.91k
  return LValue;
110
7.91k
}
111
112
std::pair<ProgramStateRef, SVal> ExprEngine::prepareForObjectConstruction(
113
    const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
114
23.3k
    const ConstructionContext *CC, EvalCallOptions &CallOpts) {
115
23.3k
  SValBuilder &SVB = getSValBuilder();
116
23.3k
  MemRegionManager &MRMgr = SVB.getRegionManager();
117
23.3k
  ASTContext &ACtx = SVB.getContext();
118
23.3k
119
23.3k
  // See if we're constructing an existing region by looking at the
120
23.3k
  // current construction context.
121
23.3k
  if (CC) {
122
23.0k
    switch (CC->getKind()) {
123
23.0k
    case ConstructionContext::CXX17ElidedCopyVariableKind:
124
4.74k
    case ConstructionContext::SimpleVariableKind: {
125
4.74k
      const auto *DSCC = cast<VariableConstructionContext>(CC);
126
4.74k
      const auto *DS = DSCC->getDeclStmt();
127
4.74k
      const auto *Var = cast<VarDecl>(DS->getSingleDecl());
128
4.74k
      SVal LValue = State->getLValue(Var, LCtx);
129
4.74k
      QualType Ty = Var->getType();
130
4.74k
      LValue =
131
4.74k
          makeZeroElementRegion(State, LValue, Ty, CallOpts.IsArrayCtorOrDtor);
132
4.74k
      State =
133
4.74k
          addObjectUnderConstruction(State, DSCC->getDeclStmt(), LCtx, LValue);
134
4.74k
      return std::make_pair(State, LValue);
135
4.74k
    }
136
4.74k
    case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
137
2.53k
    case ConstructionContext::SimpleConstructorInitializerKind: {
138
2.53k
      const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
139
2.53k
      const auto *Init = ICC->getCXXCtorInitializer();
140
2.53k
      assert(Init->isAnyMemberInitializer());
141
2.53k
      const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
142
2.53k
      Loc ThisPtr =
143
2.53k
      SVB.getCXXThis(CurCtor, LCtx->getStackFrame());
144
2.53k
      SVal ThisVal = State->getSVal(ThisPtr);
145
2.53k
146
2.53k
      const ValueDecl *Field;
147
2.53k
      SVal FieldVal;
148
2.53k
      if (Init->isIndirectMemberInitializer()) {
149
0
        Field = Init->getIndirectMember();
150
0
        FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
151
2.53k
      } else {
152
2.53k
        Field = Init->getMember();
153
2.53k
        FieldVal = State->getLValue(Init->getMember(), ThisVal);
154
2.53k
      }
155
2.53k
156
2.53k
      QualType Ty = Field->getType();
157
2.53k
      FieldVal = makeZeroElementRegion(State, FieldVal, Ty,
158
2.53k
                                       CallOpts.IsArrayCtorOrDtor);
159
2.53k
      State = addObjectUnderConstruction(State, Init, LCtx, FieldVal);
160
2.53k
      return std::make_pair(State, FieldVal);
161
2.53k
    }
162
2.53k
    case ConstructionContext::NewAllocatedObjectKind: {
163
478
      if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
164
475
        const auto *NECC = cast<NewAllocatedObjectConstructionContext>(CC);
165
475
        const auto *NE = NECC->getCXXNewExpr();
166
475
        SVal V = *getObjectUnderConstruction(State, NE, LCtx);
167
475
        if (const SubRegion *MR =
168
463
                dyn_cast_or_null<SubRegion>(V.getAsRegion())) {
169
463
          if (NE->isArray()) {
170
36
            // TODO: In fact, we need to call the constructor for every
171
36
            // allocated element, not just the first one!
172
36
            CallOpts.IsArrayCtorOrDtor = true;
173
36
            return std::make_pair(
174
36
                State, loc::MemRegionVal(getStoreManager().GetElementZeroRegion(
175
36
                           MR, NE->getType()->getPointeeType())));
176
36
          }
177
427
          return std::make_pair(State, V);
178
427
        }
179
475
        // TODO: Detect when the allocator returns a null pointer.
180
475
        // Constructor shall not be called in this case.
181
475
      }
182
15
      break;
183
15
    }
184
810
    case ConstructionContext::SimpleReturnedValueKind:
185
810
    case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
186
810
      // The temporary is to be managed by the parent stack frame.
187
810
      // So build it in the parent stack frame if we're not in the
188
810
      // top frame of the analysis.
189
810
      const StackFrameContext *SFC = LCtx->getStackFrame();
190
810
      if (const LocationContext *CallerLCtx = SFC->getParent()) {
191
753
        auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
192
753
                       .getAs<CFGCXXRecordTypedCall>();
193
753
        if (!RTC) {
194
102
          // We were unable to find the correct construction context for the
195
102
          // call in the parent stack frame. This is equivalent to not being
196
102
          // able to find construction context at all.
197
102
          break;
198
102
        }
199
651
        if (isa<BlockInvocationContext>(CallerLCtx)) {
200
1
          // Unwrap block invocation contexts. They're mostly part of
201
1
          // the current stack frame.
202
1
          CallerLCtx = CallerLCtx->getParent();
203
1
          assert(!isa<BlockInvocationContext>(CallerLCtx));
204
1
        }
205
651
        return prepareForObjectConstruction(
206
651
            cast<Expr>(SFC->getCallSite()), State, CallerLCtx,
207
651
            RTC->getConstructionContext(), CallOpts);
208
651
      } else {
209
57
        // We are on the top frame of the analysis. We do not know where is the
210
57
        // object returned to. Conjure a symbolic region for the return value.
211
57
        // TODO: We probably need a new MemRegion kind to represent the storage
212
57
        // of that SymbolicRegion, so that we cound produce a fancy symbol
213
57
        // instead of an anonymous conjured symbol.
214
57
        // TODO: Do we need to track the region to avoid having it dead
215
57
        // too early? It does die too early, at least in C++17, but because
216
57
        // putting anything into a SymbolicRegion causes an immediate escape,
217
57
        // it doesn't cause any leak false positives.
218
57
        const auto *RCC = cast<ReturnedValueConstructionContext>(CC);
219
57
        // Make sure that this doesn't coincide with any other symbol
220
57
        // conjured for the returned expression.
221
57
        static const int TopLevelSymRegionTag = 0;
222
57
        const Expr *RetE = RCC->getReturnStmt()->getRetValue();
223
57
        assert(RetE && "Void returns should not have a construction context");
224
57
        QualType ReturnTy = RetE->getType();
225
57
        QualType RegionTy = ACtx.getPointerType(ReturnTy);
226
57
        SVal V = SVB.conjureSymbolVal(&TopLevelSymRegionTag, RetE, SFC,
227
57
                                      RegionTy, currBldrCtx->blockCount());
228
57
        return std::make_pair(State, V);
229
57
      }
230
0
      llvm_unreachable("Unhandled return value construction context!");
231
0
    }
232
2.95k
    case ConstructionContext::ElidedTemporaryObjectKind: {
233
2.95k
      assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
234
2.95k
      const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
235
2.95k
      const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
236
2.95k
      const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
237
2.95k
      const CXXConstructExpr *CE = TCC->getConstructorAfterElision();
238
2.95k
239
2.95k
      // Support pre-C++17 copy elision. We'll have the elidable copy
240
2.95k
      // constructor in the AST and in the CFG, but we'll skip it
241
2.95k
      // and construct directly into the final object. This call
242
2.95k
      // also sets the CallOpts flags for us.
243
2.95k
      SVal V;
244
2.95k
      // If the elided copy/move constructor is not supported, there's still
245
2.95k
      // benefit in trying to model the non-elided constructor.
246
2.95k
      // Stash our state before trying to elide, as it'll get overwritten.
247
2.95k
      ProgramStateRef PreElideState = State;
248
2.95k
      EvalCallOptions PreElideCallOpts = CallOpts;
249
2.95k
250
2.95k
      std::tie(State, V) = prepareForObjectConstruction(
251
2.95k
          CE, State, LCtx, TCC->getConstructionContextAfterElision(), CallOpts);
252
2.95k
253
2.95k
      // FIXME: This definition of "copy elision has not failed" is unreliable.
254
2.95k
      // It doesn't indicate that the constructor will actually be inlined
255
2.95k
      // later; it is still up to evalCall() to decide.
256
2.95k
      if (!CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion) {
257
2.75k
        // Remember that we've elided the constructor.
258
2.75k
        State = addObjectUnderConstruction(State, CE, LCtx, V);
259
2.75k
260
2.75k
        // Remember that we've elided the destructor.
261
2.75k
        if (BTE)
262
312
          State = elideDestructor(State, BTE, LCtx);
263
2.75k
264
2.75k
        // Instead of materialization, shamelessly return
265
2.75k
        // the final object destination.
266
2.75k
        if (MTE)
267
2.75k
          State = addObjectUnderConstruction(State, MTE, LCtx, V);
268
2.75k
269
2.75k
        return std::make_pair(State, V);
270
2.75k
      } else {
271
200
        // Copy elision failed. Revert the changes and proceed as if we have
272
200
        // a simple temporary.
273
200
        State = PreElideState;
274
200
        CallOpts = PreElideCallOpts;
275
200
      }
276
2.95k
      
LLVM_FALLTHROUGH200
;
277
200
    }
278
1.36k
    case ConstructionContext::SimpleTemporaryObjectKind: {
279
1.36k
      const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
280
1.36k
      const CXXBindTemporaryExpr *BTE = TCC->getCXXBindTemporaryExpr();
281
1.36k
      const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
282
1.36k
      SVal V = UnknownVal();
283
1.36k
284
1.36k
      if (MTE) {
285
1.25k
        if (const ValueDecl *VD = MTE->getExtendingDecl()) {
286
182
          assert(MTE->getStorageDuration() != SD_FullExpression);
287
182
          if (!VD->getType()->isReferenceType()) {
288
24
            // We're lifetime-extended by a surrounding aggregate.
289
24
            // Automatic destructors aren't quite working in this case
290
24
            // on the CFG side. We should warn the caller about that.
291
24
            // FIXME: Is there a better way to retrieve this information from
292
24
            // the MaterializeTemporaryExpr?
293
24
            CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true;
294
24
          }
295
182
        }
296
1.25k
297
1.25k
        if (MTE->getStorageDuration() == SD_Static ||
298
1.25k
            
MTE->getStorageDuration() == SD_Thread1.24k
)
299
14
          V = loc::MemRegionVal(MRMgr.getCXXStaticTempObjectRegion(E));
300
1.25k
      }
301
1.36k
302
1.36k
      if (V.isUnknown())
303
1.35k
        V = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx));
304
1.36k
305
1.36k
      if (BTE)
306
353
        State = addObjectUnderConstruction(State, BTE, LCtx, V);
307
1.36k
308
1.36k
      if (MTE)
309
1.25k
        State = addObjectUnderConstruction(State, MTE, LCtx, V);
310
1.36k
311
1.36k
      CallOpts.IsTemporaryCtorOrDtor = true;
312
1.36k
      return std::make_pair(State, V);
313
200
    }
314
10.4k
    case ConstructionContext::ArgumentKind: {
315
10.4k
      // Arguments are technically temporaries.
316
10.4k
      CallOpts.IsTemporaryCtorOrDtor = true;
317
10.4k
318
10.4k
      const auto *ACC = cast<ArgumentConstructionContext>(CC);
319
10.4k
      const Expr *E = ACC->getCallLikeExpr();
320
10.4k
      unsigned Idx = ACC->getIndex();
321
10.4k
      const CXXBindTemporaryExpr *BTE = ACC->getCXXBindTemporaryExpr();
322
10.4k
323
10.4k
      CallEventManager &CEMgr = getStateManager().getCallEventManager();
324
10.4k
      SVal V = UnknownVal();
325
10.4k
      auto getArgLoc = [&](CallEventRef<> Caller) -> Optional<SVal> {
326
10.4k
        const LocationContext *FutureSFC = Caller->getCalleeStackFrame();
327
10.4k
        // Return early if we are unable to reliably foresee
328
10.4k
        // the future stack frame.
329
10.4k
        if (!FutureSFC)
330
9.53k
          return None;
331
879
332
879
        // This should be equivalent to Caller->getDecl() for now, but
333
879
        // FutureSFC->getDecl() is likely to support better stuff (like
334
879
        // virtual functions) earlier.
335
879
        const Decl *CalleeD = FutureSFC->getDecl();
336
879
337
879
        // FIXME: Support for variadic arguments is not implemented here yet.
338
879
        if (CallEvent::isVariadic(CalleeD))
339
0
          return None;
340
879
341
879
        // Operator arguments do not correspond to operator parameters
342
879
        // because this-argument is implemented as a normal argument in
343
879
        // operator call expressions but not in operator declarations.
344
879
        const VarRegion *VR = Caller->getParameterLocation(
345
879
            *Caller->getAdjustedParameterIndex(Idx));
346
879
        if (!VR)
347
0
          return None;
348
879
349
879
        return loc::MemRegionVal(VR);
350
879
      };
351
10.4k
352
10.4k
      if (const auto *CE = dyn_cast<CallExpr>(E)) {
353
10.3k
        CallEventRef<> Caller = CEMgr.getSimpleCall(CE, State, LCtx);
354
10.3k
        if (auto OptV = getArgLoc(Caller))
355
858
          V = *OptV;
356
9.49k
        else
357
9.49k
          break;
358
858
        State = addObjectUnderConstruction(State, {CE, Idx}, LCtx, V);
359
858
      } else 
if (const auto *64
CCE64
= dyn_cast<CXXConstructExpr>(E)) {
360
53
        // Don't bother figuring out the target region for the future
361
53
        // constructor because we won't need it.
362
53
        CallEventRef<> Caller =
363
53
            CEMgr.getCXXConstructorCall(CCE, /*Target=*/nullptr, State, LCtx);
364
53
        if (auto OptV = getArgLoc(Caller))
365
21
          V = *OptV;
366
32
        else
367
32
          break;
368
21
        State = addObjectUnderConstruction(State, {CCE, Idx}, LCtx, V);
369
21
      } else 
if (const auto *11
ME11
= dyn_cast<ObjCMessageExpr>(E)) {
370
11
        CallEventRef<> Caller = CEMgr.getObjCMethodCall(ME, State, LCtx);
371
11
        if (auto OptV = getArgLoc(Caller))
372
0
          V = *OptV;
373
11
        else
374
11
          break;
375
0
        State = addObjectUnderConstruction(State, {ME, Idx}, LCtx, V);
376
0
      }
377
10.4k
378
10.4k
      assert(!V.isUnknown());
379
879
380
879
      if (BTE)
381
21
        State = addObjectUnderConstruction(State, BTE, LCtx, V);
382
879
383
879
      return std::make_pair(State, V);
384
9.94k
    }
385
23.0k
    }
386
23.0k
  }
387
9.94k
  // If we couldn't find an existing region to construct into, assume we're
388
9.94k
  // constructing a temporary. Notify the caller of our failure.
389
9.94k
  CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
390
9.94k
  return std::make_pair(
391
9.94k
      State, loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(E, LCtx)));
392
9.94k
}
393
394
void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
395
                                       ExplodedNode *Pred,
396
22.6k
                                       ExplodedNodeSet &destNodes) {
397
22.6k
  const LocationContext *LCtx = Pred->getLocationContext();
398
22.6k
  ProgramStateRef State = Pred->getState();
399
22.6k
400
22.6k
  SVal Target = UnknownVal();
401
22.6k
402
22.6k
  if (Optional<SVal> ElidedTarget =
403
2.74k
          getObjectUnderConstruction(State, CE, LCtx)) {
404
2.74k
    // We've previously modeled an elidable constructor by pretending that it in
405
2.74k
    // fact constructs into the correct target. This constructor can therefore
406
2.74k
    // be skipped.
407
2.74k
    Target = *ElidedTarget;
408
2.74k
    StmtNodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
409
2.74k
    State = finishObjectConstruction(State, CE, LCtx);
410
2.74k
    if (auto L = Target.getAs<Loc>())
411
2.74k
      State = State->BindExpr(CE, LCtx, State->getSVal(*L, CE->getType()));
412
2.74k
    Bldr.generateNode(CE, Pred, State);
413
2.74k
    return;
414
2.74k
  }
415
19.9k
416
19.9k
  // FIXME: Handle arrays, which run the same constructor for every element.
417
19.9k
  // For now, we just run the first constructor (which should still invalidate
418
19.9k
  // the entire array).
419
19.9k
420
19.9k
  EvalCallOptions CallOpts;
421
19.9k
  auto C = getCurrentCFGElement().getAs<CFGConstructor>();
422
19.9k
  assert(C || getCurrentCFGElement().getAs<CFGStmt>());
423
19.9k
  const ConstructionContext *CC = C ? 
C->getConstructionContext()19.5k
:
nullptr311
;
424
19.9k
425
19.9k
  switch (CE->getConstructionKind()) {
426
19.9k
  case CXXConstructExpr::CK_Complete: {
427
19.1k
    std::tie(State, Target) =
428
19.1k
        prepareForObjectConstruction(CE, State, LCtx, CC, CallOpts);
429
19.1k
    break;
430
19.9k
  }
431
19.9k
  case CXXConstructExpr::CK_VirtualBase: {
432
106
    // Make sure we are not calling virtual base class initializers twice.
433
106
    // Only the most-derived object should initialize virtual base classes.
434
106
    const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
435
106
        LCtx->getStackFrame()->getCallSite());
436
106
    assert(
437
106
        (!OuterCtor ||
438
106
         OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Complete ||
439
106
         OuterCtor->getConstructionKind() == CXXConstructExpr::CK_Delegating) &&
440
106
        ("This virtual base should have already been initialized by "
441
106
         "the most derived class!"));
442
106
    (void)OuterCtor;
443
106
    LLVM_FALLTHROUGH;
444
106
  }
445
709
  case CXXConstructExpr::CK_NonVirtualBase:
446
709
    // In C++17, classes with non-virtual bases may be aggregates, so they would
447
709
    // be initialized as aggregates without a constructor call, so we may have
448
709
    // a base class constructed directly into an initializer list without
449
709
    // having the derived-class constructor call on the previous stack frame.
450
709
    // Initializer lists may be nested into more initializer lists that
451
709
    // correspond to surrounding aggregate initializations.
452
709
    // FIXME: For now this code essentially bails out. We need to find the
453
709
    // correct target region and set it.
454
709
    // FIXME: Instead of relying on the ParentMap, we should have the
455
709
    // trigger-statement (InitListExpr in this case) passed down from CFG or
456
709
    // otherwise always available during construction.
457
709
    if (dyn_cast_or_null<InitListExpr>(LCtx->getParentMap().getParent(CE))) {
458
24
      MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
459
24
      Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(CE, LCtx));
460
24
      CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
461
24
      break;
462
24
    }
463
685
    LLVM_FALLTHROUGH;
464
693
  case CXXConstructExpr::CK_Delegating: {
465
693
    const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
466
693
    Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
467
693
                                              LCtx->getStackFrame());
468
693
    SVal ThisVal = State->getSVal(ThisPtr);
469
693
470
693
    if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
471
8
      Target = ThisVal;
472
685
    } else {
473
685
      // Cast to the base type.
474
685
      bool IsVirtual =
475
685
        (CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase);
476
685
      SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
477
685
                                                         IsVirtual);
478
685
      Target = BaseVal;
479
685
    }
480
693
    break;
481
19.9k
  }
482
19.9k
  }
483
19.9k
484
19.9k
  if (State != Pred->getState()) {
485
8.95k
    static SimpleProgramPointTag T("ExprEngine",
486
8.95k
                                   "Prepare for object construction");
487
8.95k
    ExplodedNodeSet DstPrepare;
488
8.95k
    StmtNodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
489
8.95k
    BldrPrepare.generateNode(CE, Pred, State, &T, ProgramPoint::PreStmtKind);
490
8.95k
    assert(DstPrepare.size() <= 1);
491
8.95k
    if (DstPrepare.size() == 0)
492
26
      return;
493
8.92k
    Pred = *BldrPrepare.begin();
494
8.92k
  }
495
19.9k
496
19.9k
  CallEventManager &CEMgr = getStateManager().getCallEventManager();
497
19.8k
  CallEventRef<CXXConstructorCall> Call =
498
19.8k
    CEMgr.getCXXConstructorCall(CE, Target.getAsRegion(), State, LCtx);
499
19.8k
500
19.8k
  ExplodedNodeSet DstPreVisit;
501
19.8k
  getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
502
19.8k
503
19.8k
  // FIXME: Is it possible and/or useful to do this before PreStmt?
504
19.8k
  ExplodedNodeSet PreInitialized;
505
19.8k
  {
506
19.8k
    StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
507
19.8k
    for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
508
19.8k
                                   E = DstPreVisit.end();
509
39.7k
         I != E; 
++I19.8k
) {
510
19.8k
      ProgramStateRef State = (*I)->getState();
511
19.8k
      if (CE->requiresZeroInitialization()) {
512
1.79k
        // FIXME: Once we properly handle constructors in new-expressions, we'll
513
1.79k
        // need to invalidate the region before setting a default value, to make
514
1.79k
        // sure there aren't any lingering bindings around. This probably needs
515
1.79k
        // to happen regardless of whether or not the object is zero-initialized
516
1.79k
        // to handle random fields of a placement-initialized object picking up
517
1.79k
        // old bindings. We might only want to do it when we need to, though.
518
1.79k
        // FIXME: This isn't actually correct for arrays -- we need to zero-
519
1.79k
        // initialize the entire array, not just the first element -- but our
520
1.79k
        // handling of arrays everywhere else is weak as well, so this shouldn't
521
1.79k
        // actually make things worse. Placement new makes this tricky as well,
522
1.79k
        // since it's then possible to be initializing one part of a multi-
523
1.79k
        // dimensional array.
524
1.79k
        State = State->bindDefaultZero(Target, LCtx);
525
1.79k
      }
526
19.8k
527
19.8k
      Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
528
19.8k
                        ProgramPoint::PreStmtKind);
529
19.8k
    }
530
19.8k
  }
531
19.8k
532
19.8k
  ExplodedNodeSet DstPreCall;
533
19.8k
  getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
534
19.8k
                                            *Call, *this);
535
19.8k
536
19.8k
  ExplodedNodeSet DstEvaluated;
537
19.8k
  StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
538
19.8k
539
19.8k
  if (CE->getConstructor()->isTrivial() &&
540
19.8k
      
CE->getConstructor()->isCopyOrMoveConstructor()14.2k
&&
541
19.8k
      
!CallOpts.IsArrayCtorOrDtor11.7k
) {
542
11.7k
    // FIXME: Handle other kinds of trivial constructors as well.
543
11.7k
    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
544
23.4k
         I != E; 
++I11.7k
)
545
11.7k
      performTrivialCopy(Bldr, *I, *Call);
546
11.7k
547
11.7k
  } else {
548
8.17k
    for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
549
16.3k
         I != E; 
++I8.17k
)
550
8.17k
      defaultEvalCall(Bldr, *I, *Call, CallOpts);
551
8.17k
  }
552
19.8k
553
19.8k
  // If the CFG was constructed without elements for temporary destructors
554
19.8k
  // and the just-called constructor created a temporary object then
555
19.8k
  // stop exploration if the temporary object has a noreturn constructor.
556
19.8k
  // This can lose coverage because the destructor, if it were present
557
19.8k
  // in the CFG, would be called at the end of the full expression or
558
19.8k
  // later (for life-time extended temporaries) -- but avoids infeasible
559
19.8k
  // paths when no-return temporary destructors are used for assertions.
560
19.8k
  const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
561
19.8k
  if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
562
281
    const MemRegion *Target = Call->getCXXThisVal().getAsRegion();
563
281
    if (Target && isa<CXXTempObjectRegion>(Target) &&
564
281
        
Call->getDecl()->getParent()->isAnyDestructorNoReturn()126
) {
565
4
566
4
      // If we've inlined the constructor, then DstEvaluated would be empty.
567
4
      // In this case we still want a sink, which could be implemented
568
4
      // in processCallExit. But we don't have that implemented at the moment,
569
4
      // so if you hit this assertion, see if you can avoid inlining
570
4
      // the respective constructor when analyzer-config cfg-temporary-dtors
571
4
      // is set to false.
572
4
      // Otherwise there's nothing wrong with inlining such constructor.
573
4
      assert(!DstEvaluated.empty() &&
574
4
             "We should not have inlined this constructor!");
575
4
576
4
      for (ExplodedNode *N : DstEvaluated) {
577
4
        Bldr.generateSink(CE, N, N->getState());
578
4
      }
579
4
580
4
      // There is no need to run the PostCall and PostStmt checker
581
4
      // callbacks because we just generated sinks on all nodes in th
582
4
      // frontier.
583
4
      return;
584
4
    }
585
19.8k
  }
586
19.8k
587
19.8k
  ExplodedNodeSet DstPostArgumentCleanup;
588
19.8k
  for (auto I : DstEvaluated)
589
12.5k
    finishArgumentConstruction(DstPostArgumentCleanup, I, *Call);
590
19.8k
591
19.8k
  // If there were other constructors called for object-type arguments
592
19.8k
  // of this constructor, clean them up.
593
19.8k
  ExplodedNodeSet DstPostCall;
594
19.8k
  getCheckerManager().runCheckersForPostCall(DstPostCall,
595
19.8k
                                             DstPostArgumentCleanup,
596
19.8k
                                             *Call, *this);
597
19.8k
  getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
598
19.8k
}
599
600
void ExprEngine::VisitCXXDestructor(QualType ObjectType,
601
                                    const MemRegion *Dest,
602
                                    const Stmt *S,
603
                                    bool IsBaseDtor,
604
                                    ExplodedNode *Pred,
605
                                    ExplodedNodeSet &Dst,
606
1.31k
                                    const EvalCallOptions &CallOpts) {
607
1.31k
  assert(S && "A destructor without a trigger!");
608
1.31k
  const LocationContext *LCtx = Pred->getLocationContext();
609
1.31k
  ProgramStateRef State = Pred->getState();
610
1.31k
611
1.31k
  const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
612
1.31k
  assert(RecordDecl && "Only CXXRecordDecls should have destructors");
613
1.31k
  const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
614
1.31k
615
1.31k
  // FIXME: There should always be a Decl, otherwise the destructor call
616
1.31k
  // shouldn't have been added to the CFG in the first place.
617
1.31k
  if (!DtorDecl) {
618
1
    // Skip the invalid destructor. We cannot simply return because
619
1
    // it would interrupt the analysis instead.
620
1
    static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
621
1
    // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway.
622
1
    PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx, &T);
623
1
    NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
624
1
    Bldr.generateNode(PP, Pred->getState(), Pred);
625
1
    return;
626
1
  }
627
1.31k
628
1.31k
  CallEventManager &CEMgr = getStateManager().getCallEventManager();
629
1.31k
  CallEventRef<CXXDestructorCall> Call =
630
1.31k
    CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
631
1.31k
632
1.31k
  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
633
1.31k
                                Call->getSourceRange().getBegin(),
634
1.31k
                                "Error evaluating destructor");
635
1.31k
636
1.31k
  ExplodedNodeSet DstPreCall;
637
1.31k
  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
638
1.31k
                                            *Call, *this);
639
1.31k
640
1.31k
  ExplodedNodeSet DstInvalidated;
641
1.31k
  StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
642
1.31k
  for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
643
2.60k
       I != E; 
++I1.29k
)
644
1.29k
    defaultEvalCall(Bldr, *I, *Call, CallOpts);
645
1.31k
646
1.31k
  getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
647
1.31k
                                             *Call, *this);
648
1.31k
}
649
650
void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
651
                                          ExplodedNode *Pred,
652
1.03k
                                          ExplodedNodeSet &Dst) {
653
1.03k
  ProgramStateRef State = Pred->getState();
654
1.03k
  const LocationContext *LCtx = Pred->getLocationContext();
655
1.03k
  PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
656
1.03k
                                CNE->getBeginLoc(),
657
1.03k
                                "Error evaluating New Allocator Call");
658
1.03k
  CallEventManager &CEMgr = getStateManager().getCallEventManager();
659
1.03k
  CallEventRef<CXXAllocatorCall> Call =
660
1.03k
    CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
661
1.03k
662
1.03k
  ExplodedNodeSet DstPreCall;
663
1.03k
  getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
664
1.03k
                                            *Call, *this);
665
1.03k
666
1.03k
  ExplodedNodeSet DstPostCall;
667
1.03k
  StmtNodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
668
1.03k
  for (auto I : DstPreCall) {
669
1.02k
    // FIXME: Provide evalCall for checkers?
670
1.02k
    defaultEvalCall(CallBldr, I, *Call);
671
1.02k
  }
672
1.03k
  // If the call is inlined, DstPostCall will be empty and we bail out now.
673
1.03k
674
1.03k
  // Store return value of operator new() for future use, until the actual
675
1.03k
  // CXXNewExpr gets processed.
676
1.03k
  ExplodedNodeSet DstPostValue;
677
1.03k
  StmtNodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
678
1.03k
  for (auto I : DstPostCall) {
679
685
    // FIXME: Because CNE serves as the "call site" for the allocator (due to
680
685
    // lack of a better expression in the AST), the conjured return value symbol
681
685
    // is going to be of the same type (C++ object pointer type). Technically
682
685
    // this is not correct because the operator new's prototype always says that
683
685
    // it returns a 'void *'. So we should change the type of the symbol,
684
685
    // and then evaluate the cast over the symbolic pointer from 'void *' to
685
685
    // the object pointer type. But without changing the symbol's type it
686
685
    // is breaking too much to evaluate the no-op symbolic cast over it, so we
687
685
    // skip it for now.
688
685
    ProgramStateRef State = I->getState();
689
685
    SVal RetVal = State->getSVal(CNE, LCtx);
690
685
691
685
    // If this allocation function is not declared as non-throwing, failures
692
685
    // /must/ be signalled by exceptions, and thus the return value will never
693
685
    // be NULL. -fno-exceptions does not influence this semantics.
694
685
    // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
695
685
    // where new can return NULL. If we end up supporting that option, we can
696
685
    // consider adding a check for it here.
697
685
    // C++11 [basic.stc.dynamic.allocation]p3.
698
685
    if (const FunctionDecl *FD = CNE->getOperatorNew()) {
699
685
      QualType Ty = FD->getType();
700
685
      if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
701
685
        if (!ProtoType->isNothrow())
702
665
          State = State->assume(RetVal.castAs<DefinedOrUnknownSVal>(), true);
703
685
    }
704
685
705
685
    ValueBldr.generateNode(
706
685
        CNE, I, addObjectUnderConstruction(State, CNE, LCtx, RetVal));
707
685
  }
708
1.03k
709
1.03k
  ExplodedNodeSet DstPostPostCallCallback;
710
1.03k
  getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
711
1.03k
                                             DstPostValue, *Call, *this);
712
1.03k
  for (auto I : DstPostPostCallCallback) {
713
685
    getCheckerManager().runCheckersForNewAllocator(
714
685
        CNE, *getObjectUnderConstruction(I->getState(), CNE, LCtx), Dst, I,
715
685
        *this);
716
685
  }
717
1.03k
}
718
719
void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
720
1.03k
                                   ExplodedNodeSet &Dst) {
721
1.03k
  // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
722
1.03k
  // Also, we need to decide how allocators actually work -- they're not
723
1.03k
  // really part of the CXXNewExpr because they happen BEFORE the
724
1.03k
  // CXXConstructExpr subexpression. See PR12014 for some discussion.
725
1.03k
726
1.03k
  unsigned blockCount = currBldrCtx->blockCount();
727
1.03k
  const LocationContext *LCtx = Pred->getLocationContext();
728
1.03k
  SVal symVal = UnknownVal();
729
1.03k
  FunctionDecl *FD = CNE->getOperatorNew();
730
1.03k
731
1.03k
  bool IsStandardGlobalOpNewFunction =
732
1.03k
      FD->isReplaceableGlobalAllocationFunction();
733
1.03k
734
1.03k
  ProgramStateRef State = Pred->getState();
735
1.03k
736
1.03k
  // Retrieve the stored operator new() return value.
737
1.03k
  if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
738
1.03k
    symVal = *getObjectUnderConstruction(State, CNE, LCtx);
739
1.03k
    State = finishObjectConstruction(State, CNE, LCtx);
740
1.03k
  }
741
1.03k
742
1.03k
  // We assume all standard global 'operator new' functions allocate memory in
743
1.03k
  // heap. We realize this is an approximation that might not correctly model
744
1.03k
  // a custom global allocator.
745
1.03k
  if (symVal.isUnknown()) {
746
7
    if (IsStandardGlobalOpNewFunction)
747
5
      symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
748
2
    else
749
2
      symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
750
2
                                            blockCount);
751
7
  }
752
1.03k
753
1.03k
  CallEventManager &CEMgr = getStateManager().getCallEventManager();
754
1.03k
  CallEventRef<CXXAllocatorCall> Call =
755
1.03k
    CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
756
1.03k
757
1.03k
  if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
758
7
    // Invalidate placement args.
759
7
    // FIXME: Once we figure out how we want allocators to work,
760
7
    // we should be using the usual pre-/(default-)eval-/post-call checks here.
761
7
    State = Call->invalidateRegions(blockCount);
762
7
    if (!State)
763
0
      return;
764
7
765
7
    // If this allocation function is not declared as non-throwing, failures
766
7
    // /must/ be signalled by exceptions, and thus the return value will never
767
7
    // be NULL. -fno-exceptions does not influence this semantics.
768
7
    // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
769
7
    // where new can return NULL. If we end up supporting that option, we can
770
7
    // consider adding a check for it here.
771
7
    // C++11 [basic.stc.dynamic.allocation]p3.
772
7
    if (FD) {
773
7
      QualType Ty = FD->getType();
774
7
      if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
775
7
        if (!ProtoType->isNothrow())
776
3
          if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
777
3
            State = State->assume(*dSymVal, true);
778
7
    }
779
7
  }
780
1.03k
781
1.03k
  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
782
1.03k
783
1.03k
  SVal Result = symVal;
784
1.03k
785
1.03k
  if (CNE->isArray()) {
786
133
    // FIXME: allocating an array requires simulating the constructors.
787
133
    // For now, just return a symbolicated region.
788
133
    if (const SubRegion *NewReg =
789
128
            dyn_cast_or_null<SubRegion>(symVal.getAsRegion())) {
790
128
      QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
791
128
      const ElementRegion *EleReg =
792
128
          getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
793
128
      Result = loc::MemRegionVal(EleReg);
794
128
    }
795
133
    State = State->BindExpr(CNE, Pred->getLocationContext(), Result);
796
133
    Bldr.generateNode(CNE, Pred, State);
797
133
    return;
798
133
  }
799
904
800
904
  // FIXME: Once we have proper support for CXXConstructExprs inside
801
904
  // CXXNewExpr, we need to make sure that the constructed object is not
802
904
  // immediately invalidated here. (The placement call should happen before
803
904
  // the constructor call anyway.)
804
904
  if (FD && FD->isReservedGlobalPlacementOperator()) {
805
295
    // Non-array placement new should always return the placement location.
806
295
    SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
807
295
    Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
808
295
                                  CNE->getPlacementArg(0)->getType());
809
295
  }
810
904
811
904
  // Bind the address of the object, then check to see if we cached out.
812
904
  State = State->BindExpr(CNE, LCtx, Result);
813
904
  ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
814
904
  if (!NewN)
815
0
    return;
816
904
817
904
  // If the type is not a record, we won't have a CXXConstructExpr as an
818
904
  // initializer. Copy the value over.
819
904
  if (const Expr *Init = CNE->getInitializer()) {
820
608
    if (!isa<CXXConstructExpr>(Init)) {
821
171
      assert(Bldr.getResults().size() == 1);
822
171
      Bldr.takeNodes(NewN);
823
171
      evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
824
171
               /*FirstInit=*/IsStandardGlobalOpNewFunction);
825
171
    }
826
608
  }
827
904
}
828
829
void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
830
365
                                    ExplodedNode *Pred, ExplodedNodeSet &Dst) {
831
365
  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
832
365
  ProgramStateRef state = Pred->getState();
833
365
  Bldr.generateNode(CDE, Pred, state);
834
365
}
835
836
void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
837
                                   ExplodedNode *Pred,
838
0
                                   ExplodedNodeSet &Dst) {
839
0
  const VarDecl *VD = CS->getExceptionDecl();
840
0
  if (!VD) {
841
0
    Dst.Add(Pred);
842
0
    return;
843
0
  }
844
0
845
0
  const LocationContext *LCtx = Pred->getLocationContext();
846
0
  SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
847
0
                                        currBldrCtx->blockCount());
848
0
  ProgramStateRef state = Pred->getState();
849
0
  state = state->bindLoc(state->getLValue(VD, LCtx), V, LCtx);
850
0
851
0
  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
852
0
  Bldr.generateNode(CS, Pred, state);
853
0
}
854
855
void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
856
7.41k
                                    ExplodedNodeSet &Dst) {
857
7.41k
  StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
858
7.41k
859
7.41k
  // Get the this object region from StoreManager.
860
7.41k
  const LocationContext *LCtx = Pred->getLocationContext();
861
7.41k
  const MemRegion *R =
862
7.41k
    svalBuilder.getRegionManager().getCXXThisRegion(
863
7.41k
                                  getContext().getCanonicalType(TE->getType()),
864
7.41k
                                                    LCtx);
865
7.41k
866
7.41k
  ProgramStateRef state = Pred->getState();
867
7.41k
  SVal V = state->getSVal(loc::MemRegionVal(R));
868
7.41k
  Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
869
7.41k
}
870
871
void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
872
179
                                 ExplodedNodeSet &Dst) {
873
179
  const LocationContext *LocCtxt = Pred->getLocationContext();
874
179
875
179
  // Get the region of the lambda itself.
876
179
  const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
877
179
      LE, LocCtxt);
878
179
  SVal V = loc::MemRegionVal(R);
879
179
880
179
  ProgramStateRef State = Pred->getState();
881
179
882
179
  // If we created a new MemRegion for the lambda, we should explicitly bind
883
179
  // the captures.
884
179
  CXXRecordDecl::field_iterator CurField = LE->getLambdaClass()->field_begin();
885
179
  for (LambdaExpr::const_capture_init_iterator i = LE->capture_init_begin(),
886
179
                                               e = LE->capture_init_end();
887
371
       i != e; 
++i, ++CurField192
) {
888
192
    FieldDecl *FieldForCapture = *CurField;
889
192
    SVal FieldLoc = State->getLValue(FieldForCapture, V);
890
192
891
192
    SVal InitVal;
892
192
    if (!FieldForCapture->hasCapturedVLAType()) {
893
190
      Expr *InitExpr = *i;
894
190
      assert(InitExpr && "Capture missing initialization expression");
895
190
      InitVal = State->getSVal(InitExpr, LocCtxt);
896
190
    } else {
897
2
      // The field stores the length of a captured variable-length array.
898
2
      // These captures don't have initialization expressions; instead we
899
2
      // get the length from the VLAType size expression.
900
2
      Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
901
2
      InitVal = State->getSVal(SizeExpr, LocCtxt);
902
2
    }
903
192
904
192
    State = State->bindLoc(FieldLoc, InitVal, LocCtxt);
905
192
  }
906
179
907
179
  // Decay the Loc into an RValue, because there might be a
908
179
  // MaterializeTemporaryExpr node above this one which expects the bound value
909
179
  // to be an RValue.
910
179
  SVal LambdaRVal = State->getSVal(R);
911
179
912
179
  ExplodedNodeSet Tmp;
913
179
  StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
914
179
  // FIXME: is this the right program point kind?
915
179
  Bldr.generateNode(LE, Pred,
916
179
                    State->BindExpr(LE, LocCtxt, LambdaRVal),
917
179
                    nullptr, ProgramPoint::PostLValueKind);
918
179
919
179
  // FIXME: Move all post/pre visits to ::Visit().
920
179
  getCheckerManager().runCheckersForPostStmt(Dst, Tmp, LE, *this);
921
179
}