22 using namespace clang;
33 state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
42 bool AlwaysReturnsLValue;
44 assert(Ctor->getDecl()->isTrivial());
45 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
46 ThisVal = Ctor->getCXXThisVal();
47 AlwaysReturnsLValue =
false;
50 assert(cast<CXXMethodDecl>(Call.
getDecl())->getOverloadedOperator() ==
52 ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
53 AlwaysReturnsLValue =
true;
71 evalBind(Dst, CallExpr, Pred, ThisVal, V,
true);
77 if (AlwaysReturnsLValue)
78 State = State->BindExpr(CallExpr, LCtx, ThisVal);
94 SValBuilder &SVB = State->getStateManager().getSValBuilder();
98 Ty = AT->getElementType();
115 if (
auto Elem = findElementDirectlyInitializedByCurrentConstructor()) {
117 auto *DS = cast<DeclStmt>(StmtElem->getStmt());
118 if (
const auto *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
119 if (Var->getInit() && Var->getInit()->IgnoreImplicit() == CE) {
120 SVal LValue = State->getLValue(Var, LCtx);
132 SVal ThisVal = State->getSVal(ThisPtr);
141 FieldVal = State->getLValue(Init->
getMember(), ThisVal);
165 if (isa<DeclStmt>(StmtElem->getStmt())) {
178 ExprEngine::findElementDirectlyInitializedByCurrentConstructor() {
183 assert(isa<CXXConstructExpr>(((*B)[currStmtIdx]).castAs<CFGStmt>().
getStmt()));
184 unsigned int NextStmtIdx = currStmtIdx + 1;
185 if (NextStmtIdx >= B->
size())
194 Next = (*B)[NextStmtIdx];
204 ExprEngine::findDirectConstructorForCurrentCFGElement() {
210 if (currStmtIdx == 0)
216 unsigned int PreviousStmtIdx = currStmtIdx - 1;
221 Previous = (*B)[PreviousStmtIdx];
225 if (
auto *CtorExpr = dyn_cast<CXXConstructExpr>(PrevStmtElem->getStmt())) {
247 Target = getRegionForConstructedObject(CE, Pred);
274 SVal ThisVal = State->getSVal(ThisPtr);
305 E = DstPreVisit.
end();
334 bool IsArray = isa<ElementRegion>(Target);
341 performTrivialCopy(Bldr, *
I, *Call);
374 assert(RecordDecl &&
"Only CXXRecordDecls should have destructors");
382 Call->getSourceRange().getBegin(),
383 "Error evaluating destructor");
407 "Error evaluating New Allocator Call");
410 CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
433 unsigned blockCount = currBldrCtx->
blockCount();
438 bool IsStandardGlobalOpNewFunction =
false;
439 if (FD && !isa<CXXMethodDecl>(FD) && !FD->
isVariadic()) {
444 IsStandardGlobalOpNewFunction = II->getName().equals(
"nothrow_t");
448 IsStandardGlobalOpNewFunction = (FD->
getNumParams() == 1);
454 if (IsStandardGlobalOpNewFunction)
468 State = Call->invalidateRegions(blockCount);
483 State = State->assume(symVal,
true);
514 State = State->BindExpr(CNE, LCtx, Result);
522 if (!isa<CXXConstructExpr>(Init)) {
525 evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
526 IsStandardGlobalOpNewFunction);
551 state = state->bindLoc(state->getLValue(VD, LCtx), V);
570 Bldr.
generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
589 i != e; ++i, ++CurField) {
591 SVal FieldLoc = State->getLValue(FieldForCapture, V);
596 assert(InitExpr &&
"Capture missing initialization expression");
597 InitVal = State->getSVal(InitExpr, LocCtxt);
603 InitVal = State->getSVal(SizeExpr, LocCtxt);
606 State = State->bindLoc(FieldLoc, InitVal);
612 SVal LambdaRVal = State->getSVal(R);
618 State->BindExpr(LE, LocCtxt, LambdaRVal),
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
SVal evalDerivedToBase(SVal Derived, const CastExpr *Cast)
Evaluates a chain of derived-to-base casts through the path specified in Cast.
PointerType - C99 6.7.5.1 - Pointer Declarators.
A (possibly-)qualified type.
MemRegion - The root abstract class for all memory regions.
This builder class is useful for generating nodes that resulted from visiting a statement.
Expr * GetTemporaryExpr() const
Retrieve the temporary-generating subexpression whose value will be materialized into a glvalue...
Defines the PrettyStackTraceEntry class, which is used to make crashes give more contextual informati...
const VariableArrayType * getCapturedVLAType() const
Get the captured variable length array type.
Manages the lifetime of CallEvent objects.
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Represents an array type, per C99 6.7.5.2 - Array Declarators.
Represents a call to a C++ constructor.
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a prvalue temporary that is written into memory so that a reference can bind to it...
Expr *const * const_capture_init_iterator
Const iterator that walks over the capture initialization arguments.
void takeNodes(const ExplodedNodeSet &S)
VarDecl - An instance of this class is created to represent a variable declaration or definition...
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
const Stmt * getStmt() const
field_iterator field_begin() const
const NodeBuilderContext & getBuilderContext()
bool isCopyOrMoveConstructor(unsigned &TypeQuals) const
Determine whether this is a copy or move constructor.
void VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
RecordDecl - Represents a struct/union/class.
One of these records is kept for each identifier that is lexed.
MemRegionManager & getRegionManager()
ImplTy::iterator iterator
Expr * getSizeExpr() const
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
SourceLocation getStartLoc() const
FieldDecl - An instance of this class is created by Sema::ActOnField to represent a member of a struc...
void VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest, const Stmt *S, bool IsBaseDtor, ExplodedNode *Pred, ExplodedNodeSet &Dst)
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Expr * getPlacementArg(unsigned i)
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
IndirectFieldDecl * getIndirectMember() const
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
capture_init_iterator capture_init_begin()
Retrieve the first initialization argument for this lambda expression (which initializes the first ca...
Expr * getInitializer()
The initializer of this new-expression.
const ArrayType * getAsArrayType(QualType T) const
Type Query functions.
const Stmt * getCallSite() const
bool hasCapturedVLAType() const
Determine whether this member captures the variable length array type.
If a crash happens while one of these objects are live, the message is printed out along with the spe...
bool isVariadic() const
Whether this function is variadic.
A C++ lambda expression, which produces a function object (of unspecified type) that can be invoked l...
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
detail::InMemoryDirectory::const_iterator I
Represents the this expression in C++.
void evalBind(ExplodedNodeSet &Dst, const Stmt *StoreE, ExplodedNode *Pred, SVal location, SVal Val, bool atDeclInit=false, const ProgramPoint *PP=nullptr)
evalBind - Handle the semantics of binding a value to a specific location.
const LocationContext * getLocationContext() const
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Represents a prototype with parameter type info, e.g.
void VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CFGBlock - Represents a single basic block in a source-level CFG.
unsigned blockCount() const
Returns the number of times the current basic block has been visited on the exploded graph path...
CheckerManager & getCheckerManager() const
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
bool requiresZeroInitialization() const
Whether this construction first requires zero-initialization before the initializer is called...
DefinedOrUnknownSVal makeZeroVal(QualType type)
Construct an SVal representing '0' for the specified type.
ValueDecl - Represent the declaration of a variable (in which case it is an lvalue) a function (in wh...
Expr - This represents one expression.
const ProgramStateRef & getState() const
void VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
void VisitCXXNewAllocatorCall(const CXXNewExpr *CNE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Represents a C++ destructor within a class.
const ElementRegion * GetElementZeroRegion(const MemRegion *R, QualType T)
This is the simplest builder which generates nodes in the ExplodedGraph.
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
void Add(ExplodedNode *N)
const ParmVarDecl * getParamDecl(unsigned i) const
const ExplodedNodeSet & getResults()
ConstructionKind getConstructionKind() const
Determine whether this constructor is actually constructing a base class (rather than a complete obje...
bool isIndirectMemberInitializer() const
const IdentifierInfo * getBaseTypeIdentifier() const
Retrieves a pointer to the name of the base type.
The result type of a method or function.
NonLoc makeZeroArrayIndex()
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
DefinedOrUnknownSVal conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, unsigned count)
Create a new symbol with a unique 'name'.
unsigned getNumParams() const
getNumParams - Return the number of parameters this function must have based on its FunctionType...
const StackFrameContext * getCurrentStackFrame() const
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
CallEventManager & getCallEventManager()
static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue, QualType &Ty)
Returns a region representing the first element of a (possibly multi-dimensional) array...
const CXXTempObjectRegion * getCXXTempObjectRegion(Expr const *Ex, LocationContext const *LC)
Represents a static or instance method of a struct/union/class.
ASTContext & getContext()
void VisitCXXDeleteExpr(const CXXDeleteExpr *CDE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
const Decl * getDecl() const
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
DefinedOrUnknownSVal getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned Count)
Conjure a symbol representing heap allocated memory region.
const CXXThisRegion * getCXXThisRegion(QualType thisPointerTy, const LocationContext *LC)
getCXXThisRegion - Retrieve the [artificial] region associated with the parameter 'this'...
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
SValBuilder & getSValBuilder()
Represents a delete expression for memory deallocation and destructor calls, e.g. ...
StoreManager & getStoreManager()
CXXDestructorDecl * getDestructor() const
Returns the destructor decl for this class.
void VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitLambdaExpr - Transfer function logic for LambdaExprs.
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
FieldDecl * getMember() const
If this is a member initializer, returns the declaration of the non-static data member being initiali...
Represents an abstract call to a function or method along a particular path.
ProgramStateManager & getStateManager() override
const CFGBlock * getBlock() const
Return the CFGBlock associated with this builder.
specific_decl_iterator - Iterates over a subrange of declarations stored in a DeclContext, providing only those that are of type SpecificDecl (or a class derived from it).
FunctionDecl * getOperatorNew() const
const T * getAs() const
Member-template getAs<specific type>'.
Represents a C++ base or member initializer.
void VisitCXXConstructExpr(const CXXConstructExpr *E, ExplodedNode *Pred, ExplodedNodeSet &Dst)
CXXConstructorDecl * getConstructor() const
Get the constructor that this expression will (ultimately) call.
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
bool isAnyMemberInitializer() const
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call)
Default implementation of call evaluation.
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
Represents a C++ struct/union/class.
bool isTrivial(const SExpr *E)
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
CXXCatchStmt - This represents a C++ catch block.
bool isReservedGlobalPlacementOperator() const
Determines whether this operator new or delete is one of the reserved global placement operators: voi...
CFGElement - Represents a top-level expression in a basic block.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
ElementRegin is used to represent both array elements and casts.
capture_init_iterator capture_init_end()
Retrieve the iterator pointing one past the last initialization argument for this lambda expression...
VarDecl * getExceptionDecl() const
CFGInitializer - Represents C++ base or member initializer from constructor's initialization list...
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
void CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Create a C++ temporary object for an rvalue.
Represents a call to a C++ constructor.
CXXRecordDecl * getLambdaClass() const
Retrieve the class that corresponds to the lambda.
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Expr * IgnoreParens() LLVM_READONLY
IgnoreParens - Ignore parentheses.
static bool canHaveDirectConstructor(CFGElement Elem)
Returns true if the initializer for can be a direct constructor.