1//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file defines the C++ expression evaluation engine.
10//
11//===----------------------------------------------------------------------===//
12
13#include "clang/AST/ASTContext.h"
14#include "clang/AST/AttrIterator.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/ParentMap.h"
17#include "clang/AST/StmtCXX.h"
18#include "clang/Analysis/ConstructionContext.h"
19#include "clang/Basic/PrettyStackTrace.h"
20#include "clang/StaticAnalyzer/Core/CheckerManager.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
22#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
23#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
25#include "llvm/ADT/STLExtras.h"
26#include "llvm/ADT/Sequence.h"
27#include "llvm/Support/Casting.h"
28#include <optional>
29
30using namespace clang;
31using namespace ento;
32
33void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
34 ExplodedNode *Pred,
35 ExplodedNodeSet &Dst) {
36 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
37 const Expr *tempExpr = ME->getSubExpr()->IgnoreParens();
38 ProgramStateRef state = Pred->getState();
39 const LocationContext *LCtx = Pred->getLocationContext();
40
41 state = createTemporaryRegionIfNeeded(State: state, LC: LCtx, InitWithAdjustments: tempExpr, Result: ME);
42 Bldr.generateNode(S: ME, Pred, St: state);
43}
44
45// FIXME: This is the sort of code that should eventually live in a Core
46// checker rather than as a special case in ExprEngine.
47void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
48 const CallEvent &Call) {
49 SVal ThisVal;
50 bool AlwaysReturnsLValue;
51 [[maybe_unused]] const CXXRecordDecl *ThisRD = nullptr;
52 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(Val: &Call)) {
53 assert(Ctor->getDecl()->isTrivial());
54 assert(Ctor->getDecl()->isCopyOrMoveConstructor());
55 ThisVal = Ctor->getCXXThisVal();
56 ThisRD = Ctor->getDecl()->getParent();
57 AlwaysReturnsLValue = false;
58 } else {
59 assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
60 assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
61 OO_Equal);
62 ThisVal = cast<CXXInstanceCall>(Val: Call).getCXXThisVal();
63 ThisRD = cast<CXXMethodDecl>(Val: Call.getDecl())->getParent();
64 AlwaysReturnsLValue = true;
65 }
66
67 const LocationContext *LCtx = Pred->getLocationContext();
68 const Expr *CallExpr = Call.getOriginExpr();
69
70 ExplodedNodeSet Dst;
71 Bldr.takeNodes(N: Pred);
72
73 assert(ThisRD);
74
75 if (!ThisRD->isEmpty()) {
76 SVal V = Call.getArgSVal(Index: 0);
77 const Expr *VExpr = Call.getArgExpr(Index: 0);
78
79 // If the value being copied is not unknown, load from its location to get
80 // an aggregate rvalue.
81 if (std::optional<Loc> L = V.getAs<Loc>())
82 V = Pred->getState()->getSVal(LV: *L);
83 else
84 assert(V.isUnknownOrUndef());
85
86 ExplodedNodeSet Tmp;
87 evalLocation(Dst&: Tmp, NodeEx: CallExpr, BoundEx: VExpr, Pred, St: Pred->getState(), location: V,
88 /*isLoad=*/true);
89 for (ExplodedNode *N : Tmp)
90 evalBind(Dst, StoreE: CallExpr, Pred: N, location: ThisVal, Val: V, AtDeclInit: !AlwaysReturnsLValue);
91 } else {
92 // We can't copy empty classes because of empty base class optimization.
93 // In that case, copying the empty base class subobject would overwrite the
94 // object that it overlaps with - so let's not do that.
95 // See issue-157467.cpp for an example.
96 Dst.Add(N: Pred);
97 }
98
99 PostStmt PS(CallExpr, LCtx);
100 for (ExplodedNode *N : Dst) {
101 ProgramStateRef State = N->getState();
102 if (AlwaysReturnsLValue)
103 State = State->BindExpr(S: CallExpr, LCtx, V: ThisVal);
104 else
105 State = bindReturnValue(Call, LCtx, State);
106 Bldr.generateNode(PP: PS, State, Pred: N);
107 }
108}
109
110SVal ExprEngine::makeElementRegion(ProgramStateRef State, SVal LValue,
111 QualType &Ty, bool &IsArray, unsigned Idx) {
112 SValBuilder &SVB = State->getStateManager().getSValBuilder();
113 ASTContext &Ctx = SVB.getContext();
114
115 if (const ArrayType *AT = Ctx.getAsArrayType(T: Ty)) {
116 while (AT) {
117 Ty = AT->getElementType();
118 AT = dyn_cast<ArrayType>(Val: AT->getElementType());
119 }
120 LValue = State->getLValue(ElementType: Ty, Idx: SVB.makeArrayIndex(idx: Idx), Base: LValue);
121 IsArray = true;
122 }
123
124 return LValue;
125}
126
127// In case when the prvalue is returned from the function (kind is one of
128// SimpleReturnedValueKind, CXX17ElidedCopyReturnedValueKind), then
129// it's materialization happens in context of the caller.
130SVal ExprEngine::computeObjectUnderConstruction(
131 const Expr *E, ProgramStateRef State, unsigned NumVisitedCaller,
132 const LocationContext *LCtx, const ConstructionContext *CC,
133 EvalCallOptions &CallOpts, unsigned Idx) {
134
135 SValBuilder &SVB = getSValBuilder();
136 MemRegionManager &MRMgr = SVB.getRegionManager();
137 ASTContext &ACtx = SVB.getContext();
138
139 // Compute the target region by exploring the construction context.
140 if (CC) {
141 switch (CC->getKind()) {
142 case ConstructionContext::CXX17ElidedCopyVariableKind:
143 case ConstructionContext::SimpleVariableKind: {
144 const auto *DSCC = cast<VariableConstructionContext>(Val: CC);
145 const auto *DS = DSCC->getDeclStmt();
146 const auto *Var = cast<VarDecl>(Val: DS->getSingleDecl());
147 QualType Ty = Var->getType();
148 return makeElementRegion(State, LValue: State->getLValue(VD: Var, LC: LCtx), Ty,
149 IsArray&: CallOpts.IsArrayCtorOrDtor, Idx);
150 }
151 case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
152 case ConstructionContext::SimpleConstructorInitializerKind: {
153 const auto *ICC = cast<ConstructorInitializerConstructionContext>(Val: CC);
154 const auto *Init = ICC->getCXXCtorInitializer();
155 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(Val: LCtx->getDecl());
156 Loc ThisPtr = SVB.getCXXThis(D: CurCtor, SFC: LCtx->getStackFrame());
157 SVal ThisVal = State->getSVal(LV: ThisPtr);
158 if (Init->isBaseInitializer()) {
159 const auto *ThisReg = cast<SubRegion>(Val: ThisVal.getAsRegion());
160 const CXXRecordDecl *BaseClass =
161 Init->getBaseClass()->getAsCXXRecordDecl();
162 const auto *BaseReg =
163 MRMgr.getCXXBaseObjectRegion(BaseClass, Super: ThisReg,
164 IsVirtual: Init->isBaseVirtual());
165 return SVB.makeLoc(region: BaseReg);
166 }
167 if (Init->isDelegatingInitializer())
168 return ThisVal;
169
170 const ValueDecl *Field;
171 SVal FieldVal;
172 if (Init->isIndirectMemberInitializer()) {
173 Field = Init->getIndirectMember();
174 FieldVal = State->getLValue(decl: Init->getIndirectMember(), Base: ThisVal);
175 } else {
176 Field = Init->getMember();
177 FieldVal = State->getLValue(decl: Init->getMember(), Base: ThisVal);
178 }
179
180 QualType Ty = Field->getType();
181 return makeElementRegion(State, LValue: FieldVal, Ty, IsArray&: CallOpts.IsArrayCtorOrDtor,
182 Idx);
183 }
184 case ConstructionContext::NewAllocatedObjectKind: {
185 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
186 const auto *NECC = cast<NewAllocatedObjectConstructionContext>(Val: CC);
187 const auto *NE = NECC->getCXXNewExpr();
188 SVal V = *getObjectUnderConstruction(State, Item: NE, LC: LCtx);
189 if (const SubRegion *MR =
190 dyn_cast_or_null<SubRegion>(Val: V.getAsRegion())) {
191 if (NE->isArray()) {
192 CallOpts.IsArrayCtorOrDtor = true;
193
194 auto Ty = NE->getType()->getPointeeType();
195 while (const auto *AT = getContext().getAsArrayType(T: Ty))
196 Ty = AT->getElementType();
197
198 auto R = MRMgr.getElementRegion(elementType: Ty, Idx: svalBuilder.makeArrayIndex(idx: Idx),
199 superRegion: MR, Ctx: SVB.getContext());
200
201 return loc::MemRegionVal(R);
202 }
203 return V;
204 }
205 // TODO: Detect when the allocator returns a null pointer.
206 // Constructor shall not be called in this case.
207 }
208 break;
209 }
210 case ConstructionContext::SimpleReturnedValueKind:
211 case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
212 // The temporary is to be managed by the parent stack frame.
213 // So build it in the parent stack frame if we're not in the
214 // top frame of the analysis.
215 const StackFrameContext *SFC = LCtx->getStackFrame();
216 if (const LocationContext *CallerLCtx = SFC->getParent()) {
217 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
218 .getAs<CFGCXXRecordTypedCall>();
219 if (!RTC) {
220 // We were unable to find the correct construction context for the
221 // call in the parent stack frame. This is equivalent to not being
222 // able to find construction context at all.
223 break;
224 }
225 if (isa<BlockInvocationContext>(Val: CallerLCtx)) {
226 // Unwrap block invocation contexts. They're mostly part of
227 // the current stack frame.
228 CallerLCtx = CallerLCtx->getParent();
229 assert(!isa<BlockInvocationContext>(CallerLCtx));
230 }
231
232 unsigned NVCaller = getNumVisited(LC: CallerLCtx, Block: SFC->getCallSiteBlock());
233 return computeObjectUnderConstruction(
234 E: cast<Expr>(Val: SFC->getCallSite()), State, NumVisitedCaller: NVCaller, LCtx: CallerLCtx,
235 CC: RTC->getConstructionContext(), CallOpts);
236 } else {
237 // We are on the top frame of the analysis. We do not know where is the
238 // object returned to. Conjure a symbolic region for the return value.
239 // TODO: We probably need a new MemRegion kind to represent the storage
240 // of that SymbolicRegion, so that we could produce a fancy symbol
241 // instead of an anonymous conjured symbol.
242 // TODO: Do we need to track the region to avoid having it dead
243 // too early? It does die too early, at least in C++17, but because
244 // putting anything into a SymbolicRegion causes an immediate escape,
245 // it doesn't cause any leak false positives.
246 const auto *RCC = cast<ReturnedValueConstructionContext>(Val: CC);
247 // Make sure that this doesn't coincide with any other symbol
248 // conjured for the returned expression.
249 static const int TopLevelSymRegionTag = 0;
250 const Expr *RetE = RCC->getReturnStmt()->getRetValue();
251 assert(RetE && "Void returns should not have a construction context");
252 QualType ReturnTy = RetE->getType();
253 QualType RegionTy = ACtx.getPointerType(T: ReturnTy);
254 return SVB.conjureSymbolVal(symbolTag: &TopLevelSymRegionTag, elem: getCFGElementRef(),
255 LCtx: SFC, type: RegionTy, count: getNumVisitedCurrent());
256 }
257 llvm_unreachable("Unhandled return value construction context!");
258 }
259 case ConstructionContext::ElidedTemporaryObjectKind: {
260 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
261 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(Val: CC);
262
263 // Support pre-C++17 copy elision. We'll have the elidable copy
264 // constructor in the AST and in the CFG, but we'll skip it
265 // and construct directly into the final object. This call
266 // also sets the CallOpts flags for us.
267 // If the elided copy/move constructor is not supported, there's still
268 // benefit in trying to model the non-elided constructor.
269 // Stash our state before trying to elide, as it'll get overwritten.
270 ProgramStateRef PreElideState = State;
271 EvalCallOptions PreElideCallOpts = CallOpts;
272
273 SVal V = computeObjectUnderConstruction(
274 E: TCC->getConstructorAfterElision(), State, NumVisitedCaller, LCtx,
275 CC: TCC->getConstructionContextAfterElision(), CallOpts);
276
277 // FIXME: This definition of "copy elision has not failed" is unreliable.
278 // It doesn't indicate that the constructor will actually be inlined
279 // later; this is still up to evalCall() to decide.
280 if (!CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion)
281 return V;
282
283 // Copy elision failed. Revert the changes and proceed as if we have
284 // a simple temporary.
285 CallOpts = PreElideCallOpts;
286 CallOpts.IsElidableCtorThatHasNotBeenElided = true;
287 [[fallthrough]];
288 }
289 case ConstructionContext::SimpleTemporaryObjectKind: {
290 const auto *TCC = cast<TemporaryObjectConstructionContext>(Val: CC);
291 const MaterializeTemporaryExpr *MTE = TCC->getMaterializedTemporaryExpr();
292
293 CallOpts.IsTemporaryCtorOrDtor = true;
294 if (MTE) {
295 if (const ValueDecl *VD = MTE->getExtendingDecl()) {
296 StorageDuration SD = MTE->getStorageDuration();
297 assert(SD != SD_FullExpression);
298 if (!VD->getType()->isReferenceType()) {
299 // We're lifetime-extended by a surrounding aggregate.
300 // Automatic destructors aren't quite working in this case
301 // on the CFG side. We should warn the caller about that.
302 // FIXME: Is there a better way to retrieve this information from
303 // the MaterializeTemporaryExpr?
304 CallOpts.IsTemporaryLifetimeExtendedViaAggregate = true;
305 }
306
307 if (SD == SD_Static || SD == SD_Thread)
308 return loc::MemRegionVal(
309 MRMgr.getCXXStaticLifetimeExtendedObjectRegion(Ex: E, VD));
310
311 return loc::MemRegionVal(
312 MRMgr.getCXXLifetimeExtendedObjectRegion(Ex: E, VD, LC: LCtx));
313 }
314 assert(MTE->getStorageDuration() == SD_FullExpression);
315 }
316
317 return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(Ex: E, LC: LCtx));
318 }
319 case ConstructionContext::LambdaCaptureKind: {
320 CallOpts.IsTemporaryCtorOrDtor = true;
321
322 const auto *LCC = cast<LambdaCaptureConstructionContext>(Val: CC);
323
324 SVal Base = loc::MemRegionVal(
325 MRMgr.getCXXTempObjectRegion(Ex: LCC->getInitializer(), LC: LCtx));
326
327 const auto *CE = dyn_cast_or_null<CXXConstructExpr>(Val: E);
328 if (getIndexOfElementToConstruct(State, E: CE, LCtx)) {
329 CallOpts.IsArrayCtorOrDtor = true;
330 Base = State->getLValue(ElementType: E->getType(), Idx: svalBuilder.makeArrayIndex(idx: Idx),
331 Base);
332 }
333
334 return Base;
335 }
336 case ConstructionContext::ArgumentKind: {
337 // Arguments are technically temporaries.
338 CallOpts.IsTemporaryCtorOrDtor = true;
339
340 const auto *ACC = cast<ArgumentConstructionContext>(Val: CC);
341 const Expr *E = ACC->getCallLikeExpr();
342 unsigned Idx = ACC->getIndex();
343
344 CallEventManager &CEMgr = getStateManager().getCallEventManager();
345 auto getArgLoc = [&](CallEventRef<> Caller) -> std::optional<SVal> {
346 const LocationContext *FutureSFC =
347 Caller->getCalleeStackFrame(BlockCount: NumVisitedCaller);
348 // Return early if we are unable to reliably foresee
349 // the future stack frame.
350 if (!FutureSFC)
351 return std::nullopt;
352
353 // This should be equivalent to Caller->getDecl() for now, but
354 // FutureSFC->getDecl() is likely to support better stuff (like
355 // virtual functions) earlier.
356 const Decl *CalleeD = FutureSFC->getDecl();
357
358 // FIXME: Support for variadic arguments is not implemented here yet.
359 if (CallEvent::isVariadic(D: CalleeD))
360 return std::nullopt;
361
362 // Operator arguments do not correspond to operator parameters
363 // because this-argument is implemented as a normal argument in
364 // operator call expressions but not in operator declarations.
365 const TypedValueRegion *TVR = Caller->getParameterLocation(
366 Index: *Caller->getAdjustedParameterIndex(ASTArgumentIndex: Idx), BlockCount: NumVisitedCaller);
367 if (!TVR)
368 return std::nullopt;
369
370 return loc::MemRegionVal(TVR);
371 };
372
373 if (const auto *CE = dyn_cast<CallExpr>(Val: E)) {
374 CallEventRef<> Caller =
375 CEMgr.getSimpleCall(E: CE, State, LCtx, ElemRef: getCFGElementRef());
376 if (std::optional<SVal> V = getArgLoc(Caller))
377 return *V;
378 else
379 break;
380 } else if (const auto *CCE = dyn_cast<CXXConstructExpr>(Val: E)) {
381 // Don't bother figuring out the target region for the future
382 // constructor because we won't need it.
383 CallEventRef<> Caller = CEMgr.getCXXConstructorCall(
384 E: CCE, /*Target=*/nullptr, State, LCtx, ElemRef: getCFGElementRef());
385 if (std::optional<SVal> V = getArgLoc(Caller))
386 return *V;
387 else
388 break;
389 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(Val: E)) {
390 CallEventRef<> Caller =
391 CEMgr.getObjCMethodCall(E: ME, State, LCtx, ElemRef: getCFGElementRef());
392 if (std::optional<SVal> V = getArgLoc(Caller))
393 return *V;
394 else
395 break;
396 }
397 }
398 } // switch (CC->getKind())
399 }
400
401 // If we couldn't find an existing region to construct into, assume we're
402 // constructing a temporary. Notify the caller of our failure.
403 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
404 return loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(Ex: E, LC: LCtx));
405}
406
407ProgramStateRef ExprEngine::updateObjectsUnderConstruction(
408 SVal V, const Expr *E, ProgramStateRef State, const LocationContext *LCtx,
409 const ConstructionContext *CC, const EvalCallOptions &CallOpts) {
410 if (CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion) {
411 // Sounds like we failed to find the target region and therefore
412 // copy elision failed. There's nothing we can do about it here.
413 return State;
414 }
415
416 // See if we're constructing an existing region by looking at the
417 // current construction context.
418 assert(CC && "Computed target region without construction context?");
419 switch (CC->getKind()) {
420 case ConstructionContext::CXX17ElidedCopyVariableKind:
421 case ConstructionContext::SimpleVariableKind: {
422 const auto *DSCC = cast<VariableConstructionContext>(Val: CC);
423 return addObjectUnderConstruction(State, Item: DSCC->getDeclStmt(), LC: LCtx, V);
424 }
425 case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
426 case ConstructionContext::SimpleConstructorInitializerKind: {
427 const auto *ICC = cast<ConstructorInitializerConstructionContext>(Val: CC);
428 const auto *Init = ICC->getCXXCtorInitializer();
429 // Base and delegating initializers handled above
430 assert(Init->isAnyMemberInitializer() &&
431 "Base and delegating initializers should have been handled by"
432 "computeObjectUnderConstruction()");
433 return addObjectUnderConstruction(State, Item: Init, LC: LCtx, V);
434 }
435 case ConstructionContext::NewAllocatedObjectKind: {
436 return State;
437 }
438 case ConstructionContext::SimpleReturnedValueKind:
439 case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
440 const StackFrameContext *SFC = LCtx->getStackFrame();
441 const LocationContext *CallerLCtx = SFC->getParent();
442 if (!CallerLCtx) {
443 // No extra work is necessary in top frame.
444 return State;
445 }
446
447 auto RTC = (*SFC->getCallSiteBlock())[SFC->getIndex()]
448 .getAs<CFGCXXRecordTypedCall>();
449 assert(RTC && "Could not have had a target region without it");
450 if (isa<BlockInvocationContext>(Val: CallerLCtx)) {
451 // Unwrap block invocation contexts. They're mostly part of
452 // the current stack frame.
453 CallerLCtx = CallerLCtx->getParent();
454 assert(!isa<BlockInvocationContext>(CallerLCtx));
455 }
456
457 return updateObjectsUnderConstruction(V,
458 E: cast<Expr>(Val: SFC->getCallSite()), State, LCtx: CallerLCtx,
459 CC: RTC->getConstructionContext(), CallOpts);
460 }
461 case ConstructionContext::ElidedTemporaryObjectKind: {
462 assert(AMgr.getAnalyzerOptions().ShouldElideConstructors);
463 if (!CallOpts.IsElidableCtorThatHasNotBeenElided) {
464 const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(Val: CC);
465 State = updateObjectsUnderConstruction(
466 V, E: TCC->getConstructorAfterElision(), State, LCtx,
467 CC: TCC->getConstructionContextAfterElision(), CallOpts);
468
469 // Remember that we've elided the constructor.
470 State = addObjectUnderConstruction(
471 State, Item: TCC->getConstructorAfterElision(), LC: LCtx, V);
472
473 // Remember that we've elided the destructor.
474 if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
475 State = elideDestructor(State, BTE, LC: LCtx);
476
477 // Instead of materialization, shamelessly return
478 // the final object destination.
479 if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
480 State = addObjectUnderConstruction(State, Item: MTE, LC: LCtx, V);
481
482 return State;
483 }
484 // If we decided not to elide the constructor, proceed as if
485 // it's a simple temporary.
486 [[fallthrough]];
487 }
488 case ConstructionContext::SimpleTemporaryObjectKind: {
489 const auto *TCC = cast<TemporaryObjectConstructionContext>(Val: CC);
490 if (const auto *BTE = TCC->getCXXBindTemporaryExpr())
491 State = addObjectUnderConstruction(State, Item: BTE, LC: LCtx, V);
492
493 if (const auto *MTE = TCC->getMaterializedTemporaryExpr())
494 State = addObjectUnderConstruction(State, Item: MTE, LC: LCtx, V);
495
496 return State;
497 }
498 case ConstructionContext::LambdaCaptureKind: {
499 const auto *LCC = cast<LambdaCaptureConstructionContext>(Val: CC);
500
501 // If we capture and array, we want to store the super region, not a
502 // sub-region.
503 if (const auto *EL = dyn_cast_or_null<ElementRegion>(Val: V.getAsRegion()))
504 V = loc::MemRegionVal(EL->getSuperRegion());
505
506 return addObjectUnderConstruction(
507 State, Item: {LCC->getLambdaExpr(), LCC->getIndex()}, LC: LCtx, V);
508 }
509 case ConstructionContext::ArgumentKind: {
510 const auto *ACC = cast<ArgumentConstructionContext>(Val: CC);
511 if (const auto *BTE = ACC->getCXXBindTemporaryExpr())
512 State = addObjectUnderConstruction(State, Item: BTE, LC: LCtx, V);
513
514 return addObjectUnderConstruction(
515 State, Item: {ACC->getCallLikeExpr(), ACC->getIndex()}, LC: LCtx, V);
516 }
517 }
518 llvm_unreachable("Unhandled construction context!");
519}
520
521static ProgramStateRef
522bindRequiredArrayElementToEnvironment(ProgramStateRef State,
523 const ArrayInitLoopExpr *AILE,
524 const LocationContext *LCtx, NonLoc Idx) {
525 SValBuilder &SVB = State->getStateManager().getSValBuilder();
526 MemRegionManager &MRMgr = SVB.getRegionManager();
527 ASTContext &Ctx = SVB.getContext();
528
529 // HACK: There is no way we can put the index of the array element into the
530 // CFG unless we unroll the loop, so we manually select and bind the required
531 // parameter to the environment.
532 const Expr *SourceArray = AILE->getCommonExpr()->getSourceExpr();
533 const auto *Ctor =
534 cast<CXXConstructExpr>(Val: extractElementInitializerFromNestedAILE(AILE));
535
536 const auto *SourceArrayRegion =
537 cast<SubRegion>(Val: State->getSVal(Ex: SourceArray, LCtx).getAsRegion());
538 const ElementRegion *ElementRegion =
539 MRMgr.getElementRegion(elementType: Ctor->getType(), Idx, superRegion: SourceArrayRegion, Ctx);
540
541 return State->BindExpr(S: Ctor->getArg(Arg: 0), LCtx,
542 V: loc::MemRegionVal(ElementRegion));
543}
544
545void ExprEngine::handleConstructor(const Expr *E,
546 ExplodedNode *Pred,
547 ExplodedNodeSet &destNodes) {
548 const auto *CE = dyn_cast<CXXConstructExpr>(Val: E);
549 const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(Val: E);
550 assert(CE || CIE);
551
552 const LocationContext *LCtx = Pred->getLocationContext();
553 ProgramStateRef State = Pred->getState();
554
555 SVal Target = UnknownVal();
556
557 if (CE) {
558 if (std::optional<SVal> ElidedTarget =
559 getObjectUnderConstruction(State, Item: CE, LC: LCtx)) {
560 // We've previously modeled an elidable constructor by pretending that
561 // it in fact constructs into the correct target. This constructor can
562 // therefore be skipped.
563 Target = *ElidedTarget;
564 NodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
565 State = finishObjectConstruction(State, Item: CE, LC: LCtx);
566 if (auto L = Target.getAs<Loc>())
567 State = State->BindExpr(S: CE, LCtx, V: State->getSVal(LV: *L, T: CE->getType()));
568 Bldr.generateNode(S: CE, Pred, St: State);
569 return;
570 }
571 }
572
573 EvalCallOptions CallOpts;
574 auto C = getCurrentCFGElement().getAs<CFGConstructor>();
575 assert(C || getCurrentCFGElement().getAs<CFGStmt>());
576 const ConstructionContext *CC = C ? C->getConstructionContext() : nullptr;
577
578 const CXXConstructionKind CK =
579 CE ? CE->getConstructionKind() : CIE->getConstructionKind();
580 switch (CK) {
581 case CXXConstructionKind::Complete: {
582 // Inherited constructors are always base class constructors.
583 assert(CE && !CIE && "A complete constructor is inherited?!");
584
585 // If the ctor is part of an ArrayInitLoopExpr, we want to handle it
586 // differently.
587 auto *AILE = CC ? CC->getArrayInitLoop() : nullptr;
588
589 unsigned Idx = 0;
590 if (CE->getType()->isArrayType() || AILE) {
591
592 auto isZeroSizeArray = [&] {
593 uint64_t Size = 1;
594
595 if (const auto *CAT = dyn_cast<ConstantArrayType>(Val: CE->getType()))
596 Size = getContext().getConstantArrayElementCount(CA: CAT);
597 else if (AILE)
598 Size = getContext().getArrayInitLoopExprElementCount(AILE);
599
600 return Size == 0;
601 };
602
603 // No element construction will happen in a 0 size array.
604 if (isZeroSizeArray()) {
605 NodeBuilder Bldr(Pred, destNodes, *currBldrCtx);
606 static SimpleProgramPointTag T{"ExprEngine",
607 "Skipping 0 size array construction"};
608 Bldr.generateNode(S: CE, Pred, St: State, tag: &T);
609 return;
610 }
611
612 Idx = getIndexOfElementToConstruct(State, E: CE, LCtx).value_or(u: 0u);
613 State = setIndexOfElementToConstruct(State, E: CE, LCtx, Idx: Idx + 1);
614 }
615
616 if (AILE) {
617 // Only set this once even though we loop through it multiple times.
618 if (!getPendingInitLoop(State, E: CE, LCtx))
619 State = setPendingInitLoop(
620 State, E: CE, LCtx,
621 Idx: getContext().getArrayInitLoopExprElementCount(AILE));
622
623 State = bindRequiredArrayElementToEnvironment(
624 State, AILE, LCtx, Idx: svalBuilder.makeArrayIndex(idx: Idx));
625 }
626
627 // The target region is found from construction context.
628 std::tie(args&: State, args&: Target) = handleConstructionContext(
629 E: CE, State, BldrCtx: currBldrCtx, LCtx, CC, CallOpts, Idx);
630 break;
631 }
632 case CXXConstructionKind::VirtualBase: {
633 // Make sure we are not calling virtual base class initializers twice.
634 // Only the most-derived object should initialize virtual base classes.
635 const auto *OuterCtor = dyn_cast_or_null<CXXConstructExpr>(
636 Val: LCtx->getStackFrame()->getCallSite());
637 assert(
638 (!OuterCtor ||
639 OuterCtor->getConstructionKind() == CXXConstructionKind::Complete ||
640 OuterCtor->getConstructionKind() == CXXConstructionKind::Delegating) &&
641 ("This virtual base should have already been initialized by "
642 "the most derived class!"));
643 (void)OuterCtor;
644 [[fallthrough]];
645 }
646 case CXXConstructionKind::NonVirtualBase:
647 // In C++17, classes with non-virtual bases may be aggregates, so they would
648 // be initialized as aggregates without a constructor call, so we may have
649 // a base class constructed directly into an initializer list without
650 // having the derived-class constructor call on the previous stack frame.
651 // Initializer lists may be nested into more initializer lists that
652 // correspond to surrounding aggregate initializations.
653 // FIXME: For now this code essentially bails out. We need to find the
654 // correct target region and set it.
655 // FIXME: Instead of relying on the ParentMap, we should have the
656 // trigger-statement (InitListExpr or CXXParenListInitExpr in this case)
657 // passed down from CFG or otherwise always available during construction.
658 if (isa_and_nonnull<InitListExpr, CXXParenListInitExpr>(
659 Val: LCtx->getParentMap().getParent(S: E))) {
660 MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
661 Target = loc::MemRegionVal(MRMgr.getCXXTempObjectRegion(Ex: E, LC: LCtx));
662 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
663 break;
664 }
665 [[fallthrough]];
666 case CXXConstructionKind::Delegating: {
667 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(Val: LCtx->getDecl());
668 Loc ThisPtr = getSValBuilder().getCXXThis(D: CurCtor,
669 SFC: LCtx->getStackFrame());
670 SVal ThisVal = State->getSVal(LV: ThisPtr);
671
672 if (CK == CXXConstructionKind::Delegating) {
673 Target = ThisVal;
674 } else {
675 // Cast to the base type.
676 bool IsVirtual = (CK == CXXConstructionKind::VirtualBase);
677 SVal BaseVal =
678 getStoreManager().evalDerivedToBase(Derived: ThisVal, DerivedPtrType: E->getType(), IsVirtual);
679 Target = BaseVal;
680 }
681 break;
682 }
683 }
684
685 if (State != Pred->getState()) {
686 static SimpleProgramPointTag T("ExprEngine",
687 "Prepare for object construction");
688 ExplodedNodeSet DstPrepare;
689 NodeBuilder BldrPrepare(Pred, DstPrepare, *currBldrCtx);
690 Pred =
691 BldrPrepare.generateNode(S: E, Pred, St: State, tag: &T, K: ProgramPoint::PreStmtKind);
692 if (!Pred)
693 return;
694 }
695
696 const MemRegion *TargetRegion = Target.getAsRegion();
697 CallEventManager &CEMgr = getStateManager().getCallEventManager();
698 CallEventRef<> Call =
699 CIE ? (CallEventRef<>)CEMgr.getCXXInheritedConstructorCall(
700 E: CIE, Target: TargetRegion, State, LCtx, ElemRef: getCFGElementRef())
701 : (CallEventRef<>)CEMgr.getCXXConstructorCall(
702 E: CE, Target: TargetRegion, State, LCtx, ElemRef: getCFGElementRef());
703
704 ExplodedNodeSet DstPreVisit;
705 getCheckerManager().runCheckersForPreStmt(Dst&: DstPreVisit, Src: Pred, S: E, Eng&: *this);
706
707 ExplodedNodeSet PreInitialized;
708 if (CE) {
709 // FIXME: Is it possible and/or useful to do this before PreStmt?
710 NodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
711 for (ExplodedNode *N : DstPreVisit) {
712 ProgramStateRef State = N->getState();
713 if (CE->requiresZeroInitialization()) {
714 // FIXME: Once we properly handle constructors in new-expressions, we'll
715 // need to invalidate the region before setting a default value, to make
716 // sure there aren't any lingering bindings around. This probably needs
717 // to happen regardless of whether or not the object is zero-initialized
718 // to handle random fields of a placement-initialized object picking up
719 // old bindings. We might only want to do it when we need to, though.
720 // FIXME: This isn't actually correct for arrays -- we need to zero-
721 // initialize the entire array, not just the first element -- but our
722 // handling of arrays everywhere else is weak as well, so this shouldn't
723 // actually make things worse. Placement new makes this tricky as well,
724 // since it's then possible to be initializing one part of a multi-
725 // dimensional array.
726 const CXXRecordDecl *TargetHeldRecord =
727 dyn_cast_or_null<CXXRecordDecl>(Val: CE->getType()->getAsRecordDecl());
728
729 if (!TargetHeldRecord || !TargetHeldRecord->isEmpty())
730 State = State->bindDefaultZero(loc: Target, LCtx);
731 }
732
733 Bldr.generateNode(S: CE, Pred: N, St: State, /*tag=*/nullptr,
734 K: ProgramPoint::PreStmtKind);
735 }
736 } else {
737 PreInitialized = DstPreVisit;
738 }
739
740 ExplodedNodeSet DstPreCall;
741 getCheckerManager().runCheckersForPreCall(Dst&: DstPreCall, Src: PreInitialized,
742 Call: *Call, Eng&: *this);
743
744 ExplodedNodeSet DstEvaluated;
745
746 if (CE && CE->getConstructor()->isTrivial() &&
747 CE->getConstructor()->isCopyOrMoveConstructor() &&
748 !CallOpts.IsArrayCtorOrDtor) {
749 NodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
750 // FIXME: Handle other kinds of trivial constructors as well.
751 for (ExplodedNode *N : DstPreCall)
752 performTrivialCopy(Bldr, Pred: N, Call: *Call);
753
754 } else {
755 for (ExplodedNode *N : DstPreCall)
756 getCheckerManager().runCheckersForEvalCall(Dst&: DstEvaluated, Src: N, CE: *Call, Eng&: *this,
757 CallOpts);
758 }
759
760 // If the CFG was constructed without elements for temporary destructors
761 // and the just-called constructor created a temporary object then
762 // stop exploration if the temporary object has a noreturn constructor.
763 // This can lose coverage because the destructor, if it were present
764 // in the CFG, would be called at the end of the full expression or
765 // later (for life-time extended temporaries) -- but avoids infeasible
766 // paths when no-return temporary destructors are used for assertions.
767 ExplodedNodeSet DstEvaluatedPostProcessed;
768 NodeBuilder Bldr(DstEvaluated, DstEvaluatedPostProcessed, *currBldrCtx);
769 const AnalysisDeclContext *ADC = LCtx->getAnalysisDeclContext();
770 if (!ADC->getCFGBuildOptions().AddTemporaryDtors) {
771 if (llvm::isa_and_nonnull<CXXTempObjectRegion,
772 CXXLifetimeExtendedObjectRegion>(Val: TargetRegion) &&
773 cast<CXXConstructorDecl>(Val: Call->getDecl())
774 ->getParent()
775 ->isAnyDestructorNoReturn()) {
776
777 // If we've inlined the constructor, then DstEvaluated would be empty.
778 // In this case we still want a sink, which could be implemented
779 // in processCallExit. But we don't have that implemented at the moment,
780 // so if you hit this assertion, see if you can avoid inlining
781 // the respective constructor when analyzer-config cfg-temporary-dtors
782 // is set to false.
783 // Otherwise there's nothing wrong with inlining such constructor.
784 assert(!DstEvaluated.empty() &&
785 "We should not have inlined this constructor!");
786
787 for (ExplodedNode *N : DstEvaluated) {
788 Bldr.generateSink(S: E, Pred: N, St: N->getState());
789 }
790
791 // There is no need to run the PostCall and PostStmt checker
792 // callbacks because we just generated sinks on all nodes in th
793 // frontier.
794 return;
795 }
796 }
797
798 ExplodedNodeSet DstPostArgumentCleanup;
799 for (ExplodedNode *I : DstEvaluatedPostProcessed)
800 finishArgumentConstruction(Dst&: DstPostArgumentCleanup, Pred: I, Call: *Call);
801
802 // If there were other constructors called for object-type arguments
803 // of this constructor, clean them up.
804 ExplodedNodeSet DstPostCall;
805 getCheckerManager().runCheckersForPostCall(Dst&: DstPostCall,
806 Src: DstPostArgumentCleanup,
807 Call: *Call, Eng&: *this);
808 getCheckerManager().runCheckersForPostStmt(Dst&: destNodes, Src: DstPostCall, S: E, Eng&: *this);
809}
810
811void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
812 ExplodedNode *Pred,
813 ExplodedNodeSet &Dst) {
814 handleConstructor(E: CE, Pred, destNodes&: Dst);
815}
816
817void ExprEngine::VisitCXXInheritedCtorInitExpr(
818 const CXXInheritedCtorInitExpr *CE, ExplodedNode *Pred,
819 ExplodedNodeSet &Dst) {
820 handleConstructor(E: CE, Pred, destNodes&: Dst);
821}
822
823void ExprEngine::VisitCXXDestructor(QualType ObjectType,
824 const MemRegion *Dest,
825 const Stmt *S,
826 bool IsBaseDtor,
827 ExplodedNode *Pred,
828 ExplodedNodeSet &Dst,
829 EvalCallOptions &CallOpts) {
830 assert(S && "A destructor without a trigger!");
831 const LocationContext *LCtx = Pred->getLocationContext();
832 ProgramStateRef State = Pred->getState();
833
834 const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
835 assert(RecordDecl && "Only CXXRecordDecls should have destructors");
836 const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
837 // FIXME: There should always be a Decl, otherwise the destructor call
838 // shouldn't have been added to the CFG in the first place.
839 if (!DtorDecl) {
840 // Skip the invalid destructor. We cannot simply return because
841 // it would interrupt the analysis instead.
842 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
843 // FIXME: PostImplicitCall with a null decl may crash elsewhere anyway.
844 PostImplicitCall PP(/*Decl=*/nullptr, S->getEndLoc(), LCtx,
845 getCFGElementRef(), &T);
846 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
847 Bldr.generateNode(PP, State: Pred->getState(), Pred);
848 return;
849 }
850
851 if (!Dest) {
852 // We're trying to destroy something that is not a region. This may happen
853 // for a variety of reasons (unknown target region, concrete integer instead
854 // of target region, etc.). The current code makes an attempt to recover.
855 // FIXME: We probably don't really need to recover when we're dealing
856 // with concrete integers specifically.
857 CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion = true;
858 if (const Expr *E = dyn_cast_or_null<Expr>(Val: S)) {
859 Dest = MRMgr.getCXXTempObjectRegion(Ex: E, LC: Pred->getLocationContext());
860 } else {
861 static SimpleProgramPointTag T("ExprEngine", "SkipInvalidDestructor");
862 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
863 Bldr.generateSink(PP: Pred->getLocation().withTag(tag: &T),
864 State: Pred->getState(), Pred);
865 return;
866 }
867 }
868
869 CallEventManager &CEMgr = getStateManager().getCallEventManager();
870 CallEventRef<CXXDestructorCall> Call = CEMgr.getCXXDestructorCall(
871 DD: DtorDecl, Trigger: S, Target: Dest, IsBase: IsBaseDtor, State, LCtx, ElemRef: getCFGElementRef());
872
873 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
874 Call->getSourceRange().getBegin(),
875 "Error evaluating destructor");
876
877 ExplodedNodeSet DstPreCall;
878 getCheckerManager().runCheckersForPreCall(Dst&: DstPreCall, Src: Pred,
879 Call: *Call, Eng&: *this);
880
881 ExplodedNodeSet DstInvalidated;
882 NodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
883 for (ExplodedNode *N : DstPreCall)
884 defaultEvalCall(B&: Bldr, Pred: N, Call: *Call, CallOpts);
885
886 getCheckerManager().runCheckersForPostCall(Dst, Src: DstInvalidated,
887 Call: *Call, Eng&: *this);
888}
889
890void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
891 ExplodedNode *Pred,
892 ExplodedNodeSet &Dst) {
893 ProgramStateRef State = Pred->getState();
894 const LocationContext *LCtx = Pred->getLocationContext();
895 PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
896 CNE->getBeginLoc(),
897 "Error evaluating New Allocator Call");
898 CallEventManager &CEMgr = getStateManager().getCallEventManager();
899 CallEventRef<CXXAllocatorCall> Call =
900 CEMgr.getCXXAllocatorCall(E: CNE, State, LCtx, ElemRef: getCFGElementRef());
901
902 ExplodedNodeSet DstPreCall;
903 getCheckerManager().runCheckersForPreCall(Dst&: DstPreCall, Src: Pred,
904 Call: *Call, Eng&: *this);
905
906 ExplodedNodeSet DstPostCall;
907 NodeBuilder CallBldr(DstPreCall, DstPostCall, *currBldrCtx);
908 for (ExplodedNode *I : DstPreCall) {
909 // Operator new calls (CXXNewExpr) are intentionally not eval-called,
910 // because it does not make sense to eval-call user-provided functions.
911 // 1) If the new operator can be inlined, then don't prevent it from
912 // inlining by having an eval-call of that operator.
913 // 2) If it can't be inlined, then the default conservative modeling
914 // is what we want anyway.
915 // So the best is to not allow eval-calling CXXNewExprs from checkers.
916 // Checkers can provide their pre/post-call callbacks if needed.
917 defaultEvalCall(B&: CallBldr, Pred: I, Call: *Call);
918 }
919 // If the call is inlined, DstPostCall will be empty and we bail out now.
920
921 // Store return value of operator new() for future use, until the actual
922 // CXXNewExpr gets processed.
923 ExplodedNodeSet DstPostValue;
924 NodeBuilder ValueBldr(DstPostCall, DstPostValue, *currBldrCtx);
925 for (ExplodedNode *I : DstPostCall) {
926 // FIXME: Because CNE serves as the "call site" for the allocator (due to
927 // lack of a better expression in the AST), the conjured return value symbol
928 // is going to be of the same type (C++ object pointer type). Technically
929 // this is not correct because the operator new's prototype always says that
930 // it returns a 'void *'. So we should change the type of the symbol,
931 // and then evaluate the cast over the symbolic pointer from 'void *' to
932 // the object pointer type. But without changing the symbol's type it
933 // is breaking too much to evaluate the no-op symbolic cast over it, so we
934 // skip it for now.
935 ProgramStateRef State = I->getState();
936 SVal RetVal = State->getSVal(Ex: CNE, LCtx);
937 // [basic.stc.dynamic.allocation] (on the return value of an allocation
938 // function):
939 // "The order, contiguity, and initial value of storage allocated by
940 // successive calls to an allocation function are unspecified."
941 State = State->bindDefaultInitial(loc: RetVal, V: UndefinedVal{}, LCtx);
942
943 // If this allocation function is not declared as non-throwing, failures
944 // /must/ be signalled by exceptions, and thus the return value will never
945 // be NULL. -fno-exceptions does not influence this semantics.
946 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
947 // where new can return NULL. If we end up supporting that option, we can
948 // consider adding a check for it here.
949 // C++11 [basic.stc.dynamic.allocation]p3.
950 if (const FunctionDecl *FD = CNE->getOperatorNew()) {
951 QualType Ty = FD->getType();
952 if (const auto *ProtoType = Ty->getAs<FunctionProtoType>())
953 if (!ProtoType->isNothrow())
954 State = State->assume(Cond: RetVal.castAs<DefinedOrUnknownSVal>(), Assumption: true);
955 }
956
957 ValueBldr.generateNode(
958 S: CNE, Pred: I, St: addObjectUnderConstruction(State, Item: CNE, LC: LCtx, V: RetVal));
959 }
960
961 ExplodedNodeSet DstPostPostCallCallback;
962 getCheckerManager().runCheckersForPostCall(Dst&: DstPostPostCallCallback,
963 Src: DstPostValue, Call: *Call, Eng&: *this);
964 for (ExplodedNode *I : DstPostPostCallCallback) {
965 getCheckerManager().runCheckersForNewAllocator(Call: *Call, Dst, Pred: I, Eng&: *this);
966 }
967}
968
969void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
970 ExplodedNodeSet &Dst) {
971 // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
972 // Also, we need to decide how allocators actually work -- they're not
973 // really part of the CXXNewExpr because they happen BEFORE the
974 // CXXConstructExpr subexpression. See PR12014 for some discussion.
975
976 unsigned blockCount = getNumVisitedCurrent();
977 const LocationContext *LCtx = Pred->getLocationContext();
978 SVal symVal = UnknownVal();
979 FunctionDecl *FD = CNE->getOperatorNew();
980
981 bool IsStandardGlobalOpNewFunction =
982 FD->isReplaceableGlobalAllocationFunction();
983
984 ProgramStateRef State = Pred->getState();
985
986 // Retrieve the stored operator new() return value.
987 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
988 symVal = *getObjectUnderConstruction(State, Item: CNE, LC: LCtx);
989 State = finishObjectConstruction(State, Item: CNE, LC: LCtx);
990 }
991
992 // We assume all standard global 'operator new' functions allocate memory in
993 // heap. We realize this is an approximation that might not correctly model
994 // a custom global allocator.
995 if (symVal.isUnknown()) {
996 if (IsStandardGlobalOpNewFunction)
997 symVal = svalBuilder.getConjuredHeapSymbolVal(elem: getCFGElementRef(), LCtx,
998 type: CNE->getType(), Count: blockCount);
999 else
1000 symVal = svalBuilder.conjureSymbolVal(
1001 /*symbolTag=*/nullptr, elem: getCFGElementRef(), LCtx, count: blockCount);
1002 }
1003
1004 CallEventManager &CEMgr = getStateManager().getCallEventManager();
1005 CallEventRef<CXXAllocatorCall> Call =
1006 CEMgr.getCXXAllocatorCall(E: CNE, State, LCtx, ElemRef: getCFGElementRef());
1007
1008 if (!AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
1009 // Invalidate placement args.
1010 // FIXME: Once we figure out how we want allocators to work,
1011 // we should be using the usual pre-/(default-)eval-/post-call checkers
1012 // here.
1013 State = Call->invalidateRegions(BlockCount: blockCount, State);
1014 if (!State)
1015 return;
1016
1017 // If this allocation function is not declared as non-throwing, failures
1018 // /must/ be signalled by exceptions, and thus the return value will never
1019 // be NULL. -fno-exceptions does not influence this semantics.
1020 // FIXME: GCC has a -fcheck-new option, which forces it to consider the case
1021 // where new can return NULL. If we end up supporting that option, we can
1022 // consider adding a check for it here.
1023 // C++11 [basic.stc.dynamic.allocation]p3.
1024 if (const auto *ProtoType = FD->getType()->getAs<FunctionProtoType>())
1025 if (!ProtoType->isNothrow())
1026 if (auto dSymVal = symVal.getAs<DefinedOrUnknownSVal>())
1027 State = State->assume(Cond: *dSymVal, Assumption: true);
1028 }
1029
1030 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1031
1032 SVal Result = symVal;
1033
1034 if (CNE->isArray()) {
1035
1036 if (const auto *NewReg = cast_or_null<SubRegion>(Val: symVal.getAsRegion())) {
1037 // If each element is initialized by their default constructor, the field
1038 // values are properly placed inside the required region, however if an
1039 // initializer list is used, this doesn't happen automatically.
1040 auto *Init = CNE->getInitializer();
1041 bool isInitList =
1042 isa_and_nonnull<InitListExpr, CXXParenListInitExpr>(Val: Init);
1043
1044 QualType ObjTy =
1045 isInitList ? Init->getType() : CNE->getType()->getPointeeType();
1046 const ElementRegion *EleReg =
1047 MRMgr.getElementRegion(elementType: ObjTy, Idx: svalBuilder.makeArrayIndex(idx: 0), superRegion: NewReg,
1048 Ctx: svalBuilder.getContext());
1049 Result = loc::MemRegionVal(EleReg);
1050
1051 // If the array is list initialized, we bind the initializer list to the
1052 // memory region here, otherwise we would lose it.
1053 if (isInitList) {
1054 Bldr.takeNodes(N: Pred);
1055 Pred = Bldr.generateNode(S: CNE, Pred, St: State);
1056
1057 SVal V = State->getSVal(Ex: Init, LCtx);
1058 ExplodedNodeSet evaluated;
1059 evalBind(Dst&: evaluated, StoreE: CNE, Pred, location: Result, Val: V, AtDeclInit: true);
1060
1061 Bldr.takeNodes(N: Pred);
1062 Bldr.addNodes(S: evaluated);
1063
1064 Pred = *evaluated.begin();
1065 State = Pred->getState();
1066 }
1067 }
1068
1069 State = State->BindExpr(S: CNE, LCtx: Pred->getLocationContext(), V: Result);
1070 Bldr.generateNode(S: CNE, Pred, St: State);
1071 return;
1072 }
1073
1074 // FIXME: Once we have proper support for CXXConstructExprs inside
1075 // CXXNewExpr, we need to make sure that the constructed object is not
1076 // immediately invalidated here. (The placement call should happen before
1077 // the constructor call anyway.)
1078 if (FD->isReservedGlobalPlacementOperator()) {
1079 // Non-array placement new should always return the placement location.
1080 SVal PlacementLoc = State->getSVal(Ex: CNE->getPlacementArg(I: 0), LCtx);
1081 Result = svalBuilder.evalCast(V: PlacementLoc, CastTy: CNE->getType(),
1082 OriginalTy: CNE->getPlacementArg(I: 0)->getType());
1083 }
1084
1085 // Bind the address of the object, then check to see if we cached out.
1086 State = State->BindExpr(S: CNE, LCtx, V: Result);
1087 ExplodedNode *NewN = Bldr.generateNode(S: CNE, Pred, St: State);
1088 if (!NewN)
1089 return;
1090
1091 // If the type is not a record, we won't have a CXXConstructExpr as an
1092 // initializer. Copy the value over.
1093 if (const Expr *Init = CNE->getInitializer()) {
1094 if (!isa<CXXConstructExpr>(Val: Init)) {
1095 assert(Bldr.getResults().size() == 1);
1096 Bldr.takeNodes(N: NewN);
1097 evalBind(Dst, StoreE: CNE, Pred: NewN, location: Result, Val: State->getSVal(Ex: Init, LCtx),
1098 /*FirstInit=*/AtDeclInit: IsStandardGlobalOpNewFunction);
1099 }
1100 }
1101}
1102
1103void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
1104 ExplodedNode *Pred, ExplodedNodeSet &Dst) {
1105
1106 CallEventManager &CEMgr = getStateManager().getCallEventManager();
1107 CallEventRef<CXXDeallocatorCall> Call = CEMgr.getCXXDeallocatorCall(
1108 E: CDE, State: Pred->getState(), LCtx: Pred->getLocationContext(), ElemRef: getCFGElementRef());
1109
1110 ExplodedNodeSet DstPreCall;
1111 getCheckerManager().runCheckersForPreCall(Dst&: DstPreCall, Src: Pred, Call: *Call, Eng&: *this);
1112 ExplodedNodeSet DstPostCall;
1113
1114 if (AMgr.getAnalyzerOptions().MayInlineCXXAllocator) {
1115 NodeBuilder Bldr(DstPreCall, DstPostCall, *currBldrCtx);
1116 for (ExplodedNode *I : DstPreCall) {
1117 // Intentionally either inline or conservative eval-call the operator
1118 // delete, but avoid triggering an eval-call event for checkers.
1119 // As detailed at handling CXXNewExprs, in short, because it does not
1120 // really make sense to eval-call user-provided functions.
1121 defaultEvalCall(B&: Bldr, Pred: I, Call: *Call);
1122 }
1123 } else {
1124 DstPostCall = std::move(DstPreCall);
1125 }
1126 getCheckerManager().runCheckersForPostCall(Dst, Src: DstPostCall, Call: *Call, Eng&: *this);
1127}
1128
1129void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
1130 ExplodedNodeSet &Dst) {
1131 const VarDecl *VD = CS->getExceptionDecl();
1132 if (!VD) {
1133 Dst.Add(N: Pred);
1134 return;
1135 }
1136
1137 const LocationContext *LCtx = Pred->getLocationContext();
1138 SVal V = svalBuilder.conjureSymbolVal(elem: getCFGElementRef(), LCtx, type: VD->getType(),
1139 visitCount: getNumVisitedCurrent());
1140 ProgramStateRef state = Pred->getState();
1141 state = state->bindLoc(location: state->getLValue(VD, LC: LCtx), V, LCtx);
1142
1143 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1144 Bldr.generateNode(S: CS, Pred, St: state);
1145}
1146
1147void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
1148 ExplodedNodeSet &Dst) {
1149 NodeBuilder Bldr(Pred, Dst, *currBldrCtx);
1150
1151 // Get the this object region from StoreManager.
1152 const LocationContext *LCtx = Pred->getLocationContext();
1153 const MemRegion *R =
1154 svalBuilder.getRegionManager().getCXXThisRegion(
1155 thisPointerTy: getContext().getCanonicalType(T: TE->getType()),
1156 LC: LCtx);
1157
1158 ProgramStateRef state = Pred->getState();
1159 SVal V = state->getSVal(LV: loc::MemRegionVal(R));
1160 Bldr.generateNode(S: TE, Pred, St: state->BindExpr(S: TE, LCtx, V));
1161}
1162
1163void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
1164 ExplodedNodeSet &Dst) {
1165 const LocationContext *LocCtxt = Pred->getLocationContext();
1166
1167 // Get the region of the lambda itself.
1168 const MemRegion *R = svalBuilder.getRegionManager().getCXXTempObjectRegion(
1169 Ex: LE, LC: LocCtxt);
1170 SVal V = loc::MemRegionVal(R);
1171
1172 ProgramStateRef State = Pred->getState();
1173
1174 // If we created a new MemRegion for the lambda, we should explicitly bind
1175 // the captures.
1176 for (auto const [Idx, FieldForCapture, InitExpr] :
1177 llvm::zip(t: llvm::seq<unsigned>(Begin: 0, End: -1), u: LE->getLambdaClass()->fields(),
1178 args: LE->capture_inits())) {
1179 SVal FieldLoc = State->getLValue(decl: FieldForCapture, Base: V);
1180
1181 SVal InitVal;
1182 if (!FieldForCapture->hasCapturedVLAType()) {
1183 assert(InitExpr && "Capture missing initialization expression");
1184
1185 // Capturing a 0 length array is a no-op, so we ignore it to get a more
1186 // accurate analysis. If it's not ignored, it would set the default
1187 // binding of the lambda to 'Unknown', which can lead to falsely detecting
1188 // 'Uninitialized' values as 'Unknown' and not reporting a warning.
1189 const auto FTy = FieldForCapture->getType();
1190 if (FTy->isConstantArrayType() &&
1191 getContext().getConstantArrayElementCount(
1192 CA: getContext().getAsConstantArrayType(T: FTy)) == 0)
1193 continue;
1194
1195 // With C++17 copy elision the InitExpr can be anything, so instead of
1196 // pattern matching all cases, we simple check if the current field is
1197 // under construction or not, regardless what it's InitExpr is.
1198 if (const auto OUC =
1199 getObjectUnderConstruction(State, Item: {LE, Idx}, LC: LocCtxt)) {
1200 InitVal = State->getSVal(R: OUC->getAsRegion());
1201
1202 State = finishObjectConstruction(State, Item: {LE, Idx}, LC: LocCtxt);
1203 } else
1204 InitVal = State->getSVal(Ex: InitExpr, LCtx: LocCtxt);
1205
1206 } else {
1207
1208 assert(!getObjectUnderConstruction(State, {LE, Idx}, LocCtxt) &&
1209 "VLA capture by value is a compile time error!");
1210
1211 // The field stores the length of a captured variable-length array.
1212 // These captures don't have initialization expressions; instead we
1213 // get the length from the VLAType size expression.
1214 Expr *SizeExpr = FieldForCapture->getCapturedVLAType()->getSizeExpr();
1215 InitVal = State->getSVal(Ex: SizeExpr, LCtx: LocCtxt);
1216 }
1217
1218 State = State->bindLoc(LV: FieldLoc, V: InitVal, LCtx: LocCtxt);
1219 }
1220
1221 // Decay the Loc into an RValue, because there might be a
1222 // MaterializeTemporaryExpr node above this one which expects the bound value
1223 // to be an RValue.
1224 SVal LambdaRVal = State->getSVal(R);
1225
1226 ExplodedNodeSet Tmp;
1227 NodeBuilder Bldr(Pred, Tmp, *currBldrCtx);
1228 // FIXME: is this the right program point kind?
1229 Bldr.generateNode(S: LE, Pred,
1230 St: State->BindExpr(S: LE, LCtx: LocCtxt, V: LambdaRVal),
1231 tag: nullptr, K: ProgramPoint::PostLValueKind);
1232
1233 // FIXME: Move all post/pre visits to ::Visit().
1234 getCheckerManager().runCheckersForPostStmt(Dst, Src: Tmp, S: LE, Eng&: *this);
1235}
1236
1237void ExprEngine::VisitAttributedStmt(const AttributedStmt *A,
1238 ExplodedNode *Pred, ExplodedNodeSet &Dst) {
1239 ExplodedNodeSet CheckerPreStmt;
1240 getCheckerManager().runCheckersForPreStmt(Dst&: CheckerPreStmt, Src: Pred, S: A, Eng&: *this);
1241
1242 ExplodedNodeSet EvalSet;
1243 NodeBuilder Bldr(CheckerPreStmt, EvalSet, *currBldrCtx);
1244
1245 for (const auto *Attr : getSpecificAttrs<CXXAssumeAttr>(container: A->getAttrs())) {
1246 for (ExplodedNode *N : CheckerPreStmt) {
1247 Visit(S: Attr->getAssumption()->IgnoreParens(), Pred: N, Dst&: EvalSet);
1248 }
1249 }
1250
1251 getCheckerManager().runCheckersForPostStmt(Dst, Src: EvalSet, S: A, Eng&: *this);
1252}
1253