2009-04-22 05:51:34 +08:00
|
|
|
//== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==//
|
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
// This file defined the types Store and StoreManager.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2011-02-10 09:03:03 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
|
2012-10-03 09:08:32 +08:00
|
|
|
#include "clang/AST/CXXInheritance.h"
|
2012-12-04 17:13:33 +08:00
|
|
|
#include "clang/AST/CharUnits.h"
|
2012-01-28 20:06:22 +08:00
|
|
|
#include "clang/AST/DeclObjC.h"
|
2012-12-04 17:13:33 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
|
2009-04-22 05:51:34 +08:00
|
|
|
|
|
|
|
using namespace clang;
|
2010-12-23 15:20:52 +08:00
|
|
|
using namespace ento;
|
2009-04-22 05:51:34 +08:00
|
|
|
|
2011-08-16 06:09:50 +08:00
|
|
|
StoreManager::StoreManager(ProgramStateManager &stateMgr)
|
2010-12-02 15:49:45 +08:00
|
|
|
: svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
|
|
|
|
MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
|
2009-04-22 05:51:34 +08:00
|
|
|
|
2012-07-11 06:07:57 +08:00
|
|
|
StoreRef StoreManager::enterStackFrame(Store OldStore,
|
|
|
|
const CallEvent &Call,
|
|
|
|
const StackFrameContext *LCtx) {
|
|
|
|
StoreRef Store = StoreRef(OldStore, *this);
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
|
|
|
|
Call.getInitialStackFrameContents(LCtx, InitialBindings);
|
2012-07-11 06:07:57 +08:00
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
for (CallEvent::BindingsTy::iterator I = InitialBindings.begin(),
|
|
|
|
E = InitialBindings.end();
|
|
|
|
I != E; ++I) {
|
|
|
|
Store = Bind(Store.getStore(), I->first, I->second);
|
2012-07-11 06:07:57 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
return Store;
|
2010-08-04 04:44:35 +08:00
|
|
|
}
|
|
|
|
|
2009-10-14 14:55:01 +08:00
|
|
|
const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base,
|
2009-11-16 12:49:44 +08:00
|
|
|
QualType EleTy, uint64_t index) {
|
2010-12-02 15:49:45 +08:00
|
|
|
NonLoc idx = svalBuilder.makeArrayIndex(index);
|
|
|
|
return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
|
2009-07-07 06:23:45 +08:00
|
|
|
}
|
|
|
|
|
2011-02-19 09:59:33 +08:00
|
|
|
StoreRef StoreManager::BindDefault(Store store, const MemRegion *R, SVal V) {
|
|
|
|
return StoreRef(store, *this);
|
|
|
|
}
|
|
|
|
|
2015-09-08 11:50:52 +08:00
|
|
|
const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R,
|
2010-04-19 19:47:28 +08:00
|
|
|
QualType T) {
|
2010-12-02 15:49:45 +08:00
|
|
|
NonLoc idx = svalBuilder.makeZeroArrayIndex();
|
2010-04-19 19:47:28 +08:00
|
|
|
assert(!T.isNull());
|
|
|
|
return MRMgr.getElementRegion(T, idx, R, Ctx);
|
|
|
|
}
|
|
|
|
|
2011-02-12 03:48:15 +08:00
|
|
|
const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy) {
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-08-13 07:37:29 +08:00
|
|
|
ASTContext &Ctx = StateMgr.getContext();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-07-07 06:39:40 +08:00
|
|
|
// Handle casts to Objective-C objects.
|
2009-08-01 14:17:29 +08:00
|
|
|
if (CastToTy->isObjCObjectPointerType())
|
2009-11-10 10:17:20 +08:00
|
|
|
return R->StripCasts();
|
2009-08-01 14:17:29 +08:00
|
|
|
|
2009-07-18 14:27:51 +08:00
|
|
|
if (CastToTy->isBlockPointerType()) {
|
2009-08-28 12:49:15 +08:00
|
|
|
// FIXME: We may need different solutions, depending on the symbol
|
2009-07-18 14:27:51 +08:00
|
|
|
// involved. Blocks can be casted to/from 'id', as they can be treated
|
2009-08-28 12:49:15 +08:00
|
|
|
// as Objective-C objects. This could possibly be handled by enhancing
|
2009-09-09 23:08:12 +08:00
|
|
|
// our reasoning of downcasts of symbolic objects.
|
2009-08-28 12:49:15 +08:00
|
|
|
if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
|
2009-10-14 14:55:01 +08:00
|
|
|
return R;
|
2009-07-18 14:27:51 +08:00
|
|
|
|
|
|
|
// We don't know what to make of it. Return a NULL region, which
|
|
|
|
// will be interpretted as UnknownVal.
|
2014-05-27 10:45:47 +08:00
|
|
|
return nullptr;
|
2009-07-18 14:27:51 +08:00
|
|
|
}
|
2009-07-07 06:23:45 +08:00
|
|
|
|
2009-07-07 04:21:51 +08:00
|
|
|
// Now assume we are casting from pointer to pointer. Other cases should
|
|
|
|
// already be handled.
|
2011-02-19 16:03:18 +08:00
|
|
|
QualType PointeeTy = CastToTy->getPointeeType();
|
2009-08-02 12:12:53 +08:00
|
|
|
QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
|
|
|
|
|
|
|
|
// Handle casts to void*. We just pass the region through.
|
First part of changes to eliminate problems with cv-qualifiers and
sugared types. The basic problem is that our qualifier accessors
(getQualifiers, getCVRQualifiers, isConstQualified, etc.) only look at
the current QualType and not at any qualifiers that come from sugared
types, meaning that we won't see these qualifiers through, e.g.,
typedefs:
typedef const int CInt;
typedef CInt Self;
Self.isConstQualified() currently returns false!
Various bugs (e.g., PR5383) have cropped up all over the front end due
to such problems. I'm addressing this problem by splitting each
qualifier accessor into two versions:
- the "local" version only returns qualifiers on this particular
QualType instance
- the "normal" version that will eventually combine qualifiers from this
QualType instance with the qualifiers on the canonical type to
produce the full set of qualifiers.
This commit adds the local versions and switches a few callers from
the "normal" version (e.g., isConstQualified) over to the "local"
version (e.g., isLocalConstQualified) when that is the right thing to
do, e.g., because we're printing or serializing the qualifiers. Also,
switch a bunch of
Context.getCanonicalType(T1).getUnqualifiedType() == Context.getCanonicalType(T2).getQualifiedType()
expressions over to
Context.hasSameUnqualifiedType(T1, T2)
llvm-svn: 88969
2009-11-17 05:35:15 +08:00
|
|
|
if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
|
2009-10-14 14:55:01 +08:00
|
|
|
return R;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-02 12:12:53 +08:00
|
|
|
// Handle casts from compatible types.
|
2009-08-01 14:17:29 +08:00
|
|
|
if (R->isBoundable())
|
2011-08-13 04:02:48 +08:00
|
|
|
if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
|
2009-08-02 12:12:53 +08:00
|
|
|
if (CanonPointeeTy == ObjTy)
|
2009-10-14 14:55:01 +08:00
|
|
|
return R;
|
2009-08-01 14:17:29 +08:00
|
|
|
}
|
|
|
|
|
2009-07-07 04:21:51 +08:00
|
|
|
// Process region cast according to the kind of the region being cast.
|
2009-07-07 06:56:37 +08:00
|
|
|
switch (R->getKind()) {
|
2010-01-05 10:18:06 +08:00
|
|
|
case MemRegion::CXXThisRegionKind:
|
2009-12-08 06:05:27 +08:00
|
|
|
case MemRegion::GenericMemSpaceRegionKind:
|
|
|
|
case MemRegion::StackLocalsSpaceRegionKind:
|
|
|
|
case MemRegion::StackArgumentsSpaceRegionKind:
|
|
|
|
case MemRegion::HeapSpaceRegionKind:
|
2009-12-11 14:43:27 +08:00
|
|
|
case MemRegion::UnknownSpaceRegionKind:
|
2012-01-05 07:54:01 +08:00
|
|
|
case MemRegion::StaticGlobalSpaceRegionKind:
|
|
|
|
case MemRegion::GlobalInternalSpaceRegionKind:
|
|
|
|
case MemRegion::GlobalSystemSpaceRegionKind:
|
|
|
|
case MemRegion::GlobalImmutableSpaceRegionKind: {
|
2011-09-23 13:06:16 +08:00
|
|
|
llvm_unreachable("Invalid region cast");
|
2009-09-09 23:08:12 +08:00
|
|
|
}
|
2010-09-02 07:00:46 +08:00
|
|
|
|
2009-11-25 09:32:22 +08:00
|
|
|
case MemRegion::FunctionTextRegionKind:
|
2009-11-26 07:58:21 +08:00
|
|
|
case MemRegion::BlockTextRegionKind:
|
2010-09-02 07:00:46 +08:00
|
|
|
case MemRegion::BlockDataRegionKind:
|
2009-07-07 06:56:37 +08:00
|
|
|
case MemRegion::StringRegionKind:
|
|
|
|
// FIXME: Need to handle arbitrary downcasts.
|
2009-08-01 14:17:29 +08:00
|
|
|
case MemRegion::SymbolicRegionKind:
|
|
|
|
case MemRegion::AllocaRegionKind:
|
2009-07-07 06:56:37 +08:00
|
|
|
case MemRegion::CompoundLiteralRegionKind:
|
|
|
|
case MemRegion::FieldRegionKind:
|
|
|
|
case MemRegion::ObjCIvarRegionKind:
|
2012-02-28 08:56:05 +08:00
|
|
|
case MemRegion::ObjCStringRegionKind:
|
2009-09-09 23:08:12 +08:00
|
|
|
case MemRegion::VarRegionKind:
|
2010-11-26 16:52:48 +08:00
|
|
|
case MemRegion::CXXTempObjectRegionKind:
|
|
|
|
case MemRegion::CXXBaseObjectRegionKind:
|
2009-10-14 14:55:01 +08:00
|
|
|
return MakeElementRegion(R, PointeeTy);
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
case MemRegion::ElementRegionKind: {
|
|
|
|
// If we are casting from an ElementRegion to another type, the
|
|
|
|
// algorithm is as follows:
|
|
|
|
//
|
|
|
|
// (1) Compute the "raw offset" of the ElementRegion from the
|
|
|
|
// base region. This is done by calling 'getAsRawOffset()'.
|
|
|
|
//
|
2009-09-09 23:08:12 +08:00
|
|
|
// (2a) If we get a 'RegionRawOffset' after calling
|
2009-08-01 14:17:29 +08:00
|
|
|
// 'getAsRawOffset()', determine if the absolute offset
|
2009-09-09 23:08:12 +08:00
|
|
|
// can be exactly divided into chunks of the size of the
|
|
|
|
// casted-pointee type. If so, create a new ElementRegion with
|
2009-08-01 14:17:29 +08:00
|
|
|
// the pointee-cast type as the new ElementType and the index
|
|
|
|
// being the offset divded by the chunk size. If not, create
|
|
|
|
// a new ElementRegion at offset 0 off the raw offset region.
|
|
|
|
//
|
|
|
|
// (2b) If we don't a get a 'RegionRawOffset' after calling
|
|
|
|
// 'getAsRawOffset()', it means that we are at offset 0.
|
2009-09-09 23:08:12 +08:00
|
|
|
//
|
2009-08-01 14:17:29 +08:00
|
|
|
// FIXME: Handle symbolic raw offsets.
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
const ElementRegion *elementR = cast<ElementRegion>(R);
|
2010-08-02 12:56:14 +08:00
|
|
|
const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
|
2009-08-01 14:17:29 +08:00
|
|
|
const MemRegion *baseR = rawOff.getRegion();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// If we cannot compute a raw offset, throw up our hands and return
|
|
|
|
// a NULL MemRegion*.
|
|
|
|
if (!baseR)
|
2014-05-27 10:45:47 +08:00
|
|
|
return nullptr;
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-01-24 09:55:39 +08:00
|
|
|
CharUnits off = rawOff.getOffset();
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2010-01-12 01:06:35 +08:00
|
|
|
if (off.isZero()) {
|
2009-08-01 14:17:29 +08:00
|
|
|
// Edge case: we are at 0 bytes off the beginning of baseR. We
|
|
|
|
// check to see if type we are casting to is the same as the base
|
2009-09-09 23:08:12 +08:00
|
|
|
// region. If so, just return the base region.
|
2011-08-13 04:02:48 +08:00
|
|
|
if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(baseR)) {
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
|
2009-08-01 14:17:29 +08:00
|
|
|
QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
|
|
|
|
if (CanonPointeeTy == ObjTy)
|
2009-10-14 14:55:01 +08:00
|
|
|
return baseR;
|
2009-08-01 14:17:29 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// Otherwise, create a new ElementRegion at offset 0.
|
2009-10-14 14:55:01 +08:00
|
|
|
return MakeElementRegion(baseR, PointeeTy);
|
2009-07-07 07:47:19 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// We have a non-zero offset from the base region. We want to determine
|
|
|
|
// if the offset can be evenly divided by sizeof(PointeeTy). If so,
|
|
|
|
// we create an ElementRegion whose index is that value. Otherwise, we
|
|
|
|
// create two ElementRegions, one that reflects a raw offset and the other
|
|
|
|
// that reflects the cast.
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// Compute the index for the new ElementRegion.
|
|
|
|
int64_t newIndex = 0;
|
2014-05-27 10:45:47 +08:00
|
|
|
const MemRegion *newSuperR = nullptr;
|
2009-07-07 07:47:19 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
// We can only compute sizeof(PointeeTy) if it is a complete type.
|
2014-10-04 05:49:03 +08:00
|
|
|
if (!PointeeTy->isIncompleteType()) {
|
2009-08-01 14:17:29 +08:00
|
|
|
// Compute the size in **bytes**.
|
2010-01-12 01:06:35 +08:00
|
|
|
CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
|
2010-04-07 08:46:49 +08:00
|
|
|
if (!pointeeTySize.isZero()) {
|
|
|
|
// Is the offset a multiple of the size? If so, we can layer the
|
|
|
|
// ElementRegion (with elementType == PointeeTy) directly on top of
|
|
|
|
// the base region.
|
|
|
|
if (off % pointeeTySize == 0) {
|
|
|
|
newIndex = off / pointeeTySize;
|
|
|
|
newSuperR = baseR;
|
|
|
|
}
|
2009-08-01 14:17:29 +08:00
|
|
|
}
|
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-08-01 14:17:29 +08:00
|
|
|
if (!newSuperR) {
|
|
|
|
// Create an intermediate ElementRegion to represent the raw byte.
|
|
|
|
// This will be the super region of the final ElementRegion.
|
2010-01-12 01:06:35 +08:00
|
|
|
newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off.getQuantity());
|
2009-08-01 14:17:29 +08:00
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2009-10-14 14:55:01 +08:00
|
|
|
return MakeElementRegion(newSuperR, PointeeTy, newIndex);
|
2009-07-07 04:21:51 +08:00
|
|
|
}
|
|
|
|
}
|
2009-09-09 23:08:12 +08:00
|
|
|
|
2011-09-23 13:06:16 +08:00
|
|
|
llvm_unreachable("unreachable");
|
2009-07-07 04:21:51 +08:00
|
|
|
}
|
2009-08-26 04:51:30 +08:00
|
|
|
|
2013-02-15 09:23:24 +08:00
|
|
|
static bool regionMatchesCXXRecordType(SVal V, QualType Ty) {
|
|
|
|
const MemRegion *MR = V.getAsRegion();
|
|
|
|
if (!MR)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR);
|
|
|
|
if (!TVR)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
|
|
|
|
if (!RD)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
const CXXRecordDecl *Expected = Ty->getPointeeCXXRecordDecl();
|
|
|
|
if (!Expected)
|
|
|
|
Expected = Ty->getAsCXXRecordDecl();
|
|
|
|
|
|
|
|
return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
|
|
|
|
}
|
|
|
|
|
2012-08-10 05:24:02 +08:00
|
|
|
SVal StoreManager::evalDerivedToBase(SVal Derived, const CastExpr *Cast) {
|
2013-02-15 09:23:24 +08:00
|
|
|
// Sanity check to avoid doing the wrong thing in the face of
|
|
|
|
// reinterpret_cast.
|
|
|
|
if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
|
|
|
|
return UnknownVal();
|
|
|
|
|
2012-08-10 05:24:02 +08:00
|
|
|
// Walk through the cast path to create nested CXXBaseRegions.
|
|
|
|
SVal Result = Derived;
|
|
|
|
for (CastExpr::path_const_iterator I = Cast->path_begin(),
|
|
|
|
E = Cast->path_end();
|
|
|
|
I != E; ++I) {
|
2013-02-21 11:12:32 +08:00
|
|
|
Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
|
2012-08-10 05:24:02 +08:00
|
|
|
}
|
|
|
|
return Result;
|
|
|
|
}
|
|
|
|
|
2012-10-03 09:08:32 +08:00
|
|
|
SVal StoreManager::evalDerivedToBase(SVal Derived, const CXXBasePath &Path) {
|
|
|
|
// Walk through the path to create nested CXXBaseRegions.
|
|
|
|
SVal Result = Derived;
|
|
|
|
for (CXXBasePath::const_iterator I = Path.begin(), E = Path.end();
|
|
|
|
I != E; ++I) {
|
2013-02-21 11:12:32 +08:00
|
|
|
Result = evalDerivedToBase(Result, I->Base->getType(),
|
|
|
|
I->Base->isVirtual());
|
2012-10-03 09:08:32 +08:00
|
|
|
}
|
|
|
|
return Result;
|
|
|
|
}
|
|
|
|
|
2013-02-21 11:12:32 +08:00
|
|
|
SVal StoreManager::evalDerivedToBase(SVal Derived, QualType BaseType,
|
|
|
|
bool IsVirtual) {
|
2013-02-21 06:23:23 +08:00
|
|
|
Optional<loc::MemRegionVal> DerivedRegVal =
|
2013-02-20 13:52:05 +08:00
|
|
|
Derived.getAs<loc::MemRegionVal>();
|
2012-10-03 09:08:32 +08:00
|
|
|
if (!DerivedRegVal)
|
|
|
|
return Derived;
|
|
|
|
|
|
|
|
const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
|
|
|
|
if (!BaseDecl)
|
|
|
|
BaseDecl = BaseType->getAsCXXRecordDecl();
|
|
|
|
assert(BaseDecl && "not a C++ object?");
|
|
|
|
|
|
|
|
const MemRegion *BaseReg =
|
2013-02-21 11:12:32 +08:00
|
|
|
MRMgr.getCXXBaseObjectRegion(BaseDecl, DerivedRegVal->getRegion(),
|
|
|
|
IsVirtual);
|
2012-10-03 09:08:32 +08:00
|
|
|
|
|
|
|
return loc::MemRegionVal(BaseReg);
|
|
|
|
}
|
|
|
|
|
2013-04-23 05:36:49 +08:00
|
|
|
/// Returns the static type of the given region, if it represents a C++ class
|
|
|
|
/// object.
|
|
|
|
///
|
|
|
|
/// This handles both fully-typed regions, where the dynamic type is known, and
|
|
|
|
/// symbolic regions, where the dynamic type is merely bounded (and even then,
|
|
|
|
/// only ostensibly!), but does not take advantage of any dynamic type info.
|
|
|
|
static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
|
|
|
|
if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR))
|
|
|
|
return TVR->getValueType()->getAsCXXRecordDecl();
|
|
|
|
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
|
|
|
|
return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
|
2014-05-27 10:45:47 +08:00
|
|
|
return nullptr;
|
2013-04-23 05:36:49 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
SVal StoreManager::evalDynamicCast(SVal Base, QualType TargetType,
|
2012-10-03 09:08:32 +08:00
|
|
|
bool &Failed) {
|
|
|
|
Failed = false;
|
|
|
|
|
2013-04-23 05:36:49 +08:00
|
|
|
const MemRegion *MR = Base.getAsRegion();
|
|
|
|
if (!MR)
|
2012-10-03 09:08:32 +08:00
|
|
|
return UnknownVal();
|
|
|
|
|
|
|
|
// Assume the derived class is a pointer or a reference to a CXX record.
|
2013-04-23 05:36:49 +08:00
|
|
|
TargetType = TargetType->getPointeeType();
|
|
|
|
assert(!TargetType.isNull());
|
|
|
|
const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
|
|
|
|
if (!TargetClass && !TargetType->isVoidType())
|
2012-10-03 09:08:32 +08:00
|
|
|
return UnknownVal();
|
|
|
|
|
|
|
|
// Drill down the CXXBaseObject chains, which represent upcasts (casts from
|
|
|
|
// derived to base).
|
2013-04-23 05:36:49 +08:00
|
|
|
while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
|
2012-10-03 09:08:32 +08:00
|
|
|
// If found the derived class, the cast succeeds.
|
2013-04-23 05:36:49 +08:00
|
|
|
if (MRClass == TargetClass)
|
|
|
|
return loc::MemRegionVal(MR);
|
2012-10-03 09:08:32 +08:00
|
|
|
|
2013-06-20 15:45:01 +08:00
|
|
|
// We skip over incomplete types. They must be the result of an earlier
|
|
|
|
// reinterpret_cast, as one can only dynamic_cast between types in the same
|
|
|
|
// class hierarchy.
|
|
|
|
if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
|
2012-10-03 09:08:32 +08:00
|
|
|
// Static upcasts are marked as DerivedToBase casts by Sema, so this will
|
|
|
|
// only happen when multiple or virtual inheritance is involved.
|
|
|
|
CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
|
|
|
|
/*DetectVirtual=*/false);
|
2013-04-23 05:36:49 +08:00
|
|
|
if (MRClass->isDerivedFrom(TargetClass, Paths))
|
|
|
|
return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
|
2012-10-03 09:08:32 +08:00
|
|
|
}
|
|
|
|
|
2013-04-23 05:36:49 +08:00
|
|
|
if (const CXXBaseObjectRegion *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
|
2012-10-03 09:08:32 +08:00
|
|
|
// Drill down the chain to get the derived classes.
|
2013-04-23 05:36:49 +08:00
|
|
|
MR = BaseR->getSuperRegion();
|
|
|
|
continue;
|
2012-10-03 09:08:32 +08:00
|
|
|
}
|
2013-04-23 05:36:49 +08:00
|
|
|
|
|
|
|
// If this is a cast to void*, return the region.
|
|
|
|
if (TargetType->isVoidType())
|
|
|
|
return loc::MemRegionVal(MR);
|
|
|
|
|
|
|
|
// Strange use of reinterpret_cast can give us paths we don't reason
|
|
|
|
// about well, by putting in ElementRegions where we'd expect
|
|
|
|
// CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
|
|
|
|
// derived class has a zero offset from the base class), then it's safe
|
|
|
|
// to strip the cast; if it's invalid, -Wreinterpret-base-class should
|
|
|
|
// catch it. In the interest of performance, the analyzer will silently
|
|
|
|
// do the wrong thing in the invalid case (because offsets for subregions
|
|
|
|
// will be wrong).
|
|
|
|
const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
|
|
|
|
if (Uncasted == MR) {
|
|
|
|
// We reached the bottom of the hierarchy and did not find the derived
|
|
|
|
// class. We we must be casting the base to derived, so the cast should
|
|
|
|
// fail.
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
MR = Uncasted;
|
2012-10-03 09:08:32 +08:00
|
|
|
}
|
2013-04-23 05:36:49 +08:00
|
|
|
|
|
|
|
// We failed if the region we ended up with has perfect type info.
|
|
|
|
Failed = isa<TypedValueRegion>(MR);
|
2012-10-03 09:08:32 +08:00
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
|
2009-08-26 04:51:30 +08:00
|
|
|
|
|
|
|
/// CastRetrievedVal - Used by subclasses of StoreManager to implement
|
|
|
|
/// implicit casts that arise from loads from regions that are reinterpreted
|
|
|
|
/// as another region.
|
2011-08-13 04:02:48 +08:00
|
|
|
SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
|
2010-01-11 10:33:26 +08:00
|
|
|
QualType castTy, bool performTestOnly) {
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2011-12-07 07:12:27 +08:00
|
|
|
if (castTy.isNull() || V.isUnknownOrUndef())
|
2009-11-16 12:49:44 +08:00
|
|
|
return V;
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2010-12-02 15:49:45 +08:00
|
|
|
ASTContext &Ctx = svalBuilder.getContext();
|
2009-12-09 16:32:57 +08:00
|
|
|
|
2015-09-08 11:50:52 +08:00
|
|
|
if (performTestOnly) {
|
2010-01-11 10:33:26 +08:00
|
|
|
// Automatically translate references to pointers.
|
2010-08-11 14:10:55 +08:00
|
|
|
QualType T = R->getValueType();
|
2010-01-11 10:33:26 +08:00
|
|
|
if (const ReferenceType *RT = T->getAs<ReferenceType>())
|
|
|
|
T = Ctx.getPointerType(RT->getPointeeType());
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2010-12-02 15:49:45 +08:00
|
|
|
assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T));
|
2010-01-11 10:33:26 +08:00
|
|
|
return V;
|
|
|
|
}
|
2015-09-08 11:50:52 +08:00
|
|
|
|
2011-12-07 07:12:27 +08:00
|
|
|
return svalBuilder.dispatchCast(V, castTy);
|
2009-08-26 04:51:30 +08:00
|
|
|
}
|
|
|
|
|
2011-08-13 07:37:29 +08:00
|
|
|
SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
|
2010-02-08 15:58:06 +08:00
|
|
|
if (Base.isUnknownOrUndef())
|
|
|
|
return Base;
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
Loc BaseL = Base.castAs<Loc>();
|
2014-05-27 10:45:47 +08:00
|
|
|
const MemRegion* BaseR = nullptr;
|
2010-02-08 15:58:06 +08:00
|
|
|
|
|
|
|
switch (BaseL.getSubKind()) {
|
|
|
|
case loc::MemRegionKind:
|
2013-02-20 13:52:05 +08:00
|
|
|
BaseR = BaseL.castAs<loc::MemRegionVal>().getRegion();
|
2010-02-08 15:58:06 +08:00
|
|
|
break;
|
|
|
|
|
|
|
|
case loc::GotoLabelKind:
|
|
|
|
// These are anormal cases. Flag an undefined value.
|
|
|
|
return UndefinedVal();
|
|
|
|
|
|
|
|
case loc::ConcreteIntKind:
|
|
|
|
// While these seem funny, this can happen through casts.
|
|
|
|
// FIXME: What we should return is the field offset. For example,
|
|
|
|
// add the field offset to the integer value. That way funny things
|
|
|
|
// like this work properly: &(((struct foo *) 0xa)->f)
|
|
|
|
return Base;
|
|
|
|
|
|
|
|
default:
|
2011-09-23 13:06:16 +08:00
|
|
|
llvm_unreachable("Unhandled Base.");
|
2010-02-08 15:58:06 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
// NOTE: We must have this check first because ObjCIvarDecl is a subclass
|
|
|
|
// of FieldDecl.
|
|
|
|
if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D))
|
|
|
|
return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR));
|
|
|
|
|
|
|
|
return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
|
|
|
|
}
|
2010-02-08 16:17:02 +08:00
|
|
|
|
2012-01-28 20:06:22 +08:00
|
|
|
SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
|
|
|
|
return getLValueFieldOrIvar(decl, base);
|
|
|
|
}
|
|
|
|
|
2015-09-08 11:50:52 +08:00
|
|
|
SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
|
2010-02-08 16:17:02 +08:00
|
|
|
SVal Base) {
|
|
|
|
|
|
|
|
// If the base is an unknown or undefined value, just return it back.
|
|
|
|
// FIXME: For absolute pointer addresses, we just return that value back as
|
|
|
|
// well, although in reality we should return the offset added to that
|
|
|
|
// value.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
|
2010-02-08 16:17:02 +08:00
|
|
|
return Base;
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
const MemRegion* BaseRegion = Base.castAs<loc::MemRegionVal>().getRegion();
|
2010-02-08 16:17:02 +08:00
|
|
|
|
|
|
|
// Pointer of any type can be cast and used as array base.
|
|
|
|
const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
|
|
|
|
|
|
|
|
// Convert the offset to the appropriate size and signedness.
|
2013-02-20 13:52:05 +08:00
|
|
|
Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
|
2010-02-08 16:17:02 +08:00
|
|
|
|
|
|
|
if (!ElemR) {
|
|
|
|
//
|
|
|
|
// If the base region is not an ElementRegion, create one.
|
|
|
|
// This can happen in the following example:
|
|
|
|
//
|
|
|
|
// char *p = __builtin_alloc(10);
|
|
|
|
// p[1] = 8;
|
|
|
|
//
|
|
|
|
// Observe that 'p' binds to an AllocaRegion.
|
|
|
|
//
|
|
|
|
return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
|
|
|
|
BaseRegion, Ctx));
|
|
|
|
}
|
|
|
|
|
|
|
|
SVal BaseIdx = ElemR->getIndex();
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
if (!BaseIdx.getAs<nonloc::ConcreteInt>())
|
2010-02-08 16:17:02 +08:00
|
|
|
return UnknownVal();
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
const llvm::APSInt &BaseIdxI =
|
|
|
|
BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
|
2010-08-16 09:15:17 +08:00
|
|
|
|
|
|
|
// Only allow non-integer offsets if the base region has no offset itself.
|
|
|
|
// FIXME: This is a somewhat arbitrary restriction. We should be using
|
2010-12-02 05:28:31 +08:00
|
|
|
// SValBuilder here to add the two offsets without checking their types.
|
2013-02-20 13:52:05 +08:00
|
|
|
if (!Offset.getAs<nonloc::ConcreteInt>()) {
|
2010-08-16 09:15:17 +08:00
|
|
|
if (isa<ElementRegion>(BaseRegion->StripCasts()))
|
|
|
|
return UnknownVal();
|
|
|
|
|
|
|
|
return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
|
|
|
|
ElemR->getSuperRegion(),
|
|
|
|
Ctx));
|
|
|
|
}
|
|
|
|
|
2013-02-20 13:52:05 +08:00
|
|
|
const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
|
2010-02-08 16:17:02 +08:00
|
|
|
assert(BaseIdxI.isSigned());
|
|
|
|
|
|
|
|
// Compute the new index.
|
2010-12-02 15:49:45 +08:00
|
|
|
nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
|
2010-09-15 11:13:30 +08:00
|
|
|
OffI));
|
2010-02-08 16:17:02 +08:00
|
|
|
|
|
|
|
// Construct the new ElementRegion.
|
|
|
|
const MemRegion *ArrayR = ElemR->getSuperRegion();
|
|
|
|
return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
|
|
|
|
Ctx));
|
|
|
|
}
|
2011-07-29 07:08:16 +08:00
|
|
|
|
2015-10-20 21:23:58 +08:00
|
|
|
StoreManager::BindingsHandler::~BindingsHandler() {}
|
2011-07-29 07:08:16 +08:00
|
|
|
|
2012-03-22 03:45:01 +08:00
|
|
|
bool StoreManager::FindUniqueBinding::HandleBinding(StoreManager& SMgr,
|
|
|
|
Store store,
|
|
|
|
const MemRegion* R,
|
|
|
|
SVal val) {
|
|
|
|
SymbolRef SymV = val.getAsLocSymbol();
|
|
|
|
if (!SymV || SymV != Sym)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
if (Binding) {
|
|
|
|
First = false;
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
else
|
|
|
|
Binding = R;
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|