head 1.1; branch 1.1.1; access; symbols netbsd-11-0-RC4:1.1.1.8 netbsd-11-0-RC3:1.1.1.8 netbsd-11-0-RC2:1.1.1.8 netbsd-11-0-RC1:1.1.1.8 perseant-exfatfs-base-20250801:1.1.1.8 netbsd-11:1.1.1.8.0.10 netbsd-11-base:1.1.1.8 netbsd-10-1-RELEASE:1.1.1.8 perseant-exfatfs-base-20240630:1.1.1.8 perseant-exfatfs:1.1.1.8.0.8 perseant-exfatfs-base:1.1.1.8 netbsd-8-3-RELEASE:1.1.1.5 netbsd-9-4-RELEASE:1.1.1.7 netbsd-10-0-RELEASE:1.1.1.8 netbsd-10-0-RC6:1.1.1.8 netbsd-10-0-RC5:1.1.1.8 netbsd-10-0-RC4:1.1.1.8 netbsd-10-0-RC3:1.1.1.8 netbsd-10-0-RC2:1.1.1.8 netbsd-10-0-RC1:1.1.1.8 netbsd-10:1.1.1.8.0.6 netbsd-10-base:1.1.1.8 netbsd-9-3-RELEASE:1.1.1.7 cjep_sun2x:1.1.1.8.0.4 cjep_sun2x-base:1.1.1.8 cjep_staticlib_x-base1:1.1.1.8 netbsd-9-2-RELEASE:1.1.1.7 cjep_staticlib_x:1.1.1.8.0.2 cjep_staticlib_x-base:1.1.1.8 netbsd-9-1-RELEASE:1.1.1.7 phil-wifi-20200421:1.1.1.8 phil-wifi-20200411:1.1.1.8 phil-wifi-20200406:1.1.1.8 netbsd-8-2-RELEASE:1.1.1.5 netbsd-9-0-RELEASE:1.1.1.7 netbsd-9-0-RC2:1.1.1.7 netbsd-9-0-RC1:1.1.1.7 netbsd-9:1.1.1.7.0.2 netbsd-9-base:1.1.1.7 phil-wifi-20190609:1.1.1.7 netbsd-8-1-RELEASE:1.1.1.5 netbsd-8-1-RC1:1.1.1.5 pgoyette-compat-merge-20190127:1.1.1.6.2.1 pgoyette-compat-20190127:1.1.1.7 pgoyette-compat-20190118:1.1.1.7 pgoyette-compat-1226:1.1.1.7 pgoyette-compat-1126:1.1.1.7 pgoyette-compat-1020:1.1.1.7 pgoyette-compat-0930:1.1.1.7 pgoyette-compat-0906:1.1.1.7 netbsd-7-2-RELEASE:1.1.1.2 pgoyette-compat-0728:1.1.1.7 clang-337282:1.1.1.7 netbsd-8-0-RELEASE:1.1.1.5 phil-wifi:1.1.1.6.0.4 phil-wifi-base:1.1.1.6 pgoyette-compat-0625:1.1.1.6 netbsd-8-0-RC2:1.1.1.5 pgoyette-compat-0521:1.1.1.6 pgoyette-compat-0502:1.1.1.6 pgoyette-compat-0422:1.1.1.6 netbsd-8-0-RC1:1.1.1.5 pgoyette-compat-0415:1.1.1.6 pgoyette-compat-0407:1.1.1.6 pgoyette-compat-0330:1.1.1.6 pgoyette-compat-0322:1.1.1.6 pgoyette-compat-0315:1.1.1.6 netbsd-7-1-2-RELEASE:1.1.1.2 pgoyette-compat:1.1.1.6.0.2 pgoyette-compat-base:1.1.1.6 netbsd-7-1-1-RELEASE:1.1.1.2 clang-319952:1.1.1.6 matt-nb8-mediatek:1.1.1.5.0.8 matt-nb8-mediatek-base:1.1.1.5 clang-309604:1.1.1.6 perseant-stdc-iso10646:1.1.1.5.0.6 perseant-stdc-iso10646-base:1.1.1.5 netbsd-8:1.1.1.5.0.4 netbsd-8-base:1.1.1.5 prg-localcount2-base3:1.1.1.5 prg-localcount2-base2:1.1.1.5 prg-localcount2-base1:1.1.1.5 prg-localcount2:1.1.1.5.0.2 prg-localcount2-base:1.1.1.5 pgoyette-localcount-20170426:1.1.1.5 bouyer-socketcan-base1:1.1.1.5 pgoyette-localcount-20170320:1.1.1.5 netbsd-7-1:1.1.1.2.0.14 netbsd-7-1-RELEASE:1.1.1.2 netbsd-7-1-RC2:1.1.1.2 clang-294123:1.1.1.5 netbsd-7-nhusb-base-20170116:1.1.1.2 bouyer-socketcan:1.1.1.4.0.2 bouyer-socketcan-base:1.1.1.4 clang-291444:1.1.1.4 pgoyette-localcount-20170107:1.1.1.3 netbsd-7-1-RC1:1.1.1.2 pgoyette-localcount-20161104:1.1.1.3 netbsd-7-0-2-RELEASE:1.1.1.2 localcount-20160914:1.1.1.3 netbsd-7-nhusb:1.1.1.2.0.12 netbsd-7-nhusb-base:1.1.1.2 clang-280599:1.1.1.3 pgoyette-localcount-20160806:1.1.1.3 pgoyette-localcount-20160726:1.1.1.3 pgoyette-localcount:1.1.1.3.0.2 pgoyette-localcount-base:1.1.1.3 netbsd-7-0-1-RELEASE:1.1.1.2 clang-261930:1.1.1.3 netbsd-7-0:1.1.1.2.0.10 netbsd-7-0-RELEASE:1.1.1.2 netbsd-7-0-RC3:1.1.1.2 netbsd-7-0-RC2:1.1.1.2 netbsd-7-0-RC1:1.1.1.2 clang-237755:1.1.1.2 clang-232565:1.1.1.2 clang-227398:1.1.1.2 tls-maxphys-base:1.1.1.2 tls-maxphys:1.1.1.2.0.8 netbsd-7:1.1.1.2.0.6 netbsd-7-base:1.1.1.2 clang-215315:1.1.1.2 clang-209886:1.1.1.2 yamt-pagecache:1.1.1.2.0.4 yamt-pagecache-base9:1.1.1.2 tls-earlyentropy:1.1.1.2.0.2 tls-earlyentropy-base:1.1.1.2 riastradh-xf86-video-intel-2-7-1-pre-2-21-15:1.1.1.2 riastradh-drm2-base3:1.1.1.2 clang-202566:1.1.1.2 clang-201163:1.1.1.2 clang-199312:1.1.1.2 clang-198450:1.1.1.2 clang-196603:1.1.1.1 clang-195771:1.1.1.1 LLVM:1.1.1; locks; strict; comment @// @; 1.1 date 2013.11.28.14.14.53; author joerg; state Exp; branches 1.1.1.1; next ; commitid ow8OybrawrB1f3fx; 1.1.1.1 date 2013.11.28.14.14.53; author joerg; state Exp; branches; next 1.1.1.2; commitid ow8OybrawrB1f3fx; 1.1.1.2 date 2014.01.05.15.39.38; author joerg; state Exp; branches 1.1.1.2.4.1 1.1.1.2.8.1; next 1.1.1.3; commitid wh3aCSIWykURqWjx; 1.1.1.3 date 2016.02.27.22.12.05; author joerg; state Exp; branches 1.1.1.3.2.1; next 1.1.1.4; commitid tIimz3oDlh1NpBWy; 1.1.1.4 date 2017.01.11.10.35.37; author joerg; state Exp; branches 1.1.1.4.2.1; next 1.1.1.5; commitid CNnUNfII1jgNmxBz; 1.1.1.5 date 2017.02.09.17.38.31; author joerg; state Exp; branches; next 1.1.1.6; commitid UxB8JMFWM7xyMiFz; 1.1.1.6 date 2017.08.01.19.35.14; author joerg; state Exp; branches 1.1.1.6.2.1 1.1.1.6.4.1; next 1.1.1.7; commitid pMuDy65V0VicSx1A; 1.1.1.7 date 2018.07.17.18.31.06; author joerg; state Exp; branches; next 1.1.1.8; commitid wDzL46ALjrCZgwKA; 1.1.1.8 date 2019.11.13.22.19.29; author joerg; state dead; branches; next ; commitid QD8YATxuNG34YJKB; 1.1.1.2.4.1 date 2014.01.05.15.39.38; author yamt; state dead; branches; next 1.1.1.2.4.2; commitid WSrDtL5nYAUyiyBx; 1.1.1.2.4.2 date 2014.05.22.16.18.31; author yamt; state Exp; branches; next ; commitid WSrDtL5nYAUyiyBx; 1.1.1.2.8.1 date 2014.01.05.15.39.38; author tls; state dead; branches; next 1.1.1.2.8.2; commitid jTnpym9Qu0o4R1Nx; 1.1.1.2.8.2 date 2014.08.19.23.47.32; author tls; state Exp; branches; next ; commitid jTnpym9Qu0o4R1Nx; 1.1.1.3.2.1 date 2017.03.20.06.52.42; author pgoyette; state Exp; branches; next ; commitid jjw7cAwgyKq7RfKz; 1.1.1.4.2.1 date 2017.04.21.16.51.40; author bouyer; state Exp; branches; next ; commitid dUG7nkTKALCadqOz; 1.1.1.6.2.1 date 2018.07.28.04.33.24; author pgoyette; state Exp; branches; next ; commitid 1UP1xAIUxv1ZgRLA; 1.1.1.6.4.1 date 2019.06.10.21.45.29; author christos; state Exp; branches; next 1.1.1.6.4.2; commitid jtc8rnCzWiEEHGqB; 1.1.1.6.4.2 date 2020.04.13.07.46.39; author martin; state dead; branches; next ; commitid X01YhRUPVUDaec4C; desc @@ 1.1 log @Initial revision @ text @// SValBuilder.cpp - Basic class for all SValBuilder implementations -*- C++ -*- // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines SValBuilder, the base class for all (complete) SValBuilder // implementations. // //===----------------------------------------------------------------------===// #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/ExprCXX.h" #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h" #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" using namespace clang; using namespace ento; //===----------------------------------------------------------------------===// // Basic SVal creation. //===----------------------------------------------------------------------===// void SValBuilder::anchor() { } DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType type) { if (Loc::isLocType(type)) return makeNull(); if (type->isIntegralOrEnumerationType()) return makeIntVal(0, type); // FIXME: Handle floats. // FIXME: Handle structs. return UnknownVal(); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt& rhs, QualType type) { // The Environment ensures we always get a persistent APSInt in // BasicValueFactory, so we don't need to get the APSInt from // BasicValueFactory again. assert(lhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(lhs && rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy) { assert(operand); assert(!Loc::isLocType(toTy)); return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy)); } SVal SValBuilder::convertToArrayIndex(SVal val) { if (val.isUnknownOrUndef()) return val; // Common case: we have an appropriately sized integer. if (Optional CI = val.getAs()) { const llvm::APSInt& I = CI->getValue(); if (I.getBitWidth() == ArrayIndexWidth && I.isSigned()) return val; } return evalCastFromNonLoc(val.castAs(), ArrayIndexTy); } nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){ return makeTruthVal(boolean->getValue()); } DefinedOrUnknownSVal SValBuilder::getRegionValueSymbolVal(const TypedValueRegion* region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getRegionValueSymbol(region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *SymbolTag, const Expr *Ex, const LocationContext *LCtx, unsigned Count) { QualType T = Ex->getType(); // Compute the type of the result. If the expression is not an R-value, the // result should be a location. QualType ExType = Ex->getType(); if (Ex->isGLValue()) T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType); return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, QualType type, unsigned count) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt, const LocationContext *LCtx, QualType type, unsigned visitCount) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned VisitCount) { QualType T = E->getType(); assert(Loc::isLocType(T)); assert(SymbolManager::canSymbolicate(T)); SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount); return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym)); } DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); SymbolRef sym = SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl *func) { return loc::MemRegionVal(MemMgr.getFunctionTextRegion(func)); } DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount) { const BlockTextRegion *BC = MemMgr.getBlockTextRegion(block, locTy, locContext->getAnalysisDeclContext()); const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext, blockCount); return loc::MemRegionVal(BD); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC) { return loc::MemRegionVal(getRegionManager(). getCXXThisRegion(D->getThisType(getContext()), SFC)); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D, const StackFrameContext *SFC) { const Type *T = D->getTypeForDecl(); QualType PT = getContext().getPointerType(QualType(T, 0)); return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC)); } Optional SValBuilder::getConstantVal(const Expr *E) { E = E->IgnoreParens(); switch (E->getStmtClass()) { // Handle expressions that we treat differently from the AST's constant // evaluator. case Stmt::AddrLabelExprClass: return makeLoc(cast(E)); case Stmt::CXXScalarValueInitExprClass: case Stmt::ImplicitValueInitExprClass: return makeZeroVal(E->getType()); case Stmt::ObjCStringLiteralClass: { const ObjCStringLiteral *SL = cast(E); return makeLoc(getRegionManager().getObjCStringRegion(SL)); } case Stmt::StringLiteralClass: { const StringLiteral *SL = cast(E); return makeLoc(getRegionManager().getStringRegion(SL)); } // Fast-path some expressions to avoid the overhead of going through the AST's // constant evaluator case Stmt::CharacterLiteralClass: { const CharacterLiteral *C = cast(E); return makeIntVal(C->getValue(), C->getType()); } case Stmt::CXXBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::IntegerLiteralClass: return makeIntVal(cast(E)); case Stmt::ObjCBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::CXXNullPtrLiteralExprClass: return makeNull(); case Stmt::ImplicitCastExprClass: { const CastExpr *CE = cast(E); if (CE->getCastKind() == CK_ArrayToPointerDecay) { Optional ArrayVal = getConstantVal(CE->getSubExpr()); if (!ArrayVal) return None; return evalCast(*ArrayVal, CE->getType(), CE->getSubExpr()->getType()); } // FALLTHROUGH } // If we don't have a special case, fall back to the AST's constant evaluator. default: { // Don't try to come up with a value for materialized temporaries. if (E->isGLValue()) return None; ASTContext &Ctx = getContext(); llvm::APSInt Result; if (E->EvaluateAsInt(Result, Ctx)) return makeIntVal(Result); if (Loc::isLocType(E->getType())) if (E->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNotNull)) return makeNull(); return None; } } } //===----------------------------------------------------------------------===// SVal SValBuilder::makeSymExprValNN(ProgramStateRef State, BinaryOperator::Opcode Op, NonLoc LHS, NonLoc RHS, QualType ResultTy) { if (!State->isTainted(RHS) && !State->isTainted(LHS)) return UnknownVal(); const SymExpr *symLHS = LHS.getAsSymExpr(); const SymExpr *symRHS = RHS.getAsSymExpr(); // TODO: When the Max Complexity is reached, we should conjure a symbol // instead of generating an Unknown value and propagate the taint info to it. const unsigned MaxComp = 10000; // 100000 28X if (symLHS && symRHS && (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp) return makeNonLoc(symLHS, Op, symRHS, ResultTy); if (symLHS && symLHS->computeComplexity() < MaxComp) if (Optional rInt = RHS.getAs()) return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy); if (symRHS && symRHS->computeComplexity() < MaxComp) if (Optional lInt = LHS.getAs()) return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy); return UnknownVal(); } SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type) { if (lhs.isUndef() || rhs.isUndef()) return UndefinedVal(); if (lhs.isUnknown() || rhs.isUnknown()) return UnknownVal(); if (Optional LV = lhs.getAs()) { if (Optional RV = rhs.getAs()) return evalBinOpLL(state, op, *LV, *RV, type); return evalBinOpLN(state, op, *LV, rhs.castAs(), type); } if (Optional RV = rhs.getAs()) { // Support pointer arithmetic where the addend is on the left // and the pointer on the right. assert(op == BO_Add); // Commute the operands. return evalBinOpLN(state, op, *RV, lhs.castAs(), type); } return evalBinOpNN(state, op, lhs.castAs(), rhs.castAs(), type); } DefinedOrUnknownSVal SValBuilder::evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, Context.IntTy) .castAs(); } /// Recursively check if the pointer types are equal modulo const, volatile, /// and restrict qualifiers. Also, assume that all types are similar to 'void'. /// Assumes the input types are canonical. static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy) { while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) { Qualifiers Quals1, Quals2; ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1); FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2); // Make sure that non cvr-qualifiers the other qualifiers (e.g., address // spaces) are identical. Quals1.removeCVRQualifiers(); Quals2.removeCVRQualifiers(); if (Quals1 != Quals2) return false; } // If we are casting to void, the 'From' value can be used to represent the // 'To' value. if (ToTy->isVoidType()) return true; if (ToTy != FromTy) return false; return true; } // FIXME: should rewrite according to the cast kind. SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) { castTy = Context.getCanonicalType(castTy); originalTy = Context.getCanonicalType(originalTy); if (val.isUnknownOrUndef() || castTy == originalTy) return val; if (castTy->isBooleanType()) { if (val.isUnknownOrUndef()) return val; if (val.isConstant()) return makeTruthVal(!val.isZeroConstant(), castTy); if (!Loc::isLocType(originalTy) && !originalTy->isIntegralOrEnumerationType() && !originalTy->isMemberPointerType()) return UnknownVal(); if (SymbolRef Sym = val.getAsSymbol(true)) { BasicValueFactory &BVF = getBasicValueFactory(); // FIXME: If we had a state here, we could see if the symbol is known to // be zero, but we don't. return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy); } // Loc values are not always true, they could be weakly linked functions. if (Optional L = val.getAs()) return evalCastFromLoc(*L, castTy); Loc L = val.castAs().getLoc(); return evalCastFromLoc(L, castTy); } // For const casts, casts to void, just propagate the value. if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType()) if (shouldBeModeledWithNoOp(Context, Context.getPointerType(castTy), Context.getPointerType(originalTy))) return val; // Check for casts from pointers to integers. if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy)) return evalCastFromLoc(val.castAs(), castTy); // Check for casts from integers to pointers. if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) { if (Optional LV = val.getAs()) { if (const MemRegion *R = LV->getLoc().getAsRegion()) { StoreManager &storeMgr = StateMgr.getStoreManager(); R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return LV->getLoc(); } return dispatchCast(val, castTy); } // Just pass through function and block pointers. if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) { assert(Loc::isLocType(castTy)); return val; } // Check for casts from array type to another type. if (const ArrayType *arrayT = dyn_cast(originalTy.getCanonicalType())) { // We will always decay to a pointer. QualType elemTy = arrayT->getElementType(); val = StateMgr.ArrayToPointer(val.castAs(), elemTy); // Are we casting from an array to a pointer? If so just pass on // the decayed value. if (castTy->isPointerType() || castTy->isReferenceType()) return val; // Are we casting from an array to an integer? If so, cast the decayed // pointer value to an integer. assert(castTy->isIntegralOrEnumerationType()); // FIXME: Keep these here for now in case we decide soon that we // need the original decayed type. // QualType elemTy = cast(originalTy)->getElementType(); // QualType pointerTy = C.getPointerType(elemTy); return evalCastFromLoc(val.castAs(), castTy); } // Check for casts from a region to a specific type. if (const MemRegion *R = val.getAsRegion()) { // Handle other casts of locations to integers. if (castTy->isIntegralOrEnumerationType()) return evalCastFromLoc(loc::MemRegionVal(R), castTy); // FIXME: We should handle the case where we strip off view layers to get // to a desugared type. if (!Loc::isLocType(castTy)) { // FIXME: There can be gross cases where one casts the result of a function // (that returns a pointer) to some other value that happens to fit // within that pointer value. We currently have no good way to // model such operations. When this happens, the underlying operation // is that the caller is reasoning about bits. Conceptually we are // layering a "view" of a location on top of those bits. Perhaps // we need to be more lazy about mutual possible views, even on an // SVal? This may be necessary for bit-level reasoning as well. return UnknownVal(); } // We get a symbolic function pointer for a dereference of a function // pointer, but it is of function type. Example: // struct FPRec { // void (*my_func)(int * x); // }; // // int bar(int x); // // int f1_a(struct FPRec* foo) { // int x; // (*foo->my_func)(&x); // return bar(x)+1; // no-warning // } assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() || originalTy->isBlockPointerType() || castTy->isReferenceType()); StoreManager &storeMgr = StateMgr.getStoreManager(); // Delegate to store manager to get the result of casting a region to a // different type. If the MemRegion* returned is NULL, this expression // Evaluates to UnknownVal. R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return dispatchCast(val, castTy); } @ 1.1.1.1 log @Import Clang 3.4rc1 r195771. @ text @@ 1.1.1.2 log @Import clang 3.5svn r198450. @ text @d365 1 a365 1 return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()) d379 1 a379 1 // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address @ 1.1.1.3 log @Import Clang 3.8.0rc3 r261930. @ text @d94 1 a94 1 DefinedOrUnknownSVal a97 3 if (T->isNullPtrType()) return makeZeroVal(T); a114 3 if (T->isNullPtrType()) return makeZeroVal(T); a128 3 if (type->isNullPtrType()) return makeZeroVal(type); a144 3 if (type->isNullPtrType()) return makeZeroVal(type); d149 1 a149 1 d152 1 a152 1 a162 2 if (T->isNullPtrType()) return makeZeroVal(T); a187 3 if (T->isNullPtrType()) return makeZeroVal(T); d200 1 a200 1 return loc::MemRegionVal(MemMgr.getFunctionCodeRegion(func)); d207 2 a208 2 const BlockCodeRegion *BC = MemMgr.getBlockCodeRegion(block, locTy, locContext->getAnalysisDeclContext()); a261 5 case Stmt::TypeTraitExprClass: { const TypeTraitExpr *TE = cast(E); return makeTruthVal(TE->getValue(), TE->getType()); } d273 3 a275 8 switch (CE->getCastKind()) { default: break; case CK_ArrayToPointerDecay: case CK_BitCast: { const Expr *SE = CE->getSubExpr(); Optional Val = getConstantVal(SE); if (!Val) d277 1 a277 2 return evalCast(*Val, CE->getType(), SE->getType()); } d310 1 a310 1 a397 39 // Handles casts of type CK_IntegralCast. // At the moment, this function will redirect to evalCast, except when the range // of the original value is known to be greater than the max of the target type. SVal SValBuilder::evalIntegralCast(ProgramStateRef state, SVal val, QualType castTy, QualType originalTy) { // No truncations if target type is big enough. if (getContext().getTypeSize(castTy) >= getContext().getTypeSize(originalTy)) return evalCast(val, castTy, originalTy); const SymExpr *se = val.getAsSymbolicExpression(); if (!se) // Let evalCast handle non symbolic expressions. return evalCast(val, castTy, originalTy); // Find the maximum value of the target type. APSIntType ToType(getContext().getTypeSize(castTy), castTy->isUnsignedIntegerType()); llvm::APSInt ToTypeMax = ToType.getMaxValue(); NonLoc ToTypeMaxVal = makeIntVal(ToTypeMax.isUnsigned() ? ToTypeMax.getZExtValue() : ToTypeMax.getSExtValue(), castTy) .castAs(); // Check the range of the symbol being casted against the maximum value of the // target type. NonLoc FromVal = val.castAs(); QualType CmpTy = getConditionType(); NonLoc CompVal = evalBinOpNN(state, BO_LT, FromVal, ToTypeMaxVal, CmpTy).castAs(); ProgramStateRef IsNotTruncated, IsTruncated; std::tie(IsNotTruncated, IsTruncated) = state->assume(CompVal); if (!IsNotTruncated && IsTruncated) { // Symbol is truncated so we evaluate it as a cast. NonLoc CastVal = makeNonLoc(se, originalTy, castTy); return CastVal; } return evalCast(val, castTy, originalTy); } d433 1 a433 1 @ 1.1.1.3.2.1 log @Sync with HEAD @ text @a38 4 if (type->isArrayType() || type->isRecordType() || type->isVectorType() || type->isAnyComplexType()) return makeCompoundVal(type, BasicVals.getEmptySValList()); d40 1 a184 1 const LocationContext *LCtx, d189 1 a189 1 SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag); a215 16 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl* DD) { assert(!DD || isa(DD) || isa(DD)); if (auto *MD = dyn_cast_or_null(DD)) { // Sema treats pointers to static member functions as have function pointer // type, so return a function pointer for the method. // We don't need to play a similar trick for static member fields // because these are represented as plain VarDecls and not FieldDecls // in the AST. if (MD->isStatic()) return getFunctionPointer(MD); } return nonloc::PointerToMember(DD); } a369 5 if (lhs.getAs() || rhs.getAs()) { return UnknownVal(); } d454 1 a454 1 evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs(); @ 1.1.1.4 log @Import Clang pre-4.0.0 r291444. @ text @a38 4 if (type->isArrayType() || type->isRecordType() || type->isVectorType() || type->isAnyComplexType()) return makeCompoundVal(type, BasicVals.getEmptySValList()); d40 1 a184 1 const LocationContext *LCtx, d189 1 a189 1 SymMgr.getMetadataSymbol(region, expr, type, LCtx, count, symbolTag); a215 4 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl* DD) { return nonloc::PointerToMember(DD); } a369 5 if (lhs.getAs() || rhs.getAs()) { return UnknownVal(); } d454 1 a454 1 evalBinOpNN(state, BO_LE, FromVal, ToTypeMaxVal, CmpTy).castAs(); @ 1.1.1.4.2.1 log @Sync with HEAD @ text @a220 12 assert(!DD || isa(DD) || isa(DD)); if (auto *MD = dyn_cast_or_null(DD)) { // Sema treats pointers to static member functions as have function pointer // type, so return a function pointer for the method. // We don't need to play a similar trick for static member fields // because these are represented as plain VarDecls and not FieldDecls // in the AST. if (MD->isStatic()) return getFunctionPointer(MD); } @ 1.1.1.5 log @Import Clang 4.0RC1 r294123. @ text @a220 12 assert(!DD || isa(DD) || isa(DD)); if (auto *MD = dyn_cast_or_null(DD)) { // Sema treats pointers to static member functions as have function pointer // type, so return a function pointer for the method. // We don't need to play a similar trick for static member fields // because these are represented as plain VarDecls and not FieldDecls // in the AST. if (MD->isStatic()) return getFunctionPointer(MD); } @ 1.1.1.6 log @Import clang r309604 from branches/release_50 @ text @a327 1 LLVM_FALLTHROUGH; @ 1.1.1.6.4.1 log @Sync with HEAD @ text @d1 1 a1 1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===// a15 2 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" a17 7 #include "clang/AST/ExprObjC.h" #include "clang/AST/Stmt.h" #include "clang/AST/Type.h" #include "clang/Basic/LLVM.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h" a20 1 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" a21 11 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/None.h" #include "llvm/ADT/Optional.h" #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include #include d30 1 a30 1 void SValBuilder::anchor() {} d98 1 a98 1 SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) { d103 1 a103 1 d152 1 d220 1 a220 1 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl *DD) { d223 1 a223 1 if (const auto *MD = dyn_cast_or_null(DD)) { d280 1 a280 1 const auto *SL = cast(E); d285 1 a285 1 const auto *SL = cast(E); d292 1 a292 1 const auto *C = cast(E); d300 1 a300 1 const auto *TE = cast(E); a312 5 case Stmt::CStyleCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXStaticCastExprClass: d314 1 a314 1 const auto *CE = cast(E); a318 2 case CK_IntegralToPointer: case CK_NoOp: d351 2 d357 3 a361 1 d364 1 a364 3 const unsigned MaxComp = StateMgr.getOwningEngine() ->getAnalysisManager() .options.getMaxSymbolComplexity(); d381 1 d384 1 a415 9 ConditionTruthVal SValBuilder::areEqual(ProgramStateRef state, SVal lhs, SVal rhs) { return state->isNonNull(evalEQ(state, lhs, rhs)); } SVal SValBuilder::evalEQ(ProgramStateRef state, SVal lhs, SVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()); } d419 1 a419 1 return evalEQ(state, static_cast(lhs), static_cast(rhs)) d428 1 a428 1 while (Context.UnwrapSimilarTypes(ToTy, FromTy)) { a442 4 // // FIXME: Doing this after unwrapping the types doesn't make any sense. A // cast from 'int**' to 'void**' is not special in the way that a cast from // 'int*' to 'void*' is. d457 1 d551 2 a552 2 if (const auto *arrayT = dyn_cast(originalTy.getCanonicalType())) { @ 1.1.1.6.4.2 log @Mostly merge changes from HEAD upto 20200411 @ text @@ 1.1.1.6.2.1 log @Sync with HEAD @ text @d1 1 a1 1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===// a15 2 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" a17 7 #include "clang/AST/ExprObjC.h" #include "clang/AST/Stmt.h" #include "clang/AST/Type.h" #include "clang/Basic/LLVM.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h" a20 1 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" a21 11 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/None.h" #include "llvm/ADT/Optional.h" #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include #include d30 1 a30 1 void SValBuilder::anchor() {} d98 1 a98 1 SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) { d103 1 a103 1 d152 1 d220 1 a220 1 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl *DD) { d223 1 a223 1 if (const auto *MD = dyn_cast_or_null(DD)) { d280 1 a280 1 const auto *SL = cast(E); d285 1 a285 1 const auto *SL = cast(E); d292 1 a292 1 const auto *C = cast(E); d300 1 a300 1 const auto *TE = cast(E); a312 5 case Stmt::CStyleCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXStaticCastExprClass: d314 1 a314 1 const auto *CE = cast(E); a318 2 case CK_IntegralToPointer: case CK_NoOp: d351 2 d357 3 a361 1 d364 1 a364 3 const unsigned MaxComp = StateMgr.getOwningEngine() ->getAnalysisManager() .options.getMaxSymbolComplexity(); d381 1 d384 1 a415 9 ConditionTruthVal SValBuilder::areEqual(ProgramStateRef state, SVal lhs, SVal rhs) { return state->isNonNull(evalEQ(state, lhs, rhs)); } SVal SValBuilder::evalEQ(ProgramStateRef state, SVal lhs, SVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()); } d419 1 a419 1 return evalEQ(state, static_cast(lhs), static_cast(rhs)) d428 1 a428 1 while (Context.UnwrapSimilarTypes(ToTy, FromTy)) { a442 4 // // FIXME: Doing this after unwrapping the types doesn't make any sense. A // cast from 'int**' to 'void**' is not special in the way that a cast from // 'int*' to 'void*' is. d457 1 d551 2 a552 2 if (const auto *arrayT = dyn_cast(originalTy.getCanonicalType())) { @ 1.1.1.7 log @Import clang r337282 from trunk @ text @d1 1 a1 1 //===- SValBuilder.cpp - Basic class for all SValBuilder implementations --===// a15 2 #include "clang/AST/ASTContext.h" #include "clang/AST/Decl.h" a17 7 #include "clang/AST/ExprObjC.h" #include "clang/AST/Stmt.h" #include "clang/AST/Type.h" #include "clang/Basic/LLVM.h" #include "clang/Analysis/AnalysisDeclContext.h" #include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h" #include "clang/StaticAnalyzer/Core/PathSensitive/APSIntType.h" a20 1 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" a21 11 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SubEngine.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymExpr.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" #include "llvm/ADT/APSInt.h" #include "llvm/ADT/None.h" #include "llvm/ADT/Optional.h" #include "llvm/Support/Casting.h" #include "llvm/Support/Compiler.h" #include #include d30 1 a30 1 void SValBuilder::anchor() {} d98 1 a98 1 SValBuilder::getRegionValueSymbolVal(const TypedValueRegion *region) { d103 1 a103 1 d152 1 d220 1 a220 1 DefinedSVal SValBuilder::getMemberPointer(const DeclaratorDecl *DD) { d223 1 a223 1 if (const auto *MD = dyn_cast_or_null(DD)) { d280 1 a280 1 const auto *SL = cast(E); d285 1 a285 1 const auto *SL = cast(E); d292 1 a292 1 const auto *C = cast(E); d300 1 a300 1 const auto *TE = cast(E); a312 5 case Stmt::CStyleCastExprClass: case Stmt::CXXFunctionalCastExprClass: case Stmt::CXXConstCastExprClass: case Stmt::CXXReinterpretCastExprClass: case Stmt::CXXStaticCastExprClass: d314 1 a314 1 const auto *CE = cast(E); a318 2 case CK_IntegralToPointer: case CK_NoOp: d351 2 d357 3 a361 1 d364 1 a364 3 const unsigned MaxComp = StateMgr.getOwningEngine() ->getAnalysisManager() .options.getMaxSymbolComplexity(); d381 1 d384 1 a415 9 ConditionTruthVal SValBuilder::areEqual(ProgramStateRef state, SVal lhs, SVal rhs) { return state->isNonNull(evalEQ(state, lhs, rhs)); } SVal SValBuilder::evalEQ(ProgramStateRef state, SVal lhs, SVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()); } d419 1 a419 1 return evalEQ(state, static_cast(lhs), static_cast(rhs)) d428 1 a428 1 while (Context.UnwrapSimilarTypes(ToTy, FromTy)) { a442 4 // // FIXME: Doing this after unwrapping the types doesn't make any sense. A // cast from 'int**' to 'void**' is not special in the way that a cast from // 'int*' to 'void*' is. d457 1 d551 2 a552 2 if (const auto *arrayT = dyn_cast(originalTy.getCanonicalType())) { @ 1.1.1.8 log @Mark old LLVM instance as dead. @ text @@ 1.1.1.2.8.1 log @file SValBuilder.cpp was added on branch tls-maxphys on 2014-08-19 23:47:32 +0000 @ text @d1 528 @ 1.1.1.2.8.2 log @Rebase to HEAD as of a few days ago. @ text @a0 528 // SValBuilder.cpp - Basic class for all SValBuilder implementations -*- C++ -*- // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines SValBuilder, the base class for all (complete) SValBuilder // implementations. // //===----------------------------------------------------------------------===// #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/ExprCXX.h" #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h" #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" using namespace clang; using namespace ento; //===----------------------------------------------------------------------===// // Basic SVal creation. //===----------------------------------------------------------------------===// void SValBuilder::anchor() { } DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType type) { if (Loc::isLocType(type)) return makeNull(); if (type->isIntegralOrEnumerationType()) return makeIntVal(0, type); // FIXME: Handle floats. // FIXME: Handle structs. return UnknownVal(); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt& rhs, QualType type) { // The Environment ensures we always get a persistent APSInt in // BasicValueFactory, so we don't need to get the APSInt from // BasicValueFactory again. assert(lhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(lhs && rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy) { assert(operand); assert(!Loc::isLocType(toTy)); return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy)); } SVal SValBuilder::convertToArrayIndex(SVal val) { if (val.isUnknownOrUndef()) return val; // Common case: we have an appropriately sized integer. if (Optional CI = val.getAs()) { const llvm::APSInt& I = CI->getValue(); if (I.getBitWidth() == ArrayIndexWidth && I.isSigned()) return val; } return evalCastFromNonLoc(val.castAs(), ArrayIndexTy); } nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){ return makeTruthVal(boolean->getValue()); } DefinedOrUnknownSVal SValBuilder::getRegionValueSymbolVal(const TypedValueRegion* region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getRegionValueSymbol(region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *SymbolTag, const Expr *Ex, const LocationContext *LCtx, unsigned Count) { QualType T = Ex->getType(); // Compute the type of the result. If the expression is not an R-value, the // result should be a location. QualType ExType = Ex->getType(); if (Ex->isGLValue()) T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType); return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, QualType type, unsigned count) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt, const LocationContext *LCtx, QualType type, unsigned visitCount) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned VisitCount) { QualType T = E->getType(); assert(Loc::isLocType(T)); assert(SymbolManager::canSymbolicate(T)); SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount); return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym)); } DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); SymbolRef sym = SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl *func) { return loc::MemRegionVal(MemMgr.getFunctionTextRegion(func)); } DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount) { const BlockTextRegion *BC = MemMgr.getBlockTextRegion(block, locTy, locContext->getAnalysisDeclContext()); const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext, blockCount); return loc::MemRegionVal(BD); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC) { return loc::MemRegionVal(getRegionManager(). getCXXThisRegion(D->getThisType(getContext()), SFC)); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D, const StackFrameContext *SFC) { const Type *T = D->getTypeForDecl(); QualType PT = getContext().getPointerType(QualType(T, 0)); return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC)); } Optional SValBuilder::getConstantVal(const Expr *E) { E = E->IgnoreParens(); switch (E->getStmtClass()) { // Handle expressions that we treat differently from the AST's constant // evaluator. case Stmt::AddrLabelExprClass: return makeLoc(cast(E)); case Stmt::CXXScalarValueInitExprClass: case Stmt::ImplicitValueInitExprClass: return makeZeroVal(E->getType()); case Stmt::ObjCStringLiteralClass: { const ObjCStringLiteral *SL = cast(E); return makeLoc(getRegionManager().getObjCStringRegion(SL)); } case Stmt::StringLiteralClass: { const StringLiteral *SL = cast(E); return makeLoc(getRegionManager().getStringRegion(SL)); } // Fast-path some expressions to avoid the overhead of going through the AST's // constant evaluator case Stmt::CharacterLiteralClass: { const CharacterLiteral *C = cast(E); return makeIntVal(C->getValue(), C->getType()); } case Stmt::CXXBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::IntegerLiteralClass: return makeIntVal(cast(E)); case Stmt::ObjCBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::CXXNullPtrLiteralExprClass: return makeNull(); case Stmt::ImplicitCastExprClass: { const CastExpr *CE = cast(E); if (CE->getCastKind() == CK_ArrayToPointerDecay) { Optional ArrayVal = getConstantVal(CE->getSubExpr()); if (!ArrayVal) return None; return evalCast(*ArrayVal, CE->getType(), CE->getSubExpr()->getType()); } // FALLTHROUGH } // If we don't have a special case, fall back to the AST's constant evaluator. default: { // Don't try to come up with a value for materialized temporaries. if (E->isGLValue()) return None; ASTContext &Ctx = getContext(); llvm::APSInt Result; if (E->EvaluateAsInt(Result, Ctx)) return makeIntVal(Result); if (Loc::isLocType(E->getType())) if (E->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNotNull)) return makeNull(); return None; } } } //===----------------------------------------------------------------------===// SVal SValBuilder::makeSymExprValNN(ProgramStateRef State, BinaryOperator::Opcode Op, NonLoc LHS, NonLoc RHS, QualType ResultTy) { if (!State->isTainted(RHS) && !State->isTainted(LHS)) return UnknownVal(); const SymExpr *symLHS = LHS.getAsSymExpr(); const SymExpr *symRHS = RHS.getAsSymExpr(); // TODO: When the Max Complexity is reached, we should conjure a symbol // instead of generating an Unknown value and propagate the taint info to it. const unsigned MaxComp = 10000; // 100000 28X if (symLHS && symRHS && (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp) return makeNonLoc(symLHS, Op, symRHS, ResultTy); if (symLHS && symLHS->computeComplexity() < MaxComp) if (Optional rInt = RHS.getAs()) return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy); if (symRHS && symRHS->computeComplexity() < MaxComp) if (Optional lInt = LHS.getAs()) return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy); return UnknownVal(); } SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type) { if (lhs.isUndef() || rhs.isUndef()) return UndefinedVal(); if (lhs.isUnknown() || rhs.isUnknown()) return UnknownVal(); if (Optional LV = lhs.getAs()) { if (Optional RV = rhs.getAs()) return evalBinOpLL(state, op, *LV, *RV, type); return evalBinOpLN(state, op, *LV, rhs.castAs(), type); } if (Optional RV = rhs.getAs()) { // Support pointer arithmetic where the addend is on the left // and the pointer on the right. assert(op == BO_Add); // Commute the operands. return evalBinOpLN(state, op, *RV, lhs.castAs(), type); } return evalBinOpNN(state, op, lhs.castAs(), rhs.castAs(), type); } DefinedOrUnknownSVal SValBuilder::evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()) .castAs(); } /// Recursively check if the pointer types are equal modulo const, volatile, /// and restrict qualifiers. Also, assume that all types are similar to 'void'. /// Assumes the input types are canonical. static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy) { while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) { Qualifiers Quals1, Quals2; ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1); FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2); // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address // spaces) are identical. Quals1.removeCVRQualifiers(); Quals2.removeCVRQualifiers(); if (Quals1 != Quals2) return false; } // If we are casting to void, the 'From' value can be used to represent the // 'To' value. if (ToTy->isVoidType()) return true; if (ToTy != FromTy) return false; return true; } // FIXME: should rewrite according to the cast kind. SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) { castTy = Context.getCanonicalType(castTy); originalTy = Context.getCanonicalType(originalTy); if (val.isUnknownOrUndef() || castTy == originalTy) return val; if (castTy->isBooleanType()) { if (val.isUnknownOrUndef()) return val; if (val.isConstant()) return makeTruthVal(!val.isZeroConstant(), castTy); if (!Loc::isLocType(originalTy) && !originalTy->isIntegralOrEnumerationType() && !originalTy->isMemberPointerType()) return UnknownVal(); if (SymbolRef Sym = val.getAsSymbol(true)) { BasicValueFactory &BVF = getBasicValueFactory(); // FIXME: If we had a state here, we could see if the symbol is known to // be zero, but we don't. return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy); } // Loc values are not always true, they could be weakly linked functions. if (Optional L = val.getAs()) return evalCastFromLoc(*L, castTy); Loc L = val.castAs().getLoc(); return evalCastFromLoc(L, castTy); } // For const casts, casts to void, just propagate the value. if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType()) if (shouldBeModeledWithNoOp(Context, Context.getPointerType(castTy), Context.getPointerType(originalTy))) return val; // Check for casts from pointers to integers. if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy)) return evalCastFromLoc(val.castAs(), castTy); // Check for casts from integers to pointers. if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) { if (Optional LV = val.getAs()) { if (const MemRegion *R = LV->getLoc().getAsRegion()) { StoreManager &storeMgr = StateMgr.getStoreManager(); R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return LV->getLoc(); } return dispatchCast(val, castTy); } // Just pass through function and block pointers. if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) { assert(Loc::isLocType(castTy)); return val; } // Check for casts from array type to another type. if (const ArrayType *arrayT = dyn_cast(originalTy.getCanonicalType())) { // We will always decay to a pointer. QualType elemTy = arrayT->getElementType(); val = StateMgr.ArrayToPointer(val.castAs(), elemTy); // Are we casting from an array to a pointer? If so just pass on // the decayed value. if (castTy->isPointerType() || castTy->isReferenceType()) return val; // Are we casting from an array to an integer? If so, cast the decayed // pointer value to an integer. assert(castTy->isIntegralOrEnumerationType()); // FIXME: Keep these here for now in case we decide soon that we // need the original decayed type. // QualType elemTy = cast(originalTy)->getElementType(); // QualType pointerTy = C.getPointerType(elemTy); return evalCastFromLoc(val.castAs(), castTy); } // Check for casts from a region to a specific type. if (const MemRegion *R = val.getAsRegion()) { // Handle other casts of locations to integers. if (castTy->isIntegralOrEnumerationType()) return evalCastFromLoc(loc::MemRegionVal(R), castTy); // FIXME: We should handle the case where we strip off view layers to get // to a desugared type. if (!Loc::isLocType(castTy)) { // FIXME: There can be gross cases where one casts the result of a function // (that returns a pointer) to some other value that happens to fit // within that pointer value. We currently have no good way to // model such operations. When this happens, the underlying operation // is that the caller is reasoning about bits. Conceptually we are // layering a "view" of a location on top of those bits. Perhaps // we need to be more lazy about mutual possible views, even on an // SVal? This may be necessary for bit-level reasoning as well. return UnknownVal(); } // We get a symbolic function pointer for a dereference of a function // pointer, but it is of function type. Example: // struct FPRec { // void (*my_func)(int * x); // }; // // int bar(int x); // // int f1_a(struct FPRec* foo) { // int x; // (*foo->my_func)(&x); // return bar(x)+1; // no-warning // } assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() || originalTy->isBlockPointerType() || castTy->isReferenceType()); StoreManager &storeMgr = StateMgr.getStoreManager(); // Delegate to store manager to get the result of casting a region to a // different type. If the MemRegion* returned is NULL, this expression // Evaluates to UnknownVal. R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return dispatchCast(val, castTy); } @ 1.1.1.2.4.1 log @file SValBuilder.cpp was added on branch yamt-pagecache on 2014-05-22 16:18:31 +0000 @ text @d1 528 @ 1.1.1.2.4.2 log @sync with head. for a reference, the tree before this commit was tagged as yamt-pagecache-tag8. this commit was splitted into small chunks to avoid a limitation of cvs. ("Protocol error: too many arguments") @ text @a0 528 // SValBuilder.cpp - Basic class for all SValBuilder implementations -*- C++ -*- // // The LLVM Compiler Infrastructure // // This file is distributed under the University of Illinois Open Source // License. See LICENSE.TXT for details. // //===----------------------------------------------------------------------===// // // This file defines SValBuilder, the base class for all (complete) SValBuilder // implementations. // //===----------------------------------------------------------------------===// #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/ExprCXX.h" #include "clang/StaticAnalyzer/Core/PathSensitive/BasicValueFactory.h" #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" using namespace clang; using namespace ento; //===----------------------------------------------------------------------===// // Basic SVal creation. //===----------------------------------------------------------------------===// void SValBuilder::anchor() { } DefinedOrUnknownSVal SValBuilder::makeZeroVal(QualType type) { if (Loc::isLocType(type)) return makeNull(); if (type->isIntegralOrEnumerationType()) return makeIntVal(0, type); // FIXME: Handle floats. // FIXME: Handle structs. return UnknownVal(); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const llvm::APSInt& rhs, QualType type) { // The Environment ensures we always get a persistent APSInt in // BasicValueFactory, so we don't need to get the APSInt from // BasicValueFactory again. assert(lhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymIntExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const llvm::APSInt& lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getIntSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *lhs, BinaryOperator::Opcode op, const SymExpr *rhs, QualType type) { assert(lhs && rhs); assert(!Loc::isLocType(type)); return nonloc::SymbolVal(SymMgr.getSymSymExpr(lhs, op, rhs, type)); } NonLoc SValBuilder::makeNonLoc(const SymExpr *operand, QualType fromTy, QualType toTy) { assert(operand); assert(!Loc::isLocType(toTy)); return nonloc::SymbolVal(SymMgr.getCastSymbol(operand, fromTy, toTy)); } SVal SValBuilder::convertToArrayIndex(SVal val) { if (val.isUnknownOrUndef()) return val; // Common case: we have an appropriately sized integer. if (Optional CI = val.getAs()) { const llvm::APSInt& I = CI->getValue(); if (I.getBitWidth() == ArrayIndexWidth && I.isSigned()) return val; } return evalCastFromNonLoc(val.castAs(), ArrayIndexTy); } nonloc::ConcreteInt SValBuilder::makeBoolVal(const CXXBoolLiteralExpr *boolean){ return makeTruthVal(boolean->getValue()); } DefinedOrUnknownSVal SValBuilder::getRegionValueSymbolVal(const TypedValueRegion* region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getRegionValueSymbol(region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *SymbolTag, const Expr *Ex, const LocationContext *LCtx, unsigned Count) { QualType T = Ex->getType(); // Compute the type of the result. If the expression is not an R-value, the // result should be a location. QualType ExType = Ex->getType(); if (Ex->isGLValue()) T = LCtx->getAnalysisDeclContext()->getASTContext().getPointerType(ExType); return conjureSymbolVal(SymbolTag, Ex, LCtx, T, Count); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const void *symbolTag, const Expr *expr, const LocationContext *LCtx, QualType type, unsigned count) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(expr, LCtx, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::conjureSymbolVal(const Stmt *stmt, const LocationContext *LCtx, QualType type, unsigned visitCount) { if (!SymbolManager::canSymbolicate(type)) return UnknownVal(); SymbolRef sym = SymMgr.conjureSymbol(stmt, LCtx, type, visitCount); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getConjuredHeapSymbolVal(const Expr *E, const LocationContext *LCtx, unsigned VisitCount) { QualType T = E->getType(); assert(Loc::isLocType(T)); assert(SymbolManager::canSymbolicate(T)); SymbolRef sym = SymMgr.conjureSymbol(E, LCtx, T, VisitCount); return loc::MemRegionVal(MemMgr.getSymbolicHeapRegion(sym)); } DefinedSVal SValBuilder::getMetadataSymbolVal(const void *symbolTag, const MemRegion *region, const Expr *expr, QualType type, unsigned count) { assert(SymbolManager::canSymbolicate(type) && "Invalid metadata symbol type"); SymbolRef sym = SymMgr.getMetadataSymbol(region, expr, type, count, symbolTag); if (Loc::isLocType(type)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedOrUnknownSVal SValBuilder::getDerivedRegionValueSymbolVal(SymbolRef parentSymbol, const TypedValueRegion *region) { QualType T = region->getValueType(); if (!SymbolManager::canSymbolicate(T)) return UnknownVal(); SymbolRef sym = SymMgr.getDerivedSymbol(parentSymbol, region); if (Loc::isLocType(T)) return loc::MemRegionVal(MemMgr.getSymbolicRegion(sym)); return nonloc::SymbolVal(sym); } DefinedSVal SValBuilder::getFunctionPointer(const FunctionDecl *func) { return loc::MemRegionVal(MemMgr.getFunctionTextRegion(func)); } DefinedSVal SValBuilder::getBlockPointer(const BlockDecl *block, CanQualType locTy, const LocationContext *locContext, unsigned blockCount) { const BlockTextRegion *BC = MemMgr.getBlockTextRegion(block, locTy, locContext->getAnalysisDeclContext()); const BlockDataRegion *BD = MemMgr.getBlockDataRegion(BC, locContext, blockCount); return loc::MemRegionVal(BD); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC) { return loc::MemRegionVal(getRegionManager(). getCXXThisRegion(D->getThisType(getContext()), SFC)); } /// Return a memory region for the 'this' object reference. loc::MemRegionVal SValBuilder::getCXXThis(const CXXRecordDecl *D, const StackFrameContext *SFC) { const Type *T = D->getTypeForDecl(); QualType PT = getContext().getPointerType(QualType(T, 0)); return loc::MemRegionVal(getRegionManager().getCXXThisRegion(PT, SFC)); } Optional SValBuilder::getConstantVal(const Expr *E) { E = E->IgnoreParens(); switch (E->getStmtClass()) { // Handle expressions that we treat differently from the AST's constant // evaluator. case Stmt::AddrLabelExprClass: return makeLoc(cast(E)); case Stmt::CXXScalarValueInitExprClass: case Stmt::ImplicitValueInitExprClass: return makeZeroVal(E->getType()); case Stmt::ObjCStringLiteralClass: { const ObjCStringLiteral *SL = cast(E); return makeLoc(getRegionManager().getObjCStringRegion(SL)); } case Stmt::StringLiteralClass: { const StringLiteral *SL = cast(E); return makeLoc(getRegionManager().getStringRegion(SL)); } // Fast-path some expressions to avoid the overhead of going through the AST's // constant evaluator case Stmt::CharacterLiteralClass: { const CharacterLiteral *C = cast(E); return makeIntVal(C->getValue(), C->getType()); } case Stmt::CXXBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::IntegerLiteralClass: return makeIntVal(cast(E)); case Stmt::ObjCBoolLiteralExprClass: return makeBoolVal(cast(E)); case Stmt::CXXNullPtrLiteralExprClass: return makeNull(); case Stmt::ImplicitCastExprClass: { const CastExpr *CE = cast(E); if (CE->getCastKind() == CK_ArrayToPointerDecay) { Optional ArrayVal = getConstantVal(CE->getSubExpr()); if (!ArrayVal) return None; return evalCast(*ArrayVal, CE->getType(), CE->getSubExpr()->getType()); } // FALLTHROUGH } // If we don't have a special case, fall back to the AST's constant evaluator. default: { // Don't try to come up with a value for materialized temporaries. if (E->isGLValue()) return None; ASTContext &Ctx = getContext(); llvm::APSInt Result; if (E->EvaluateAsInt(Result, Ctx)) return makeIntVal(Result); if (Loc::isLocType(E->getType())) if (E->isNullPointerConstant(Ctx, Expr::NPC_ValueDependentIsNotNull)) return makeNull(); return None; } } } //===----------------------------------------------------------------------===// SVal SValBuilder::makeSymExprValNN(ProgramStateRef State, BinaryOperator::Opcode Op, NonLoc LHS, NonLoc RHS, QualType ResultTy) { if (!State->isTainted(RHS) && !State->isTainted(LHS)) return UnknownVal(); const SymExpr *symLHS = LHS.getAsSymExpr(); const SymExpr *symRHS = RHS.getAsSymExpr(); // TODO: When the Max Complexity is reached, we should conjure a symbol // instead of generating an Unknown value and propagate the taint info to it. const unsigned MaxComp = 10000; // 100000 28X if (symLHS && symRHS && (symLHS->computeComplexity() + symRHS->computeComplexity()) < MaxComp) return makeNonLoc(symLHS, Op, symRHS, ResultTy); if (symLHS && symLHS->computeComplexity() < MaxComp) if (Optional rInt = RHS.getAs()) return makeNonLoc(symLHS, Op, rInt->getValue(), ResultTy); if (symRHS && symRHS->computeComplexity() < MaxComp) if (Optional lInt = LHS.getAs()) return makeNonLoc(lInt->getValue(), Op, symRHS, ResultTy); return UnknownVal(); } SVal SValBuilder::evalBinOp(ProgramStateRef state, BinaryOperator::Opcode op, SVal lhs, SVal rhs, QualType type) { if (lhs.isUndef() || rhs.isUndef()) return UndefinedVal(); if (lhs.isUnknown() || rhs.isUnknown()) return UnknownVal(); if (Optional LV = lhs.getAs()) { if (Optional RV = rhs.getAs()) return evalBinOpLL(state, op, *LV, *RV, type); return evalBinOpLN(state, op, *LV, rhs.castAs(), type); } if (Optional RV = rhs.getAs()) { // Support pointer arithmetic where the addend is on the left // and the pointer on the right. assert(op == BO_Add); // Commute the operands. return evalBinOpLN(state, op, *RV, lhs.castAs(), type); } return evalBinOpNN(state, op, lhs.castAs(), rhs.castAs(), type); } DefinedOrUnknownSVal SValBuilder::evalEQ(ProgramStateRef state, DefinedOrUnknownSVal lhs, DefinedOrUnknownSVal rhs) { return evalBinOp(state, BO_EQ, lhs, rhs, getConditionType()) .castAs(); } /// Recursively check if the pointer types are equal modulo const, volatile, /// and restrict qualifiers. Also, assume that all types are similar to 'void'. /// Assumes the input types are canonical. static bool shouldBeModeledWithNoOp(ASTContext &Context, QualType ToTy, QualType FromTy) { while (Context.UnwrapSimilarPointerTypes(ToTy, FromTy)) { Qualifiers Quals1, Quals2; ToTy = Context.getUnqualifiedArrayType(ToTy, Quals1); FromTy = Context.getUnqualifiedArrayType(FromTy, Quals2); // Make sure that non-cvr-qualifiers the other qualifiers (e.g., address // spaces) are identical. Quals1.removeCVRQualifiers(); Quals2.removeCVRQualifiers(); if (Quals1 != Quals2) return false; } // If we are casting to void, the 'From' value can be used to represent the // 'To' value. if (ToTy->isVoidType()) return true; if (ToTy != FromTy) return false; return true; } // FIXME: should rewrite according to the cast kind. SVal SValBuilder::evalCast(SVal val, QualType castTy, QualType originalTy) { castTy = Context.getCanonicalType(castTy); originalTy = Context.getCanonicalType(originalTy); if (val.isUnknownOrUndef() || castTy == originalTy) return val; if (castTy->isBooleanType()) { if (val.isUnknownOrUndef()) return val; if (val.isConstant()) return makeTruthVal(!val.isZeroConstant(), castTy); if (!Loc::isLocType(originalTy) && !originalTy->isIntegralOrEnumerationType() && !originalTy->isMemberPointerType()) return UnknownVal(); if (SymbolRef Sym = val.getAsSymbol(true)) { BasicValueFactory &BVF = getBasicValueFactory(); // FIXME: If we had a state here, we could see if the symbol is known to // be zero, but we don't. return makeNonLoc(Sym, BO_NE, BVF.getValue(0, Sym->getType()), castTy); } // Loc values are not always true, they could be weakly linked functions. if (Optional L = val.getAs()) return evalCastFromLoc(*L, castTy); Loc L = val.castAs().getLoc(); return evalCastFromLoc(L, castTy); } // For const casts, casts to void, just propagate the value. if (!castTy->isVariableArrayType() && !originalTy->isVariableArrayType()) if (shouldBeModeledWithNoOp(Context, Context.getPointerType(castTy), Context.getPointerType(originalTy))) return val; // Check for casts from pointers to integers. if (castTy->isIntegralOrEnumerationType() && Loc::isLocType(originalTy)) return evalCastFromLoc(val.castAs(), castTy); // Check for casts from integers to pointers. if (Loc::isLocType(castTy) && originalTy->isIntegralOrEnumerationType()) { if (Optional LV = val.getAs()) { if (const MemRegion *R = LV->getLoc().getAsRegion()) { StoreManager &storeMgr = StateMgr.getStoreManager(); R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return LV->getLoc(); } return dispatchCast(val, castTy); } // Just pass through function and block pointers. if (originalTy->isBlockPointerType() || originalTy->isFunctionPointerType()) { assert(Loc::isLocType(castTy)); return val; } // Check for casts from array type to another type. if (const ArrayType *arrayT = dyn_cast(originalTy.getCanonicalType())) { // We will always decay to a pointer. QualType elemTy = arrayT->getElementType(); val = StateMgr.ArrayToPointer(val.castAs(), elemTy); // Are we casting from an array to a pointer? If so just pass on // the decayed value. if (castTy->isPointerType() || castTy->isReferenceType()) return val; // Are we casting from an array to an integer? If so, cast the decayed // pointer value to an integer. assert(castTy->isIntegralOrEnumerationType()); // FIXME: Keep these here for now in case we decide soon that we // need the original decayed type. // QualType elemTy = cast(originalTy)->getElementType(); // QualType pointerTy = C.getPointerType(elemTy); return evalCastFromLoc(val.castAs(), castTy); } // Check for casts from a region to a specific type. if (const MemRegion *R = val.getAsRegion()) { // Handle other casts of locations to integers. if (castTy->isIntegralOrEnumerationType()) return evalCastFromLoc(loc::MemRegionVal(R), castTy); // FIXME: We should handle the case where we strip off view layers to get // to a desugared type. if (!Loc::isLocType(castTy)) { // FIXME: There can be gross cases where one casts the result of a function // (that returns a pointer) to some other value that happens to fit // within that pointer value. We currently have no good way to // model such operations. When this happens, the underlying operation // is that the caller is reasoning about bits. Conceptually we are // layering a "view" of a location on top of those bits. Perhaps // we need to be more lazy about mutual possible views, even on an // SVal? This may be necessary for bit-level reasoning as well. return UnknownVal(); } // We get a symbolic function pointer for a dereference of a function // pointer, but it is of function type. Example: // struct FPRec { // void (*my_func)(int * x); // }; // // int bar(int x); // // int f1_a(struct FPRec* foo) { // int x; // (*foo->my_func)(&x); // return bar(x)+1; // no-warning // } assert(Loc::isLocType(originalTy) || originalTy->isFunctionType() || originalTy->isBlockPointerType() || castTy->isReferenceType()); StoreManager &storeMgr = StateMgr.getStoreManager(); // Delegate to store manager to get the result of casting a region to a // different type. If the MemRegion* returned is NULL, this expression // Evaluates to UnknownVal. R = storeMgr.castRegion(R, castTy); return R ? SVal(loc::MemRegionVal(R)) : UnknownVal(); } return dispatchCast(val, castTy); } @