516 lines
20 KiB
C++
516 lines
20 KiB
C++
//===- ExprEngineCXX.cpp - ExprEngine support for C++ -----------*- C++ -*-===//
|
|
//
|
|
// The LLVM Compiler Infrastructure
|
|
//
|
|
// This file is distributed under the University of Illinois Open Source
|
|
// License. See LICENSE.TXT for details.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// This file defines the C++ expression evaluation engine.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
|
|
#include "clang/AST/DeclCXX.h"
|
|
#include "clang/AST/StmtCXX.h"
|
|
#include "clang/Basic/PrettyStackTrace.h"
|
|
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
|
|
|
using namespace clang;
|
|
using namespace ento;
|
|
|
|
void ExprEngine::CreateCXXTemporaryObject(const MaterializeTemporaryExpr *ME,
|
|
ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
|
|
const Expr *tempExpr = ME->GetTemporaryExpr()->IgnoreParens();
|
|
ProgramStateRef state = Pred->getState();
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
|
|
state = createTemporaryRegionIfNeeded(state, LCtx, tempExpr, ME);
|
|
Bldr.generateNode(ME, Pred, state);
|
|
}
|
|
|
|
// FIXME: This is the sort of code that should eventually live in a Core
|
|
// checker rather than as a special case in ExprEngine.
|
|
void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
|
|
const CallEvent &Call) {
|
|
SVal ThisVal;
|
|
bool AlwaysReturnsLValue;
|
|
if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
|
|
assert(Ctor->getDecl()->isTrivial());
|
|
assert(Ctor->getDecl()->isCopyOrMoveConstructor());
|
|
ThisVal = Ctor->getCXXThisVal();
|
|
AlwaysReturnsLValue = false;
|
|
} else {
|
|
assert(cast<CXXMethodDecl>(Call.getDecl())->isTrivial());
|
|
assert(cast<CXXMethodDecl>(Call.getDecl())->getOverloadedOperator() ==
|
|
OO_Equal);
|
|
ThisVal = cast<CXXInstanceCall>(Call).getCXXThisVal();
|
|
AlwaysReturnsLValue = true;
|
|
}
|
|
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
|
|
ExplodedNodeSet Dst;
|
|
Bldr.takeNodes(Pred);
|
|
|
|
SVal V = Call.getArgSVal(0);
|
|
|
|
// If the value being copied is not unknown, load from its location to get
|
|
// an aggregate rvalue.
|
|
if (Optional<Loc> L = V.getAs<Loc>())
|
|
V = Pred->getState()->getSVal(*L);
|
|
else
|
|
assert(V.isUnknown());
|
|
|
|
const Expr *CallExpr = Call.getOriginExpr();
|
|
evalBind(Dst, CallExpr, Pred, ThisVal, V, true);
|
|
|
|
PostStmt PS(CallExpr, LCtx);
|
|
for (ExplodedNodeSet::iterator I = Dst.begin(), E = Dst.end();
|
|
I != E; ++I) {
|
|
ProgramStateRef State = (*I)->getState();
|
|
if (AlwaysReturnsLValue)
|
|
State = State->BindExpr(CallExpr, LCtx, ThisVal);
|
|
else
|
|
State = bindReturnValue(Call, LCtx, State);
|
|
Bldr.generateNode(PS, State, *I);
|
|
}
|
|
}
|
|
|
|
|
|
/// Returns a region representing the first element of a (possibly
|
|
/// multi-dimensional) array.
|
|
///
|
|
/// On return, \p Ty will be set to the base type of the array.
|
|
///
|
|
/// If the type is not an array type at all, the original value is returned.
|
|
static SVal makeZeroElementRegion(ProgramStateRef State, SVal LValue,
|
|
QualType &Ty) {
|
|
SValBuilder &SVB = State->getStateManager().getSValBuilder();
|
|
ASTContext &Ctx = SVB.getContext();
|
|
|
|
while (const ArrayType *AT = Ctx.getAsArrayType(Ty)) {
|
|
Ty = AT->getElementType();
|
|
LValue = State->getLValue(Ty, SVB.makeZeroArrayIndex(), LValue);
|
|
}
|
|
|
|
return LValue;
|
|
}
|
|
|
|
|
|
static const MemRegion *getRegionForConstructedObject(
|
|
const CXXConstructExpr *CE, ExplodedNode *Pred, ExprEngine &Eng,
|
|
unsigned int CurrStmtIdx) {
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
ProgramStateRef State = Pred->getState();
|
|
const NodeBuilderContext &CurrBldrCtx = Eng.getBuilderContext();
|
|
|
|
// See if we're constructing an existing region by looking at the next
|
|
// element in the CFG.
|
|
const CFGBlock *B = CurrBldrCtx.getBlock();
|
|
unsigned int NextStmtIdx = CurrStmtIdx + 1;
|
|
if (NextStmtIdx < B->size()) {
|
|
CFGElement Next = (*B)[NextStmtIdx];
|
|
|
|
// Is this a destructor? If so, we might be in the middle of an assignment
|
|
// to a local or member: look ahead one more element to see what we find.
|
|
while (Next.getAs<CFGImplicitDtor>() && NextStmtIdx + 1 < B->size()) {
|
|
++NextStmtIdx;
|
|
Next = (*B)[NextStmtIdx];
|
|
}
|
|
|
|
// Is this a constructor for a local variable?
|
|
if (Optional<CFGStmt> StmtElem = Next.getAs<CFGStmt>()) {
|
|
if (const DeclStmt *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
|
|
if (const VarDecl *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
|
|
if (Var->getInit() && Var->getInit()->IgnoreImplicit() == CE) {
|
|
SVal LValue = State->getLValue(Var, LCtx);
|
|
QualType Ty = Var->getType();
|
|
LValue = makeZeroElementRegion(State, LValue, Ty);
|
|
return LValue.getAsRegion();
|
|
}
|
|
}
|
|
}
|
|
}
|
|
|
|
// Is this a constructor for a member?
|
|
if (Optional<CFGInitializer> InitElem = Next.getAs<CFGInitializer>()) {
|
|
const CXXCtorInitializer *Init = InitElem->getInitializer();
|
|
assert(Init->isAnyMemberInitializer());
|
|
|
|
const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
|
|
Loc ThisPtr = Eng.getSValBuilder().getCXXThis(CurCtor,
|
|
LCtx->getCurrentStackFrame());
|
|
SVal ThisVal = State->getSVal(ThisPtr);
|
|
|
|
const ValueDecl *Field;
|
|
SVal FieldVal;
|
|
if (Init->isIndirectMemberInitializer()) {
|
|
Field = Init->getIndirectMember();
|
|
FieldVal = State->getLValue(Init->getIndirectMember(), ThisVal);
|
|
} else {
|
|
Field = Init->getMember();
|
|
FieldVal = State->getLValue(Init->getMember(), ThisVal);
|
|
}
|
|
|
|
QualType Ty = Field->getType();
|
|
FieldVal = makeZeroElementRegion(State, FieldVal, Ty);
|
|
return FieldVal.getAsRegion();
|
|
}
|
|
|
|
// FIXME: This will eventually need to handle new-expressions as well.
|
|
// Don't forget to update the pre-constructor initialization code in
|
|
// ExprEngine::VisitCXXConstructExpr.
|
|
}
|
|
|
|
// If we couldn't find an existing region to construct into, assume we're
|
|
// constructing a temporary.
|
|
MemRegionManager &MRMgr = Eng.getSValBuilder().getRegionManager();
|
|
return MRMgr.getCXXTempObjectRegion(CE, LCtx);
|
|
}
|
|
|
|
void ExprEngine::VisitCXXConstructExpr(const CXXConstructExpr *CE,
|
|
ExplodedNode *Pred,
|
|
ExplodedNodeSet &destNodes) {
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
ProgramStateRef State = Pred->getState();
|
|
|
|
const MemRegion *Target = nullptr;
|
|
|
|
// FIXME: Handle arrays, which run the same constructor for every element.
|
|
// For now, we just run the first constructor (which should still invalidate
|
|
// the entire array).
|
|
|
|
switch (CE->getConstructionKind()) {
|
|
case CXXConstructExpr::CK_Complete: {
|
|
Target = getRegionForConstructedObject(CE, Pred, *this, currStmtIdx);
|
|
break;
|
|
}
|
|
case CXXConstructExpr::CK_VirtualBase:
|
|
// Make sure we are not calling virtual base class initializers twice.
|
|
// Only the most-derived object should initialize virtual base classes.
|
|
if (const Stmt *Outer = LCtx->getCurrentStackFrame()->getCallSite()) {
|
|
const CXXConstructExpr *OuterCtor = dyn_cast<CXXConstructExpr>(Outer);
|
|
if (OuterCtor) {
|
|
switch (OuterCtor->getConstructionKind()) {
|
|
case CXXConstructExpr::CK_NonVirtualBase:
|
|
case CXXConstructExpr::CK_VirtualBase:
|
|
// Bail out!
|
|
destNodes.Add(Pred);
|
|
return;
|
|
case CXXConstructExpr::CK_Complete:
|
|
case CXXConstructExpr::CK_Delegating:
|
|
break;
|
|
}
|
|
}
|
|
}
|
|
// FALLTHROUGH
|
|
case CXXConstructExpr::CK_NonVirtualBase:
|
|
case CXXConstructExpr::CK_Delegating: {
|
|
const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
|
|
Loc ThisPtr = getSValBuilder().getCXXThis(CurCtor,
|
|
LCtx->getCurrentStackFrame());
|
|
SVal ThisVal = State->getSVal(ThisPtr);
|
|
|
|
if (CE->getConstructionKind() == CXXConstructExpr::CK_Delegating) {
|
|
Target = ThisVal.getAsRegion();
|
|
} else {
|
|
// Cast to the base type.
|
|
bool IsVirtual =
|
|
(CE->getConstructionKind() == CXXConstructExpr::CK_VirtualBase);
|
|
SVal BaseVal = getStoreManager().evalDerivedToBase(ThisVal, CE->getType(),
|
|
IsVirtual);
|
|
Target = BaseVal.getAsRegion();
|
|
}
|
|
break;
|
|
}
|
|
}
|
|
|
|
CallEventManager &CEMgr = getStateManager().getCallEventManager();
|
|
CallEventRef<CXXConstructorCall> Call =
|
|
CEMgr.getCXXConstructorCall(CE, Target, State, LCtx);
|
|
|
|
ExplodedNodeSet DstPreVisit;
|
|
getCheckerManager().runCheckersForPreStmt(DstPreVisit, Pred, CE, *this);
|
|
|
|
ExplodedNodeSet PreInitialized;
|
|
{
|
|
StmtNodeBuilder Bldr(DstPreVisit, PreInitialized, *currBldrCtx);
|
|
if (CE->requiresZeroInitialization()) {
|
|
// Type of the zero doesn't matter.
|
|
SVal ZeroVal = svalBuilder.makeZeroVal(getContext().CharTy);
|
|
|
|
for (ExplodedNodeSet::iterator I = DstPreVisit.begin(),
|
|
E = DstPreVisit.end();
|
|
I != E; ++I) {
|
|
ProgramStateRef State = (*I)->getState();
|
|
// FIXME: Once we properly handle constructors in new-expressions, we'll
|
|
// need to invalidate the region before setting a default value, to make
|
|
// sure there aren't any lingering bindings around. This probably needs
|
|
// to happen regardless of whether or not the object is zero-initialized
|
|
// to handle random fields of a placement-initialized object picking up
|
|
// old bindings. We might only want to do it when we need to, though.
|
|
// FIXME: This isn't actually correct for arrays -- we need to zero-
|
|
// initialize the entire array, not just the first element -- but our
|
|
// handling of arrays everywhere else is weak as well, so this shouldn't
|
|
// actually make things worse. Placement new makes this tricky as well,
|
|
// since it's then possible to be initializing one part of a multi-
|
|
// dimensional array.
|
|
State = State->bindDefault(loc::MemRegionVal(Target), ZeroVal);
|
|
Bldr.generateNode(CE, *I, State, /*tag=*/nullptr,
|
|
ProgramPoint::PreStmtKind);
|
|
}
|
|
}
|
|
}
|
|
|
|
ExplodedNodeSet DstPreCall;
|
|
getCheckerManager().runCheckersForPreCall(DstPreCall, PreInitialized,
|
|
*Call, *this);
|
|
|
|
ExplodedNodeSet DstEvaluated;
|
|
StmtNodeBuilder Bldr(DstPreCall, DstEvaluated, *currBldrCtx);
|
|
|
|
bool IsArray = isa<ElementRegion>(Target);
|
|
if (CE->getConstructor()->isTrivial() &&
|
|
CE->getConstructor()->isCopyOrMoveConstructor() &&
|
|
!IsArray) {
|
|
// FIXME: Handle other kinds of trivial constructors as well.
|
|
for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
|
|
I != E; ++I)
|
|
performTrivialCopy(Bldr, *I, *Call);
|
|
|
|
} else {
|
|
for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
|
|
I != E; ++I)
|
|
defaultEvalCall(Bldr, *I, *Call);
|
|
}
|
|
|
|
ExplodedNodeSet DstPostCall;
|
|
getCheckerManager().runCheckersForPostCall(DstPostCall, DstEvaluated,
|
|
*Call, *this);
|
|
getCheckerManager().runCheckersForPostStmt(destNodes, DstPostCall, CE, *this);
|
|
}
|
|
|
|
void ExprEngine::VisitCXXDestructor(QualType ObjectType,
|
|
const MemRegion *Dest,
|
|
const Stmt *S,
|
|
bool IsBaseDtor,
|
|
ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
ProgramStateRef State = Pred->getState();
|
|
|
|
// FIXME: We need to run the same destructor on every element of the array.
|
|
// This workaround will just run the first destructor (which will still
|
|
// invalidate the entire array).
|
|
SVal DestVal = UnknownVal();
|
|
if (Dest)
|
|
DestVal = loc::MemRegionVal(Dest);
|
|
DestVal = makeZeroElementRegion(State, DestVal, ObjectType);
|
|
Dest = DestVal.getAsRegion();
|
|
|
|
const CXXRecordDecl *RecordDecl = ObjectType->getAsCXXRecordDecl();
|
|
assert(RecordDecl && "Only CXXRecordDecls should have destructors");
|
|
const CXXDestructorDecl *DtorDecl = RecordDecl->getDestructor();
|
|
|
|
CallEventManager &CEMgr = getStateManager().getCallEventManager();
|
|
CallEventRef<CXXDestructorCall> Call =
|
|
CEMgr.getCXXDestructorCall(DtorDecl, S, Dest, IsBaseDtor, State, LCtx);
|
|
|
|
PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
|
|
Call->getSourceRange().getBegin(),
|
|
"Error evaluating destructor");
|
|
|
|
ExplodedNodeSet DstPreCall;
|
|
getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
|
|
*Call, *this);
|
|
|
|
ExplodedNodeSet DstInvalidated;
|
|
StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
|
|
for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
|
|
I != E; ++I)
|
|
defaultEvalCall(Bldr, *I, *Call);
|
|
|
|
ExplodedNodeSet DstPostCall;
|
|
getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
|
|
*Call, *this);
|
|
}
|
|
|
|
void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
|
|
ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
ProgramStateRef State = Pred->getState();
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
PrettyStackTraceLoc CrashInfo(getContext().getSourceManager(),
|
|
CNE->getStartLoc(),
|
|
"Error evaluating New Allocator Call");
|
|
CallEventManager &CEMgr = getStateManager().getCallEventManager();
|
|
CallEventRef<CXXAllocatorCall> Call =
|
|
CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
|
|
|
|
ExplodedNodeSet DstPreCall;
|
|
getCheckerManager().runCheckersForPreCall(DstPreCall, Pred,
|
|
*Call, *this);
|
|
|
|
ExplodedNodeSet DstInvalidated;
|
|
StmtNodeBuilder Bldr(DstPreCall, DstInvalidated, *currBldrCtx);
|
|
for (ExplodedNodeSet::iterator I = DstPreCall.begin(), E = DstPreCall.end();
|
|
I != E; ++I)
|
|
defaultEvalCall(Bldr, *I, *Call);
|
|
getCheckerManager().runCheckersForPostCall(Dst, DstInvalidated,
|
|
*Call, *this);
|
|
}
|
|
|
|
|
|
void ExprEngine::VisitCXXNewExpr(const CXXNewExpr *CNE, ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
// FIXME: Much of this should eventually migrate to CXXAllocatorCall.
|
|
// Also, we need to decide how allocators actually work -- they're not
|
|
// really part of the CXXNewExpr because they happen BEFORE the
|
|
// CXXConstructExpr subexpression. See PR12014 for some discussion.
|
|
|
|
unsigned blockCount = currBldrCtx->blockCount();
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
DefinedOrUnknownSVal symVal = UnknownVal();
|
|
FunctionDecl *FD = CNE->getOperatorNew();
|
|
|
|
bool IsStandardGlobalOpNewFunction = false;
|
|
if (FD && !isa<CXXMethodDecl>(FD) && !FD->isVariadic()) {
|
|
if (FD->getNumParams() == 2) {
|
|
QualType T = FD->getParamDecl(1)->getType();
|
|
if (const IdentifierInfo *II = T.getBaseTypeIdentifier())
|
|
// NoThrow placement new behaves as a standard new.
|
|
IsStandardGlobalOpNewFunction = II->getName().equals("nothrow_t");
|
|
}
|
|
else
|
|
// Placement forms are considered non-standard.
|
|
IsStandardGlobalOpNewFunction = (FD->getNumParams() == 1);
|
|
}
|
|
|
|
// We assume all standard global 'operator new' functions allocate memory in
|
|
// heap. We realize this is an approximation that might not correctly model
|
|
// a custom global allocator.
|
|
if (IsStandardGlobalOpNewFunction)
|
|
symVal = svalBuilder.getConjuredHeapSymbolVal(CNE, LCtx, blockCount);
|
|
else
|
|
symVal = svalBuilder.conjureSymbolVal(nullptr, CNE, LCtx, CNE->getType(),
|
|
blockCount);
|
|
|
|
ProgramStateRef State = Pred->getState();
|
|
CallEventManager &CEMgr = getStateManager().getCallEventManager();
|
|
CallEventRef<CXXAllocatorCall> Call =
|
|
CEMgr.getCXXAllocatorCall(CNE, State, LCtx);
|
|
|
|
// Invalidate placement args.
|
|
// FIXME: Once we figure out how we want allocators to work,
|
|
// we should be using the usual pre-/(default-)eval-/post-call checks here.
|
|
State = Call->invalidateRegions(blockCount);
|
|
if (!State)
|
|
return;
|
|
|
|
// If this allocation function is not declared as non-throwing, failures
|
|
// /must/ be signalled by exceptions, and thus the return value will never be
|
|
// NULL. -fno-exceptions does not influence this semantics.
|
|
// FIXME: GCC has a -fcheck-new option, which forces it to consider the case
|
|
// where new can return NULL. If we end up supporting that option, we can
|
|
// consider adding a check for it here.
|
|
// C++11 [basic.stc.dynamic.allocation]p3.
|
|
if (FD) {
|
|
QualType Ty = FD->getType();
|
|
if (const FunctionProtoType *ProtoType = Ty->getAs<FunctionProtoType>())
|
|
if (!ProtoType->isNothrow(getContext()))
|
|
State = State->assume(symVal, true);
|
|
}
|
|
|
|
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
|
|
|
|
if (CNE->isArray()) {
|
|
// FIXME: allocating an array requires simulating the constructors.
|
|
// For now, just return a symbolicated region.
|
|
const MemRegion *NewReg = symVal.castAs<loc::MemRegionVal>().getRegion();
|
|
QualType ObjTy = CNE->getType()->getAs<PointerType>()->getPointeeType();
|
|
const ElementRegion *EleReg =
|
|
getStoreManager().GetElementZeroRegion(NewReg, ObjTy);
|
|
State = State->BindExpr(CNE, Pred->getLocationContext(),
|
|
loc::MemRegionVal(EleReg));
|
|
Bldr.generateNode(CNE, Pred, State);
|
|
return;
|
|
}
|
|
|
|
// FIXME: Once we have proper support for CXXConstructExprs inside
|
|
// CXXNewExpr, we need to make sure that the constructed object is not
|
|
// immediately invalidated here. (The placement call should happen before
|
|
// the constructor call anyway.)
|
|
SVal Result = symVal;
|
|
if (FD && FD->isReservedGlobalPlacementOperator()) {
|
|
// Non-array placement new should always return the placement location.
|
|
SVal PlacementLoc = State->getSVal(CNE->getPlacementArg(0), LCtx);
|
|
Result = svalBuilder.evalCast(PlacementLoc, CNE->getType(),
|
|
CNE->getPlacementArg(0)->getType());
|
|
}
|
|
|
|
// Bind the address of the object, then check to see if we cached out.
|
|
State = State->BindExpr(CNE, LCtx, Result);
|
|
ExplodedNode *NewN = Bldr.generateNode(CNE, Pred, State);
|
|
if (!NewN)
|
|
return;
|
|
|
|
// If the type is not a record, we won't have a CXXConstructExpr as an
|
|
// initializer. Copy the value over.
|
|
if (const Expr *Init = CNE->getInitializer()) {
|
|
if (!isa<CXXConstructExpr>(Init)) {
|
|
assert(Bldr.getResults().size() == 1);
|
|
Bldr.takeNodes(NewN);
|
|
evalBind(Dst, CNE, NewN, Result, State->getSVal(Init, LCtx),
|
|
/*FirstInit=*/IsStandardGlobalOpNewFunction);
|
|
}
|
|
}
|
|
}
|
|
|
|
void ExprEngine::VisitCXXDeleteExpr(const CXXDeleteExpr *CDE,
|
|
ExplodedNode *Pred, ExplodedNodeSet &Dst) {
|
|
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
|
|
ProgramStateRef state = Pred->getState();
|
|
Bldr.generateNode(CDE, Pred, state);
|
|
}
|
|
|
|
void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS,
|
|
ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
const VarDecl *VD = CS->getExceptionDecl();
|
|
if (!VD) {
|
|
Dst.Add(Pred);
|
|
return;
|
|
}
|
|
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
SVal V = svalBuilder.conjureSymbolVal(CS, LCtx, VD->getType(),
|
|
currBldrCtx->blockCount());
|
|
ProgramStateRef state = Pred->getState();
|
|
state = state->bindLoc(state->getLValue(VD, LCtx), V);
|
|
|
|
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
|
|
Bldr.generateNode(CS, Pred, state);
|
|
}
|
|
|
|
void ExprEngine::VisitCXXThisExpr(const CXXThisExpr *TE, ExplodedNode *Pred,
|
|
ExplodedNodeSet &Dst) {
|
|
StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx);
|
|
|
|
// Get the this object region from StoreManager.
|
|
const LocationContext *LCtx = Pred->getLocationContext();
|
|
const MemRegion *R =
|
|
svalBuilder.getRegionManager().getCXXThisRegion(
|
|
getContext().getCanonicalType(TE->getType()),
|
|
LCtx);
|
|
|
|
ProgramStateRef state = Pred->getState();
|
|
SVal V = state->getSVal(loc::MemRegionVal(R));
|
|
Bldr.generateNode(TE, Pred, state->BindExpr(TE, LCtx, V));
|
|
}
|