@@ -77,7 +77,7 @@ void ExprEngine::performTrivialCopy(NodeBuilder &Bldr, ExplodedNode *Pred,
7777 V = Pred->getState ()->getSVal (*L);
7878 else
7979 assert (V.isUnknownOrUndef ());
80-
80+
8181 ExplodedNodeSet Tmp;
8282 evalLocation (Tmp, CallExpr, VExpr, Pred, Pred->getState (), V, true );
8383 for (ExplodedNode *N : Tmp)
@@ -146,9 +146,10 @@ SVal ExprEngine::computeObjectUnderConstruction(
146146 if (Init->isBaseInitializer ()) {
147147 const auto *ThisReg = cast<SubRegion>(ThisVal.getAsRegion ());
148148 const CXXRecordDecl *BaseClass =
149- Init->getBaseClass ()->getAsCXXRecordDecl ();
150- const auto *BaseReg = MRMgr.getCXXBaseObjectRegion (
151- BaseClass, ThisReg, Init->isBaseVirtual ());
149+ Init->getBaseClass ()->getAsCXXRecordDecl ();
150+ const auto *BaseReg =
151+ MRMgr.getCXXBaseObjectRegion (BaseClass, ThisReg,
152+ Init->isBaseVirtual ());
152153 return SVB.makeLoc (BaseReg);
153154 }
154155 if (Init->isDelegatingInitializer ())
@@ -187,7 +188,7 @@ SVal ExprEngine::computeObjectUnderConstruction(
187188
188189 return loc::MemRegionVal (R);
189190 }
190- return V;
191+ return V;
191192 }
192193 // TODO: Detect when the allocator returns a null pointer.
193194 // Constructor shall not be called in this case.
@@ -409,99 +410,99 @@ ProgramStateRef ExprEngine::updateObjectsUnderConstruction(
409410 case ConstructionContext::SimpleVariableKind: {
410411 const auto *DSCC = cast<VariableConstructionContext>(CC);
411412 return addObjectUnderConstruction (State, DSCC->getDeclStmt (), LCtx, V);
412- }
413- case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
414- case ConstructionContext::SimpleConstructorInitializerKind: {
415- const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC);
416- const auto *Init = ICC->getCXXCtorInitializer ();
417- // Base and delegating initializers handled above
418- assert (Init->isAnyMemberInitializer () &&
419- " Base and delegating initializers should have been handled by"
420- " computeObjectUnderConstruction()" );
421- return addObjectUnderConstruction (State, Init, LCtx, V);
422- }
423- case ConstructionContext::NewAllocatedObjectKind: {
424- return State;
425- }
426- case ConstructionContext::SimpleReturnedValueKind:
427- case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
428- const StackFrameContext *SFC = LCtx->getStackFrame ();
429- const LocationContext *CallerLCtx = SFC->getParent ();
430- if (!CallerLCtx) {
431- // No extra work is necessary in top frame.
432- return State;
433413 }
434-
435- auto RTC = (*SFC-> getCallSiteBlock ())[SFC-> getIndex ()]
436- . getAs <CFGCXXRecordTypedCall>( );
437- assert (RTC && " Could not have had a target region without it " );
438- if (isa<BlockInvocationContext>(CallerLCtx)) {
439- // Unwrap block invocation contexts. They're mostly part of
440- // the current stack frame.
441- CallerLCtx = CallerLCtx-> getParent ( );
442- assert (!isa<BlockInvocationContext>(CallerLCtx) );
414+ case ConstructionContext::CXX17ElidedCopyConstructorInitializerKind:
415+ case ConstructionContext::SimpleConstructorInitializerKind: {
416+ const auto *ICC = cast<ConstructorInitializerConstructionContext>(CC );
417+ const auto *Init = ICC-> getCXXCtorInitializer ( );
418+ // Base and delegating initializers handled above
419+ assert (Init-> isAnyMemberInitializer () &&
420+ " Base and delegating initializers should have been handled by "
421+ " computeObjectUnderConstruction() " );
422+ return addObjectUnderConstruction (State, Init, LCtx, V );
443423 }
424+ case ConstructionContext::NewAllocatedObjectKind: {
425+ return State;
426+ }
427+ case ConstructionContext::SimpleReturnedValueKind:
428+ case ConstructionContext::CXX17ElidedCopyReturnedValueKind: {
429+ const StackFrameContext *SFC = LCtx->getStackFrame ();
430+ const LocationContext *CallerLCtx = SFC->getParent ();
431+ if (!CallerLCtx) {
432+ // No extra work is necessary in top frame.
433+ return State;
434+ }
444435
445- return updateObjectsUnderConstruction (
446- V, cast<Expr>(SFC->getCallSite ()), State, CallerLCtx,
447- RTC->getConstructionContext (), CallOpts);
448- }
449- case ConstructionContext::ElidedTemporaryObjectKind: {
450- assert (AMgr.getAnalyzerOptions ().ShouldElideConstructors );
451- if (!CallOpts.IsElidableCtorThatHasNotBeenElided ) {
452- const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
453- State = updateObjectsUnderConstruction (
454- V, TCC->getConstructorAfterElision (), State, LCtx,
455- TCC->getConstructionContextAfterElision (), CallOpts);
456-
457- // Remember that we've elided the constructor.
458- State = addObjectUnderConstruction (
459- State, TCC->getConstructorAfterElision (), LCtx, V);
436+ auto RTC = (*SFC->getCallSiteBlock ())[SFC->getIndex ()]
437+ .getAs <CFGCXXRecordTypedCall>();
438+ assert (RTC && " Could not have had a target region without it" );
439+ if (isa<BlockInvocationContext>(CallerLCtx)) {
440+ // Unwrap block invocation contexts. They're mostly part of
441+ // the current stack frame.
442+ CallerLCtx = CallerLCtx->getParent ();
443+ assert (!isa<BlockInvocationContext>(CallerLCtx));
444+ }
460445
461- // Remember that we've elided the destructor.
446+ return updateObjectsUnderConstruction (V,
447+ cast<Expr>(SFC->getCallSite ()), State, CallerLCtx,
448+ RTC->getConstructionContext (), CallOpts);
449+ }
450+ case ConstructionContext::ElidedTemporaryObjectKind: {
451+ assert (AMgr.getAnalyzerOptions ().ShouldElideConstructors );
452+ if (!CallOpts.IsElidableCtorThatHasNotBeenElided ) {
453+ const auto *TCC = cast<ElidedTemporaryObjectConstructionContext>(CC);
454+ State = updateObjectsUnderConstruction (
455+ V, TCC->getConstructorAfterElision (), State, LCtx,
456+ TCC->getConstructionContextAfterElision (), CallOpts);
457+
458+ // Remember that we've elided the constructor.
459+ State = addObjectUnderConstruction (
460+ State, TCC->getConstructorAfterElision (), LCtx, V);
461+
462+ // Remember that we've elided the destructor.
463+ if (const auto *BTE = TCC->getCXXBindTemporaryExpr ())
464+ State = elideDestructor (State, BTE, LCtx);
465+
466+ // Instead of materialization, shamelessly return
467+ // the final object destination.
468+ if (const auto *MTE = TCC->getMaterializedTemporaryExpr ())
469+ State = addObjectUnderConstruction (State, MTE, LCtx, V);
470+
471+ return State;
472+ }
473+ // If we decided not to elide the constructor, proceed as if
474+ // it's a simple temporary.
475+ [[fallthrough]];
476+ }
477+ case ConstructionContext::SimpleTemporaryObjectKind: {
478+ const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
462479 if (const auto *BTE = TCC->getCXXBindTemporaryExpr ())
463- State = elideDestructor (State, BTE, LCtx);
480+ State = addObjectUnderConstruction (State, BTE, LCtx, V );
464481
465- // Instead of materialization, shamelessly return
466- // the final object destination.
467482 if (const auto *MTE = TCC->getMaterializedTemporaryExpr ())
468483 State = addObjectUnderConstruction (State, MTE, LCtx, V);
469484
470485 return State;
471486 }
472- // If we decided not to elide the constructor, proceed as if
473- // it's a simple temporary.
474- [[fallthrough]];
475- }
476- case ConstructionContext::SimpleTemporaryObjectKind: {
477- const auto *TCC = cast<TemporaryObjectConstructionContext>(CC);
478- if (const auto *BTE = TCC->getCXXBindTemporaryExpr ())
479- State = addObjectUnderConstruction (State, BTE, LCtx, V);
480-
481- if (const auto *MTE = TCC->getMaterializedTemporaryExpr ())
482- State = addObjectUnderConstruction (State, MTE, LCtx, V);
483-
484- return State;
485- }
486- case ConstructionContext::LambdaCaptureKind: {
487- const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
487+ case ConstructionContext::LambdaCaptureKind: {
488+ const auto *LCC = cast<LambdaCaptureConstructionContext>(CC);
488489
489- // If we capture and array, we want to store the super region, not a
490- // sub-region.
491- if (const auto *EL = dyn_cast_or_null<ElementRegion>(V.getAsRegion ()))
492- V = loc::MemRegionVal (EL->getSuperRegion ());
490+ // If we capture and array, we want to store the super region, not a
491+ // sub-region.
492+ if (const auto *EL = dyn_cast_or_null<ElementRegion>(V.getAsRegion ()))
493+ V = loc::MemRegionVal (EL->getSuperRegion ());
493494
494- return addObjectUnderConstruction (
495- State, {LCC->getLambdaExpr (), LCC->getIndex ()}, LCtx, V);
496- }
497- case ConstructionContext::ArgumentKind: {
498- const auto *ACC = cast<ArgumentConstructionContext>(CC);
499- if (const auto *BTE = ACC->getCXXBindTemporaryExpr ())
500- State = addObjectUnderConstruction (State, BTE, LCtx, V);
495+ return addObjectUnderConstruction (
496+ State, {LCC->getLambdaExpr (), LCC->getIndex ()}, LCtx, V);
497+ }
498+ case ConstructionContext::ArgumentKind: {
499+ const auto *ACC = cast<ArgumentConstructionContext>(CC);
500+ if (const auto *BTE = ACC->getCXXBindTemporaryExpr ())
501+ State = addObjectUnderConstruction (State, BTE, LCtx, V);
501502
502- return addObjectUnderConstruction (
503- State, {ACC->getCallLikeExpr (), ACC->getIndex ()}, LCtx, V);
504- }
503+ return addObjectUnderConstruction (
504+ State, {ACC->getCallLikeExpr (), ACC->getIndex ()}, LCtx, V);
505+ }
505506 }
506507 llvm_unreachable (" Unhandled construction context!" );
507508}
@@ -530,7 +531,8 @@ bindRequiredArrayElementToEnvironment(ProgramStateRef State,
530531 loc::MemRegionVal (ElementRegion));
531532}
532533
533- void ExprEngine::handleConstructor (const Expr *E, ExplodedNode *Pred,
534+ void ExprEngine::handleConstructor (const Expr *E,
535+ ExplodedNode *Pred,
534536 ExplodedNodeSet &destNodes) {
535537 const auto *CE = dyn_cast<CXXConstructExpr>(E);
536538 const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(E);
@@ -544,16 +546,16 @@ void ExprEngine::handleConstructor(const Expr *E, ExplodedNode *Pred,
544546 if (CE) {
545547 if (std::optional<SVal> ElidedTarget =
546548 getObjectUnderConstruction (State, CE, LCtx)) {
547- // We've previously modeled an elidable constructor by pretending that
548- // it in fact constructs into the correct target. This constructor can
549- // therefore be skipped.
550- Target = *ElidedTarget;
551- StmtNodeBuilder Bldr (Pred, destNodes, *currBldrCtx);
552- State = finishObjectConstruction (State, CE, LCtx);
553- if (auto L = Target.getAs <Loc>())
554- State = State->BindExpr (CE, LCtx, State->getSVal (*L, CE->getType ()));
555- Bldr.generateNode (CE, Pred, State);
556- return ;
549+ // We've previously modeled an elidable constructor by pretending that
550+ // it in fact constructs into the correct target. This constructor can
551+ // therefore be skipped.
552+ Target = *ElidedTarget;
553+ StmtNodeBuilder Bldr (Pred, destNodes, *currBldrCtx);
554+ State = finishObjectConstruction (State, CE, LCtx);
555+ if (auto L = Target.getAs <Loc>())
556+ State = State->BindExpr (CE, LCtx, State->getSVal (*L, CE->getType ()));
557+ Bldr.generateNode (CE, Pred, State);
558+ return ;
557559 }
558560 }
559561
@@ -651,7 +653,8 @@ void ExprEngine::handleConstructor(const Expr *E, ExplodedNode *Pred,
651653 [[fallthrough]];
652654 case CXXConstructionKind::Delegating: {
653655 const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl ());
654- Loc ThisPtr = getSValBuilder ().getCXXThis (CurCtor, LCtx->getStackFrame ());
656+ Loc ThisPtr = getSValBuilder ().getCXXThis (CurCtor,
657+ LCtx->getStackFrame ());
655658 SVal ThisVal = State->getSVal (ThisPtr);
656659
657660 if (CK == CXXConstructionKind::Delegating) {
@@ -720,8 +723,8 @@ void ExprEngine::handleConstructor(const Expr *E, ExplodedNode *Pred,
720723 }
721724
722725 ExplodedNodeSet DstPreCall;
723- getCheckerManager ().runCheckersForPreCall (DstPreCall, PreInitialized, *Call,
724- *this );
726+ getCheckerManager ().runCheckersForPreCall (DstPreCall, PreInitialized,
727+ *Call, * this );
725728
726729 ExplodedNodeSet DstEvaluated;
727730
@@ -784,8 +787,9 @@ void ExprEngine::handleConstructor(const Expr *E, ExplodedNode *Pred,
784787 // If there were other constructors called for object-type arguments
785788 // of this constructor, clean them up.
786789 ExplodedNodeSet DstPostCall;
787- getCheckerManager ().runCheckersForPostCall (
788- DstPostCall, DstPostArgumentCleanup, *Call, *this );
790+ getCheckerManager ().runCheckersForPostCall (DstPostCall,
791+ DstPostArgumentCleanup,
792+ *Call, *this );
789793 getCheckerManager ().runCheckersForPostStmt (destNodes, DstPostCall, E, *this );
790794}
791795
@@ -801,9 +805,12 @@ void ExprEngine::VisitCXXInheritedCtorInitExpr(
801805 handleConstructor (CE, Pred, Dst);
802806}
803807
804- void ExprEngine::VisitCXXDestructor (QualType ObjectType, const MemRegion *Dest,
805- const Stmt *S, bool IsBaseDtor,
806- ExplodedNode *Pred, ExplodedNodeSet &Dst,
808+ void ExprEngine::VisitCXXDestructor (QualType ObjectType,
809+ const MemRegion *Dest,
810+ const Stmt *S,
811+ bool IsBaseDtor,
812+ ExplodedNode *Pred,
813+ ExplodedNodeSet &Dst,
807814 EvalCallOptions &CallOpts) {
808815 assert (S && " A destructor without a trigger!" );
809816 const LocationContext *LCtx = Pred->getLocationContext ();
@@ -838,8 +845,8 @@ void ExprEngine::VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
838845 } else {
839846 static SimpleProgramPointTag T (" ExprEngine" , " SkipInvalidDestructor" );
840847 NodeBuilder Bldr (Pred, Dst, *currBldrCtx);
841- Bldr.generateSink (Pred->getLocation ().withTag (&T), Pred-> getState (),
842- Pred);
848+ Bldr.generateSink (Pred->getLocation ().withTag (&T),
849+ Pred-> getState (), Pred );
843850 return ;
844851 }
845852 }
@@ -853,14 +860,16 @@ void ExprEngine::VisitCXXDestructor(QualType ObjectType, const MemRegion *Dest,
853860 " Error evaluating destructor" );
854861
855862 ExplodedNodeSet DstPreCall;
856- getCheckerManager ().runCheckersForPreCall (DstPreCall, Pred, *Call, *this );
863+ getCheckerManager ().runCheckersForPreCall (DstPreCall, Pred,
864+ *Call, *this );
857865
858866 ExplodedNodeSet DstInvalidated;
859867 StmtNodeBuilder Bldr (DstPreCall, DstInvalidated, *currBldrCtx);
860868 for (ExplodedNode *N : DstPreCall)
861869 defaultEvalCall (Bldr, N, *Call, CallOpts);
862870
863- getCheckerManager ().runCheckersForPostCall (Dst, DstInvalidated, *Call, *this );
871+ getCheckerManager ().runCheckersForPostCall (Dst, DstInvalidated,
872+ *Call, *this );
864873}
865874
866875void ExprEngine::VisitCXXNewAllocatorCall (const CXXNewExpr *CNE,
@@ -876,7 +885,8 @@ void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
876885 CEMgr.getCXXAllocatorCall (CNE, State, LCtx, getCFGElementRef ());
877886
878887 ExplodedNodeSet DstPreCall;
879- getCheckerManager ().runCheckersForPreCall (DstPreCall, Pred, *Call, *this );
888+ getCheckerManager ().runCheckersForPreCall (DstPreCall, Pred,
889+ *Call, *this );
880890
881891 ExplodedNodeSet DstPostCall;
882892 StmtNodeBuilder CallBldr (DstPreCall, DstPostCall, *currBldrCtx);
@@ -935,7 +945,7 @@ void ExprEngine::VisitCXXNewAllocatorCall(const CXXNewExpr *CNE,
935945}
936946
937947void ExprEngine::VisitCXXNewExpr (const CXXNewExpr *CNE, ExplodedNode *Pred,
938- ExplodedNodeSet &Dst) {
948+ ExplodedNodeSet &Dst) {
939949 // FIXME: Much of this should eventually migrate to CXXAllocatorCall.
940950 // Also, we need to decide how allocators actually work -- they're not
941951 // really part of the CXXNewExpr because they happen BEFORE the
@@ -1107,13 +1117,15 @@ void ExprEngine::VisitCXXCatchStmt(const CXXCatchStmt *CS, ExplodedNode *Pred,
11071117}
11081118
11091119void ExprEngine::VisitCXXThisExpr (const CXXThisExpr *TE, ExplodedNode *Pred,
1110- ExplodedNodeSet &Dst) {
1120+ ExplodedNodeSet &Dst) {
11111121 StmtNodeBuilder Bldr (Pred, Dst, *currBldrCtx);
11121122
11131123 // Get the this object region from StoreManager.
11141124 const LocationContext *LCtx = Pred->getLocationContext ();
1115- const MemRegion *R = svalBuilder.getRegionManager ().getCXXThisRegion (
1116- getContext ().getCanonicalType (TE->getType ()), LCtx);
1125+ const MemRegion *R =
1126+ svalBuilder.getRegionManager ().getCXXThisRegion (
1127+ getContext ().getCanonicalType (TE->getType ()),
1128+ LCtx);
11171129
11181130 ProgramStateRef state = Pred->getState ();
11191131 SVal V = state->getSVal (loc::MemRegionVal (R));
@@ -1125,8 +1137,8 @@ void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
11251137 const LocationContext *LocCtxt = Pred->getLocationContext ();
11261138
11271139 // Get the region of the lambda itself.
1128- const MemRegion *R =
1129- svalBuilder. getRegionManager (). getCXXTempObjectRegion ( LE, LocCtxt);
1140+ const MemRegion *R = svalBuilder. getRegionManager (). getCXXTempObjectRegion (
1141+ LE, LocCtxt);
11301142 SVal V = loc::MemRegionVal (R);
11311143
11321144 ProgramStateRef State = Pred->getState ();
@@ -1186,8 +1198,9 @@ void ExprEngine::VisitLambdaExpr(const LambdaExpr *LE, ExplodedNode *Pred,
11861198 ExplodedNodeSet Tmp;
11871199 StmtNodeBuilder Bldr (Pred, Tmp, *currBldrCtx);
11881200 // FIXME: is this the right program point kind?
1189- Bldr.generateNode (LE, Pred, State->BindExpr (LE, LocCtxt, LambdaRVal), nullptr ,
1190- ProgramPoint::PostLValueKind);
1201+ Bldr.generateNode (LE, Pred,
1202+ State->BindExpr (LE, LocCtxt, LambdaRVal),
1203+ nullptr , ProgramPoint::PostLValueKind);
11911204
11921205 // FIXME: Move all post/pre visits to ::Visit().
11931206 getCheckerManager ().runCheckersForPostStmt (Dst, Tmp, LE, *this );
0 commit comments