1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines ExprEngine's support for C expressions. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "clang/AST/DeclCXX.h" 14 #include "clang/AST/ExprCXX.h" 15 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 16 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17 #include <optional> 18 19 using namespace clang; 20 using namespace ento; 21 using llvm::APSInt; 22 23 /// Optionally conjure and return a symbol for offset when processing 24 /// an expression \p Expression. 25 /// If \p Other is a location, conjure a symbol for \p Symbol 26 /// (offset) if it is unknown so that memory arithmetic always 27 /// results in an ElementRegion. 28 /// \p Count The number of times the current basic block was visited. 29 static SVal conjureOffsetSymbolOnLocation( 30 SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder, 31 unsigned Count, const LocationContext *LCtx) { 32 QualType Ty = Expression->getType(); 33 if (isa<Loc>(Other) && Ty->isIntegralOrEnumerationType() && 34 Symbol.isUnknown()) { 35 return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count); 36 } 37 return Symbol; 38 } 39 40 void ExprEngine::VisitBinaryOperator(const BinaryOperator* B, 41 ExplodedNode *Pred, 42 ExplodedNodeSet &Dst) { 43 44 Expr *LHS = B->getLHS()->IgnoreParens(); 45 Expr *RHS = B->getRHS()->IgnoreParens(); 46 47 // FIXME: Prechecks eventually go in ::Visit(). 48 ExplodedNodeSet CheckedSet; 49 ExplodedNodeSet Tmp2; 50 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this); 51 52 // With both the LHS and RHS evaluated, process the operation itself. 53 for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end(); 54 it != ei; ++it) { 55 56 ProgramStateRef state = (*it)->getState(); 57 const LocationContext *LCtx = (*it)->getLocationContext(); 58 SVal LeftV = state->getSVal(LHS, LCtx); 59 SVal RightV = state->getSVal(RHS, LCtx); 60 61 BinaryOperator::Opcode Op = B->getOpcode(); 62 63 if (Op == BO_Assign) { 64 // EXPERIMENTAL: "Conjured" symbols. 65 // FIXME: Handle structs. 66 if (RightV.isUnknown()) { 67 unsigned Count = currBldrCtx->blockCount(); 68 RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, 69 Count); 70 } 71 // Simulate the effects of a "store": bind the value of the RHS 72 // to the L-Value represented by the LHS. 73 SVal ExprVal = B->isGLValue() ? LeftV : RightV; 74 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal), 75 LeftV, RightV); 76 continue; 77 } 78 79 if (!B->isAssignmentOp()) { 80 StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx); 81 82 if (B->isAdditiveOp()) { 83 // TODO: This can be removed after we enable history tracking with 84 // SymSymExpr. 85 unsigned Count = currBldrCtx->blockCount(); 86 RightV = conjureOffsetSymbolOnLocation( 87 RightV, LeftV, RHS, svalBuilder, Count, LCtx); 88 LeftV = conjureOffsetSymbolOnLocation( 89 LeftV, RightV, LHS, svalBuilder, Count, LCtx); 90 } 91 92 // Although we don't yet model pointers-to-members, we do need to make 93 // sure that the members of temporaries have a valid 'this' pointer for 94 // other checks. 95 if (B->getOpcode() == BO_PtrMemD) 96 state = createTemporaryRegionIfNeeded(state, LCtx, LHS); 97 98 // Process non-assignments except commas or short-circuited 99 // logical expressions (LAnd and LOr). 100 SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); 101 if (!Result.isUnknown()) { 102 state = state->BindExpr(B, LCtx, Result); 103 } else { 104 // If we cannot evaluate the operation escape the operands. 105 state = escapeValues(state, LeftV, PSK_EscapeOther); 106 state = escapeValues(state, RightV, PSK_EscapeOther); 107 } 108 109 Bldr.generateNode(B, *it, state); 110 continue; 111 } 112 113 assert (B->isCompoundAssignmentOp()); 114 115 switch (Op) { 116 default: 117 llvm_unreachable("Invalid opcode for compound assignment."); 118 case BO_MulAssign: Op = BO_Mul; break; 119 case BO_DivAssign: Op = BO_Div; break; 120 case BO_RemAssign: Op = BO_Rem; break; 121 case BO_AddAssign: Op = BO_Add; break; 122 case BO_SubAssign: Op = BO_Sub; break; 123 case BO_ShlAssign: Op = BO_Shl; break; 124 case BO_ShrAssign: Op = BO_Shr; break; 125 case BO_AndAssign: Op = BO_And; break; 126 case BO_XorAssign: Op = BO_Xor; break; 127 case BO_OrAssign: Op = BO_Or; break; 128 } 129 130 // Perform a load (the LHS). This performs the checks for 131 // null dereferences, and so on. 132 ExplodedNodeSet Tmp; 133 SVal location = LeftV; 134 evalLoad(Tmp, B, LHS, *it, state, location); 135 136 for (ExplodedNode *N : Tmp) { 137 state = N->getState(); 138 const LocationContext *LCtx = N->getLocationContext(); 139 SVal V = state->getSVal(LHS, LCtx); 140 141 // Get the computation type. 142 QualType CTy = 143 cast<CompoundAssignOperator>(B)->getComputationResultType(); 144 CTy = getContext().getCanonicalType(CTy); 145 146 QualType CLHSTy = 147 cast<CompoundAssignOperator>(B)->getComputationLHSType(); 148 CLHSTy = getContext().getCanonicalType(CLHSTy); 149 150 QualType LTy = getContext().getCanonicalType(LHS->getType()); 151 152 // Promote LHS. 153 V = svalBuilder.evalCast(V, CLHSTy, LTy); 154 155 // Compute the result of the operation. 156 SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), 157 B->getType(), CTy); 158 159 // EXPERIMENTAL: "Conjured" symbols. 160 // FIXME: Handle structs. 161 162 SVal LHSVal; 163 164 if (Result.isUnknown()) { 165 // The symbolic value is actually for the type of the left-hand side 166 // expression, not the computation type, as this is the value the 167 // LValue on the LHS will bind to. 168 LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy, 169 currBldrCtx->blockCount()); 170 // However, we need to convert the symbol to the computation type. 171 Result = svalBuilder.evalCast(LHSVal, CTy, LTy); 172 } else { 173 // The left-hand side may bind to a different value then the 174 // computation type. 175 LHSVal = svalBuilder.evalCast(Result, LTy, CTy); 176 } 177 178 // In C++, assignment and compound assignment operators return an 179 // lvalue. 180 if (B->isGLValue()) 181 state = state->BindExpr(B, LCtx, location); 182 else 183 state = state->BindExpr(B, LCtx, Result); 184 185 evalStore(Tmp2, B, LHS, N, state, location, LHSVal); 186 } 187 } 188 189 // FIXME: postvisits eventually go in ::Visit() 190 getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this); 191 } 192 193 void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 194 ExplodedNodeSet &Dst) { 195 196 CanQualType T = getContext().getCanonicalType(BE->getType()); 197 198 const BlockDecl *BD = BE->getBlockDecl(); 199 // Get the value of the block itself. 200 SVal V = svalBuilder.getBlockPointer(BD, T, 201 Pred->getLocationContext(), 202 currBldrCtx->blockCount()); 203 204 ProgramStateRef State = Pred->getState(); 205 206 // If we created a new MemRegion for the block, we should explicitly bind 207 // the captured variables. 208 if (const BlockDataRegion *BDR = 209 dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { 210 211 auto ReferencedVars = BDR->referenced_vars(); 212 auto CI = BD->capture_begin(); 213 auto CE = BD->capture_end(); 214 for (auto Var : ReferencedVars) { 215 const VarRegion *capturedR = Var.getCapturedRegion(); 216 const TypedValueRegion *originalR = Var.getOriginalRegion(); 217 218 // If the capture had a copy expression, use the result of evaluating 219 // that expression, otherwise use the original value. 220 // We rely on the invariant that the block declaration's capture variables 221 // are a prefix of the BlockDataRegion's referenced vars (which may include 222 // referenced globals, etc.) to enable fast lookup of the capture for a 223 // given referenced var. 224 const Expr *copyExpr = nullptr; 225 if (CI != CE) { 226 assert(CI->getVariable() == capturedR->getDecl()); 227 copyExpr = CI->getCopyExpr(); 228 CI++; 229 } 230 231 if (capturedR != originalR) { 232 SVal originalV; 233 const LocationContext *LCtx = Pred->getLocationContext(); 234 if (copyExpr) { 235 originalV = State->getSVal(copyExpr, LCtx); 236 } else { 237 originalV = State->getSVal(loc::MemRegionVal(originalR)); 238 } 239 State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx); 240 } 241 } 242 } 243 244 ExplodedNodeSet Tmp; 245 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx); 246 Bldr.generateNode(BE, Pred, 247 State->BindExpr(BE, Pred->getLocationContext(), V), 248 nullptr, ProgramPoint::PostLValueKind); 249 250 // FIXME: Move all post/pre visits to ::Visit(). 251 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this); 252 } 253 254 ProgramStateRef ExprEngine::handleLValueBitCast( 255 ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx, 256 QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr, 257 ExplodedNode* Pred) { 258 if (T->isLValueReferenceType()) { 259 assert(!CastE->getType()->isLValueReferenceType()); 260 ExTy = getContext().getLValueReferenceType(ExTy); 261 } else if (T->isRValueReferenceType()) { 262 assert(!CastE->getType()->isRValueReferenceType()); 263 ExTy = getContext().getRValueReferenceType(ExTy); 264 } 265 // Delegate to SValBuilder to process. 266 SVal OrigV = state->getSVal(Ex, LCtx); 267 SVal V = svalBuilder.evalCast(OrigV, T, ExTy); 268 // Negate the result if we're treating the boolean as a signed i1 269 if (CastE->getCastKind() == CK_BooleanToSignedIntegral && V.isValid()) 270 V = svalBuilder.evalMinus(V.castAs<NonLoc>()); 271 272 state = state->BindExpr(CastE, LCtx, V); 273 if (V.isUnknown() && !OrigV.isUnknown()) { 274 state = escapeValues(state, OrigV, PSK_EscapeOther); 275 } 276 Bldr.generateNode(CastE, Pred, state); 277 278 return state; 279 } 280 281 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 282 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 283 284 ExplodedNodeSet dstPreStmt; 285 getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this); 286 287 if (CastE->getCastKind() == CK_LValueToRValue || 288 CastE->getCastKind() == CK_LValueToRValueBitCast) { 289 for (ExplodedNode *subExprNode : dstPreStmt) { 290 ProgramStateRef state = subExprNode->getState(); 291 const LocationContext *LCtx = subExprNode->getLocationContext(); 292 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx)); 293 } 294 return; 295 } 296 297 // All other casts. 298 QualType T = CastE->getType(); 299 QualType ExTy = Ex->getType(); 300 301 if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) 302 T = ExCast->getTypeAsWritten(); 303 304 StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx); 305 for (ExplodedNode *Pred : dstPreStmt) { 306 ProgramStateRef state = Pred->getState(); 307 const LocationContext *LCtx = Pred->getLocationContext(); 308 309 switch (CastE->getCastKind()) { 310 case CK_LValueToRValue: 311 case CK_LValueToRValueBitCast: 312 llvm_unreachable("LValueToRValue casts handled earlier."); 313 case CK_ToVoid: 314 continue; 315 // The analyzer doesn't do anything special with these casts, 316 // since it understands retain/release semantics already. 317 case CK_ARCProduceObject: 318 case CK_ARCConsumeObject: 319 case CK_ARCReclaimReturnedObject: 320 case CK_ARCExtendBlockObject: // Fall-through. 321 case CK_CopyAndAutoreleaseBlockObject: 322 // The analyser can ignore atomic casts for now, although some future 323 // checkers may want to make certain that you're not modifying the same 324 // value through atomic and nonatomic pointers. 325 case CK_AtomicToNonAtomic: 326 case CK_NonAtomicToAtomic: 327 // True no-ops. 328 case CK_NoOp: 329 case CK_ConstructorConversion: 330 case CK_UserDefinedConversion: 331 case CK_FunctionToPointerDecay: 332 case CK_BuiltinFnToFnPtr: { 333 // Copy the SVal of Ex to CastE. 334 ProgramStateRef state = Pred->getState(); 335 const LocationContext *LCtx = Pred->getLocationContext(); 336 SVal V = state->getSVal(Ex, LCtx); 337 state = state->BindExpr(CastE, LCtx, V); 338 Bldr.generateNode(CastE, Pred, state); 339 continue; 340 } 341 case CK_MemberPointerToBoolean: 342 case CK_PointerToBoolean: { 343 SVal V = state->getSVal(Ex, LCtx); 344 auto PTMSV = V.getAs<nonloc::PointerToMember>(); 345 if (PTMSV) 346 V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy); 347 if (V.isUndef() || PTMSV) { 348 state = state->BindExpr(CastE, LCtx, V); 349 Bldr.generateNode(CastE, Pred, state); 350 continue; 351 } 352 // Explicitly proceed with default handler for this case cascade. 353 state = 354 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 355 continue; 356 } 357 case CK_Dependent: 358 case CK_ArrayToPointerDecay: 359 case CK_BitCast: 360 case CK_AddressSpaceConversion: 361 case CK_BooleanToSignedIntegral: 362 case CK_IntegralToPointer: 363 case CK_PointerToIntegral: { 364 SVal V = state->getSVal(Ex, LCtx); 365 if (isa<nonloc::PointerToMember>(V)) { 366 state = state->BindExpr(CastE, LCtx, UnknownVal()); 367 Bldr.generateNode(CastE, Pred, state); 368 continue; 369 } 370 // Explicitly proceed with default handler for this case cascade. 371 state = 372 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 373 continue; 374 } 375 case CK_IntegralToBoolean: 376 case CK_IntegralToFloating: 377 case CK_FloatingToIntegral: 378 case CK_FloatingToBoolean: 379 case CK_FloatingCast: 380 case CK_FloatingRealToComplex: 381 case CK_FloatingComplexToReal: 382 case CK_FloatingComplexToBoolean: 383 case CK_FloatingComplexCast: 384 case CK_FloatingComplexToIntegralComplex: 385 case CK_IntegralRealToComplex: 386 case CK_IntegralComplexToReal: 387 case CK_IntegralComplexToBoolean: 388 case CK_IntegralComplexCast: 389 case CK_IntegralComplexToFloatingComplex: 390 case CK_CPointerToObjCPointerCast: 391 case CK_BlockPointerToObjCPointerCast: 392 case CK_AnyPointerToBlockPointerCast: 393 case CK_ObjCObjectLValueCast: 394 case CK_ZeroToOCLOpaqueType: 395 case CK_IntToOCLSampler: 396 case CK_LValueBitCast: 397 case CK_FloatingToFixedPoint: 398 case CK_FixedPointToFloating: 399 case CK_FixedPointCast: 400 case CK_FixedPointToBoolean: 401 case CK_FixedPointToIntegral: 402 case CK_IntegralToFixedPoint: { 403 state = 404 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 405 continue; 406 } 407 case CK_IntegralCast: { 408 // Delegate to SValBuilder to process. 409 SVal V = state->getSVal(Ex, LCtx); 410 if (AMgr.options.ShouldSupportSymbolicIntegerCasts) 411 V = svalBuilder.evalCast(V, T, ExTy); 412 else 413 V = svalBuilder.evalIntegralCast(state, V, T, ExTy); 414 state = state->BindExpr(CastE, LCtx, V); 415 Bldr.generateNode(CastE, Pred, state); 416 continue; 417 } 418 case CK_DerivedToBase: 419 case CK_UncheckedDerivedToBase: { 420 // For DerivedToBase cast, delegate to the store manager. 421 SVal val = state->getSVal(Ex, LCtx); 422 val = getStoreManager().evalDerivedToBase(val, CastE); 423 state = state->BindExpr(CastE, LCtx, val); 424 Bldr.generateNode(CastE, Pred, state); 425 continue; 426 } 427 // Handle C++ dyn_cast. 428 case CK_Dynamic: { 429 SVal val = state->getSVal(Ex, LCtx); 430 431 // Compute the type of the result. 432 QualType resultType = CastE->getType(); 433 if (CastE->isGLValue()) 434 resultType = getContext().getPointerType(resultType); 435 436 bool Failed = true; 437 438 // Check if the value being cast does not evaluates to 0. 439 if (!val.isZeroConstant()) 440 if (std::optional<SVal> V = 441 StateMgr.getStoreManager().evalBaseToDerived(val, T)) { 442 val = *V; 443 Failed = false; 444 } 445 446 if (Failed) { 447 if (T->isReferenceType()) { 448 // A bad_cast exception is thrown if input value is a reference. 449 // Currently, we model this, by generating a sink. 450 Bldr.generateSink(CastE, Pred, state); 451 continue; 452 } else { 453 // If the cast fails on a pointer, bind to 0. 454 state = state->BindExpr(CastE, LCtx, 455 svalBuilder.makeNullWithType(resultType)); 456 } 457 } else { 458 // If we don't know if the cast succeeded, conjure a new symbol. 459 if (val.isUnknown()) { 460 DefinedOrUnknownSVal NewSym = 461 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 462 currBldrCtx->blockCount()); 463 state = state->BindExpr(CastE, LCtx, NewSym); 464 } else 465 // Else, bind to the derived region value. 466 state = state->BindExpr(CastE, LCtx, val); 467 } 468 Bldr.generateNode(CastE, Pred, state); 469 continue; 470 } 471 case CK_BaseToDerived: { 472 SVal val = state->getSVal(Ex, LCtx); 473 QualType resultType = CastE->getType(); 474 if (CastE->isGLValue()) 475 resultType = getContext().getPointerType(resultType); 476 477 if (!val.isConstant()) { 478 std::optional<SVal> V = getStoreManager().evalBaseToDerived(val, T); 479 val = V ? *V : UnknownVal(); 480 } 481 482 // Failed to cast or the result is unknown, fall back to conservative. 483 if (val.isUnknown()) { 484 val = 485 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 486 currBldrCtx->blockCount()); 487 } 488 state = state->BindExpr(CastE, LCtx, val); 489 Bldr.generateNode(CastE, Pred, state); 490 continue; 491 } 492 case CK_NullToPointer: { 493 SVal V = svalBuilder.makeNullWithType(CastE->getType()); 494 state = state->BindExpr(CastE, LCtx, V); 495 Bldr.generateNode(CastE, Pred, state); 496 continue; 497 } 498 case CK_NullToMemberPointer: { 499 SVal V = svalBuilder.getMemberPointer(nullptr); 500 state = state->BindExpr(CastE, LCtx, V); 501 Bldr.generateNode(CastE, Pred, state); 502 continue; 503 } 504 case CK_DerivedToBaseMemberPointer: 505 case CK_BaseToDerivedMemberPointer: 506 case CK_ReinterpretMemberPointer: { 507 SVal V = state->getSVal(Ex, LCtx); 508 if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) { 509 SVal CastedPTMSV = 510 svalBuilder.makePointerToMember(getBasicVals().accumCXXBase( 511 CastE->path(), *PTMSV, CastE->getCastKind())); 512 state = state->BindExpr(CastE, LCtx, CastedPTMSV); 513 Bldr.generateNode(CastE, Pred, state); 514 continue; 515 } 516 // Explicitly proceed with default handler for this case cascade. 517 } 518 [[fallthrough]]; 519 // Various C++ casts that are not handled yet. 520 case CK_ToUnion: 521 case CK_MatrixCast: 522 case CK_VectorSplat: { 523 QualType resultType = CastE->getType(); 524 if (CastE->isGLValue()) 525 resultType = getContext().getPointerType(resultType); 526 SVal result = svalBuilder.conjureSymbolVal( 527 /*symbolTag=*/nullptr, CastE, LCtx, resultType, 528 currBldrCtx->blockCount()); 529 state = state->BindExpr(CastE, LCtx, result); 530 Bldr.generateNode(CastE, Pred, state); 531 continue; 532 } 533 } 534 } 535 } 536 537 void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, 538 ExplodedNode *Pred, 539 ExplodedNodeSet &Dst) { 540 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 541 542 ProgramStateRef State = Pred->getState(); 543 const LocationContext *LCtx = Pred->getLocationContext(); 544 545 const Expr *Init = CL->getInitializer(); 546 SVal V = State->getSVal(CL->getInitializer(), LCtx); 547 548 if (isa<CXXConstructExpr, CXXStdInitializerListExpr>(Init)) { 549 // No work needed. Just pass the value up to this expression. 550 } else { 551 assert(isa<InitListExpr>(Init)); 552 Loc CLLoc = State->getLValue(CL, LCtx); 553 State = State->bindLoc(CLLoc, V, LCtx); 554 555 if (CL->isGLValue()) 556 V = CLLoc; 557 } 558 559 B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V)); 560 } 561 562 void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 563 ExplodedNodeSet &Dst) { 564 if (isa<TypedefNameDecl>(*DS->decl_begin())) { 565 // C99 6.7.7 "Any array size expressions associated with variable length 566 // array declarators are evaluated each time the declaration of the typedef 567 // name is reached in the order of execution." 568 // The checkers should know about typedef to be able to handle VLA size 569 // expressions. 570 ExplodedNodeSet DstPre; 571 getCheckerManager().runCheckersForPreStmt(DstPre, Pred, DS, *this); 572 getCheckerManager().runCheckersForPostStmt(Dst, DstPre, DS, *this); 573 return; 574 } 575 576 // Assumption: The CFG has one DeclStmt per Decl. 577 const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin()); 578 579 if (!VD) { 580 //TODO:AZ: remove explicit insertion after refactoring is done. 581 Dst.insert(Pred); 582 return; 583 } 584 585 // FIXME: all pre/post visits should eventually be handled by ::Visit(). 586 ExplodedNodeSet dstPreVisit; 587 getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this); 588 589 ExplodedNodeSet dstEvaluated; 590 StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx); 591 for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end(); 592 I!=E; ++I) { 593 ExplodedNode *N = *I; 594 ProgramStateRef state = N->getState(); 595 const LocationContext *LC = N->getLocationContext(); 596 597 // Decls without InitExpr are not initialized explicitly. 598 if (const Expr *InitEx = VD->getInit()) { 599 600 // Note in the state that the initialization has occurred. 601 ExplodedNode *UpdatedN = N; 602 SVal InitVal = state->getSVal(InitEx, LC); 603 604 assert(DS->isSingleDecl()); 605 if (getObjectUnderConstruction(state, DS, LC)) { 606 state = finishObjectConstruction(state, DS, LC); 607 // We constructed the object directly in the variable. 608 // No need to bind anything. 609 B.generateNode(DS, UpdatedN, state); 610 } else { 611 // Recover some path-sensitivity if a scalar value evaluated to 612 // UnknownVal. 613 if (InitVal.isUnknown()) { 614 QualType Ty = InitEx->getType(); 615 if (InitEx->isGLValue()) { 616 Ty = getContext().getPointerType(Ty); 617 } 618 619 InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty, 620 currBldrCtx->blockCount()); 621 } 622 623 624 B.takeNodes(UpdatedN); 625 ExplodedNodeSet Dst2; 626 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true); 627 B.addNodes(Dst2); 628 } 629 } 630 else { 631 B.generateNode(DS, N, state); 632 } 633 } 634 635 getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this); 636 } 637 638 void ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, 639 ExplodedNodeSet &Dst) { 640 // This method acts upon CFG elements for logical operators && and || 641 // and attaches the value (true or false) to them as expressions. 642 // It doesn't produce any state splits. 643 // If we made it that far, we're past the point when we modeled the short 644 // circuit. It means that we should have precise knowledge about whether 645 // we've short-circuited. If we did, we already know the value we need to 646 // bind. If we didn't, the value of the RHS (casted to the boolean type) 647 // is the answer. 648 // Currently this method tries to figure out whether we've short-circuited 649 // by looking at the ExplodedGraph. This method is imperfect because there 650 // could inevitably have been merges that would have resulted in multiple 651 // potential path traversal histories. We bail out when we fail. 652 // Due to this ambiguity, a more reliable solution would have been to 653 // track the short circuit operation history path-sensitively until 654 // we evaluate the respective logical operator. 655 assert(B->getOpcode() == BO_LAnd || 656 B->getOpcode() == BO_LOr); 657 658 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 659 ProgramStateRef state = Pred->getState(); 660 661 if (B->getType()->isVectorType()) { 662 // FIXME: We do not model vector arithmetic yet. When adding support for 663 // that, note that the CFG-based reasoning below does not apply, because 664 // logical operators on vectors are not short-circuit. Currently they are 665 // modeled as short-circuit in Clang CFG but this is incorrect. 666 // Do not set the value for the expression. It'd be UnknownVal by default. 667 Bldr.generateNode(B, Pred, state); 668 return; 669 } 670 671 ExplodedNode *N = Pred; 672 while (!N->getLocation().getAs<BlockEntrance>()) { 673 ProgramPoint P = N->getLocation(); 674 assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>()); 675 (void) P; 676 if (N->pred_size() != 1) { 677 // We failed to track back where we came from. 678 Bldr.generateNode(B, Pred, state); 679 return; 680 } 681 N = *N->pred_begin(); 682 } 683 684 if (N->pred_size() != 1) { 685 // We failed to track back where we came from. 686 Bldr.generateNode(B, Pred, state); 687 return; 688 } 689 690 N = *N->pred_begin(); 691 BlockEdge BE = N->getLocation().castAs<BlockEdge>(); 692 SVal X; 693 694 // Determine the value of the expression by introspecting how we 695 // got this location in the CFG. This requires looking at the previous 696 // block we were in and what kind of control-flow transfer was involved. 697 const CFGBlock *SrcBlock = BE.getSrc(); 698 // The only terminator (if there is one) that makes sense is a logical op. 699 CFGTerminator T = SrcBlock->getTerminator(); 700 if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) { 701 (void) Term; 702 assert(Term->isLogicalOp()); 703 assert(SrcBlock->succ_size() == 2); 704 // Did we take the true or false branch? 705 unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0; 706 X = svalBuilder.makeIntVal(constant, B->getType()); 707 } 708 else { 709 // If there is no terminator, by construction the last statement 710 // in SrcBlock is the value of the enclosing expression. 711 // However, we still need to constrain that value to be 0 or 1. 712 assert(!SrcBlock->empty()); 713 CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>(); 714 const Expr *RHS = cast<Expr>(Elem.getStmt()); 715 SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext()); 716 717 if (RHSVal.isUndef()) { 718 X = RHSVal; 719 } else { 720 // We evaluate "RHSVal != 0" expression which result in 0 if the value is 721 // known to be false, 1 if the value is known to be true and a new symbol 722 // when the assumption is unknown. 723 nonloc::ConcreteInt Zero(getBasicVals().getValue(0, B->getType())); 724 X = evalBinOp(N->getState(), BO_NE, 725 svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()), 726 Zero, B->getType()); 727 } 728 } 729 Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X)); 730 } 731 732 void ExprEngine::VisitInitListExpr(const InitListExpr *IE, 733 ExplodedNode *Pred, 734 ExplodedNodeSet &Dst) { 735 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 736 737 ProgramStateRef state = Pred->getState(); 738 const LocationContext *LCtx = Pred->getLocationContext(); 739 QualType T = getContext().getCanonicalType(IE->getType()); 740 unsigned NumInitElements = IE->getNumInits(); 741 742 if (!IE->isGLValue() && !IE->isTransparent() && 743 (T->isArrayType() || T->isRecordType() || T->isVectorType() || 744 T->isAnyComplexType())) { 745 llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList(); 746 747 // Handle base case where the initializer has no elements. 748 // e.g: static int* myArray[] = {}; 749 if (NumInitElements == 0) { 750 SVal V = svalBuilder.makeCompoundVal(T, vals); 751 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 752 return; 753 } 754 755 for (const Stmt *S : llvm::reverse(*IE)) { 756 SVal V = state->getSVal(cast<Expr>(S), LCtx); 757 vals = getBasicVals().prependSVal(V, vals); 758 } 759 760 B.generateNode(IE, Pred, 761 state->BindExpr(IE, LCtx, 762 svalBuilder.makeCompoundVal(T, vals))); 763 return; 764 } 765 766 // Handle scalars: int{5} and int{} and GLvalues. 767 // Note, if the InitListExpr is a GLvalue, it means that there is an address 768 // representing it, so it must have a single init element. 769 assert(NumInitElements <= 1); 770 771 SVal V; 772 if (NumInitElements == 0) 773 V = getSValBuilder().makeZeroVal(T); 774 else 775 V = state->getSVal(IE->getInit(0), LCtx); 776 777 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 778 } 779 780 void ExprEngine::VisitGuardedExpr(const Expr *Ex, 781 const Expr *L, 782 const Expr *R, 783 ExplodedNode *Pred, 784 ExplodedNodeSet &Dst) { 785 assert(L && R); 786 787 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 788 ProgramStateRef state = Pred->getState(); 789 const LocationContext *LCtx = Pred->getLocationContext(); 790 const CFGBlock *SrcBlock = nullptr; 791 792 // Find the predecessor block. 793 ProgramStateRef SrcState = state; 794 for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) { 795 ProgramPoint PP = N->getLocation(); 796 if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) { 797 // If the state N has multiple predecessors P, it means that successors 798 // of P are all equivalent. 799 // In turn, that means that all nodes at P are equivalent in terms 800 // of observable behavior at N, and we can follow any of them. 801 // FIXME: a more robust solution which does not walk up the tree. 802 continue; 803 } 804 SrcBlock = PP.castAs<BlockEdge>().getSrc(); 805 SrcState = N->getState(); 806 break; 807 } 808 809 assert(SrcBlock && "missing function entry"); 810 811 // Find the last expression in the predecessor block. That is the 812 // expression that is used for the value of the ternary expression. 813 bool hasValue = false; 814 SVal V; 815 816 for (CFGElement CE : llvm::reverse(*SrcBlock)) { 817 if (std::optional<CFGStmt> CS = CE.getAs<CFGStmt>()) { 818 const Expr *ValEx = cast<Expr>(CS->getStmt()); 819 ValEx = ValEx->IgnoreParens(); 820 821 // For GNU extension '?:' operator, the left hand side will be an 822 // OpaqueValueExpr, so get the underlying expression. 823 if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L)) 824 L = OpaqueEx->getSourceExpr(); 825 826 // If the last expression in the predecessor block matches true or false 827 // subexpression, get its the value. 828 if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) { 829 hasValue = true; 830 V = SrcState->getSVal(ValEx, LCtx); 831 } 832 break; 833 } 834 } 835 836 if (!hasValue) 837 V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, 838 currBldrCtx->blockCount()); 839 840 // Generate a new node with the binding from the appropriate path. 841 B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true)); 842 } 843 844 void ExprEngine:: 845 VisitOffsetOfExpr(const OffsetOfExpr *OOE, 846 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 847 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 848 Expr::EvalResult Result; 849 if (OOE->EvaluateAsInt(Result, getContext())) { 850 APSInt IV = Result.Val.getInt(); 851 assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); 852 assert(OOE->getType()->castAs<BuiltinType>()->isInteger()); 853 assert(IV.isSigned() == OOE->getType()->isSignedIntegerType()); 854 SVal X = svalBuilder.makeIntVal(IV); 855 B.generateNode(OOE, Pred, 856 Pred->getState()->BindExpr(OOE, Pred->getLocationContext(), 857 X)); 858 } 859 // FIXME: Handle the case where __builtin_offsetof is not a constant. 860 } 861 862 863 void ExprEngine:: 864 VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, 865 ExplodedNode *Pred, 866 ExplodedNodeSet &Dst) { 867 // FIXME: Prechecks eventually go in ::Visit(). 868 ExplodedNodeSet CheckedSet; 869 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this); 870 871 ExplodedNodeSet EvalSet; 872 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 873 874 QualType T = Ex->getTypeOfArgument(); 875 876 for (ExplodedNode *N : CheckedSet) { 877 if (Ex->getKind() == UETT_SizeOf) { 878 if (!T->isIncompleteType() && !T->isConstantSizeType()) { 879 assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); 880 881 // FIXME: Add support for VLA type arguments and VLA expressions. 882 // When that happens, we should probably refactor VLASizeChecker's code. 883 continue; 884 } else if (T->getAs<ObjCObjectType>()) { 885 // Some code tries to take the sizeof an ObjCObjectType, relying that 886 // the compiler has laid out its representation. Just report Unknown 887 // for these. 888 continue; 889 } 890 } 891 892 APSInt Value = Ex->EvaluateKnownConstInt(getContext()); 893 CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue()); 894 895 ProgramStateRef state = N->getState(); 896 state = state->BindExpr( 897 Ex, N->getLocationContext(), 898 svalBuilder.makeIntVal(amt.getQuantity(), Ex->getType())); 899 Bldr.generateNode(Ex, N, state); 900 } 901 902 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this); 903 } 904 905 void ExprEngine::handleUOExtension(ExplodedNode *N, const UnaryOperator *U, 906 StmtNodeBuilder &Bldr) { 907 // FIXME: We can probably just have some magic in Environment::getSVal() 908 // that propagates values, instead of creating a new node here. 909 // 910 // Unary "+" is a no-op, similar to a parentheses. We still have places 911 // where it may be a block-level expression, so we need to 912 // generate an extra node that just propagates the value of the 913 // subexpression. 914 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 915 ProgramStateRef state = N->getState(); 916 const LocationContext *LCtx = N->getLocationContext(); 917 Bldr.generateNode(U, N, state->BindExpr(U, LCtx, state->getSVal(Ex, LCtx))); 918 } 919 920 void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, ExplodedNode *Pred, 921 ExplodedNodeSet &Dst) { 922 // FIXME: Prechecks eventually go in ::Visit(). 923 ExplodedNodeSet CheckedSet; 924 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this); 925 926 ExplodedNodeSet EvalSet; 927 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 928 929 for (ExplodedNode *N : CheckedSet) { 930 switch (U->getOpcode()) { 931 default: { 932 Bldr.takeNodes(N); 933 ExplodedNodeSet Tmp; 934 VisitIncrementDecrementOperator(U, N, Tmp); 935 Bldr.addNodes(Tmp); 936 break; 937 } 938 case UO_Real: { 939 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 940 941 // FIXME: We don't have complex SValues yet. 942 if (Ex->getType()->isAnyComplexType()) { 943 // Just report "Unknown." 944 break; 945 } 946 947 // For all other types, UO_Real is an identity operation. 948 assert (U->getType() == Ex->getType()); 949 ProgramStateRef state = N->getState(); 950 const LocationContext *LCtx = N->getLocationContext(); 951 Bldr.generateNode(U, N, 952 state->BindExpr(U, LCtx, state->getSVal(Ex, LCtx))); 953 break; 954 } 955 956 case UO_Imag: { 957 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 958 // FIXME: We don't have complex SValues yet. 959 if (Ex->getType()->isAnyComplexType()) { 960 // Just report "Unknown." 961 break; 962 } 963 // For all other types, UO_Imag returns 0. 964 ProgramStateRef state = N->getState(); 965 const LocationContext *LCtx = N->getLocationContext(); 966 SVal X = svalBuilder.makeZeroVal(Ex->getType()); 967 Bldr.generateNode(U, N, state->BindExpr(U, LCtx, X)); 968 break; 969 } 970 971 case UO_AddrOf: { 972 // Process pointer-to-member address operation. 973 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 974 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) { 975 const ValueDecl *VD = DRE->getDecl(); 976 977 if (isa<CXXMethodDecl, FieldDecl, IndirectFieldDecl>(VD)) { 978 ProgramStateRef State = N->getState(); 979 const LocationContext *LCtx = N->getLocationContext(); 980 SVal SV = svalBuilder.getMemberPointer(cast<NamedDecl>(VD)); 981 Bldr.generateNode(U, N, State->BindExpr(U, LCtx, SV)); 982 break; 983 } 984 } 985 // Explicitly proceed with default handler for this case cascade. 986 handleUOExtension(N, U, Bldr); 987 break; 988 } 989 case UO_Plus: 990 assert(!U->isGLValue()); 991 [[fallthrough]]; 992 case UO_Deref: 993 case UO_Extension: { 994 handleUOExtension(N, U, Bldr); 995 break; 996 } 997 998 case UO_LNot: 999 case UO_Minus: 1000 case UO_Not: { 1001 assert (!U->isGLValue()); 1002 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1003 ProgramStateRef state = N->getState(); 1004 const LocationContext *LCtx = N->getLocationContext(); 1005 1006 // Get the value of the subexpression. 1007 SVal V = state->getSVal(Ex, LCtx); 1008 1009 if (V.isUnknownOrUndef()) { 1010 Bldr.generateNode(U, N, state->BindExpr(U, LCtx, V)); 1011 break; 1012 } 1013 1014 switch (U->getOpcode()) { 1015 default: 1016 llvm_unreachable("Invalid Opcode."); 1017 case UO_Not: 1018 // FIXME: Do we need to handle promotions? 1019 state = state->BindExpr( 1020 U, LCtx, svalBuilder.evalComplement(V.castAs<NonLoc>())); 1021 break; 1022 case UO_Minus: 1023 // FIXME: Do we need to handle promotions? 1024 state = state->BindExpr(U, LCtx, 1025 svalBuilder.evalMinus(V.castAs<NonLoc>())); 1026 break; 1027 case UO_LNot: 1028 // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." 1029 // 1030 // Note: technically we do "E == 0", but this is the same in the 1031 // transfer functions as "0 == E". 1032 SVal Result; 1033 if (std::optional<Loc> LV = V.getAs<Loc>()) { 1034 Loc X = svalBuilder.makeNullWithType(Ex->getType()); 1035 Result = evalBinOp(state, BO_EQ, *LV, X, U->getType()); 1036 } else if (Ex->getType()->isFloatingType()) { 1037 // FIXME: handle floating point types. 1038 Result = UnknownVal(); 1039 } else { 1040 nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); 1041 Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X, U->getType()); 1042 } 1043 1044 state = state->BindExpr(U, LCtx, Result); 1045 break; 1046 } 1047 Bldr.generateNode(U, N, state); 1048 break; 1049 } 1050 } 1051 } 1052 1053 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this); 1054 } 1055 1056 void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U, 1057 ExplodedNode *Pred, 1058 ExplodedNodeSet &Dst) { 1059 // Handle ++ and -- (both pre- and post-increment). 1060 assert (U->isIncrementDecrementOp()); 1061 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1062 1063 const LocationContext *LCtx = Pred->getLocationContext(); 1064 ProgramStateRef state = Pred->getState(); 1065 SVal loc = state->getSVal(Ex, LCtx); 1066 1067 // Perform a load. 1068 ExplodedNodeSet Tmp; 1069 evalLoad(Tmp, U, Ex, Pred, state, loc); 1070 1071 ExplodedNodeSet Dst2; 1072 StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx); 1073 for (ExplodedNode *N : Tmp) { 1074 state = N->getState(); 1075 assert(LCtx == N->getLocationContext()); 1076 SVal V2_untested = state->getSVal(Ex, LCtx); 1077 1078 // Propagate unknown and undefined values. 1079 if (V2_untested.isUnknownOrUndef()) { 1080 state = state->BindExpr(U, LCtx, V2_untested); 1081 1082 // Perform the store, so that the uninitialized value detection happens. 1083 Bldr.takeNodes(N); 1084 ExplodedNodeSet Dst3; 1085 evalStore(Dst3, U, Ex, N, state, loc, V2_untested); 1086 Bldr.addNodes(Dst3); 1087 1088 continue; 1089 } 1090 DefinedSVal V2 = V2_untested.castAs<DefinedSVal>(); 1091 1092 // Handle all other values. 1093 BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub; 1094 1095 // If the UnaryOperator has non-location type, use its type to create the 1096 // constant value. If the UnaryOperator has location type, create the 1097 // constant with int type and pointer width. 1098 SVal RHS; 1099 SVal Result; 1100 1101 if (U->getType()->isAnyPointerType()) 1102 RHS = svalBuilder.makeArrayIndex(1); 1103 else if (U->getType()->isIntegralOrEnumerationType()) 1104 RHS = svalBuilder.makeIntVal(1, U->getType()); 1105 else 1106 RHS = UnknownVal(); 1107 1108 // The use of an operand of type bool with the ++ operators is deprecated 1109 // but valid until C++17. And if the operand of the ++ operator is of type 1110 // bool, it is set to true until C++17. Note that for '_Bool', it is also 1111 // set to true when it encounters ++ operator. 1112 if (U->getType()->isBooleanType() && U->isIncrementOp()) 1113 Result = svalBuilder.makeTruthVal(true, U->getType()); 1114 else 1115 Result = evalBinOp(state, Op, V2, RHS, U->getType()); 1116 1117 // Conjure a new symbol if necessary to recover precision. 1118 if (Result.isUnknown()){ 1119 DefinedOrUnknownSVal SymVal = 1120 svalBuilder.conjureSymbolVal(nullptr, U, LCtx, 1121 currBldrCtx->blockCount()); 1122 Result = SymVal; 1123 1124 // If the value is a location, ++/-- should always preserve 1125 // non-nullness. Check if the original value was non-null, and if so 1126 // propagate that constraint. 1127 if (Loc::isLocType(U->getType())) { 1128 DefinedOrUnknownSVal Constraint = 1129 svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); 1130 1131 if (!state->assume(Constraint, true)) { 1132 // It isn't feasible for the original value to be null. 1133 // Propagate this constraint. 1134 Constraint = svalBuilder.evalEQ(state, SymVal, 1135 svalBuilder.makeZeroVal(U->getType())); 1136 1137 state = state->assume(Constraint, false); 1138 assert(state); 1139 } 1140 } 1141 } 1142 1143 // Since the lvalue-to-rvalue conversion is explicit in the AST, 1144 // we bind an l-value if the operator is prefix and an lvalue (in C++). 1145 if (U->isGLValue()) 1146 state = state->BindExpr(U, LCtx, loc); 1147 else 1148 state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result); 1149 1150 // Perform the store. 1151 Bldr.takeNodes(N); 1152 ExplodedNodeSet Dst3; 1153 evalStore(Dst3, U, Ex, N, state, loc, Result); 1154 Bldr.addNodes(Dst3); 1155 } 1156 Dst.insert(Dst2); 1157 } 1158