1 //=-- ExprEngineC.cpp - ExprEngine support for C expressions ----*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This file defines ExprEngine's support for C expressions. 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "clang/AST/ExprCXX.h" 14 #include "clang/AST/DeclCXX.h" 15 #include "clang/StaticAnalyzer/Core/CheckerManager.h" 16 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 17 18 using namespace clang; 19 using namespace ento; 20 using llvm::APSInt; 21 22 /// Optionally conjure and return a symbol for offset when processing 23 /// an expression \p Expression. 24 /// If \p Other is a location, conjure a symbol for \p Symbol 25 /// (offset) if it is unknown so that memory arithmetic always 26 /// results in an ElementRegion. 27 /// \p Count The number of times the current basic block was visited. 28 static SVal conjureOffsetSymbolOnLocation( 29 SVal Symbol, SVal Other, Expr* Expression, SValBuilder &svalBuilder, 30 unsigned Count, const LocationContext *LCtx) { 31 QualType Ty = Expression->getType(); 32 if (Other.getAs<Loc>() && 33 Ty->isIntegralOrEnumerationType() && 34 Symbol.isUnknown()) { 35 return svalBuilder.conjureSymbolVal(Expression, LCtx, Ty, Count); 36 } 37 return Symbol; 38 } 39 40 void ExprEngine::VisitBinaryOperator(const BinaryOperator* B, 41 ExplodedNode *Pred, 42 ExplodedNodeSet &Dst) { 43 44 Expr *LHS = B->getLHS()->IgnoreParens(); 45 Expr *RHS = B->getRHS()->IgnoreParens(); 46 47 // FIXME: Prechecks eventually go in ::Visit(). 48 ExplodedNodeSet CheckedSet; 49 ExplodedNodeSet Tmp2; 50 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, B, *this); 51 52 // With both the LHS and RHS evaluated, process the operation itself. 53 for (ExplodedNodeSet::iterator it=CheckedSet.begin(), ei=CheckedSet.end(); 54 it != ei; ++it) { 55 56 ProgramStateRef state = (*it)->getState(); 57 const LocationContext *LCtx = (*it)->getLocationContext(); 58 SVal LeftV = state->getSVal(LHS, LCtx); 59 SVal RightV = state->getSVal(RHS, LCtx); 60 61 BinaryOperator::Opcode Op = B->getOpcode(); 62 63 if (Op == BO_Assign) { 64 // EXPERIMENTAL: "Conjured" symbols. 65 // FIXME: Handle structs. 66 if (RightV.isUnknown()) { 67 unsigned Count = currBldrCtx->blockCount(); 68 RightV = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, 69 Count); 70 } 71 // Simulate the effects of a "store": bind the value of the RHS 72 // to the L-Value represented by the LHS. 73 SVal ExprVal = B->isGLValue() ? LeftV : RightV; 74 evalStore(Tmp2, B, LHS, *it, state->BindExpr(B, LCtx, ExprVal), 75 LeftV, RightV); 76 continue; 77 } 78 79 if (!B->isAssignmentOp()) { 80 StmtNodeBuilder Bldr(*it, Tmp2, *currBldrCtx); 81 82 if (B->isAdditiveOp()) { 83 // TODO: This can be removed after we enable history tracking with 84 // SymSymExpr. 85 unsigned Count = currBldrCtx->blockCount(); 86 RightV = conjureOffsetSymbolOnLocation( 87 RightV, LeftV, RHS, svalBuilder, Count, LCtx); 88 LeftV = conjureOffsetSymbolOnLocation( 89 LeftV, RightV, LHS, svalBuilder, Count, LCtx); 90 } 91 92 // Although we don't yet model pointers-to-members, we do need to make 93 // sure that the members of temporaries have a valid 'this' pointer for 94 // other checks. 95 if (B->getOpcode() == BO_PtrMemD) 96 state = createTemporaryRegionIfNeeded(state, LCtx, LHS); 97 98 // Process non-assignments except commas or short-circuited 99 // logical expressions (LAnd and LOr). 100 SVal Result = evalBinOp(state, Op, LeftV, RightV, B->getType()); 101 if (!Result.isUnknown()) { 102 state = state->BindExpr(B, LCtx, Result); 103 } else { 104 // If we cannot evaluate the operation escape the operands. 105 state = escapeValues(state, LeftV, PSK_EscapeOther); 106 state = escapeValues(state, RightV, PSK_EscapeOther); 107 } 108 109 Bldr.generateNode(B, *it, state); 110 continue; 111 } 112 113 assert (B->isCompoundAssignmentOp()); 114 115 switch (Op) { 116 default: 117 llvm_unreachable("Invalid opcode for compound assignment."); 118 case BO_MulAssign: Op = BO_Mul; break; 119 case BO_DivAssign: Op = BO_Div; break; 120 case BO_RemAssign: Op = BO_Rem; break; 121 case BO_AddAssign: Op = BO_Add; break; 122 case BO_SubAssign: Op = BO_Sub; break; 123 case BO_ShlAssign: Op = BO_Shl; break; 124 case BO_ShrAssign: Op = BO_Shr; break; 125 case BO_AndAssign: Op = BO_And; break; 126 case BO_XorAssign: Op = BO_Xor; break; 127 case BO_OrAssign: Op = BO_Or; break; 128 } 129 130 // Perform a load (the LHS). This performs the checks for 131 // null dereferences, and so on. 132 ExplodedNodeSet Tmp; 133 SVal location = LeftV; 134 evalLoad(Tmp, B, LHS, *it, state, location); 135 136 for (ExplodedNodeSet::iterator I = Tmp.begin(), E = Tmp.end(); I != E; 137 ++I) { 138 139 state = (*I)->getState(); 140 const LocationContext *LCtx = (*I)->getLocationContext(); 141 SVal V = state->getSVal(LHS, LCtx); 142 143 // Get the computation type. 144 QualType CTy = 145 cast<CompoundAssignOperator>(B)->getComputationResultType(); 146 CTy = getContext().getCanonicalType(CTy); 147 148 QualType CLHSTy = 149 cast<CompoundAssignOperator>(B)->getComputationLHSType(); 150 CLHSTy = getContext().getCanonicalType(CLHSTy); 151 152 QualType LTy = getContext().getCanonicalType(LHS->getType()); 153 154 // Promote LHS. 155 V = svalBuilder.evalCast(V, CLHSTy, LTy); 156 157 // Compute the result of the operation. 158 SVal Result = svalBuilder.evalCast(evalBinOp(state, Op, V, RightV, CTy), 159 B->getType(), CTy); 160 161 // EXPERIMENTAL: "Conjured" symbols. 162 // FIXME: Handle structs. 163 164 SVal LHSVal; 165 166 if (Result.isUnknown()) { 167 // The symbolic value is actually for the type of the left-hand side 168 // expression, not the computation type, as this is the value the 169 // LValue on the LHS will bind to. 170 LHSVal = svalBuilder.conjureSymbolVal(nullptr, B->getRHS(), LCtx, LTy, 171 currBldrCtx->blockCount()); 172 // However, we need to convert the symbol to the computation type. 173 Result = svalBuilder.evalCast(LHSVal, CTy, LTy); 174 } 175 else { 176 // The left-hand side may bind to a different value then the 177 // computation type. 178 LHSVal = svalBuilder.evalCast(Result, LTy, CTy); 179 } 180 181 // In C++, assignment and compound assignment operators return an 182 // lvalue. 183 if (B->isGLValue()) 184 state = state->BindExpr(B, LCtx, location); 185 else 186 state = state->BindExpr(B, LCtx, Result); 187 188 evalStore(Tmp2, B, LHS, *I, state, location, LHSVal); 189 } 190 } 191 192 // FIXME: postvisits eventually go in ::Visit() 193 getCheckerManager().runCheckersForPostStmt(Dst, Tmp2, B, *this); 194 } 195 196 void ExprEngine::VisitBlockExpr(const BlockExpr *BE, ExplodedNode *Pred, 197 ExplodedNodeSet &Dst) { 198 199 CanQualType T = getContext().getCanonicalType(BE->getType()); 200 201 const BlockDecl *BD = BE->getBlockDecl(); 202 // Get the value of the block itself. 203 SVal V = svalBuilder.getBlockPointer(BD, T, 204 Pred->getLocationContext(), 205 currBldrCtx->blockCount()); 206 207 ProgramStateRef State = Pred->getState(); 208 209 // If we created a new MemRegion for the block, we should explicitly bind 210 // the captured variables. 211 if (const BlockDataRegion *BDR = 212 dyn_cast_or_null<BlockDataRegion>(V.getAsRegion())) { 213 214 BlockDataRegion::referenced_vars_iterator I = BDR->referenced_vars_begin(), 215 E = BDR->referenced_vars_end(); 216 217 auto CI = BD->capture_begin(); 218 auto CE = BD->capture_end(); 219 for (; I != E; ++I) { 220 const VarRegion *capturedR = I.getCapturedRegion(); 221 const VarRegion *originalR = I.getOriginalRegion(); 222 223 // If the capture had a copy expression, use the result of evaluating 224 // that expression, otherwise use the original value. 225 // We rely on the invariant that the block declaration's capture variables 226 // are a prefix of the BlockDataRegion's referenced vars (which may include 227 // referenced globals, etc.) to enable fast lookup of the capture for a 228 // given referenced var. 229 const Expr *copyExpr = nullptr; 230 if (CI != CE) { 231 assert(CI->getVariable() == capturedR->getDecl()); 232 copyExpr = CI->getCopyExpr(); 233 CI++; 234 } 235 236 if (capturedR != originalR) { 237 SVal originalV; 238 const LocationContext *LCtx = Pred->getLocationContext(); 239 if (copyExpr) { 240 originalV = State->getSVal(copyExpr, LCtx); 241 } else { 242 originalV = State->getSVal(loc::MemRegionVal(originalR)); 243 } 244 State = State->bindLoc(loc::MemRegionVal(capturedR), originalV, LCtx); 245 } 246 } 247 } 248 249 ExplodedNodeSet Tmp; 250 StmtNodeBuilder Bldr(Pred, Tmp, *currBldrCtx); 251 Bldr.generateNode(BE, Pred, 252 State->BindExpr(BE, Pred->getLocationContext(), V), 253 nullptr, ProgramPoint::PostLValueKind); 254 255 // FIXME: Move all post/pre visits to ::Visit(). 256 getCheckerManager().runCheckersForPostStmt(Dst, Tmp, BE, *this); 257 } 258 259 ProgramStateRef ExprEngine::handleLValueBitCast( 260 ProgramStateRef state, const Expr* Ex, const LocationContext* LCtx, 261 QualType T, QualType ExTy, const CastExpr* CastE, StmtNodeBuilder& Bldr, 262 ExplodedNode* Pred) { 263 if (T->isLValueReferenceType()) { 264 assert(!CastE->getType()->isLValueReferenceType()); 265 ExTy = getContext().getLValueReferenceType(ExTy); 266 } else if (T->isRValueReferenceType()) { 267 assert(!CastE->getType()->isRValueReferenceType()); 268 ExTy = getContext().getRValueReferenceType(ExTy); 269 } 270 // Delegate to SValBuilder to process. 271 SVal OrigV = state->getSVal(Ex, LCtx); 272 SVal V = svalBuilder.evalCast(OrigV, T, ExTy); 273 // Negate the result if we're treating the boolean as a signed i1 274 if (CastE->getCastKind() == CK_BooleanToSignedIntegral) 275 V = evalMinus(V); 276 state = state->BindExpr(CastE, LCtx, V); 277 if (V.isUnknown() && !OrigV.isUnknown()) { 278 state = escapeValues(state, OrigV, PSK_EscapeOther); 279 } 280 Bldr.generateNode(CastE, Pred, state); 281 282 return state; 283 } 284 285 ProgramStateRef ExprEngine::handleLVectorSplat( 286 ProgramStateRef state, const LocationContext* LCtx, const CastExpr* CastE, 287 StmtNodeBuilder &Bldr, ExplodedNode* Pred) { 288 // Recover some path sensitivity by conjuring a new value. 289 QualType resultType = CastE->getType(); 290 if (CastE->isGLValue()) 291 resultType = getContext().getPointerType(resultType); 292 SVal result = svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, 293 resultType, 294 currBldrCtx->blockCount()); 295 state = state->BindExpr(CastE, LCtx, result); 296 Bldr.generateNode(CastE, Pred, state); 297 298 return state; 299 } 300 301 void ExprEngine::VisitCast(const CastExpr *CastE, const Expr *Ex, 302 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 303 304 ExplodedNodeSet dstPreStmt; 305 getCheckerManager().runCheckersForPreStmt(dstPreStmt, Pred, CastE, *this); 306 307 if (CastE->getCastKind() == CK_LValueToRValue) { 308 for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 309 I!=E; ++I) { 310 ExplodedNode *subExprNode = *I; 311 ProgramStateRef state = subExprNode->getState(); 312 const LocationContext *LCtx = subExprNode->getLocationContext(); 313 evalLoad(Dst, CastE, CastE, subExprNode, state, state->getSVal(Ex, LCtx)); 314 } 315 return; 316 } 317 318 // All other casts. 319 QualType T = CastE->getType(); 320 QualType ExTy = Ex->getType(); 321 322 if (const ExplicitCastExpr *ExCast=dyn_cast_or_null<ExplicitCastExpr>(CastE)) 323 T = ExCast->getTypeAsWritten(); 324 325 StmtNodeBuilder Bldr(dstPreStmt, Dst, *currBldrCtx); 326 for (ExplodedNodeSet::iterator I = dstPreStmt.begin(), E = dstPreStmt.end(); 327 I != E; ++I) { 328 329 Pred = *I; 330 ProgramStateRef state = Pred->getState(); 331 const LocationContext *LCtx = Pred->getLocationContext(); 332 333 switch (CastE->getCastKind()) { 334 case CK_LValueToRValue: 335 llvm_unreachable("LValueToRValue casts handled earlier."); 336 case CK_ToVoid: 337 continue; 338 // The analyzer doesn't do anything special with these casts, 339 // since it understands retain/release semantics already. 340 case CK_ARCProduceObject: 341 case CK_ARCConsumeObject: 342 case CK_ARCReclaimReturnedObject: 343 case CK_ARCExtendBlockObject: // Fall-through. 344 case CK_CopyAndAutoreleaseBlockObject: 345 // The analyser can ignore atomic casts for now, although some future 346 // checkers may want to make certain that you're not modifying the same 347 // value through atomic and nonatomic pointers. 348 case CK_AtomicToNonAtomic: 349 case CK_NonAtomicToAtomic: 350 // True no-ops. 351 case CK_NoOp: 352 case CK_ConstructorConversion: 353 case CK_UserDefinedConversion: 354 case CK_FunctionToPointerDecay: 355 case CK_BuiltinFnToFnPtr: { 356 // Copy the SVal of Ex to CastE. 357 ProgramStateRef state = Pred->getState(); 358 const LocationContext *LCtx = Pred->getLocationContext(); 359 SVal V = state->getSVal(Ex, LCtx); 360 state = state->BindExpr(CastE, LCtx, V); 361 Bldr.generateNode(CastE, Pred, state); 362 continue; 363 } 364 case CK_MemberPointerToBoolean: 365 case CK_PointerToBoolean: { 366 SVal V = state->getSVal(Ex, LCtx); 367 auto PTMSV = V.getAs<nonloc::PointerToMember>(); 368 if (PTMSV) 369 V = svalBuilder.makeTruthVal(!PTMSV->isNullMemberPointer(), ExTy); 370 if (V.isUndef() || PTMSV) { 371 state = state->BindExpr(CastE, LCtx, V); 372 Bldr.generateNode(CastE, Pred, state); 373 continue; 374 } 375 // Explicitly proceed with default handler for this case cascade. 376 state = 377 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 378 continue; 379 } 380 case CK_Dependent: 381 case CK_ArrayToPointerDecay: 382 case CK_BitCast: 383 case CK_LValueToRValueBitCast: 384 case CK_AddressSpaceConversion: 385 case CK_BooleanToSignedIntegral: 386 case CK_IntegralToPointer: 387 case CK_PointerToIntegral: { 388 SVal V = state->getSVal(Ex, LCtx); 389 if (V.getAs<nonloc::PointerToMember>()) { 390 state = state->BindExpr(CastE, LCtx, UnknownVal()); 391 Bldr.generateNode(CastE, Pred, state); 392 continue; 393 } 394 // Explicitly proceed with default handler for this case cascade. 395 state = 396 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 397 continue; 398 } 399 case CK_IntegralToBoolean: 400 case CK_IntegralToFloating: 401 case CK_FloatingToIntegral: 402 case CK_FloatingToBoolean: 403 case CK_FloatingCast: 404 case CK_FloatingRealToComplex: 405 case CK_FloatingComplexToReal: 406 case CK_FloatingComplexToBoolean: 407 case CK_FloatingComplexCast: 408 case CK_FloatingComplexToIntegralComplex: 409 case CK_IntegralRealToComplex: 410 case CK_IntegralComplexToReal: 411 case CK_IntegralComplexToBoolean: 412 case CK_IntegralComplexCast: 413 case CK_IntegralComplexToFloatingComplex: 414 case CK_CPointerToObjCPointerCast: 415 case CK_BlockPointerToObjCPointerCast: 416 case CK_AnyPointerToBlockPointerCast: 417 case CK_ObjCObjectLValueCast: 418 case CK_ZeroToOCLOpaqueType: 419 case CK_IntToOCLSampler: 420 case CK_LValueBitCast: 421 case CK_FixedPointCast: 422 case CK_FixedPointToBoolean: 423 case CK_FixedPointToIntegral: 424 case CK_IntegralToFixedPoint: { 425 state = 426 handleLValueBitCast(state, Ex, LCtx, T, ExTy, CastE, Bldr, Pred); 427 continue; 428 } 429 case CK_IntegralCast: { 430 // Delegate to SValBuilder to process. 431 SVal V = state->getSVal(Ex, LCtx); 432 V = svalBuilder.evalIntegralCast(state, V, T, ExTy); 433 state = state->BindExpr(CastE, LCtx, V); 434 Bldr.generateNode(CastE, Pred, state); 435 continue; 436 } 437 case CK_DerivedToBase: 438 case CK_UncheckedDerivedToBase: { 439 // For DerivedToBase cast, delegate to the store manager. 440 SVal val = state->getSVal(Ex, LCtx); 441 val = getStoreManager().evalDerivedToBase(val, CastE); 442 state = state->BindExpr(CastE, LCtx, val); 443 Bldr.generateNode(CastE, Pred, state); 444 continue; 445 } 446 // Handle C++ dyn_cast. 447 case CK_Dynamic: { 448 SVal val = state->getSVal(Ex, LCtx); 449 450 // Compute the type of the result. 451 QualType resultType = CastE->getType(); 452 if (CastE->isGLValue()) 453 resultType = getContext().getPointerType(resultType); 454 455 bool Failed = false; 456 457 // Check if the value being cast evaluates to 0. 458 if (val.isZeroConstant()) 459 Failed = true; 460 // Else, evaluate the cast. 461 else 462 val = getStoreManager().attemptDownCast(val, T, Failed); 463 464 if (Failed) { 465 if (T->isReferenceType()) { 466 // A bad_cast exception is thrown if input value is a reference. 467 // Currently, we model this, by generating a sink. 468 Bldr.generateSink(CastE, Pred, state); 469 continue; 470 } else { 471 // If the cast fails on a pointer, bind to 0. 472 state = state->BindExpr(CastE, LCtx, svalBuilder.makeNull()); 473 } 474 } else { 475 // If we don't know if the cast succeeded, conjure a new symbol. 476 if (val.isUnknown()) { 477 DefinedOrUnknownSVal NewSym = 478 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 479 currBldrCtx->blockCount()); 480 state = state->BindExpr(CastE, LCtx, NewSym); 481 } else 482 // Else, bind to the derived region value. 483 state = state->BindExpr(CastE, LCtx, val); 484 } 485 Bldr.generateNode(CastE, Pred, state); 486 continue; 487 } 488 case CK_BaseToDerived: { 489 SVal val = state->getSVal(Ex, LCtx); 490 QualType resultType = CastE->getType(); 491 if (CastE->isGLValue()) 492 resultType = getContext().getPointerType(resultType); 493 494 bool Failed = false; 495 496 if (!val.isConstant()) { 497 val = getStoreManager().attemptDownCast(val, T, Failed); 498 } 499 500 // Failed to cast or the result is unknown, fall back to conservative. 501 if (Failed || val.isUnknown()) { 502 val = 503 svalBuilder.conjureSymbolVal(nullptr, CastE, LCtx, resultType, 504 currBldrCtx->blockCount()); 505 } 506 state = state->BindExpr(CastE, LCtx, val); 507 Bldr.generateNode(CastE, Pred, state); 508 continue; 509 } 510 case CK_NullToPointer: { 511 SVal V = svalBuilder.makeNull(); 512 state = state->BindExpr(CastE, LCtx, V); 513 Bldr.generateNode(CastE, Pred, state); 514 continue; 515 } 516 case CK_NullToMemberPointer: { 517 SVal V = svalBuilder.getMemberPointer(nullptr); 518 state = state->BindExpr(CastE, LCtx, V); 519 Bldr.generateNode(CastE, Pred, state); 520 continue; 521 } 522 case CK_DerivedToBaseMemberPointer: 523 case CK_BaseToDerivedMemberPointer: 524 case CK_ReinterpretMemberPointer: { 525 SVal V = state->getSVal(Ex, LCtx); 526 if (auto PTMSV = V.getAs<nonloc::PointerToMember>()) { 527 SVal CastedPTMSV = svalBuilder.makePointerToMember( 528 getBasicVals().accumCXXBase( 529 llvm::make_range<CastExpr::path_const_iterator>( 530 CastE->path_begin(), CastE->path_end()), *PTMSV)); 531 state = state->BindExpr(CastE, LCtx, CastedPTMSV); 532 Bldr.generateNode(CastE, Pred, state); 533 continue; 534 } 535 // Explicitly proceed with default handler for this case cascade. 536 state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred); 537 continue; 538 } 539 // Various C++ casts that are not handled yet. 540 case CK_ToUnion: 541 case CK_VectorSplat: { 542 state = handleLVectorSplat(state, LCtx, CastE, Bldr, Pred); 543 continue; 544 } 545 } 546 } 547 } 548 549 void ExprEngine::VisitCompoundLiteralExpr(const CompoundLiteralExpr *CL, 550 ExplodedNode *Pred, 551 ExplodedNodeSet &Dst) { 552 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 553 554 ProgramStateRef State = Pred->getState(); 555 const LocationContext *LCtx = Pred->getLocationContext(); 556 557 const Expr *Init = CL->getInitializer(); 558 SVal V = State->getSVal(CL->getInitializer(), LCtx); 559 560 if (isa<CXXConstructExpr>(Init) || isa<CXXStdInitializerListExpr>(Init)) { 561 // No work needed. Just pass the value up to this expression. 562 } else { 563 assert(isa<InitListExpr>(Init)); 564 Loc CLLoc = State->getLValue(CL, LCtx); 565 State = State->bindLoc(CLLoc, V, LCtx); 566 567 if (CL->isGLValue()) 568 V = CLLoc; 569 } 570 571 B.generateNode(CL, Pred, State->BindExpr(CL, LCtx, V)); 572 } 573 574 void ExprEngine::VisitDeclStmt(const DeclStmt *DS, ExplodedNode *Pred, 575 ExplodedNodeSet &Dst) { 576 // Assumption: The CFG has one DeclStmt per Decl. 577 const VarDecl *VD = dyn_cast_or_null<VarDecl>(*DS->decl_begin()); 578 579 if (!VD) { 580 //TODO:AZ: remove explicit insertion after refactoring is done. 581 Dst.insert(Pred); 582 return; 583 } 584 585 // FIXME: all pre/post visits should eventually be handled by ::Visit(). 586 ExplodedNodeSet dstPreVisit; 587 getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, DS, *this); 588 589 ExplodedNodeSet dstEvaluated; 590 StmtNodeBuilder B(dstPreVisit, dstEvaluated, *currBldrCtx); 591 for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end(); 592 I!=E; ++I) { 593 ExplodedNode *N = *I; 594 ProgramStateRef state = N->getState(); 595 const LocationContext *LC = N->getLocationContext(); 596 597 // Decls without InitExpr are not initialized explicitly. 598 if (const Expr *InitEx = VD->getInit()) { 599 600 // Note in the state that the initialization has occurred. 601 ExplodedNode *UpdatedN = N; 602 SVal InitVal = state->getSVal(InitEx, LC); 603 604 assert(DS->isSingleDecl()); 605 if (getObjectUnderConstruction(state, DS, LC)) { 606 state = finishObjectConstruction(state, DS, LC); 607 // We constructed the object directly in the variable. 608 // No need to bind anything. 609 B.generateNode(DS, UpdatedN, state); 610 } else { 611 // Recover some path-sensitivity if a scalar value evaluated to 612 // UnknownVal. 613 if (InitVal.isUnknown()) { 614 QualType Ty = InitEx->getType(); 615 if (InitEx->isGLValue()) { 616 Ty = getContext().getPointerType(Ty); 617 } 618 619 InitVal = svalBuilder.conjureSymbolVal(nullptr, InitEx, LC, Ty, 620 currBldrCtx->blockCount()); 621 } 622 623 624 B.takeNodes(UpdatedN); 625 ExplodedNodeSet Dst2; 626 evalBind(Dst2, DS, UpdatedN, state->getLValue(VD, LC), InitVal, true); 627 B.addNodes(Dst2); 628 } 629 } 630 else { 631 B.generateNode(DS, N, state); 632 } 633 } 634 635 getCheckerManager().runCheckersForPostStmt(Dst, B.getResults(), DS, *this); 636 } 637 638 void ExprEngine::VisitLogicalExpr(const BinaryOperator* B, ExplodedNode *Pred, 639 ExplodedNodeSet &Dst) { 640 // This method acts upon CFG elements for logical operators && and || 641 // and attaches the value (true or false) to them as expressions. 642 // It doesn't produce any state splits. 643 // If we made it that far, we're past the point when we modeled the short 644 // circuit. It means that we should have precise knowledge about whether 645 // we've short-circuited. If we did, we already know the value we need to 646 // bind. If we didn't, the value of the RHS (casted to the boolean type) 647 // is the answer. 648 // Currently this method tries to figure out whether we've short-circuited 649 // by looking at the ExplodedGraph. This method is imperfect because there 650 // could inevitably have been merges that would have resulted in multiple 651 // potential path traversal histories. We bail out when we fail. 652 // Due to this ambiguity, a more reliable solution would have been to 653 // track the short circuit operation history path-sensitively until 654 // we evaluate the respective logical operator. 655 assert(B->getOpcode() == BO_LAnd || 656 B->getOpcode() == BO_LOr); 657 658 StmtNodeBuilder Bldr(Pred, Dst, *currBldrCtx); 659 ProgramStateRef state = Pred->getState(); 660 661 if (B->getType()->isVectorType()) { 662 // FIXME: We do not model vector arithmetic yet. When adding support for 663 // that, note that the CFG-based reasoning below does not apply, because 664 // logical operators on vectors are not short-circuit. Currently they are 665 // modeled as short-circuit in Clang CFG but this is incorrect. 666 // Do not set the value for the expression. It'd be UnknownVal by default. 667 Bldr.generateNode(B, Pred, state); 668 return; 669 } 670 671 ExplodedNode *N = Pred; 672 while (!N->getLocation().getAs<BlockEntrance>()) { 673 ProgramPoint P = N->getLocation(); 674 assert(P.getAs<PreStmt>()|| P.getAs<PreStmtPurgeDeadSymbols>()); 675 (void) P; 676 if (N->pred_size() != 1) { 677 // We failed to track back where we came from. 678 Bldr.generateNode(B, Pred, state); 679 return; 680 } 681 N = *N->pred_begin(); 682 } 683 684 if (N->pred_size() != 1) { 685 // We failed to track back where we came from. 686 Bldr.generateNode(B, Pred, state); 687 return; 688 } 689 690 N = *N->pred_begin(); 691 BlockEdge BE = N->getLocation().castAs<BlockEdge>(); 692 SVal X; 693 694 // Determine the value of the expression by introspecting how we 695 // got this location in the CFG. This requires looking at the previous 696 // block we were in and what kind of control-flow transfer was involved. 697 const CFGBlock *SrcBlock = BE.getSrc(); 698 // The only terminator (if there is one) that makes sense is a logical op. 699 CFGTerminator T = SrcBlock->getTerminator(); 700 if (const BinaryOperator *Term = cast_or_null<BinaryOperator>(T.getStmt())) { 701 (void) Term; 702 assert(Term->isLogicalOp()); 703 assert(SrcBlock->succ_size() == 2); 704 // Did we take the true or false branch? 705 unsigned constant = (*SrcBlock->succ_begin() == BE.getDst()) ? 1 : 0; 706 X = svalBuilder.makeIntVal(constant, B->getType()); 707 } 708 else { 709 // If there is no terminator, by construction the last statement 710 // in SrcBlock is the value of the enclosing expression. 711 // However, we still need to constrain that value to be 0 or 1. 712 assert(!SrcBlock->empty()); 713 CFGStmt Elem = SrcBlock->rbegin()->castAs<CFGStmt>(); 714 const Expr *RHS = cast<Expr>(Elem.getStmt()); 715 SVal RHSVal = N->getState()->getSVal(RHS, Pred->getLocationContext()); 716 717 if (RHSVal.isUndef()) { 718 X = RHSVal; 719 } else { 720 // We evaluate "RHSVal != 0" expression which result in 0 if the value is 721 // known to be false, 1 if the value is known to be true and a new symbol 722 // when the assumption is unknown. 723 nonloc::ConcreteInt Zero(getBasicVals().getValue(0, B->getType())); 724 X = evalBinOp(N->getState(), BO_NE, 725 svalBuilder.evalCast(RHSVal, B->getType(), RHS->getType()), 726 Zero, B->getType()); 727 } 728 } 729 Bldr.generateNode(B, Pred, state->BindExpr(B, Pred->getLocationContext(), X)); 730 } 731 732 void ExprEngine::VisitInitListExpr(const InitListExpr *IE, 733 ExplodedNode *Pred, 734 ExplodedNodeSet &Dst) { 735 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 736 737 ProgramStateRef state = Pred->getState(); 738 const LocationContext *LCtx = Pred->getLocationContext(); 739 QualType T = getContext().getCanonicalType(IE->getType()); 740 unsigned NumInitElements = IE->getNumInits(); 741 742 if (!IE->isGLValue() && !IE->isTransparent() && 743 (T->isArrayType() || T->isRecordType() || T->isVectorType() || 744 T->isAnyComplexType())) { 745 llvm::ImmutableList<SVal> vals = getBasicVals().getEmptySValList(); 746 747 // Handle base case where the initializer has no elements. 748 // e.g: static int* myArray[] = {}; 749 if (NumInitElements == 0) { 750 SVal V = svalBuilder.makeCompoundVal(T, vals); 751 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 752 return; 753 } 754 755 for (InitListExpr::const_reverse_iterator it = IE->rbegin(), 756 ei = IE->rend(); it != ei; ++it) { 757 SVal V = state->getSVal(cast<Expr>(*it), LCtx); 758 vals = getBasicVals().prependSVal(V, vals); 759 } 760 761 B.generateNode(IE, Pred, 762 state->BindExpr(IE, LCtx, 763 svalBuilder.makeCompoundVal(T, vals))); 764 return; 765 } 766 767 // Handle scalars: int{5} and int{} and GLvalues. 768 // Note, if the InitListExpr is a GLvalue, it means that there is an address 769 // representing it, so it must have a single init element. 770 assert(NumInitElements <= 1); 771 772 SVal V; 773 if (NumInitElements == 0) 774 V = getSValBuilder().makeZeroVal(T); 775 else 776 V = state->getSVal(IE->getInit(0), LCtx); 777 778 B.generateNode(IE, Pred, state->BindExpr(IE, LCtx, V)); 779 } 780 781 void ExprEngine::VisitGuardedExpr(const Expr *Ex, 782 const Expr *L, 783 const Expr *R, 784 ExplodedNode *Pred, 785 ExplodedNodeSet &Dst) { 786 assert(L && R); 787 788 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 789 ProgramStateRef state = Pred->getState(); 790 const LocationContext *LCtx = Pred->getLocationContext(); 791 const CFGBlock *SrcBlock = nullptr; 792 793 // Find the predecessor block. 794 ProgramStateRef SrcState = state; 795 for (const ExplodedNode *N = Pred ; N ; N = *N->pred_begin()) { 796 ProgramPoint PP = N->getLocation(); 797 if (PP.getAs<PreStmtPurgeDeadSymbols>() || PP.getAs<BlockEntrance>()) { 798 // If the state N has multiple predecessors P, it means that successors 799 // of P are all equivalent. 800 // In turn, that means that all nodes at P are equivalent in terms 801 // of observable behavior at N, and we can follow any of them. 802 // FIXME: a more robust solution which does not walk up the tree. 803 continue; 804 } 805 SrcBlock = PP.castAs<BlockEdge>().getSrc(); 806 SrcState = N->getState(); 807 break; 808 } 809 810 assert(SrcBlock && "missing function entry"); 811 812 // Find the last expression in the predecessor block. That is the 813 // expression that is used for the value of the ternary expression. 814 bool hasValue = false; 815 SVal V; 816 817 for (CFGElement CE : llvm::reverse(*SrcBlock)) { 818 if (Optional<CFGStmt> CS = CE.getAs<CFGStmt>()) { 819 const Expr *ValEx = cast<Expr>(CS->getStmt()); 820 ValEx = ValEx->IgnoreParens(); 821 822 // For GNU extension '?:' operator, the left hand side will be an 823 // OpaqueValueExpr, so get the underlying expression. 824 if (const OpaqueValueExpr *OpaqueEx = dyn_cast<OpaqueValueExpr>(L)) 825 L = OpaqueEx->getSourceExpr(); 826 827 // If the last expression in the predecessor block matches true or false 828 // subexpression, get its the value. 829 if (ValEx == L->IgnoreParens() || ValEx == R->IgnoreParens()) { 830 hasValue = true; 831 V = SrcState->getSVal(ValEx, LCtx); 832 } 833 break; 834 } 835 } 836 837 if (!hasValue) 838 V = svalBuilder.conjureSymbolVal(nullptr, Ex, LCtx, 839 currBldrCtx->blockCount()); 840 841 // Generate a new node with the binding from the appropriate path. 842 B.generateNode(Ex, Pred, state->BindExpr(Ex, LCtx, V, true)); 843 } 844 845 void ExprEngine:: 846 VisitOffsetOfExpr(const OffsetOfExpr *OOE, 847 ExplodedNode *Pred, ExplodedNodeSet &Dst) { 848 StmtNodeBuilder B(Pred, Dst, *currBldrCtx); 849 Expr::EvalResult Result; 850 if (OOE->EvaluateAsInt(Result, getContext())) { 851 APSInt IV = Result.Val.getInt(); 852 assert(IV.getBitWidth() == getContext().getTypeSize(OOE->getType())); 853 assert(OOE->getType()->castAs<BuiltinType>()->isInteger()); 854 assert(IV.isSigned() == OOE->getType()->isSignedIntegerType()); 855 SVal X = svalBuilder.makeIntVal(IV); 856 B.generateNode(OOE, Pred, 857 Pred->getState()->BindExpr(OOE, Pred->getLocationContext(), 858 X)); 859 } 860 // FIXME: Handle the case where __builtin_offsetof is not a constant. 861 } 862 863 864 void ExprEngine:: 865 VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *Ex, 866 ExplodedNode *Pred, 867 ExplodedNodeSet &Dst) { 868 // FIXME: Prechecks eventually go in ::Visit(). 869 ExplodedNodeSet CheckedSet; 870 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, Ex, *this); 871 872 ExplodedNodeSet EvalSet; 873 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 874 875 QualType T = Ex->getTypeOfArgument(); 876 877 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 878 I != E; ++I) { 879 if (Ex->getKind() == UETT_SizeOf) { 880 if (!T->isIncompleteType() && !T->isConstantSizeType()) { 881 assert(T->isVariableArrayType() && "Unknown non-constant-sized type."); 882 883 // FIXME: Add support for VLA type arguments and VLA expressions. 884 // When that happens, we should probably refactor VLASizeChecker's code. 885 continue; 886 } else if (T->getAs<ObjCObjectType>()) { 887 // Some code tries to take the sizeof an ObjCObjectType, relying that 888 // the compiler has laid out its representation. Just report Unknown 889 // for these. 890 continue; 891 } 892 } 893 894 APSInt Value = Ex->EvaluateKnownConstInt(getContext()); 895 CharUnits amt = CharUnits::fromQuantity(Value.getZExtValue()); 896 897 ProgramStateRef state = (*I)->getState(); 898 state = state->BindExpr(Ex, (*I)->getLocationContext(), 899 svalBuilder.makeIntVal(amt.getQuantity(), 900 Ex->getType())); 901 Bldr.generateNode(Ex, *I, state); 902 } 903 904 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, Ex, *this); 905 } 906 907 void ExprEngine::handleUOExtension(ExplodedNodeSet::iterator I, 908 const UnaryOperator *U, 909 StmtNodeBuilder &Bldr) { 910 // FIXME: We can probably just have some magic in Environment::getSVal() 911 // that propagates values, instead of creating a new node here. 912 // 913 // Unary "+" is a no-op, similar to a parentheses. We still have places 914 // where it may be a block-level expression, so we need to 915 // generate an extra node that just propagates the value of the 916 // subexpression. 917 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 918 ProgramStateRef state = (*I)->getState(); 919 const LocationContext *LCtx = (*I)->getLocationContext(); 920 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, 921 state->getSVal(Ex, LCtx))); 922 } 923 924 void ExprEngine::VisitUnaryOperator(const UnaryOperator* U, ExplodedNode *Pred, 925 ExplodedNodeSet &Dst) { 926 // FIXME: Prechecks eventually go in ::Visit(). 927 ExplodedNodeSet CheckedSet; 928 getCheckerManager().runCheckersForPreStmt(CheckedSet, Pred, U, *this); 929 930 ExplodedNodeSet EvalSet; 931 StmtNodeBuilder Bldr(CheckedSet, EvalSet, *currBldrCtx); 932 933 for (ExplodedNodeSet::iterator I = CheckedSet.begin(), E = CheckedSet.end(); 934 I != E; ++I) { 935 switch (U->getOpcode()) { 936 default: { 937 Bldr.takeNodes(*I); 938 ExplodedNodeSet Tmp; 939 VisitIncrementDecrementOperator(U, *I, Tmp); 940 Bldr.addNodes(Tmp); 941 break; 942 } 943 case UO_Real: { 944 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 945 946 // FIXME: We don't have complex SValues yet. 947 if (Ex->getType()->isAnyComplexType()) { 948 // Just report "Unknown." 949 break; 950 } 951 952 // For all other types, UO_Real is an identity operation. 953 assert (U->getType() == Ex->getType()); 954 ProgramStateRef state = (*I)->getState(); 955 const LocationContext *LCtx = (*I)->getLocationContext(); 956 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, 957 state->getSVal(Ex, LCtx))); 958 break; 959 } 960 961 case UO_Imag: { 962 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 963 // FIXME: We don't have complex SValues yet. 964 if (Ex->getType()->isAnyComplexType()) { 965 // Just report "Unknown." 966 break; 967 } 968 // For all other types, UO_Imag returns 0. 969 ProgramStateRef state = (*I)->getState(); 970 const LocationContext *LCtx = (*I)->getLocationContext(); 971 SVal X = svalBuilder.makeZeroVal(Ex->getType()); 972 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, X)); 973 break; 974 } 975 976 case UO_AddrOf: { 977 // Process pointer-to-member address operation. 978 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 979 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Ex)) { 980 const ValueDecl *VD = DRE->getDecl(); 981 982 if (isa<CXXMethodDecl>(VD) || isa<FieldDecl>(VD)) { 983 ProgramStateRef State = (*I)->getState(); 984 const LocationContext *LCtx = (*I)->getLocationContext(); 985 SVal SV = svalBuilder.getMemberPointer(cast<DeclaratorDecl>(VD)); 986 Bldr.generateNode(U, *I, State->BindExpr(U, LCtx, SV)); 987 break; 988 } 989 } 990 // Explicitly proceed with default handler for this case cascade. 991 handleUOExtension(I, U, Bldr); 992 break; 993 } 994 case UO_Plus: 995 assert(!U->isGLValue()); 996 LLVM_FALLTHROUGH; 997 case UO_Deref: 998 case UO_Extension: { 999 handleUOExtension(I, U, Bldr); 1000 break; 1001 } 1002 1003 case UO_LNot: 1004 case UO_Minus: 1005 case UO_Not: { 1006 assert (!U->isGLValue()); 1007 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1008 ProgramStateRef state = (*I)->getState(); 1009 const LocationContext *LCtx = (*I)->getLocationContext(); 1010 1011 // Get the value of the subexpression. 1012 SVal V = state->getSVal(Ex, LCtx); 1013 1014 if (V.isUnknownOrUndef()) { 1015 Bldr.generateNode(U, *I, state->BindExpr(U, LCtx, V)); 1016 break; 1017 } 1018 1019 switch (U->getOpcode()) { 1020 default: 1021 llvm_unreachable("Invalid Opcode."); 1022 case UO_Not: 1023 // FIXME: Do we need to handle promotions? 1024 state = state->BindExpr(U, LCtx, evalComplement(V.castAs<NonLoc>())); 1025 break; 1026 case UO_Minus: 1027 // FIXME: Do we need to handle promotions? 1028 state = state->BindExpr(U, LCtx, evalMinus(V.castAs<NonLoc>())); 1029 break; 1030 case UO_LNot: 1031 // C99 6.5.3.3: "The expression !E is equivalent to (0==E)." 1032 // 1033 // Note: technically we do "E == 0", but this is the same in the 1034 // transfer functions as "0 == E". 1035 SVal Result; 1036 if (Optional<Loc> LV = V.getAs<Loc>()) { 1037 Loc X = svalBuilder.makeNullWithType(Ex->getType()); 1038 Result = evalBinOp(state, BO_EQ, *LV, X, U->getType()); 1039 } else if (Ex->getType()->isFloatingType()) { 1040 // FIXME: handle floating point types. 1041 Result = UnknownVal(); 1042 } else { 1043 nonloc::ConcreteInt X(getBasicVals().getValue(0, Ex->getType())); 1044 Result = evalBinOp(state, BO_EQ, V.castAs<NonLoc>(), X, 1045 U->getType()); 1046 } 1047 1048 state = state->BindExpr(U, LCtx, Result); 1049 break; 1050 } 1051 Bldr.generateNode(U, *I, state); 1052 break; 1053 } 1054 } 1055 } 1056 1057 getCheckerManager().runCheckersForPostStmt(Dst, EvalSet, U, *this); 1058 } 1059 1060 void ExprEngine::VisitIncrementDecrementOperator(const UnaryOperator* U, 1061 ExplodedNode *Pred, 1062 ExplodedNodeSet &Dst) { 1063 // Handle ++ and -- (both pre- and post-increment). 1064 assert (U->isIncrementDecrementOp()); 1065 const Expr *Ex = U->getSubExpr()->IgnoreParens(); 1066 1067 const LocationContext *LCtx = Pred->getLocationContext(); 1068 ProgramStateRef state = Pred->getState(); 1069 SVal loc = state->getSVal(Ex, LCtx); 1070 1071 // Perform a load. 1072 ExplodedNodeSet Tmp; 1073 evalLoad(Tmp, U, Ex, Pred, state, loc); 1074 1075 ExplodedNodeSet Dst2; 1076 StmtNodeBuilder Bldr(Tmp, Dst2, *currBldrCtx); 1077 for (ExplodedNodeSet::iterator I=Tmp.begin(), E=Tmp.end();I!=E;++I) { 1078 1079 state = (*I)->getState(); 1080 assert(LCtx == (*I)->getLocationContext()); 1081 SVal V2_untested = state->getSVal(Ex, LCtx); 1082 1083 // Propagate unknown and undefined values. 1084 if (V2_untested.isUnknownOrUndef()) { 1085 state = state->BindExpr(U, LCtx, V2_untested); 1086 1087 // Perform the store, so that the uninitialized value detection happens. 1088 Bldr.takeNodes(*I); 1089 ExplodedNodeSet Dst3; 1090 evalStore(Dst3, U, Ex, *I, state, loc, V2_untested); 1091 Bldr.addNodes(Dst3); 1092 1093 continue; 1094 } 1095 DefinedSVal V2 = V2_untested.castAs<DefinedSVal>(); 1096 1097 // Handle all other values. 1098 BinaryOperator::Opcode Op = U->isIncrementOp() ? BO_Add : BO_Sub; 1099 1100 // If the UnaryOperator has non-location type, use its type to create the 1101 // constant value. If the UnaryOperator has location type, create the 1102 // constant with int type and pointer width. 1103 SVal RHS; 1104 SVal Result; 1105 1106 if (U->getType()->isAnyPointerType()) 1107 RHS = svalBuilder.makeArrayIndex(1); 1108 else if (U->getType()->isIntegralOrEnumerationType()) 1109 RHS = svalBuilder.makeIntVal(1, U->getType()); 1110 else 1111 RHS = UnknownVal(); 1112 1113 // The use of an operand of type bool with the ++ operators is deprecated 1114 // but valid until C++17. And if the operand of the ++ operator is of type 1115 // bool, it is set to true until C++17. Note that for '_Bool', it is also 1116 // set to true when it encounters ++ operator. 1117 if (U->getType()->isBooleanType() && U->isIncrementOp()) 1118 Result = svalBuilder.makeTruthVal(true, U->getType()); 1119 else 1120 Result = evalBinOp(state, Op, V2, RHS, U->getType()); 1121 1122 // Conjure a new symbol if necessary to recover precision. 1123 if (Result.isUnknown()){ 1124 DefinedOrUnknownSVal SymVal = 1125 svalBuilder.conjureSymbolVal(nullptr, U, LCtx, 1126 currBldrCtx->blockCount()); 1127 Result = SymVal; 1128 1129 // If the value is a location, ++/-- should always preserve 1130 // non-nullness. Check if the original value was non-null, and if so 1131 // propagate that constraint. 1132 if (Loc::isLocType(U->getType())) { 1133 DefinedOrUnknownSVal Constraint = 1134 svalBuilder.evalEQ(state, V2,svalBuilder.makeZeroVal(U->getType())); 1135 1136 if (!state->assume(Constraint, true)) { 1137 // It isn't feasible for the original value to be null. 1138 // Propagate this constraint. 1139 Constraint = svalBuilder.evalEQ(state, SymVal, 1140 svalBuilder.makeZeroVal(U->getType())); 1141 1142 state = state->assume(Constraint, false); 1143 assert(state); 1144 } 1145 } 1146 } 1147 1148 // Since the lvalue-to-rvalue conversion is explicit in the AST, 1149 // we bind an l-value if the operator is prefix and an lvalue (in C++). 1150 if (U->isGLValue()) 1151 state = state->BindExpr(U, LCtx, loc); 1152 else 1153 state = state->BindExpr(U, LCtx, U->isPostfix() ? V2 : Result); 1154 1155 // Perform the store. 1156 Bldr.takeNodes(*I); 1157 ExplodedNodeSet Dst3; 1158 evalStore(Dst3, U, Ex, *I, state, loc, Result); 1159 Bldr.addNodes(Dst3); 1160 } 1161 Dst.insert(Dst2); 1162 } 1163