Home | History | Annotate | Download | only in Core
      1 //== Store.cpp - Interface for maps from Locations to Values ----*- C++ -*--==//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 //  This file defined the types Store and StoreManager.
     11 //
     12 //===----------------------------------------------------------------------===//
     13 
     14 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
     15 #include "clang/AST/CXXInheritance.h"
     16 #include "clang/AST/CharUnits.h"
     17 #include "clang/AST/DeclObjC.h"
     18 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
     19 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
     20 
     21 using namespace clang;
     22 using namespace ento;
     23 
     24 StoreManager::StoreManager(ProgramStateManager &stateMgr)
     25   : svalBuilder(stateMgr.getSValBuilder()), StateMgr(stateMgr),
     26     MRMgr(svalBuilder.getRegionManager()), Ctx(stateMgr.getContext()) {}
     27 
     28 StoreRef StoreManager::enterStackFrame(Store OldStore,
     29                                        const CallEvent &Call,
     30                                        const StackFrameContext *LCtx) {
     31   StoreRef Store = StoreRef(OldStore, *this);
     32 
     33   SmallVector<CallEvent::FrameBindingTy, 16> InitialBindings;
     34   Call.getInitialStackFrameContents(LCtx, InitialBindings);
     35 
     36   for (CallEvent::BindingsTy::iterator I = InitialBindings.begin(),
     37                                        E = InitialBindings.end();
     38        I != E; ++I) {
     39     Store = Bind(Store.getStore(), I->first, I->second);
     40   }
     41 
     42   return Store;
     43 }
     44 
     45 const MemRegion *StoreManager::MakeElementRegion(const MemRegion *Base,
     46                                               QualType EleTy, uint64_t index) {
     47   NonLoc idx = svalBuilder.makeArrayIndex(index);
     48   return MRMgr.getElementRegion(EleTy, idx, Base, svalBuilder.getContext());
     49 }
     50 
     51 // FIXME: Merge with the implementation of the same method in MemRegion.cpp
     52 static bool IsCompleteType(ASTContext &Ctx, QualType Ty) {
     53   if (const RecordType *RT = Ty->getAs<RecordType>()) {
     54     const RecordDecl *D = RT->getDecl();
     55     if (!D->getDefinition())
     56       return false;
     57   }
     58 
     59   return true;
     60 }
     61 
     62 StoreRef StoreManager::BindDefault(Store store, const MemRegion *R, SVal V) {
     63   return StoreRef(store, *this);
     64 }
     65 
     66 const ElementRegion *StoreManager::GetElementZeroRegion(const MemRegion *R,
     67                                                         QualType T) {
     68   NonLoc idx = svalBuilder.makeZeroArrayIndex();
     69   assert(!T.isNull());
     70   return MRMgr.getElementRegion(T, idx, R, Ctx);
     71 }
     72 
     73 const MemRegion *StoreManager::castRegion(const MemRegion *R, QualType CastToTy) {
     74 
     75   ASTContext &Ctx = StateMgr.getContext();
     76 
     77   // Handle casts to Objective-C objects.
     78   if (CastToTy->isObjCObjectPointerType())
     79     return R->StripCasts();
     80 
     81   if (CastToTy->isBlockPointerType()) {
     82     // FIXME: We may need different solutions, depending on the symbol
     83     // involved.  Blocks can be casted to/from 'id', as they can be treated
     84     // as Objective-C objects.  This could possibly be handled by enhancing
     85     // our reasoning of downcasts of symbolic objects.
     86     if (isa<CodeTextRegion>(R) || isa<SymbolicRegion>(R))
     87       return R;
     88 
     89     // We don't know what to make of it.  Return a NULL region, which
     90     // will be interpretted as UnknownVal.
     91     return NULL;
     92   }
     93 
     94   // Now assume we are casting from pointer to pointer. Other cases should
     95   // already be handled.
     96   QualType PointeeTy = CastToTy->getPointeeType();
     97   QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
     98 
     99   // Handle casts to void*.  We just pass the region through.
    100   if (CanonPointeeTy.getLocalUnqualifiedType() == Ctx.VoidTy)
    101     return R;
    102 
    103   // Handle casts from compatible types.
    104   if (R->isBoundable())
    105     if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(R)) {
    106       QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
    107       if (CanonPointeeTy == ObjTy)
    108         return R;
    109     }
    110 
    111   // Process region cast according to the kind of the region being cast.
    112   switch (R->getKind()) {
    113     case MemRegion::CXXThisRegionKind:
    114     case MemRegion::GenericMemSpaceRegionKind:
    115     case MemRegion::StackLocalsSpaceRegionKind:
    116     case MemRegion::StackArgumentsSpaceRegionKind:
    117     case MemRegion::HeapSpaceRegionKind:
    118     case MemRegion::UnknownSpaceRegionKind:
    119     case MemRegion::StaticGlobalSpaceRegionKind:
    120     case MemRegion::GlobalInternalSpaceRegionKind:
    121     case MemRegion::GlobalSystemSpaceRegionKind:
    122     case MemRegion::GlobalImmutableSpaceRegionKind: {
    123       llvm_unreachable("Invalid region cast");
    124     }
    125 
    126     case MemRegion::FunctionTextRegionKind:
    127     case MemRegion::BlockTextRegionKind:
    128     case MemRegion::BlockDataRegionKind:
    129     case MemRegion::StringRegionKind:
    130       // FIXME: Need to handle arbitrary downcasts.
    131     case MemRegion::SymbolicRegionKind:
    132     case MemRegion::AllocaRegionKind:
    133     case MemRegion::CompoundLiteralRegionKind:
    134     case MemRegion::FieldRegionKind:
    135     case MemRegion::ObjCIvarRegionKind:
    136     case MemRegion::ObjCStringRegionKind:
    137     case MemRegion::VarRegionKind:
    138     case MemRegion::CXXTempObjectRegionKind:
    139     case MemRegion::CXXBaseObjectRegionKind:
    140       return MakeElementRegion(R, PointeeTy);
    141 
    142     case MemRegion::ElementRegionKind: {
    143       // If we are casting from an ElementRegion to another type, the
    144       // algorithm is as follows:
    145       //
    146       // (1) Compute the "raw offset" of the ElementRegion from the
    147       //     base region.  This is done by calling 'getAsRawOffset()'.
    148       //
    149       // (2a) If we get a 'RegionRawOffset' after calling
    150       //      'getAsRawOffset()', determine if the absolute offset
    151       //      can be exactly divided into chunks of the size of the
    152       //      casted-pointee type.  If so, create a new ElementRegion with
    153       //      the pointee-cast type as the new ElementType and the index
    154       //      being the offset divded by the chunk size.  If not, create
    155       //      a new ElementRegion at offset 0 off the raw offset region.
    156       //
    157       // (2b) If we don't a get a 'RegionRawOffset' after calling
    158       //      'getAsRawOffset()', it means that we are at offset 0.
    159       //
    160       // FIXME: Handle symbolic raw offsets.
    161 
    162       const ElementRegion *elementR = cast<ElementRegion>(R);
    163       const RegionRawOffset &rawOff = elementR->getAsArrayOffset();
    164       const MemRegion *baseR = rawOff.getRegion();
    165 
    166       // If we cannot compute a raw offset, throw up our hands and return
    167       // a NULL MemRegion*.
    168       if (!baseR)
    169         return NULL;
    170 
    171       CharUnits off = rawOff.getOffset();
    172 
    173       if (off.isZero()) {
    174         // Edge case: we are at 0 bytes off the beginning of baseR.  We
    175         // check to see if type we are casting to is the same as the base
    176         // region.  If so, just return the base region.
    177         if (const TypedValueRegion *TR = dyn_cast<TypedValueRegion>(baseR)) {
    178           QualType ObjTy = Ctx.getCanonicalType(TR->getValueType());
    179           QualType CanonPointeeTy = Ctx.getCanonicalType(PointeeTy);
    180           if (CanonPointeeTy == ObjTy)
    181             return baseR;
    182         }
    183 
    184         // Otherwise, create a new ElementRegion at offset 0.
    185         return MakeElementRegion(baseR, PointeeTy);
    186       }
    187 
    188       // We have a non-zero offset from the base region.  We want to determine
    189       // if the offset can be evenly divided by sizeof(PointeeTy).  If so,
    190       // we create an ElementRegion whose index is that value.  Otherwise, we
    191       // create two ElementRegions, one that reflects a raw offset and the other
    192       // that reflects the cast.
    193 
    194       // Compute the index for the new ElementRegion.
    195       int64_t newIndex = 0;
    196       const MemRegion *newSuperR = 0;
    197 
    198       // We can only compute sizeof(PointeeTy) if it is a complete type.
    199       if (IsCompleteType(Ctx, PointeeTy)) {
    200         // Compute the size in **bytes**.
    201         CharUnits pointeeTySize = Ctx.getTypeSizeInChars(PointeeTy);
    202         if (!pointeeTySize.isZero()) {
    203           // Is the offset a multiple of the size?  If so, we can layer the
    204           // ElementRegion (with elementType == PointeeTy) directly on top of
    205           // the base region.
    206           if (off % pointeeTySize == 0) {
    207             newIndex = off / pointeeTySize;
    208             newSuperR = baseR;
    209           }
    210         }
    211       }
    212 
    213       if (!newSuperR) {
    214         // Create an intermediate ElementRegion to represent the raw byte.
    215         // This will be the super region of the final ElementRegion.
    216         newSuperR = MakeElementRegion(baseR, Ctx.CharTy, off.getQuantity());
    217       }
    218 
    219       return MakeElementRegion(newSuperR, PointeeTy, newIndex);
    220     }
    221   }
    222 
    223   llvm_unreachable("unreachable");
    224 }
    225 
    226 static bool regionMatchesCXXRecordType(SVal V, QualType Ty) {
    227   const MemRegion *MR = V.getAsRegion();
    228   if (!MR)
    229     return true;
    230 
    231   const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR);
    232   if (!TVR)
    233     return true;
    234 
    235   const CXXRecordDecl *RD = TVR->getValueType()->getAsCXXRecordDecl();
    236   if (!RD)
    237     return true;
    238 
    239   const CXXRecordDecl *Expected = Ty->getPointeeCXXRecordDecl();
    240   if (!Expected)
    241     Expected = Ty->getAsCXXRecordDecl();
    242 
    243   return Expected->getCanonicalDecl() == RD->getCanonicalDecl();
    244 }
    245 
    246 SVal StoreManager::evalDerivedToBase(SVal Derived, const CastExpr *Cast) {
    247   // Sanity check to avoid doing the wrong thing in the face of
    248   // reinterpret_cast.
    249   if (!regionMatchesCXXRecordType(Derived, Cast->getSubExpr()->getType()))
    250     return UnknownVal();
    251 
    252   // Walk through the cast path to create nested CXXBaseRegions.
    253   SVal Result = Derived;
    254   for (CastExpr::path_const_iterator I = Cast->path_begin(),
    255                                      E = Cast->path_end();
    256        I != E; ++I) {
    257     Result = evalDerivedToBase(Result, (*I)->getType(), (*I)->isVirtual());
    258   }
    259   return Result;
    260 }
    261 
    262 SVal StoreManager::evalDerivedToBase(SVal Derived, const CXXBasePath &Path) {
    263   // Walk through the path to create nested CXXBaseRegions.
    264   SVal Result = Derived;
    265   for (CXXBasePath::const_iterator I = Path.begin(), E = Path.end();
    266        I != E; ++I) {
    267     Result = evalDerivedToBase(Result, I->Base->getType(),
    268                                I->Base->isVirtual());
    269   }
    270   return Result;
    271 }
    272 
    273 SVal StoreManager::evalDerivedToBase(SVal Derived, QualType BaseType,
    274                                      bool IsVirtual) {
    275   Optional<loc::MemRegionVal> DerivedRegVal =
    276       Derived.getAs<loc::MemRegionVal>();
    277   if (!DerivedRegVal)
    278     return Derived;
    279 
    280   const CXXRecordDecl *BaseDecl = BaseType->getPointeeCXXRecordDecl();
    281   if (!BaseDecl)
    282     BaseDecl = BaseType->getAsCXXRecordDecl();
    283   assert(BaseDecl && "not a C++ object?");
    284 
    285   const MemRegion *BaseReg =
    286     MRMgr.getCXXBaseObjectRegion(BaseDecl, DerivedRegVal->getRegion(),
    287                                  IsVirtual);
    288 
    289   return loc::MemRegionVal(BaseReg);
    290 }
    291 
    292 /// Returns the static type of the given region, if it represents a C++ class
    293 /// object.
    294 ///
    295 /// This handles both fully-typed regions, where the dynamic type is known, and
    296 /// symbolic regions, where the dynamic type is merely bounded (and even then,
    297 /// only ostensibly!), but does not take advantage of any dynamic type info.
    298 static const CXXRecordDecl *getCXXRecordType(const MemRegion *MR) {
    299   if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(MR))
    300     return TVR->getValueType()->getAsCXXRecordDecl();
    301   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
    302     return SR->getSymbol()->getType()->getPointeeCXXRecordDecl();
    303   return 0;
    304 }
    305 
    306 SVal StoreManager::evalDynamicCast(SVal Base, QualType TargetType,
    307                                    bool &Failed) {
    308   Failed = false;
    309 
    310   const MemRegion *MR = Base.getAsRegion();
    311   if (!MR)
    312     return UnknownVal();
    313 
    314   // Assume the derived class is a pointer or a reference to a CXX record.
    315   TargetType = TargetType->getPointeeType();
    316   assert(!TargetType.isNull());
    317   const CXXRecordDecl *TargetClass = TargetType->getAsCXXRecordDecl();
    318   if (!TargetClass && !TargetType->isVoidType())
    319     return UnknownVal();
    320 
    321   // Drill down the CXXBaseObject chains, which represent upcasts (casts from
    322   // derived to base).
    323   while (const CXXRecordDecl *MRClass = getCXXRecordType(MR)) {
    324     // If found the derived class, the cast succeeds.
    325     if (MRClass == TargetClass)
    326       return loc::MemRegionVal(MR);
    327 
    328     // We skip over incomplete types. They must be the result of an earlier
    329     // reinterpret_cast, as one can only dynamic_cast between types in the same
    330     // class hierarchy.
    331     if (!TargetType->isVoidType() && MRClass->hasDefinition()) {
    332       // Static upcasts are marked as DerivedToBase casts by Sema, so this will
    333       // only happen when multiple or virtual inheritance is involved.
    334       CXXBasePaths Paths(/*FindAmbiguities=*/false, /*RecordPaths=*/true,
    335                          /*DetectVirtual=*/false);
    336       if (MRClass->isDerivedFrom(TargetClass, Paths))
    337         return evalDerivedToBase(loc::MemRegionVal(MR), Paths.front());
    338     }
    339 
    340     if (const CXXBaseObjectRegion *BaseR = dyn_cast<CXXBaseObjectRegion>(MR)) {
    341       // Drill down the chain to get the derived classes.
    342       MR = BaseR->getSuperRegion();
    343       continue;
    344     }
    345 
    346     // If this is a cast to void*, return the region.
    347     if (TargetType->isVoidType())
    348       return loc::MemRegionVal(MR);
    349 
    350     // Strange use of reinterpret_cast can give us paths we don't reason
    351     // about well, by putting in ElementRegions where we'd expect
    352     // CXXBaseObjectRegions. If it's a valid reinterpret_cast (i.e. if the
    353     // derived class has a zero offset from the base class), then it's safe
    354     // to strip the cast; if it's invalid, -Wreinterpret-base-class should
    355     // catch it. In the interest of performance, the analyzer will silently
    356     // do the wrong thing in the invalid case (because offsets for subregions
    357     // will be wrong).
    358     const MemRegion *Uncasted = MR->StripCasts(/*IncludeBaseCasts=*/false);
    359     if (Uncasted == MR) {
    360       // We reached the bottom of the hierarchy and did not find the derived
    361       // class. We we must be casting the base to derived, so the cast should
    362       // fail.
    363       break;
    364     }
    365 
    366     MR = Uncasted;
    367   }
    368 
    369   // We failed if the region we ended up with has perfect type info.
    370   Failed = isa<TypedValueRegion>(MR);
    371   return UnknownVal();
    372 }
    373 
    374 
    375 /// CastRetrievedVal - Used by subclasses of StoreManager to implement
    376 ///  implicit casts that arise from loads from regions that are reinterpreted
    377 ///  as another region.
    378 SVal StoreManager::CastRetrievedVal(SVal V, const TypedValueRegion *R,
    379                                     QualType castTy, bool performTestOnly) {
    380 
    381   if (castTy.isNull() || V.isUnknownOrUndef())
    382     return V;
    383 
    384   ASTContext &Ctx = svalBuilder.getContext();
    385 
    386   if (performTestOnly) {
    387     // Automatically translate references to pointers.
    388     QualType T = R->getValueType();
    389     if (const ReferenceType *RT = T->getAs<ReferenceType>())
    390       T = Ctx.getPointerType(RT->getPointeeType());
    391 
    392     assert(svalBuilder.getContext().hasSameUnqualifiedType(castTy, T));
    393     return V;
    394   }
    395 
    396   return svalBuilder.dispatchCast(V, castTy);
    397 }
    398 
    399 SVal StoreManager::getLValueFieldOrIvar(const Decl *D, SVal Base) {
    400   if (Base.isUnknownOrUndef())
    401     return Base;
    402 
    403   Loc BaseL = Base.castAs<Loc>();
    404   const MemRegion* BaseR = 0;
    405 
    406   switch (BaseL.getSubKind()) {
    407   case loc::MemRegionKind:
    408     BaseR = BaseL.castAs<loc::MemRegionVal>().getRegion();
    409     break;
    410 
    411   case loc::GotoLabelKind:
    412     // These are anormal cases. Flag an undefined value.
    413     return UndefinedVal();
    414 
    415   case loc::ConcreteIntKind:
    416     // While these seem funny, this can happen through casts.
    417     // FIXME: What we should return is the field offset.  For example,
    418     //  add the field offset to the integer value.  That way funny things
    419     //  like this work properly:  &(((struct foo *) 0xa)->f)
    420     return Base;
    421 
    422   default:
    423     llvm_unreachable("Unhandled Base.");
    424   }
    425 
    426   // NOTE: We must have this check first because ObjCIvarDecl is a subclass
    427   // of FieldDecl.
    428   if (const ObjCIvarDecl *ID = dyn_cast<ObjCIvarDecl>(D))
    429     return loc::MemRegionVal(MRMgr.getObjCIvarRegion(ID, BaseR));
    430 
    431   return loc::MemRegionVal(MRMgr.getFieldRegion(cast<FieldDecl>(D), BaseR));
    432 }
    433 
    434 SVal StoreManager::getLValueIvar(const ObjCIvarDecl *decl, SVal base) {
    435   return getLValueFieldOrIvar(decl, base);
    436 }
    437 
    438 SVal StoreManager::getLValueElement(QualType elementType, NonLoc Offset,
    439                                     SVal Base) {
    440 
    441   // If the base is an unknown or undefined value, just return it back.
    442   // FIXME: For absolute pointer addresses, we just return that value back as
    443   //  well, although in reality we should return the offset added to that
    444   //  value.
    445   if (Base.isUnknownOrUndef() || Base.getAs<loc::ConcreteInt>())
    446     return Base;
    447 
    448   const MemRegion* BaseRegion = Base.castAs<loc::MemRegionVal>().getRegion();
    449 
    450   // Pointer of any type can be cast and used as array base.
    451   const ElementRegion *ElemR = dyn_cast<ElementRegion>(BaseRegion);
    452 
    453   // Convert the offset to the appropriate size and signedness.
    454   Offset = svalBuilder.convertToArrayIndex(Offset).castAs<NonLoc>();
    455 
    456   if (!ElemR) {
    457     //
    458     // If the base region is not an ElementRegion, create one.
    459     // This can happen in the following example:
    460     //
    461     //   char *p = __builtin_alloc(10);
    462     //   p[1] = 8;
    463     //
    464     //  Observe that 'p' binds to an AllocaRegion.
    465     //
    466     return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
    467                                                     BaseRegion, Ctx));
    468   }
    469 
    470   SVal BaseIdx = ElemR->getIndex();
    471 
    472   if (!BaseIdx.getAs<nonloc::ConcreteInt>())
    473     return UnknownVal();
    474 
    475   const llvm::APSInt &BaseIdxI =
    476       BaseIdx.castAs<nonloc::ConcreteInt>().getValue();
    477 
    478   // Only allow non-integer offsets if the base region has no offset itself.
    479   // FIXME: This is a somewhat arbitrary restriction. We should be using
    480   // SValBuilder here to add the two offsets without checking their types.
    481   if (!Offset.getAs<nonloc::ConcreteInt>()) {
    482     if (isa<ElementRegion>(BaseRegion->StripCasts()))
    483       return UnknownVal();
    484 
    485     return loc::MemRegionVal(MRMgr.getElementRegion(elementType, Offset,
    486                                                     ElemR->getSuperRegion(),
    487                                                     Ctx));
    488   }
    489 
    490   const llvm::APSInt& OffI = Offset.castAs<nonloc::ConcreteInt>().getValue();
    491   assert(BaseIdxI.isSigned());
    492 
    493   // Compute the new index.
    494   nonloc::ConcreteInt NewIdx(svalBuilder.getBasicValueFactory().getValue(BaseIdxI +
    495                                                                     OffI));
    496 
    497   // Construct the new ElementRegion.
    498   const MemRegion *ArrayR = ElemR->getSuperRegion();
    499   return loc::MemRegionVal(MRMgr.getElementRegion(elementType, NewIdx, ArrayR,
    500                                                   Ctx));
    501 }
    502 
    503 StoreManager::BindingsHandler::~BindingsHandler() {}
    504 
    505 bool StoreManager::FindUniqueBinding::HandleBinding(StoreManager& SMgr,
    506                                                     Store store,
    507                                                     const MemRegion* R,
    508                                                     SVal val) {
    509   SymbolRef SymV = val.getAsLocSymbol();
    510   if (!SymV || SymV != Sym)
    511     return true;
    512 
    513   if (Binding) {
    514     First = false;
    515     return false;
    516   }
    517   else
    518     Binding = R;
    519 
    520   return true;
    521 }
    522