<html><head><meta http-equiv="Content-Type" content="text/html charset=iso-8859-1"></head><body style="word-wrap: break-word; -webkit-nbsp-mode: space; -webkit-line-break: after-white-space;"><br><div><div>On Sep 11, 2013, at 2:03 PM, Gábor Kozár <<a href="mailto:kozargabor@gmail.com">kozargabor@gmail.com</a>> wrote:</div><br class="Apple-interchange-newline"><blockquote type="cite">
<title></title>
<div><div>I'm analyzing the following source line:<br></div>
<div> </div>
<div>auto it = v.begin(); // v is an std::vector<int><br></div>
<div> </div>
<div>As far as I'm able to reconstruct what happens using the checker callbacks, it goes somehow like this:<br></div>
<div> - checkPostCall on v.begin(): the call has been interpreted, the result is a lazyCompoundVal with a temp_object within it<br></div>
<div> - checkPostStmt on v.begin(): ProgramState::getSVal() yields the same result as above (the same lazyCompoundVal with the same temp_object within it)<br></div>
<div> - bind: some lazyCompoundVal with a temp_object within it to loc '&it' -- but this lazyCompoundVal and temp_object are different than above!!!<br></div>
<div> - checkPostStmt on v.begin() again: ProgramState::getSVal() yields &it, getting the SVal inside the region gives a lazyCompoundVal with 'it' in it<br></div></div></blockquote><div><br></div><div>The last line is probably wrong.. You have "checkPostStmt on v.begin()" twice. Also, can you figure out which AST node is responsible for the bind?</div><div><br></div><div>Basically, to understand what is going on better, it would be valuable to match the AST of the statements to the callbacks (you can get the AST with <span style="font-family: Menlo; font-size: 11px;">clang -cc1 -ast-dump</span>):</div><div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-DeclStmt 0x1023e7f00 <line:6:3, col:22></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-VarDecl 0x1023cd780 <col:3, col:21> it 'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >'</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-CXXConstructExpr 0x1023e7ec8 <col:13, col:21> 'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' 'void (const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > > &) throw()' elidable</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-MaterializeTemporaryExpr 0x1023e7da8 <col:13, col:21> 'const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' lvalue</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-ImplicitCastExpr 0x1023e7d90 <col:13, col:21> 'const class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >' <NoOp></div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-CXXMemberCallExpr 0x1023cd8a0 <col:13, col:21> 'iterator':'class __gnu_cxx::__normal_iterator<int *, class std::vector<int, class std::allocator<int> > >'</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-MemberExpr 0x1023cd870 <col:13, col:15> '<bound member function type>' .begin 0x1023c66d0</div><div style="margin: 0px; font-size: 11px; font-family: Menlo;"> `-DeclRefExpr 0x1023cd7d8 <col:13> 'std::vector<int>':'class std::vector<int, class std::allocator<int> >' lvalue Var 0x1023bebc0 'v' 'std::vector<int>':'class std::vector<int, class std::allocator<int> >'</div><div><br></div></div><div><br></div>We've looked at implementing these checks before and it is not a simple problem. The issue here is that the iterators are value objects, represented by LazyCompoundVals and SVals, and we do not have any way of persisting/tracking values right now.</div><div><br></div><div>Let's start with mapping the results of callbacks to the AST nodes to see if the modeling that we have now makes sense. </div><div><br></div><div>Thanks,</div><div>Anna.</div><div><br></div><div><blockquote type="cite" dir="auto"><div>
<div> </div>
<div>My problem is that I'm unable to implement a checker that would need to track iterator values, as temp_objects just seem to pop and disappear without leaving a trace and without having any followable connection between them.<br></div>
<div> </div>
<div>Is this working as intended, and if so, how should I approach this? I recall there being an open project for better modelling of C++ temporary objects, is that whose effect I'm seeing here?<br></div>
<div> </div>
<div>Thanks!<br></div>
<div> </div>
<div id="sig19426269"><div class="signature">-- <br></div>
<div class="signature"> Gábor Kozár -- ShdNx<br></div>
<div class="signature"> <a href="mailto:kozargabor@gmail.com">kozargabor@gmail.com</a><br></div>
<div class="signature"> </div>
</div>
</div>
_______________________________________________<br>cfe-dev mailing list<br><a href="mailto:cfe-dev@cs.uiuc.edu">cfe-dev@cs.uiuc.edu</a><br>http://lists.cs.uiuc.edu/mailman/listinfo/cfe-dev<br></blockquote></div><br></body></html>