clang  10.0.0svn
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Decl.h"
18 #include "clang/AST/DeclBase.h"
19 #include "clang/AST/DeclCXX.h"
20 #include "clang/AST/DeclObjC.h"
21 #include "clang/AST/Expr.h"
22 #include "clang/AST/ExprCXX.h"
23 #include "clang/AST/ExprObjC.h"
24 #include "clang/AST/ParentMap.h"
25 #include "clang/AST/Stmt.h"
26 #include "clang/AST/Type.h"
28 #include "clang/Analysis/CFG.h"
34 #include "clang/Basic/LLVM.h"
37 #include "clang/Basic/Specifiers.h"
47 #include "llvm/ADT/ArrayRef.h"
48 #include "llvm/ADT/DenseMap.h"
49 #include "llvm/ADT/None.h"
50 #include "llvm/ADT/Optional.h"
51 #include "llvm/ADT/PointerIntPair.h"
52 #include "llvm/ADT/SmallSet.h"
53 #include "llvm/ADT/SmallVector.h"
54 #include "llvm/ADT/StringExtras.h"
55 #include "llvm/ADT/StringRef.h"
56 #include "llvm/Support/Casting.h"
57 #include "llvm/Support/Compiler.h"
58 #include "llvm/Support/Debug.h"
59 #include "llvm/Support/ErrorHandling.h"
60 #include "llvm/Support/raw_ostream.h"
61 #include <cassert>
62 #include <utility>
63 
64 #define DEBUG_TYPE "static-analyzer-call-event"
65 
66 using namespace clang;
67 using namespace ento;
68 
70  ASTContext &Ctx = getState()->getStateManager().getContext();
71  const Expr *E = getOriginExpr();
72  if (!E)
73  return Ctx.VoidTy;
74  assert(E);
75 
76  QualType ResultTy = E->getType();
77 
78  // A function that returns a reference to 'int' will have a result type
79  // of simply 'int'. Check the origin expr's value kind to recover the
80  // proper type.
81  switch (E->getValueKind()) {
82  case VK_LValue:
83  ResultTy = Ctx.getLValueReferenceType(ResultTy);
84  break;
85  case VK_XValue:
86  ResultTy = Ctx.getRValueReferenceType(ResultTy);
87  break;
88  case VK_RValue:
89  // No adjustment is necessary.
90  break;
91  }
92 
93  return ResultTy;
94 }
95 
96 static bool isCallback(QualType T) {
97  // If a parameter is a block or a callback, assume it can modify pointer.
98  if (T->isBlockPointerType() ||
99  T->isFunctionPointerType() ||
100  T->isObjCSelType())
101  return true;
102 
103  // Check if a callback is passed inside a struct (for both, struct passed by
104  // reference and by value). Dig just one level into the struct for now.
105 
106  if (T->isAnyPointerType() || T->isReferenceType())
107  T = T->getPointeeType();
108 
109  if (const RecordType *RT = T->getAsStructureType()) {
110  const RecordDecl *RD = RT->getDecl();
111  for (const auto *I : RD->fields()) {
112  QualType FieldT = I->getType();
113  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
114  return true;
115  }
116  }
117  return false;
118 }
119 
121  if (const auto *PT = T->getAs<PointerType>()) {
122  QualType PointeeTy = PT->getPointeeType();
123  if (PointeeTy.isConstQualified())
124  return false;
125  return PointeeTy->isVoidType();
126  } else
127  return false;
128 }
129 
130 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
131  unsigned NumOfArgs = getNumArgs();
132 
133  // If calling using a function pointer, assume the function does not
134  // satisfy the callback.
135  // TODO: We could check the types of the arguments here.
136  if (!getDecl())
137  return false;
138 
139  unsigned Idx = 0;
141  E = param_type_end();
142  I != E && Idx < NumOfArgs; ++I, ++Idx) {
143  // If the parameter is 0, it's harmless.
144  if (getArgSVal(Idx).isZeroConstant())
145  continue;
146 
147  if (Condition(*I))
148  return true;
149  }
150  return false;
151 }
152 
155 }
156 
159 }
160 
161 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
162  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
163  if (!FD)
164  return false;
165 
166  return CheckerContext::isCLibraryFunction(FD, FunctionName);
167 }
168 
170  const Decl *D = getDecl();
171  if (!D)
172  return nullptr;
173 
174  // TODO: For now we skip functions without definitions, even if we have
175  // our own getDecl(), because it's hard to find out which re-declaration
176  // is going to be used, and usually clients don't really care about this
177  // situation because there's a loss of precision anyway because we cannot
178  // inline the call.
180  if (!RD.getDecl())
181  return nullptr;
182 
183  AnalysisDeclContext *ADC =
185 
186  // TODO: For now we skip virtual functions, because this also rises
187  // the problem of which decl to use, but now it's across different classes.
188  if (RD.mayHaveOtherDefinitions() || RD.getDecl() != ADC->getDecl())
189  return nullptr;
190 
191  return ADC;
192 }
193 
194 const StackFrameContext *
195 CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
197  if (!ADC)
198  return nullptr;
199 
200  const Expr *E = getOriginExpr();
201  if (!E)
202  return nullptr;
203 
204  // Recover CFG block via reverse lookup.
205  // TODO: If we were to keep CFG element information as part of the CallEvent
206  // instead of doing this reverse lookup, we would be able to build the stack
207  // frame for non-expression-based calls, and also we wouldn't need the reverse
208  // lookup.
210  const CFGBlock *B = Map->getBlock(E);
211  assert(B);
212 
213  // Also recover CFG index by scanning the CFG block.
214  unsigned Idx = 0, Sz = B->size();
215  for (; Idx < Sz; ++Idx)
216  if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
217  if (StmtElem->getStmt() == E)
218  break;
219  assert(Idx < Sz);
220 
221  return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
222 }
223 
225  unsigned BlockCount) const {
226  const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
227  // We cannot construct a VarRegion without a stack frame.
228  if (!SFC)
229  return nullptr;
230 
231  // Retrieve parameters of the definition, which are different from
232  // CallEvent's parameters() because getDecl() isn't necessarily
233  // the definition. SFC contains the definition that would be used
234  // during analysis.
235  const Decl *D = SFC->getDecl();
236 
237  // TODO: Refactor into a virtual method of CallEvent, like parameters().
238  const ParmVarDecl *PVD = nullptr;
239  if (const auto *FD = dyn_cast<FunctionDecl>(D))
240  PVD = FD->parameters()[Index];
241  else if (const auto *BD = dyn_cast<BlockDecl>(D))
242  PVD = BD->parameters()[Index];
243  else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
244  PVD = MD->parameters()[Index];
245  else if (const auto *CD = dyn_cast<CXXConstructorDecl>(D))
246  PVD = CD->parameters()[Index];
247  assert(PVD && "Unexpected Decl kind!");
248 
249  const VarRegion *VR =
250  State->getStateManager().getRegionManager().getVarRegion(PVD, SFC);
251 
252  // This sanity check would fail if our parameter declaration doesn't
253  // correspond to the stack frame's function declaration.
254  assert(VR->getStackFrame() == SFC);
255 
256  return VR;
257 }
258 
259 /// Returns true if a type is a pointer-to-const or reference-to-const
260 /// with no further indirection.
261 static bool isPointerToConst(QualType Ty) {
262  QualType PointeeTy = Ty->getPointeeType();
263  if (PointeeTy == QualType())
264  return false;
265  if (!PointeeTy.isConstQualified())
266  return false;
267  if (PointeeTy->isAnyPointerType())
268  return false;
269  return true;
270 }
271 
272 // Try to retrieve the function declaration and find the function parameter
273 // types which are pointers/references to a non-pointer const.
274 // We will not invalidate the corresponding argument regions.
275 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
276  const CallEvent &Call) {
277  unsigned Idx = 0;
278  for (CallEvent::param_type_iterator I = Call.param_type_begin(),
279  E = Call.param_type_end();
280  I != E; ++I, ++Idx) {
281  if (isPointerToConst(*I))
282  PreserveArgs.insert(Idx);
283  }
284 }
285 
287  ProgramStateRef Orig) const {
288  ProgramStateRef Result = (Orig ? Orig : getState());
289 
290  // Don't invalidate anything if the callee is marked pure/const.
291  if (const Decl *callee = getDecl())
292  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
293  return Result;
294 
295  SmallVector<SVal, 8> ValuesToInvalidate;
297 
298  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
299 
300  // Indexes of arguments whose values will be preserved by the call.
301  llvm::SmallSet<unsigned, 4> PreserveArgs;
302  if (!argumentsMayEscape())
303  findPtrToConstParams(PreserveArgs, *this);
304 
305  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
306  // Mark this region for invalidation. We batch invalidate regions
307  // below for efficiency.
308  if (PreserveArgs.count(Idx))
309  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
310  ETraits.setTrait(MR->getBaseRegion(),
312  // TODO: Factor this out + handle the lower level const pointers.
313 
314  ValuesToInvalidate.push_back(getArgSVal(Idx));
315 
316  // If a function accepts an object by argument (which would of course be a
317  // temporary that isn't lifetime-extended), invalidate the object itself,
318  // not only other objects reachable from it. This is necessary because the
319  // destructor has access to the temporary object after the call.
320  // TODO: Support placement arguments once we start
321  // constructing them directly.
322  // TODO: This is unnecessary when there's no destructor, but that's
323  // currently hard to figure out.
324  if (getKind() != CE_CXXAllocator)
326  if (auto AdjIdx = getAdjustedParameterIndex(Idx))
327  if (const VarRegion *VR = getParameterLocation(*AdjIdx, BlockCount))
328  ValuesToInvalidate.push_back(loc::MemRegionVal(VR));
329  }
330 
331  // Invalidate designated regions using the batch invalidation API.
332  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
333  // global variables.
334  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
335  BlockCount, getLocationContext(),
336  /*CausedByPointerEscape*/ true,
337  /*Symbols=*/nullptr, this, &ETraits);
338 }
339 
341  const ProgramPointTag *Tag) const {
342  if (const Expr *E = getOriginExpr()) {
343  if (IsPreVisit)
344  return PreStmt(E, getLocationContext(), Tag);
345  return PostStmt(E, getLocationContext(), Tag);
346  }
347 
348  const Decl *D = getDecl();
349  assert(D && "Cannot get a program point without a statement or decl");
350 
352  if (IsPreVisit)
353  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
354  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
355 }
356 
357 bool CallEvent::isCalled(const CallDescription &CD) const {
358  // FIXME: Add ObjC Message support.
359  if (getKind() == CE_ObjCMessage)
360  return false;
361 
362  const IdentifierInfo *II = getCalleeIdentifier();
363  if (!II)
364  return false;
365  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
366  if (!FD)
367  return false;
368 
369  if (CD.Flags & CDF_MaybeBuiltin) {
371  (!CD.RequiredArgs || CD.RequiredArgs <= getNumArgs()) &&
372  (!CD.RequiredParams || CD.RequiredParams <= parameters().size());
373  }
374 
375  if (!CD.IsLookupDone) {
376  CD.IsLookupDone = true;
377  CD.II = &getState()->getStateManager().getContext().Idents.get(
378  CD.getFunctionName());
379  }
380 
381  if (II != CD.II)
382  return false;
383 
384  // If CallDescription provides prefix names, use them to improve matching
385  // accuracy.
386  if (CD.QualifiedName.size() > 1 && FD) {
387  const DeclContext *Ctx = FD->getDeclContext();
388  // See if we'll be able to match them all.
389  size_t NumUnmatched = CD.QualifiedName.size() - 1;
390  for (; Ctx && isa<NamedDecl>(Ctx); Ctx = Ctx->getParent()) {
391  if (NumUnmatched == 0)
392  break;
393 
394  if (const auto *ND = dyn_cast<NamespaceDecl>(Ctx)) {
395  if (ND->getName() == CD.QualifiedName[NumUnmatched - 1])
396  --NumUnmatched;
397  continue;
398  }
399 
400  if (const auto *RD = dyn_cast<RecordDecl>(Ctx)) {
401  if (RD->getName() == CD.QualifiedName[NumUnmatched - 1])
402  --NumUnmatched;
403  continue;
404  }
405  }
406 
407  if (NumUnmatched > 0)
408  return false;
409  }
410 
411  return (!CD.RequiredArgs || CD.RequiredArgs == getNumArgs()) &&
412  (!CD.RequiredParams || CD.RequiredParams == parameters().size());
413 }
414 
415 SVal CallEvent::getArgSVal(unsigned Index) const {
416  const Expr *ArgE = getArgExpr(Index);
417  if (!ArgE)
418  return UnknownVal();
419  return getSVal(ArgE);
420 }
421 
423  const Expr *ArgE = getArgExpr(Index);
424  if (!ArgE)
425  return {};
426  return ArgE->getSourceRange();
427 }
428 
430  const Expr *E = getOriginExpr();
431  if (!E)
432  return UndefinedVal();
433  return getSVal(E);
434 }
435 
436 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
437 
438 void CallEvent::dump(raw_ostream &Out) const {
439  ASTContext &Ctx = getState()->getStateManager().getContext();
440  if (const Expr *E = getOriginExpr()) {
441  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
442  Out << "\n";
443  return;
444  }
445 
446  if (const Decl *D = getDecl()) {
447  Out << "Call to ";
448  D->print(Out, Ctx.getPrintingPolicy());
449  return;
450  }
451 
452  // FIXME: a string representation of the kind would be nice.
453  Out << "Unknown call (type " << getKind() << ")";
454 }
455 
456 bool CallEvent::isCallStmt(const Stmt *S) {
457  return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
458  || isa<CXXConstructExpr>(S)
459  || isa<CXXNewExpr>(S);
460 }
461 
463  assert(D);
464  if (const auto *FD = dyn_cast<FunctionDecl>(D))
465  return FD->getReturnType();
466  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
467  return MD->getReturnType();
468  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
469  // Blocks are difficult because the return type may not be stored in the
470  // BlockDecl itself. The AST should probably be enhanced, but for now we
471  // just do what we can.
472  // If the block is declared without an explicit argument list, the
473  // signature-as-written just includes the return type, not the entire
474  // function type.
475  // FIXME: All blocks should have signatures-as-written, even if the return
476  // type is inferred. (That's signified with a dependent result type.)
477  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
478  QualType Ty = TSI->getType();
479  if (const FunctionType *FT = Ty->getAs<FunctionType>())
480  Ty = FT->getReturnType();
481  if (!Ty->isDependentType())
482  return Ty;
483  }
484 
485  return {};
486  }
487 
488  llvm_unreachable("unknown callable kind");
489 }
490 
491 bool CallEvent::isVariadic(const Decl *D) {
492  assert(D);
493 
494  if (const auto *FD = dyn_cast<FunctionDecl>(D))
495  return FD->isVariadic();
496  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
497  return MD->isVariadic();
498  if (const auto *BD = dyn_cast<BlockDecl>(D))
499  return BD->isVariadic();
500 
501  llvm_unreachable("unknown callable kind");
502 }
503 
504 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
505  CallEvent::BindingsTy &Bindings,
506  SValBuilder &SVB,
507  const CallEvent &Call,
508  ArrayRef<ParmVarDecl*> parameters) {
509  MemRegionManager &MRMgr = SVB.getRegionManager();
510 
511  // If the function has fewer parameters than the call has arguments, we simply
512  // do not bind any values to them.
513  unsigned NumArgs = Call.getNumArgs();
514  unsigned Idx = 0;
515  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
516  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
517  const ParmVarDecl *ParamDecl = *I;
518  assert(ParamDecl && "Formal parameter has no decl?");
519 
520  // TODO: Support allocator calls.
521  if (Call.getKind() != CE_CXXAllocator)
522  if (Call.isArgumentConstructedDirectly(Idx))
523  continue;
524 
525  // TODO: Allocators should receive the correct size and possibly alignment,
526  // determined in compile-time but not represented as arg-expressions,
527  // which makes getArgSVal() fail and return UnknownVal.
528  SVal ArgVal = Call.getArgSVal(Idx);
529  if (!ArgVal.isUnknown()) {
530  Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
531  Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
532  }
533  }
534 
535  // FIXME: Variadic arguments are not handled at all right now.
536 }
537 
539  const FunctionDecl *D = getDecl();
540  if (!D)
541  return None;
542  return D->parameters();
543 }
544 
546  const FunctionDecl *FD = getDecl();
547  if (!FD)
548  return {};
549 
550  // Note that the AnalysisDeclContext will have the FunctionDecl with
551  // the definition (if one exists).
552  AnalysisDeclContext *AD =
554  getManager()->getContext(FD);
555  bool IsAutosynthesized;
556  Stmt* Body = AD->getBody(IsAutosynthesized);
557  LLVM_DEBUG({
558  if (IsAutosynthesized)
559  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
560  << "\n";
561  });
562  if (Body) {
563  const Decl* Decl = AD->getDecl();
564  return RuntimeDefinition(Decl);
565  }
566 
567  SubEngine &Engine = getState()->getStateManager().getOwningEngine();
568  AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
569 
570  // Try to get CTU definition only if CTUDir is provided.
571  if (!Opts.IsNaiveCTUEnabled)
572  return {};
573 
576  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
577  CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
578  Opts.DisplayCTUProgress);
579 
580  if (!CTUDeclOrError) {
581  handleAllErrors(CTUDeclOrError.takeError(),
582  [&](const cross_tu::IndexError &IE) {
583  CTUCtx.emitCrossTUDiagnostics(IE);
584  });
585  return {};
586  }
587 
588  return RuntimeDefinition(*CTUDeclOrError);
589 }
590 
592  const StackFrameContext *CalleeCtx,
593  BindingsTy &Bindings) const {
594  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
595  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
596  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
597  D->parameters());
598 }
599 
602  return true;
603 
604  const FunctionDecl *D = getDecl();
605  if (!D)
606  return true;
607 
608  const IdentifierInfo *II = D->getIdentifier();
609  if (!II)
610  return false;
611 
612  // This set of "escaping" APIs is
613 
614  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
615  // value into thread local storage. The value can later be retrieved with
616  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
617  // parameter is 'const void *', the region escapes through the call.
618  if (II->isStr("pthread_setspecific"))
619  return true;
620 
621  // - xpc_connection_set_context stores a value which can be retrieved later
622  // with xpc_connection_get_context.
623  if (II->isStr("xpc_connection_set_context"))
624  return true;
625 
626  // - funopen - sets a buffer for future IO calls.
627  if (II->isStr("funopen"))
628  return true;
629 
630  // - __cxa_demangle - can reallocate memory and can return the pointer to
631  // the input buffer.
632  if (II->isStr("__cxa_demangle"))
633  return true;
634 
635  StringRef FName = II->getName();
636 
637  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
638  // buffer even if it is const.
639  if (FName.endswith("NoCopy"))
640  return true;
641 
642  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
643  // be deallocated by NSMapRemove.
644  if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
645  return true;
646 
647  // - Many CF containers allow objects to escape through custom
648  // allocators/deallocators upon container construction. (PR12101)
649  if (FName.startswith("CF") || FName.startswith("CG")) {
650  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
651  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
652  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
653  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
654  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
655  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
656  }
657 
658  return false;
659 }
660 
662  const FunctionDecl *D = getOriginExpr()->getDirectCallee();
663  if (D)
664  return D;
665 
666  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
667 }
668 
670  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
671  if (!CE)
672  return AnyFunctionCall::getDecl();
673 
674  const FunctionDecl *D = CE->getDirectCallee();
675  if (D)
676  return D;
677 
678  return getSVal(CE->getCallee()).getAsFunctionDecl();
679 }
680 
682  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
683  SVal ThisVal = getCXXThisVal();
684  Values.push_back(ThisVal);
685 
686  // Don't invalidate if the method is const and there are no mutable fields.
687  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
688  if (!D->isConst())
689  return;
690  // Get the record decl for the class of 'This'. D->getParent() may return a
691  // base class decl, rather than the class of the instance which needs to be
692  // checked for mutable fields.
693  // TODO: We might as well look at the dynamic type of the object.
694  const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
695  QualType T = Ex->getType();
696  if (T->isPointerType()) // Arrow or implicit-this syntax?
697  T = T->getPointeeType();
698  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
699  assert(ParentRecord);
700  if (ParentRecord->hasMutableFields())
701  return;
702  // Preserve CXXThis.
703  const MemRegion *ThisRegion = ThisVal.getAsRegion();
704  if (!ThisRegion)
705  return;
706 
707  ETraits->setTrait(ThisRegion->getBaseRegion(),
709  }
710 }
711 
713  const Expr *Base = getCXXThisExpr();
714  // FIXME: This doesn't handle an overloaded ->* operator.
715  if (!Base)
716  return UnknownVal();
717 
718  SVal ThisVal = getSVal(Base);
719  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
720  return ThisVal;
721 }
722 
723 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
724  // Do we have a decl at all?
725  const Decl *D = getDecl();
726  if (!D)
727  return {};
728 
729  // If the method is non-virtual, we know we can inline it.
730  const auto *MD = cast<CXXMethodDecl>(D);
731  if (!MD->isVirtual())
733 
734  // Do we know the implicit 'this' object being called?
735  const MemRegion *R = getCXXThisVal().getAsRegion();
736  if (!R)
737  return {};
738 
739  // Do we know anything about the type of 'this'?
740  DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
741  if (!DynType.isValid())
742  return {};
743 
744  // Is the type a C++ class? (This is mostly a defensive check.)
745  QualType RegionType = DynType.getType()->getPointeeType();
746  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
747 
748  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
749  if (!RD || !RD->hasDefinition())
750  return {};
751 
752  // Find the decl for this method in that class.
753  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
754  if (!Result) {
755  // We might not even get the original statically-resolved method due to
756  // some particularly nasty casting (e.g. casts to sister classes).
757  // However, we should at least be able to search up and down our own class
758  // hierarchy, and some real bugs have been caught by checking this.
759  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
760 
761  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
762  // the static type. However, because we currently don't update
763  // DynamicTypeInfo when an object is cast, we can't actually be sure the
764  // DynamicTypeInfo is up to date. This assert should be re-enabled once
765  // this is fixed. <rdar://problem/12287087>
766  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
767 
768  return {};
769  }
770 
771  // Does the decl that we found have an implementation?
772  const FunctionDecl *Definition;
773  if (!Result->hasBody(Definition)) {
774  if (!DynType.canBeASubClass())
776  return {};
777  }
778 
779  // We found a definition. If we're not sure that this devirtualization is
780  // actually what will happen at runtime, make sure to provide the region so
781  // that ExprEngine can decide what to do with it.
782  if (DynType.canBeASubClass())
783  return RuntimeDefinition(Definition, R->StripCasts());
784  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
785 }
786 
788  const StackFrameContext *CalleeCtx,
789  BindingsTy &Bindings) const {
791 
792  // Handle the binding of 'this' in the new stack frame.
793  SVal ThisVal = getCXXThisVal();
794  if (!ThisVal.isUnknown()) {
795  ProgramStateManager &StateMgr = getState()->getStateManager();
796  SValBuilder &SVB = StateMgr.getSValBuilder();
797 
798  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
799  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
800 
801  // If we devirtualized to a different member function, we need to make sure
802  // we have the proper layering of CXXBaseObjectRegions.
803  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
804  ASTContext &Ctx = SVB.getContext();
805  const CXXRecordDecl *Class = MD->getParent();
806  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
807 
808  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
809  bool Failed;
810  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
811  if (Failed) {
812  // We might have suffered some sort of placement new earlier, so
813  // we're constructing in a completely unexpected storage.
814  // Fall back to a generic pointer cast for this-value.
815  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
816  const CXXRecordDecl *StaticClass = StaticMD->getParent();
817  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
818  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
819  }
820  }
821 
822  if (!ThisVal.isUnknown())
823  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
824  }
825 }
826 
828  return getOriginExpr()->getImplicitObjectArgument();
829 }
830 
831 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
832  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
833  // id-expression in the class member access expression is a qualified-id,
834  // that function is called. Otherwise, its final overrider in the dynamic type
835  // of the object expression is called.
836  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
837  if (ME->hasQualifier())
839 
841 }
842 
844  return getOriginExpr()->getArg(0);
845 }
846 
847 const BlockDataRegion *BlockCall::getBlockRegion() const {
848  const Expr *Callee = getOriginExpr()->getCallee();
849  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
850 
851  return dyn_cast_or_null<BlockDataRegion>(DataReg);
852 }
853 
855  const BlockDecl *D = getDecl();
856  if (!D)
857  return None;
858  return D->parameters();
859 }
860 
862  RegionAndSymbolInvalidationTraits *ETraits) const {
863  // FIXME: This also needs to invalidate captured globals.
864  if (const MemRegion *R = getBlockRegion())
865  Values.push_back(loc::MemRegionVal(R));
866 }
867 
869  BindingsTy &Bindings) const {
870  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
871  ArrayRef<ParmVarDecl*> Params;
872  if (isConversionFromLambda()) {
873  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
874  Params = LambdaOperatorDecl->parameters();
875 
876  // For blocks converted from a C++ lambda, the callee declaration is the
877  // operator() method on the lambda so we bind "this" to
878  // the lambda captured by the block.
879  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
880  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
881  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
882  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
883  } else {
884  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
885  }
886 
887  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
888  Params);
889 }
890 
892  if (Data)
893  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
894  return UnknownVal();
895 }
896 
898  RegionAndSymbolInvalidationTraits *ETraits) const {
899  if (Data) {
900  loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
901  if (SymbolRef Sym = MV.getAsSymbol(true))
902  ETraits->setTrait(Sym,
904  Values.push_back(MV);
905  }
906 }
907 
909  const StackFrameContext *CalleeCtx,
910  BindingsTy &Bindings) const {
912 
913  SVal ThisVal = getCXXThisVal();
914  if (!ThisVal.isUnknown()) {
915  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
916  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
917  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
918  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
919  }
920 }
921 
923  if (Data)
924  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
925  return UnknownVal();
926 }
927 
928 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
929  // Base destructors are always called non-virtually.
930  // Skip CXXInstanceCall's devirtualization logic in this case.
931  if (isBaseDestructor())
933 
935 }
936 
938  const ObjCMethodDecl *D = getDecl();
939  if (!D)
940  return None;
941  return D->parameters();
942 }
943 
945  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
946 
947  // If the method call is a setter for property known to be backed by
948  // an instance variable, don't invalidate the entire receiver, just
949  // the storage for that instance variable.
950  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
951  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
952  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
953  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
954  ETraits->setTrait(
955  IvarRegion,
957  ETraits->setTrait(
958  IvarRegion,
960  Values.push_back(IvarLVal);
961  }
962  return;
963  }
964  }
965 
966  Values.push_back(getReceiverSVal());
967 }
968 
970  const LocationContext *LCtx = getLocationContext();
971  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
972  if (!SelfDecl)
973  return SVal();
974  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
975 }
976 
978  // FIXME: Is this the best way to handle class receivers?
979  if (!isInstanceMessage())
980  return UnknownVal();
981 
982  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
983  return getSVal(RecE);
984 
985  // An instance message with no expression means we are sending to super.
986  // In this case the object reference is the same as 'self'.
987  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
988  SVal SelfVal = getSelfSVal();
989  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
990  return SelfVal;
991 }
992 
994  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
995  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
996  return true;
997 
998  if (!isInstanceMessage())
999  return false;
1000 
1001  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
1002 
1003  return (RecVal == getSelfSVal());
1004 }
1005 
1007  switch (getMessageKind()) {
1008  case OCM_Message:
1009  return getOriginExpr()->getSourceRange();
1010  case OCM_PropertyAccess:
1011  case OCM_Subscript:
1012  return getContainingPseudoObjectExpr()->getSourceRange();
1013  }
1014  llvm_unreachable("unknown message kind");
1015 }
1016 
1017 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1018 
1019 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1020  assert(Data && "Lazy lookup not yet performed.");
1021  assert(getMessageKind() != OCM_Message && "Explicit message send.");
1022  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
1023 }
1024 
1025 static const Expr *
1027  const Expr *Syntactic = POE->getSyntacticForm();
1028 
1029  // This handles the funny case of assigning to the result of a getter.
1030  // This can happen if the getter returns a non-const reference.
1031  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1032  Syntactic = BO->getLHS();
1033 
1034  return Syntactic;
1035 }
1036 
1038  if (!Data) {
1039  // Find the parent, ignoring implicit casts.
1040  const ParentMap &PM = getLocationContext()->getParentMap();
1041  const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1042 
1043  // Check if parent is a PseudoObjectExpr.
1044  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1045  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1046 
1047  ObjCMessageKind K;
1048  switch (Syntactic->getStmtClass()) {
1049  case Stmt::ObjCPropertyRefExprClass:
1050  K = OCM_PropertyAccess;
1051  break;
1052  case Stmt::ObjCSubscriptRefExprClass:
1053  K = OCM_Subscript;
1054  break;
1055  default:
1056  // FIXME: Can this ever happen?
1057  K = OCM_Message;
1058  break;
1059  }
1060 
1061  if (K != OCM_Message) {
1062  const_cast<ObjCMethodCall *>(this)->Data
1063  = ObjCMessageDataTy(POE, K).getOpaqueValue();
1064  assert(getMessageKind() == K);
1065  return K;
1066  }
1067  }
1068 
1069  const_cast<ObjCMethodCall *>(this)->Data
1070  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1071  assert(getMessageKind() == OCM_Message);
1072  return OCM_Message;
1073  }
1074 
1075  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1076  if (!Info.getPointer())
1077  return OCM_Message;
1078  return static_cast<ObjCMessageKind>(Info.getInt());
1079 }
1080 
1082  // Look for properties accessed with property syntax (foo.bar = ...)
1083  if ( getMessageKind() == OCM_PropertyAccess) {
1084  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1085  assert(POE && "Property access without PseudoObjectExpr?");
1086 
1087  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1088  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1089 
1090  if (RefExpr->isExplicitProperty())
1091  return RefExpr->getExplicitProperty();
1092  }
1093 
1094  // Look for properties accessed with method syntax ([foo setBar:...]).
1095  const ObjCMethodDecl *MD = getDecl();
1096  if (!MD || !MD->isPropertyAccessor())
1097  return nullptr;
1098 
1099  // Note: This is potentially quite slow.
1100  return MD->findPropertyDecl();
1101 }
1102 
1104  Selector Sel) const {
1105  assert(IDecl);
1106  AnalysisManager &AMgr =
1107  getState()->getStateManager().getOwningEngine().getAnalysisManager();
1108  // If the class interface is declared inside the main file, assume it is not
1109  // subcassed.
1110  // TODO: It could actually be subclassed if the subclass is private as well.
1111  // This is probably very rare.
1112  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1113  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1114  return false;
1115 
1116  // Assume that property accessors are not overridden.
1117  if (getMessageKind() == OCM_PropertyAccess)
1118  return false;
1119 
1120  // We assume that if the method is public (declared outside of main file) or
1121  // has a parent which publicly declares the method, the method could be
1122  // overridden in a subclass.
1123 
1124  // Find the first declaration in the class hierarchy that declares
1125  // the selector.
1126  ObjCMethodDecl *D = nullptr;
1127  while (true) {
1128  D = IDecl->lookupMethod(Sel, true);
1129 
1130  // Cannot find a public definition.
1131  if (!D)
1132  return false;
1133 
1134  // If outside the main file,
1135  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1136  return true;
1137 
1138  if (D->isOverriding()) {
1139  // Search in the superclass on the next iteration.
1140  IDecl = D->getClassInterface();
1141  if (!IDecl)
1142  return false;
1143 
1144  IDecl = IDecl->getSuperClass();
1145  if (!IDecl)
1146  return false;
1147 
1148  continue;
1149  }
1150 
1151  return false;
1152  };
1153 
1154  llvm_unreachable("The while loop should always terminate.");
1155 }
1156 
1158  if (!MD)
1159  return MD;
1160 
1161  // Find the redeclaration that defines the method.
1162  if (!MD->hasBody()) {
1163  for (auto I : MD->redecls())
1164  if (I->hasBody())
1165  MD = cast<ObjCMethodDecl>(I);
1166  }
1167  return MD;
1168 }
1169 
1170 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1171  const Expr* InstRec = ME->getInstanceReceiver();
1172  if (!InstRec)
1173  return false;
1174  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1175 
1176  // Check that receiver is called 'self'.
1177  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1178  !InstRecIg->getFoundDecl()->getName().equals("self"))
1179  return false;
1180 
1181  // Check that the method name is 'class'.
1182  if (ME->getSelector().getNumArgs() != 0 ||
1183  !ME->getSelector().getNameForSlot(0).equals("class"))
1184  return false;
1185 
1186  return true;
1187 }
1188 
1189 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1190  const ObjCMessageExpr *E = getOriginExpr();
1191  assert(E);
1192  Selector Sel = E->getSelector();
1193 
1194  if (E->isInstanceMessage()) {
1195  // Find the receiver type.
1196  const ObjCObjectPointerType *ReceiverT = nullptr;
1197  bool CanBeSubClassed = false;
1198  QualType SupersType = E->getSuperType();
1199  const MemRegion *Receiver = nullptr;
1200 
1201  if (!SupersType.isNull()) {
1202  // The receiver is guaranteed to be 'super' in this case.
1203  // Super always means the type of immediate predecessor to the method
1204  // where the call occurs.
1205  ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1206  } else {
1207  Receiver = getReceiverSVal().getAsRegion();
1208  if (!Receiver)
1209  return {};
1210 
1211  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1212  if (!DTI.isValid()) {
1213  assert(isa<AllocaRegion>(Receiver) &&
1214  "Unhandled untyped region class!");
1215  return {};
1216  }
1217 
1218  QualType DynType = DTI.getType();
1219  CanBeSubClassed = DTI.canBeASubClass();
1220  ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1221 
1222  if (ReceiverT && CanBeSubClassed)
1223  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1224  if (!canBeOverridenInSubclass(IDecl, Sel))
1225  CanBeSubClassed = false;
1226  }
1227 
1228  // Handle special cases of '[self classMethod]' and
1229  // '[[self class] classMethod]', which are treated by the compiler as
1230  // instance (not class) messages. We will statically dispatch to those.
1231  if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1232  // For [self classMethod], return the compiler visible declaration.
1233  if (PT->getObjectType()->isObjCClass() &&
1234  Receiver == getSelfSVal().getAsRegion())
1235  return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1236 
1237  // Similarly, handle [[self class] classMethod].
1238  // TODO: We are currently doing a syntactic match for this pattern with is
1239  // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1240  // shows. A better way would be to associate the meta type with the symbol
1241  // using the dynamic type info tracking and use it here. We can add a new
1242  // SVal for ObjC 'Class' values that know what interface declaration they
1243  // come from. Then 'self' in a class method would be filled in with
1244  // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1245  // do proper dynamic dispatch for class methods just like we do for
1246  // instance methods now.
1247  if (E->getInstanceReceiver())
1248  if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1249  if (isCallToSelfClass(M))
1250  return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1251  }
1252 
1253  // Lookup the instance method implementation.
1254  if (ReceiverT)
1255  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1256  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1257  // when in many cases it returns null. We cache the results so
1258  // that repeated queries on the same ObjCIntefaceDecl and Selector
1259  // don't incur the same cost. On some test cases, we can see the
1260  // same query being issued thousands of times.
1261  //
1262  // NOTE: This cache is essentially a "global" variable, but it
1263  // only gets lazily created when we get here. The value of the
1264  // cache probably comes from it being global across ExprEngines,
1265  // where the same queries may get issued. If we are worried about
1266  // concurrency, or possibly loading/unloading ASTs, etc., we may
1267  // need to revisit this someday. In terms of memory, this table
1268  // stays around until clang quits, which also may be bad if we
1269  // need to release memory.
1270  using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1271  using PrivateMethodCache =
1272  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1273 
1274  static PrivateMethodCache PMC;
1275  Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1276 
1277  // Query lookupPrivateMethod() if the cache does not hit.
1278  if (!Val.hasValue()) {
1279  Val = IDecl->lookupPrivateMethod(Sel);
1280 
1281  // If the method is a property accessor, we should try to "inline" it
1282  // even if we don't actually have an implementation.
1283  if (!*Val)
1284  if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1285  if (CompileTimeMD->isPropertyAccessor()) {
1286  if (!CompileTimeMD->getSelfDecl() &&
1287  isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1288  // If the method is an accessor in a category, and it doesn't
1289  // have a self declaration, first
1290  // try to find the method in a class extension. This
1291  // works around a bug in Sema where multiple accessors
1292  // are synthesized for properties in class
1293  // extensions that are redeclared in a category and the
1294  // the implicit parameters are not filled in for
1295  // the method on the category.
1296  // This ensures we find the accessor in the extension, which
1297  // has the implicit parameters filled in.
1298  auto *ID = CompileTimeMD->getClassInterface();
1299  for (auto *CatDecl : ID->visible_extensions()) {
1300  Val = CatDecl->getMethod(Sel,
1301  CompileTimeMD->isInstanceMethod());
1302  if (*Val)
1303  break;
1304  }
1305  }
1306  if (!*Val)
1307  Val = IDecl->lookupInstanceMethod(Sel);
1308  }
1309  }
1310 
1311  const ObjCMethodDecl *MD = Val.getValue();
1312  if (CanBeSubClassed)
1313  return RuntimeDefinition(MD, Receiver);
1314  else
1315  return RuntimeDefinition(MD, nullptr);
1316  }
1317  } else {
1318  // This is a class method.
1319  // If we have type info for the receiver class, we are calling via
1320  // class name.
1321  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1322  // Find/Return the method implementation.
1323  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1324  }
1325  }
1326 
1327  return {};
1328 }
1329 
1331  if (isInSystemHeader() && !isInstanceMessage()) {
1332  Selector Sel = getSelector();
1333  if (Sel.getNumArgs() == 1 &&
1334  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1335  return true;
1336  }
1337 
1339 }
1340 
1342  const StackFrameContext *CalleeCtx,
1343  BindingsTy &Bindings) const {
1344  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1345  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1346  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1347  D->parameters());
1348 
1349  SVal SelfVal = getReceiverSVal();
1350  if (!SelfVal.isUnknown()) {
1351  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1352  MemRegionManager &MRMgr = SVB.getRegionManager();
1353  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1354  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1355  }
1356 }
1357 
1358 CallEventRef<>
1360  const LocationContext *LCtx) {
1361  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1362  return create<CXXMemberCall>(MCE, State, LCtx);
1363 
1364  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1365  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1366  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1367  if (MD->isInstance())
1368  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1369 
1370  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1371  return create<BlockCall>(CE, State, LCtx);
1372  }
1373 
1374  // Otherwise, it's a normal function call, static member function call, or
1375  // something we can't reason about.
1376  return create<SimpleFunctionCall>(CE, State, LCtx);
1377 }
1378 
1379 CallEventRef<>
1381  ProgramStateRef State) {
1382  const LocationContext *ParentCtx = CalleeCtx->getParent();
1383  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1384  assert(CallerCtx && "This should not be used for top-level stack frames");
1385 
1386  const Stmt *CallSite = CalleeCtx->getCallSite();
1387 
1388  if (CallSite) {
1389  if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1390  return Out;
1391 
1392  // All other cases are handled by getCall.
1393  assert(isa<CXXConstructExpr>(CallSite) &&
1394  "This is not an inlineable statement");
1395 
1396  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1397  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1398  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1399  SVal ThisVal = State->getSVal(ThisPtr);
1400 
1401  return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1402  ThisVal.getAsRegion(), State, CallerCtx);
1403  }
1404 
1405  // Fall back to the CFG. The only thing we haven't handled yet is
1406  // destructors, though this could change in the future.
1407  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1408  CFGElement E = (*B)[CalleeCtx->getIndex()];
1409  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1410  "All other CFG elements should have exprs");
1411 
1412  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1413  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1414  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1415  SVal ThisVal = State->getSVal(ThisPtr);
1416 
1417  const Stmt *Trigger;
1419  Trigger = AutoDtor->getTriggerStmt();
1420  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1421  Trigger = DeleteDtor->getDeleteExpr();
1422  else
1423  Trigger = Dtor->getBody();
1424 
1425  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1426  E.getAs<CFGBaseDtor>().hasValue(), State,
1427  CallerCtx);
1428 }
1429 
1430 CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State,
1431  const LocationContext *LC) {
1432  if (const auto *CE = dyn_cast<CallExpr>(S)) {
1433  return getSimpleCall(CE, State, LC);
1434  } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1435  return getCXXAllocatorCall(NE, State, LC);
1436  } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1437  return getObjCMethodCall(ME, State, LC);
1438  } else {
1439  return nullptr;
1440  }
1441 }
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1107
Defines the clang::ASTContext interface.
SVal getSelfSVal() const
Return the value of &#39;self&#39; if available.
Definition: CallEvent.cpp:969
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:977
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:897
Represents a function declaration or definition.
Definition: Decl.h:1784
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:5717
Smart pointer class that efficiently represents Objective-C method names.
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2585
A (possibly-)qualified type.
Definition: Type.h:643
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6399
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:600
Selector getSelector() const
Definition: ExprObjC.cpp:337
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1143
Stmt * getBody() const
Get the body of the Declaration.
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:1026
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1445
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:340
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3393
static bool isCallToSelfClass(const ObjCMessageExpr *ME)
Definition: CallEvent.cpp:1170
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:557
C Language Family Type Representation.
Defines the SourceManager interface.
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:358
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:169
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
const RecordType * getAsStructureType() const
Definition: Type.cpp:573
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
StringRef getFunctionName() const
Get the name of the function that this object matches.
Definition: CallEvent.h:1105
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
SourceRange getSourceRange() const override
Definition: CallEvent.cpp:1006
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:583
A container of type source information.
Definition: Decl.h:86
const StackFrameContext * getCalleeStackFrame(unsigned BlockCount) const
Returns the callee stack frame.
Definition: CallEvent.cpp:195
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1359
virtual RuntimeDefinition getRuntimeDefinition() const =0
Returns the definition of the function or method that will be called.
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:787
Expr * ignoreParenBaseCasts() LLVM_READONLY
Skip past any parentheses and derived-to-base casts until reaching a fixed point. ...
Definition: Expr.cpp:2988
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:449
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:222
Represents a variable declaration or definition.
Definition: Decl.h:827
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6858
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1585
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:182
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:138
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:120
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:843
ArrayRef< ParmVarDecl * > parameters() const override
Return call&#39;s formal parameters.
Definition: CallEvent.cpp:538
Represents a parameter to a function.
Definition: Decl.h:1600
Defines the clang::Expr interface and subclasses for C++ expressions.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:861
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:269
Represents a struct/union/class.
Definition: Decl.h:3662
const StackFrameContext * getStackFrame(AnalysisDeclContext *Ctx, const LocationContext *Parent, const Stmt *S, const CFGBlock *Blk, unsigned BlockCount, unsigned Idx)
One of these records is kept for each identifier that is lexed.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:831
const SymExpr * SymbolRef
Definition: SymExpr.h:110
param_type_iterator param_type_end() const
Definition: CallEvent.h:450
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:160
field_range fields() const
Definition: Decl.h:3877
AnalysisDeclContext contains the context data for the function or method under analysis.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
bool isReferenceType() const
Definition: Type.h:6403
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:272
bool isObjCSelType() const
Definition: Type.h:6536
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:125
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2325
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl *> parameters)
Definition: CallEvent.cpp:504
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:1058
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:938
virtual Kind getKind() const =0
Returns the kind of call this is.
const ImplicitParamDecl * getSelfDecl() const
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:153
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
An x-value expression is a reference to an object with independent storage but which can be "moved"...
Definition: Specifiers.h:134
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:414
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:275
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:670
const LocationContext * getParent() const
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection...
Definition: CallEvent.cpp:261
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1157
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:429
unsigned size() const
Definition: CFG.h:918
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:474
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call&#39;s formal parameters.
Definition: CallEvent.h:446
Represents an ObjC class declaration.
Definition: DeclObjC.h:1171
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:491
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:877
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call&#39;s formal parameters.
const CFGBlock * getCallSiteBlock() const
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:351
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:827
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:929
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:993
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1692
const Stmt * getCallSite() const
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:937
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
bool argumentsMayEscape() const override
Definition: CallEvent.cpp:1330
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:854
AnalysisDeclContext * getContext(const Decl *D)
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:212
static bool isCallback(QualType T)
Definition: CallEvent.cpp:96
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3951
This represents one expression.
Definition: Expr.h:108
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:1341
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:661
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:26
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1380
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Expr * getCallee()
Definition: Expr.h:2638
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:439
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:234
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
DeclContext * getDeclContext()
Definition: DeclBase.h:438
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:337
virtual SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:712
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:332
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:868
bool hasBody(const FunctionDecl *&Definition) const
Returns true if the function has a body.
Definition: Decl.cpp:2811
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
QualType getType() const
Definition: Expr.h:137
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:202
DeclContext * getParent()
getParent - Returns the containing DeclContext.
Definition: DeclBase.h:1779
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:950
virtual cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()=0
QualType getRecordType(const RecordDecl *Decl) const
unsigned getNumArgs() const
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:944
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:708
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:303
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:723
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6207
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:263
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
Definition: CallEvent.cpp:591
const ImplicitParamDecl * getSelfDecl() const
Return the ImplicitParamDecl* associated with &#39;self&#39; if this AnalysisDeclContext wraps an ObjCMethodD...
Defines the runtime definition of the called function.
Definition: CallEvent.h:101
QualType getCanonicalType() const
Definition: Type.h:6187
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:5673
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:681
Encodes a location in the source.
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:669
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:456
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:39
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:402
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1892
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
CanQualType VoidTy
Definition: ASTContext.h:1015
const StackFrameContext * getStackFrame() const
Definition: MemRegion.cpp:157
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:6395
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:413
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:728
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:928
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1356
Tells that a region&#39;s contents is not changed.
Definition: MemRegion.h:1460
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:190
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
Defines various enumerations that describe declaration and type specifiers.
CallEventRef getCall(const Stmt *S, ProgramStateRef State, const LocationContext *LC)
Gets a call event for a function call, Objective-C method call, or a &#39;new&#39; call.
Definition: CallEvent.cpp:1430
StringRef getName() const
Return the actual identifier string.
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1260
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:948
SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:891
Dataflow Directional Tag Classes.
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1103
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:847
AnalysisDeclContextManager * getManager() const
Return the AnalysisDeclContextManager (if any) that created this AnalysisDeclContext.
bool isValid() const
Return true if this is a valid SourceLocation object.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:422
DeclContext - This is used only as base class of specific decl types that can act as declaration cont...
Definition: DeclBase.h:1271
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:600
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:1189
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:226
QualType getSuperType() const
Retrieve the type referred to by &#39;super&#39;.
Definition: ExprObjC.h:1336
StmtClass getStmtClass() const
Definition: Stmt.h:1087
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:157
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2015
Describes a C standard function that is sometimes implemented as a macro that expands to a compiler b...
Definition: CallEvent.h:1053
bool mayHaveOtherDefinitions()
Check if the definition we have is precise.
Definition: CallEvent.h:122
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1037
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
Expr * IgnoreParenImpCasts() LLVM_READONLY
Skip past any parentheses and implicit casts which might surround this expression until reaching a fi...
Definition: Expr.cpp:2966
Represents a pointer to an Objective C object.
Definition: Type.h:5870
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:63
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4444
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5926
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:503
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:462
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
Definition: DynamicType.cpp:40
const StackFrameContext * getStackFrame() const
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:161
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class, its categories, and its super classes (using a linear search).
Definition: DeclObjC.cpp:682
Stores options for the analyzer from the command line.
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName, bool DisplayCTUProgress=false)
This function loads a function or variable definition from an external AST file and merges it into th...
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:69
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1134
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method&#39;s selector.
Definition: DeclObjC.cpp:1301
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:130
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:207
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
bool isVoidType() const
Definition: Type.h:6650
SVal getCXXThisVal() const override
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:922
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:357
const ParentMap & getParentMap() const
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1944
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
Represents a top-level expression in a basic block.
Definition: CFG.h:55
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:1017
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:262
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2521
void emitCrossTUDiagnostics(const IndexError &IE)
Emit diagnostics for the user for potential configuration errors.
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:275
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1081
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:145
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:286
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2121
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1146
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:4037
bool isPointerType() const
Definition: Type.h:6391
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:415
const VarRegion * getParameterLocation(unsigned Index, unsigned BlockCount) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:224
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:129
const void * Data
Definition: CallEvent.h:149
A trivial tuple used to represent a source range.
bool isPropertyAccessor() const
Definition: DeclObjC.h:431
AnalysisDeclContext * getAnalysisDeclContext() const
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1877
bool isFunctionPointerType() const
Definition: Type.h:6415
The receiver is a superclass.
Definition: ExprObjC.h:1104
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1248
SourceLocation getBegin() const
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:545
SourceLocation getLocation() const
Definition: DeclBase.h:429
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:366
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:908
ArrayRef< SVal > ValueList
virtual AnalysisManager & getAnalysisManager()=0