clang  7.0.0svn
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "clang/AST/ASTContext.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
29 #include "clang/Analysis/CFG.h"
33 #include "clang/Basic/LLVM.h"
36 #include "clang/Basic/Specifiers.h"
47 #include "llvm/ADT/ArrayRef.h"
48 #include "llvm/ADT/DenseMap.h"
49 #include "llvm/ADT/None.h"
50 #include "llvm/ADT/Optional.h"
51 #include "llvm/ADT/PointerIntPair.h"
52 #include "llvm/ADT/SmallSet.h"
53 #include "llvm/ADT/SmallVector.h"
54 #include "llvm/ADT/StringExtras.h"
55 #include "llvm/ADT/StringRef.h"
56 #include "llvm/Support/Casting.h"
57 #include "llvm/Support/Compiler.h"
58 #include "llvm/Support/Debug.h"
59 #include "llvm/Support/ErrorHandling.h"
60 #include "llvm/Support/raw_ostream.h"
61 #include <cassert>
62 #include <utility>
63 
64 #define DEBUG_TYPE "static-analyzer-call-event"
65 
66 using namespace clang;
67 using namespace ento;
68 
70  ASTContext &Ctx = getState()->getStateManager().getContext();
71  const Expr *E = getOriginExpr();
72  if (!E)
73  return Ctx.VoidTy;
74  assert(E);
75 
76  QualType ResultTy = E->getType();
77 
78  // A function that returns a reference to 'int' will have a result type
79  // of simply 'int'. Check the origin expr's value kind to recover the
80  // proper type.
81  switch (E->getValueKind()) {
82  case VK_LValue:
83  ResultTy = Ctx.getLValueReferenceType(ResultTy);
84  break;
85  case VK_XValue:
86  ResultTy = Ctx.getRValueReferenceType(ResultTy);
87  break;
88  case VK_RValue:
89  // No adjustment is necessary.
90  break;
91  }
92 
93  return ResultTy;
94 }
95 
96 static bool isCallback(QualType T) {
97  // If a parameter is a block or a callback, assume it can modify pointer.
98  if (T->isBlockPointerType() ||
99  T->isFunctionPointerType() ||
100  T->isObjCSelType())
101  return true;
102 
103  // Check if a callback is passed inside a struct (for both, struct passed by
104  // reference and by value). Dig just one level into the struct for now.
105 
106  if (T->isAnyPointerType() || T->isReferenceType())
107  T = T->getPointeeType();
108 
109  if (const RecordType *RT = T->getAsStructureType()) {
110  const RecordDecl *RD = RT->getDecl();
111  for (const auto *I : RD->fields()) {
112  QualType FieldT = I->getType();
113  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
114  return true;
115  }
116  }
117  return false;
118 }
119 
121  if (const auto *PT = T->getAs<PointerType>()) {
122  QualType PointeeTy = PT->getPointeeType();
123  if (PointeeTy.isConstQualified())
124  return false;
125  return PointeeTy->isVoidType();
126  } else
127  return false;
128 }
129 
130 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
131  unsigned NumOfArgs = getNumArgs();
132 
133  // If calling using a function pointer, assume the function does not
134  // satisfy the callback.
135  // TODO: We could check the types of the arguments here.
136  if (!getDecl())
137  return false;
138 
139  unsigned Idx = 0;
141  E = param_type_end();
142  I != E && Idx < NumOfArgs; ++I, ++Idx) {
143  // If the parameter is 0, it's harmless.
144  if (getArgSVal(Idx).isZeroConstant())
145  continue;
146 
147  if (Condition(*I))
148  return true;
149  }
150  return false;
151 }
152 
155 }
156 
159 }
160 
161 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
162  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
163  if (!FD)
164  return false;
165 
166  return CheckerContext::isCLibraryFunction(FD, FunctionName);
167 }
168 
169 /// Returns true if a type is a pointer-to-const or reference-to-const
170 /// with no further indirection.
171 static bool isPointerToConst(QualType Ty) {
172  QualType PointeeTy = Ty->getPointeeType();
173  if (PointeeTy == QualType())
174  return false;
175  if (!PointeeTy.isConstQualified())
176  return false;
177  if (PointeeTy->isAnyPointerType())
178  return false;
179  return true;
180 }
181 
182 // Try to retrieve the function declaration and find the function parameter
183 // types which are pointers/references to a non-pointer const.
184 // We will not invalidate the corresponding argument regions.
185 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
186  const CallEvent &Call) {
187  unsigned Idx = 0;
189  E = Call.param_type_end();
190  I != E; ++I, ++Idx) {
191  if (isPointerToConst(*I))
192  PreserveArgs.insert(Idx);
193  }
194 }
195 
197  ProgramStateRef Orig) const {
198  ProgramStateRef Result = (Orig ? Orig : getState());
199 
200  // Don't invalidate anything if the callee is marked pure/const.
201  if (const Decl *callee = getDecl())
202  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
203  return Result;
204 
205  SmallVector<SVal, 8> ValuesToInvalidate;
207 
208  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
209 
210  // Indexes of arguments whose values will be preserved by the call.
211  llvm::SmallSet<unsigned, 4> PreserveArgs;
212  if (!argumentsMayEscape())
213  findPtrToConstParams(PreserveArgs, *this);
214 
215  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
216  // Mark this region for invalidation. We batch invalidate regions
217  // below for efficiency.
218  if (PreserveArgs.count(Idx))
219  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
220  ETraits.setTrait(MR->getBaseRegion(),
222  // TODO: Factor this out + handle the lower level const pointers.
223 
224  ValuesToInvalidate.push_back(getArgSVal(Idx));
225  }
226 
227  // Invalidate designated regions using the batch invalidation API.
228  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
229  // global variables.
230  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
231  BlockCount, getLocationContext(),
232  /*CausedByPointerEscape*/ true,
233  /*Symbols=*/nullptr, this, &ETraits);
234 }
235 
237  const ProgramPointTag *Tag) const {
238  if (const Expr *E = getOriginExpr()) {
239  if (IsPreVisit)
240  return PreStmt(E, getLocationContext(), Tag);
241  return PostStmt(E, getLocationContext(), Tag);
242  }
243 
244  const Decl *D = getDecl();
245  assert(D && "Cannot get a program point without a statement or decl");
246 
248  if (IsPreVisit)
249  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
250  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
251 }
252 
253 bool CallEvent::isCalled(const CallDescription &CD) const {
254  // FIXME: Add ObjC Message support.
255  if (getKind() == CE_ObjCMessage)
256  return false;
257  if (!CD.IsLookupDone) {
258  CD.IsLookupDone = true;
259  CD.II = &getState()->getStateManager().getContext().Idents.get(CD.FuncName);
260  }
261  const IdentifierInfo *II = getCalleeIdentifier();
262  if (!II || II != CD.II)
263  return false;
264  return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
265  CD.RequiredArgs == getNumArgs());
266 }
267 
268 SVal CallEvent::getArgSVal(unsigned Index) const {
269  const Expr *ArgE = getArgExpr(Index);
270  if (!ArgE)
271  return UnknownVal();
272  return getSVal(ArgE);
273 }
274 
276  const Expr *ArgE = getArgExpr(Index);
277  if (!ArgE)
278  return {};
279  return ArgE->getSourceRange();
280 }
281 
283  const Expr *E = getOriginExpr();
284  if (!E)
285  return UndefinedVal();
286  return getSVal(E);
287 }
288 
289 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
290 
291 void CallEvent::dump(raw_ostream &Out) const {
292  ASTContext &Ctx = getState()->getStateManager().getContext();
293  if (const Expr *E = getOriginExpr()) {
294  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
295  Out << "\n";
296  return;
297  }
298 
299  if (const Decl *D = getDecl()) {
300  Out << "Call to ";
301  D->print(Out, Ctx.getPrintingPolicy());
302  return;
303  }
304 
305  // FIXME: a string representation of the kind would be nice.
306  Out << "Unknown call (type " << getKind() << ")";
307 }
308 
309 bool CallEvent::isCallStmt(const Stmt *S) {
310  return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
311  || isa<CXXConstructExpr>(S)
312  || isa<CXXNewExpr>(S);
313 }
314 
316  assert(D);
317  if (const auto *FD = dyn_cast<FunctionDecl>(D))
318  return FD->getReturnType();
319  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
320  return MD->getReturnType();
321  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
322  // Blocks are difficult because the return type may not be stored in the
323  // BlockDecl itself. The AST should probably be enhanced, but for now we
324  // just do what we can.
325  // If the block is declared without an explicit argument list, the
326  // signature-as-written just includes the return type, not the entire
327  // function type.
328  // FIXME: All blocks should have signatures-as-written, even if the return
329  // type is inferred. (That's signified with a dependent result type.)
330  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
331  QualType Ty = TSI->getType();
332  if (const FunctionType *FT = Ty->getAs<FunctionType>())
333  Ty = FT->getReturnType();
334  if (!Ty->isDependentType())
335  return Ty;
336  }
337 
338  return {};
339  }
340 
341  llvm_unreachable("unknown callable kind");
342 }
343 
344 bool CallEvent::isVariadic(const Decl *D) {
345  assert(D);
346 
347  if (const auto *FD = dyn_cast<FunctionDecl>(D))
348  return FD->isVariadic();
349  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
350  return MD->isVariadic();
351  if (const auto *BD = dyn_cast<BlockDecl>(D))
352  return BD->isVariadic();
353 
354  llvm_unreachable("unknown callable kind");
355 }
356 
357 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
358  CallEvent::BindingsTy &Bindings,
359  SValBuilder &SVB,
360  const CallEvent &Call,
362  MemRegionManager &MRMgr = SVB.getRegionManager();
363 
364  // If the function has fewer parameters than the call has arguments, we simply
365  // do not bind any values to them.
366  unsigned NumArgs = Call.getNumArgs();
367  unsigned Idx = 0;
368  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
369  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
370  const ParmVarDecl *ParamDecl = *I;
371  assert(ParamDecl && "Formal parameter has no decl?");
372 
373  SVal ArgVal = Call.getArgSVal(Idx);
374  if (!ArgVal.isUnknown()) {
375  Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
376  Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
377  }
378  }
379 
380  // FIXME: Variadic arguments are not handled at all right now.
381 }
382 
384  const FunctionDecl *D = getDecl();
385  if (!D)
386  return None;
387  return D->parameters();
388 }
389 
391  const FunctionDecl *FD = getDecl();
392  if (!FD)
393  return {};
394 
395  // Note that the AnalysisDeclContext will have the FunctionDecl with
396  // the definition (if one exists).
397  AnalysisDeclContext *AD =
399  getManager()->getContext(FD);
400  bool IsAutosynthesized;
401  Stmt* Body = AD->getBody(IsAutosynthesized);
402  LLVM_DEBUG({
403  if (IsAutosynthesized)
404  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
405  << "\n";
406  });
407  if (Body) {
408  const Decl* Decl = AD->getDecl();
409  return RuntimeDefinition(Decl);
410  }
411 
412  SubEngine *Engine = getState()->getStateManager().getOwningEngine();
413  AnalyzerOptions &Opts = Engine->getAnalysisManager().options;
414 
415  // Try to get CTU definition only if CTUDir is provided.
416  if (!Opts.naiveCTUEnabled())
417  return {};
418 
421  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
422  CTUCtx.getCrossTUDefinition(FD, Opts.getCTUDir(), Opts.getCTUIndexName());
423 
424  if (!CTUDeclOrError) {
425  handleAllErrors(CTUDeclOrError.takeError(),
426  [&](const cross_tu::IndexError &IE) {
427  CTUCtx.emitCrossTUDiagnostics(IE);
428  });
429  return {};
430  }
431 
432  return RuntimeDefinition(*CTUDeclOrError);
433 }
434 
436  const StackFrameContext *CalleeCtx,
437  BindingsTy &Bindings) const {
438  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
439  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
440  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
441  D->parameters());
442 }
443 
446  return true;
447 
448  const FunctionDecl *D = getDecl();
449  if (!D)
450  return true;
451 
452  const IdentifierInfo *II = D->getIdentifier();
453  if (!II)
454  return false;
455 
456  // This set of "escaping" APIs is
457 
458  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
459  // value into thread local storage. The value can later be retrieved with
460  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
461  // parameter is 'const void *', the region escapes through the call.
462  if (II->isStr("pthread_setspecific"))
463  return true;
464 
465  // - xpc_connection_set_context stores a value which can be retrieved later
466  // with xpc_connection_get_context.
467  if (II->isStr("xpc_connection_set_context"))
468  return true;
469 
470  // - funopen - sets a buffer for future IO calls.
471  if (II->isStr("funopen"))
472  return true;
473 
474  // - __cxa_demangle - can reallocate memory and can return the pointer to
475  // the input buffer.
476  if (II->isStr("__cxa_demangle"))
477  return true;
478 
479  StringRef FName = II->getName();
480 
481  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
482  // buffer even if it is const.
483  if (FName.endswith("NoCopy"))
484  return true;
485 
486  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
487  // be deallocated by NSMapRemove.
488  if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
489  return true;
490 
491  // - Many CF containers allow objects to escape through custom
492  // allocators/deallocators upon container construction. (PR12101)
493  if (FName.startswith("CF") || FName.startswith("CG")) {
494  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
495  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
496  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
497  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
498  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
499  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
500  }
501 
502  return false;
503 }
504 
506  const FunctionDecl *D = getOriginExpr()->getDirectCallee();
507  if (D)
508  return D;
509 
510  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
511 }
512 
514  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
515  if (!CE)
516  return AnyFunctionCall::getDecl();
517 
518  const FunctionDecl *D = CE->getDirectCallee();
519  if (D)
520  return D;
521 
522  return getSVal(CE->getCallee()).getAsFunctionDecl();
523 }
524 
526  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
527  SVal ThisVal = getCXXThisVal();
528  Values.push_back(ThisVal);
529 
530  // Don't invalidate if the method is const and there are no mutable fields.
531  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
532  if (!D->isConst())
533  return;
534  // Get the record decl for the class of 'This'. D->getParent() may return a
535  // base class decl, rather than the class of the instance which needs to be
536  // checked for mutable fields.
537  // TODO: We might as well look at the dynamic type of the object.
538  const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
539  QualType T = Ex->getType();
540  if (T->isPointerType()) // Arrow or implicit-this syntax?
541  T = T->getPointeeType();
542  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
543  assert(ParentRecord);
544  if (ParentRecord->hasMutableFields())
545  return;
546  // Preserve CXXThis.
547  const MemRegion *ThisRegion = ThisVal.getAsRegion();
548  if (!ThisRegion)
549  return;
550 
551  ETraits->setTrait(ThisRegion->getBaseRegion(),
553  }
554 }
555 
557  const Expr *Base = getCXXThisExpr();
558  // FIXME: This doesn't handle an overloaded ->* operator.
559  if (!Base)
560  return UnknownVal();
561 
562  SVal ThisVal = getSVal(Base);
563  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
564  return ThisVal;
565 }
566 
568  // Do we have a decl at all?
569  const Decl *D = getDecl();
570  if (!D)
571  return {};
572 
573  // If the method is non-virtual, we know we can inline it.
574  const auto *MD = cast<CXXMethodDecl>(D);
575  if (!MD->isVirtual())
577 
578  // Do we know the implicit 'this' object being called?
579  const MemRegion *R = getCXXThisVal().getAsRegion();
580  if (!R)
581  return {};
582 
583  // Do we know anything about the type of 'this'?
585  if (!DynType.isValid())
586  return {};
587 
588  // Is the type a C++ class? (This is mostly a defensive check.)
589  QualType RegionType = DynType.getType()->getPointeeType();
590  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
591 
592  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
593  if (!RD || !RD->hasDefinition())
594  return {};
595 
596  // Find the decl for this method in that class.
597  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
598  if (!Result) {
599  // We might not even get the original statically-resolved method due to
600  // some particularly nasty casting (e.g. casts to sister classes).
601  // However, we should at least be able to search up and down our own class
602  // hierarchy, and some real bugs have been caught by checking this.
603  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
604 
605  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
606  // the static type. However, because we currently don't update
607  // DynamicTypeInfo when an object is cast, we can't actually be sure the
608  // DynamicTypeInfo is up to date. This assert should be re-enabled once
609  // this is fixed. <rdar://problem/12287087>
610  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
611 
612  return {};
613  }
614 
615  // Does the decl that we found have an implementation?
616  const FunctionDecl *Definition;
617  if (!Result->hasBody(Definition))
618  return {};
619 
620  // We found a definition. If we're not sure that this devirtualization is
621  // actually what will happen at runtime, make sure to provide the region so
622  // that ExprEngine can decide what to do with it.
623  if (DynType.canBeASubClass())
624  return RuntimeDefinition(Definition, R->StripCasts());
625  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
626 }
627 
629  const StackFrameContext *CalleeCtx,
630  BindingsTy &Bindings) const {
632 
633  // Handle the binding of 'this' in the new stack frame.
634  SVal ThisVal = getCXXThisVal();
635  if (!ThisVal.isUnknown()) {
636  ProgramStateManager &StateMgr = getState()->getStateManager();
637  SValBuilder &SVB = StateMgr.getSValBuilder();
638 
639  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
640  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
641 
642  // If we devirtualized to a different member function, we need to make sure
643  // we have the proper layering of CXXBaseObjectRegions.
644  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
645  ASTContext &Ctx = SVB.getContext();
646  const CXXRecordDecl *Class = MD->getParent();
647  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
648 
649  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
650  bool Failed;
651  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
652  if (Failed) {
653  // We might have suffered some sort of placement new earlier, so
654  // we're constructing in a completely unexpected storage.
655  // Fall back to a generic pointer cast for this-value.
656  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
657  const CXXRecordDecl *StaticClass = StaticMD->getParent();
658  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
659  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
660  }
661  }
662 
663  if (!ThisVal.isUnknown())
664  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
665  }
666 }
667 
669  return getOriginExpr()->getImplicitObjectArgument();
670 }
671 
673  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
674  // id-expression in the class member access expression is a qualified-id,
675  // that function is called. Otherwise, its final overrider in the dynamic type
676  // of the object expression is called.
677  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
678  if (ME->hasQualifier())
680 
682 }
683 
685  return getOriginExpr()->getArg(0);
686 }
687 
689  const Expr *Callee = getOriginExpr()->getCallee();
690  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
691 
692  return dyn_cast_or_null<BlockDataRegion>(DataReg);
693 }
694 
696  const BlockDecl *D = getDecl();
697  if (!D)
698  return nullptr;
699  return D->parameters();
700 }
701 
703  RegionAndSymbolInvalidationTraits *ETraits) const {
704  // FIXME: This also needs to invalidate captured globals.
705  if (const MemRegion *R = getBlockRegion())
706  Values.push_back(loc::MemRegionVal(R));
707 }
708 
710  BindingsTy &Bindings) const {
711  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
712  ArrayRef<ParmVarDecl*> Params;
713  if (isConversionFromLambda()) {
714  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
715  Params = LambdaOperatorDecl->parameters();
716 
717  // For blocks converted from a C++ lambda, the callee declaration is the
718  // operator() method on the lambda so we bind "this" to
719  // the lambda captured by the block.
720  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
721  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
722  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
723  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
724  } else {
725  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
726  }
727 
728  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
729  Params);
730 }
731 
733  if (Data)
734  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
735  return UnknownVal();
736 }
737 
739  RegionAndSymbolInvalidationTraits *ETraits) const {
740  if (Data) {
741  loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
742  if (SymbolRef Sym = MV.getAsSymbol(true))
743  ETraits->setTrait(Sym,
745  Values.push_back(MV);
746  }
747 }
748 
750  const StackFrameContext *CalleeCtx,
751  BindingsTy &Bindings) const {
753 
754  SVal ThisVal = getCXXThisVal();
755  if (!ThisVal.isUnknown()) {
756  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
757  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
758  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
759  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
760  }
761 }
762 
764  if (Data)
765  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
766  return UnknownVal();
767 }
768 
770  // Base destructors are always called non-virtually.
771  // Skip CXXInstanceCall's devirtualization logic in this case.
772  if (isBaseDestructor())
774 
776 }
777 
779  const ObjCMethodDecl *D = getDecl();
780  if (!D)
781  return None;
782  return D->parameters();
783 }
784 
786  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
787 
788  // If the method call is a setter for property known to be backed by
789  // an instance variable, don't invalidate the entire receiver, just
790  // the storage for that instance variable.
791  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
792  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
793  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
794  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
795  ETraits->setTrait(
796  IvarRegion,
798  ETraits->setTrait(
799  IvarRegion,
801  Values.push_back(IvarLVal);
802  }
803  return;
804  }
805  }
806 
807  Values.push_back(getReceiverSVal());
808 }
809 
811  const LocationContext *LCtx = getLocationContext();
812  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
813  if (!SelfDecl)
814  return SVal();
815  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
816 }
817 
819  // FIXME: Is this the best way to handle class receivers?
820  if (!isInstanceMessage())
821  return UnknownVal();
822 
823  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
824  return getSVal(RecE);
825 
826  // An instance message with no expression means we are sending to super.
827  // In this case the object reference is the same as 'self'.
828  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
829  SVal SelfVal = getSelfSVal();
830  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
831  return SelfVal;
832 }
833 
835  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
836  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
837  return true;
838 
839  if (!isInstanceMessage())
840  return false;
841 
842  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
843 
844  return (RecVal == getSelfSVal());
845 }
846 
848  switch (getMessageKind()) {
849  case OCM_Message:
850  return getOriginExpr()->getSourceRange();
851  case OCM_PropertyAccess:
852  case OCM_Subscript:
853  return getContainingPseudoObjectExpr()->getSourceRange();
854  }
855  llvm_unreachable("unknown message kind");
856 }
857 
858 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
859 
860 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
861  assert(Data && "Lazy lookup not yet performed.");
862  assert(getMessageKind() != OCM_Message && "Explicit message send.");
863  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
864 }
865 
866 static const Expr *
868  const Expr *Syntactic = POE->getSyntacticForm();
869 
870  // This handles the funny case of assigning to the result of a getter.
871  // This can happen if the getter returns a non-const reference.
872  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
873  Syntactic = BO->getLHS();
874 
875  return Syntactic;
876 }
877 
879  if (!Data) {
880  // Find the parent, ignoring implicit casts.
883 
884  // Check if parent is a PseudoObjectExpr.
885  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
886  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
887 
888  ObjCMessageKind K;
889  switch (Syntactic->getStmtClass()) {
890  case Stmt::ObjCPropertyRefExprClass:
891  K = OCM_PropertyAccess;
892  break;
893  case Stmt::ObjCSubscriptRefExprClass:
894  K = OCM_Subscript;
895  break;
896  default:
897  // FIXME: Can this ever happen?
898  K = OCM_Message;
899  break;
900  }
901 
902  if (K != OCM_Message) {
903  const_cast<ObjCMethodCall *>(this)->Data
904  = ObjCMessageDataTy(POE, K).getOpaqueValue();
905  assert(getMessageKind() == K);
906  return K;
907  }
908  }
909 
910  const_cast<ObjCMethodCall *>(this)->Data
911  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
912  assert(getMessageKind() == OCM_Message);
913  return OCM_Message;
914  }
915 
916  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
917  if (!Info.getPointer())
918  return OCM_Message;
919  return static_cast<ObjCMessageKind>(Info.getInt());
920 }
921 
923  // Look for properties accessed with property syntax (foo.bar = ...)
924  if ( getMessageKind() == OCM_PropertyAccess) {
925  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
926  assert(POE && "Property access without PseudoObjectExpr?");
927 
928  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
929  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
930 
931  if (RefExpr->isExplicitProperty())
932  return RefExpr->getExplicitProperty();
933  }
934 
935  // Look for properties accessed with method syntax ([foo setBar:...]).
936  const ObjCMethodDecl *MD = getDecl();
937  if (!MD || !MD->isPropertyAccessor())
938  return nullptr;
939 
940  // Note: This is potentially quite slow.
941  return MD->findPropertyDecl();
942 }
943 
945  Selector Sel) const {
946  assert(IDecl);
947  AnalysisManager &AMgr =
948  getState()->getStateManager().getOwningEngine()->getAnalysisManager();
949  // If the class interface is declared inside the main file, assume it is not
950  // subcassed.
951  // TODO: It could actually be subclassed if the subclass is private as well.
952  // This is probably very rare.
953  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
954  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
955  return false;
956 
957  // Assume that property accessors are not overridden.
958  if (getMessageKind() == OCM_PropertyAccess)
959  return false;
960 
961  // We assume that if the method is public (declared outside of main file) or
962  // has a parent which publicly declares the method, the method could be
963  // overridden in a subclass.
964 
965  // Find the first declaration in the class hierarchy that declares
966  // the selector.
967  ObjCMethodDecl *D = nullptr;
968  while (true) {
969  D = IDecl->lookupMethod(Sel, true);
970 
971  // Cannot find a public definition.
972  if (!D)
973  return false;
974 
975  // If outside the main file,
976  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
977  return true;
978 
979  if (D->isOverriding()) {
980  // Search in the superclass on the next iteration.
981  IDecl = D->getClassInterface();
982  if (!IDecl)
983  return false;
984 
985  IDecl = IDecl->getSuperClass();
986  if (!IDecl)
987  return false;
988 
989  continue;
990  }
991 
992  return false;
993  };
994 
995  llvm_unreachable("The while loop should always terminate.");
996 }
997 
999  if (!MD)
1000  return MD;
1001 
1002  // Find the redeclaration that defines the method.
1003  if (!MD->hasBody()) {
1004  for (auto I : MD->redecls())
1005  if (I->hasBody())
1006  MD = cast<ObjCMethodDecl>(I);
1007  }
1008  return MD;
1009 }
1010 
1011 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1012  const Expr* InstRec = ME->getInstanceReceiver();
1013  if (!InstRec)
1014  return false;
1015  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1016 
1017  // Check that receiver is called 'self'.
1018  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1019  !InstRecIg->getFoundDecl()->getName().equals("self"))
1020  return false;
1021 
1022  // Check that the method name is 'class'.
1023  if (ME->getSelector().getNumArgs() != 0 ||
1024  !ME->getSelector().getNameForSlot(0).equals("class"))
1025  return false;
1026 
1027  return true;
1028 }
1029 
1031  const ObjCMessageExpr *E = getOriginExpr();
1032  assert(E);
1033  Selector Sel = E->getSelector();
1034 
1035  if (E->isInstanceMessage()) {
1036  // Find the receiver type.
1037  const ObjCObjectPointerType *ReceiverT = nullptr;
1038  bool CanBeSubClassed = false;
1039  QualType SupersType = E->getSuperType();
1040  const MemRegion *Receiver = nullptr;
1041 
1042  if (!SupersType.isNull()) {
1043  // The receiver is guaranteed to be 'super' in this case.
1044  // Super always means the type of immediate predecessor to the method
1045  // where the call occurs.
1046  ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1047  } else {
1048  Receiver = getReceiverSVal().getAsRegion();
1049  if (!Receiver)
1050  return {};
1051 
1052  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1053  if (!DTI.isValid()) {
1054  assert(isa<AllocaRegion>(Receiver) &&
1055  "Unhandled untyped region class!");
1056  return {};
1057  }
1058 
1059  QualType DynType = DTI.getType();
1060  CanBeSubClassed = DTI.canBeASubClass();
1061  ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1062 
1063  if (ReceiverT && CanBeSubClassed)
1064  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1065  if (!canBeOverridenInSubclass(IDecl, Sel))
1066  CanBeSubClassed = false;
1067  }
1068 
1069  // Handle special cases of '[self classMethod]' and
1070  // '[[self class] classMethod]', which are treated by the compiler as
1071  // instance (not class) messages. We will statically dispatch to those.
1072  if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1073  // For [self classMethod], return the compiler visible declaration.
1074  if (PT->getObjectType()->isObjCClass() &&
1075  Receiver == getSelfSVal().getAsRegion())
1077 
1078  // Similarly, handle [[self class] classMethod].
1079  // TODO: We are currently doing a syntactic match for this pattern with is
1080  // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1081  // shows. A better way would be to associate the meta type with the symbol
1082  // using the dynamic type info tracking and use it here. We can add a new
1083  // SVal for ObjC 'Class' values that know what interface declaration they
1084  // come from. Then 'self' in a class method would be filled in with
1085  // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1086  // do proper dynamic dispatch for class methods just like we do for
1087  // instance methods now.
1088  if (E->getInstanceReceiver())
1089  if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1090  if (isCallToSelfClass(M))
1092  }
1093 
1094  // Lookup the instance method implementation.
1095  if (ReceiverT)
1096  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1097  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1098  // when in many cases it returns null. We cache the results so
1099  // that repeated queries on the same ObjCIntefaceDecl and Selector
1100  // don't incur the same cost. On some test cases, we can see the
1101  // same query being issued thousands of times.
1102  //
1103  // NOTE: This cache is essentially a "global" variable, but it
1104  // only gets lazily created when we get here. The value of the
1105  // cache probably comes from it being global across ExprEngines,
1106  // where the same queries may get issued. If we are worried about
1107  // concurrency, or possibly loading/unloading ASTs, etc., we may
1108  // need to revisit this someday. In terms of memory, this table
1109  // stays around until clang quits, which also may be bad if we
1110  // need to release memory.
1111  using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1112  using PrivateMethodCache =
1113  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1114 
1115  static PrivateMethodCache PMC;
1116  Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1117 
1118  // Query lookupPrivateMethod() if the cache does not hit.
1119  if (!Val.hasValue()) {
1120  Val = IDecl->lookupPrivateMethod(Sel);
1121 
1122  // If the method is a property accessor, we should try to "inline" it
1123  // even if we don't actually have an implementation.
1124  if (!*Val)
1125  if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1126  if (CompileTimeMD->isPropertyAccessor()) {
1127  if (!CompileTimeMD->getSelfDecl() &&
1128  isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1129  // If the method is an accessor in a category, and it doesn't
1130  // have a self declaration, first
1131  // try to find the method in a class extension. This
1132  // works around a bug in Sema where multiple accessors
1133  // are synthesized for properties in class
1134  // extensions that are redeclared in a category and the
1135  // the implicit parameters are not filled in for
1136  // the method on the category.
1137  // This ensures we find the accessor in the extension, which
1138  // has the implicit parameters filled in.
1139  auto *ID = CompileTimeMD->getClassInterface();
1140  for (auto *CatDecl : ID->visible_extensions()) {
1141  Val = CatDecl->getMethod(Sel,
1142  CompileTimeMD->isInstanceMethod());
1143  if (*Val)
1144  break;
1145  }
1146  }
1147  if (!*Val)
1148  Val = IDecl->lookupInstanceMethod(Sel);
1149  }
1150  }
1151 
1152  const ObjCMethodDecl *MD = Val.getValue();
1153  if (CanBeSubClassed)
1154  return RuntimeDefinition(MD, Receiver);
1155  else
1156  return RuntimeDefinition(MD, nullptr);
1157  }
1158  } else {
1159  // This is a class method.
1160  // If we have type info for the receiver class, we are calling via
1161  // class name.
1162  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1163  // Find/Return the method implementation.
1164  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1165  }
1166  }
1167 
1168  return {};
1169 }
1170 
1172  if (isInSystemHeader() && !isInstanceMessage()) {
1173  Selector Sel = getSelector();
1174  if (Sel.getNumArgs() == 1 &&
1175  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1176  return true;
1177  }
1178 
1180 }
1181 
1183  const StackFrameContext *CalleeCtx,
1184  BindingsTy &Bindings) const {
1185  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1186  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1187  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1188  D->parameters());
1189 
1190  SVal SelfVal = getReceiverSVal();
1191  if (!SelfVal.isUnknown()) {
1192  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1193  MemRegionManager &MRMgr = SVB.getRegionManager();
1194  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1195  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1196  }
1197 }
1198 
1201  const LocationContext *LCtx) {
1202  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1203  return create<CXXMemberCall>(MCE, State, LCtx);
1204 
1205  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1206  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1207  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1208  if (MD->isInstance())
1209  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1210 
1211  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1212  return create<BlockCall>(CE, State, LCtx);
1213  }
1214 
1215  // Otherwise, it's a normal function call, static member function call, or
1216  // something we can't reason about.
1217  return create<SimpleFunctionCall>(CE, State, LCtx);
1218 }
1219 
1222  ProgramStateRef State) {
1223  const LocationContext *ParentCtx = CalleeCtx->getParent();
1224  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1225  assert(CallerCtx && "This should not be used for top-level stack frames");
1226 
1227  const Stmt *CallSite = CalleeCtx->getCallSite();
1228 
1229  if (CallSite) {
1230  if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
1231  return getSimpleCall(CE, State, CallerCtx);
1232 
1233  switch (CallSite->getStmtClass()) {
1234  case Stmt::CXXConstructExprClass:
1235  case Stmt::CXXTemporaryObjectExprClass: {
1236  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1237  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1238  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1239  SVal ThisVal = State->getSVal(ThisPtr);
1240 
1241  return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1242  ThisVal.getAsRegion(), State, CallerCtx);
1243  }
1244  case Stmt::CXXNewExprClass:
1245  return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
1246  case Stmt::ObjCMessageExprClass:
1247  return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
1248  State, CallerCtx);
1249  default:
1250  llvm_unreachable("This is not an inlineable statement.");
1251  }
1252  }
1253 
1254  // Fall back to the CFG. The only thing we haven't handled yet is
1255  // destructors, though this could change in the future.
1256  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1257  CFGElement E = (*B)[CalleeCtx->getIndex()];
1258  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1259  "All other CFG elements should have exprs");
1260 
1261  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1262  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1263  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1264  SVal ThisVal = State->getSVal(ThisPtr);
1265 
1266  const Stmt *Trigger;
1268  Trigger = AutoDtor->getTriggerStmt();
1269  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1270  Trigger = DeleteDtor->getDeleteExpr();
1271  else
1272  Trigger = Dtor->getBody();
1273 
1274  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1275  E.getAs<CFGBaseDtor>().hasValue(), State,
1276  CallerCtx);
1277 }
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1060
Defines the clang::ASTContext interface.
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:305
SVal getSelfSVal() const
Return the value of &#39;self&#39; if available.
Definition: CallEvent.cpp:810
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:818
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:738
Represents a function declaration or definition.
Definition: Decl.h:1714
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:5097
Smart pointer class that efficiently represents Objective-C method names.
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2387
A (possibly-)qualified type.
Definition: Type.h:655
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6114
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:444
Selector getSelector() const
Definition: ExprObjC.cpp:312
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1098
Stmt * getBody() const
Get the body of the Declaration.
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:867
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1384
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:236
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3205
static bool isCallToSelfClass(const ObjCMessageExpr *ME)
Definition: CallEvent.cpp:1011
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:491
C Language Family Type Representation.
Defines the SourceManager interface.
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:333
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
const RecordType * getAsStructureType() const
Definition: Type.cpp:507
CFGDeleteDtor - Represents C++ object destructor generated from a call to delete. ...
Definition: CFG.h:405
SourceRange getSourceRange() const override
Definition: CallEvent.cpp:847
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:557
A container of type source information.
Definition: Decl.h:86
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1200
SVal evalCast(SVal val, QualType castTy, QualType originalType)
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:628
Expr * ignoreParenBaseCasts() LLVM_READONLY
Ignore parentheses and derived-to-base casts.
Definition: Expr.cpp:2587
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:472
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:248
Represents a variable declaration or definition.
Definition: Decl.h:812
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6519
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1533
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:208
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:120
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:684
ArrayRef< ParmVarDecl * > parameters() const override
Return call&#39;s formal parameters.
Definition: CallEvent.cpp:383
Represents a parameter to a function.
Definition: Decl.h:1533
Defines the clang::Expr interface and subclasses for C++ expressions.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:702
Symbolic value.
Definition: SymExpr.h:30
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:269
Represents a struct/union/class.
Definition: Decl.h:3552
bool isValid() const
Return false if no dynamic type info is available.
One of these records is kept for each identifier that is lexed.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:672
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:175
param_type_iterator param_type_end() const
Definition: CallEvent.h:433
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:150
field_range fields() const
Definition: Decl.h:3768
AnalysisDeclContext contains the context data for the function or method under analysis.
StringRef getCTUDir()
Returns the directory containing the CTU related files.
CFGAutomaticObjDtor - Represents C++ object destructor implicitly generated for automatic object or t...
Definition: CFG.h:379
bool isReferenceType() const
Definition: Type.h:6118
static bool isInCodeFile(SourceLocation SL, const SourceManager &SM)
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:298
bool isObjCSelType() const
Definition: Type.h:6244
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:110
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2222
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl *> parameters)
Definition: CallEvent.cpp:357
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:668
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:892
virtual Kind getKind() const =0
Returns the kind of call this is.
const ImplicitParamDecl * getSelfDecl() const
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:153
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
An x-value expression is a reference to an object with independent storage but which can be "moved"...
Definition: Specifiers.h:119
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:405
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:185
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:637
const LocationContext * getParent() const
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection...
Definition: CallEvent.cpp:171
bool isUnknown() const
Definition: SVals.h:137
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:998
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:282
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:457
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call&#39;s formal parameters.
Definition: CallEvent.h:429
Represents an ObjC class declaration.
Definition: DeclObjC.h:1191
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:344
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:875
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call&#39;s formal parameters.
const CFGBlock * getCallSiteBlock() const
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:127
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:377
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:668
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:883
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:834
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1621
const Stmt * getCallSite() const
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:778
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:548
bool argumentsMayEscape() const override
Definition: CallEvent.cpp:1171
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:354
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:695
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:238
static bool isCallback(QualType T)
Definition: CallEvent.cpp:96
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3842
bool canBeASubClass() const
Returns false if the type information is precise (the type T is the only type in the lattice)...
Expr - This represents one expression.
Definition: Expr.h:106
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:1182
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:505
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Definition: CallEvent.cpp:1221
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:422
const Expr * getCallee() const
Definition: Expr.h:2323
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:260
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
bool isValid() const
Definition: SVals.h:149
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:331
virtual SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:556
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:358
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:709
bool hasBody(const FunctionDecl *&Definition) const
Returns true if the function has a body.
Definition: Decl.cpp:2626
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
QualType getType() const
Definition: Expr.h:128
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:228
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:903
virtual cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()=0
QualType getRecordType(const RecordDecl *Decl) const
unsigned getNumArgs() const
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:785
CFGBaseDtor - Represents C++ object destructor implicitly generated for base object in destructor...
Definition: CFG.h:431
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:720
ParentMap & getParentMap() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:112
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:329
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:567
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:5941
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:289
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
Definition: CallEvent.cpp:435
const MemRegion * StripCasts(bool StripBaseCasts=true) const
Definition: MemRegion.cpp:1152
const ImplicitParamDecl * getSelfDecl() const
Return the ImplicitParamDecl* associated with &#39;self&#39; if this AnalysisDeclContext wraps an ObjCMethodD...
Defines the runtime definition of the called function.
Definition: CallEvent.h:127
QualType getCanonicalType() const
Definition: Type.h:5921
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:5053
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:77
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:525
Encodes a location in the source.
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:513
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:309
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2043
ASTContext & getContext()
Definition: SValBuilder.h:156
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
CanQualType VoidTy
Definition: ASTContext.h:998
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:6110
bool naiveCTUEnabled()
Returns true when naive cross translation unit analysis is enabled.
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:746
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:769
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1302
Tells that a region&#39;s contents is not changed.
Definition: MemRegion.h:1399
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:216
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1206
static const unsigned NoArgRequirement
Definition: CallEvent.h:86
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName)
This function loads a function definition from an external AST file and merge it into the original AS...
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:946
SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:732
Dataflow Directional Tag Classes.
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:944
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:688
bool isValid() const
Return true if this is a valid SourceLocation object.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:275
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:574
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg)
Get dynamic type information for a region.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:1030
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:819
QualType getSuperType() const
Retrieve the type referred to by &#39;super&#39;.
Definition: ExprObjC.h:1282
StmtClass getStmtClass() const
Definition: Stmt.h:389
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:157
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2163
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:164
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:878
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
Definition: Expr.cpp:2604
Represents a pointer to an Objective C object.
Definition: Type.h:5604
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:63
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4129
StringRef getCTUIndexName()
Returns the name of the file containing the CTU index of functions.
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5660
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:524
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:315
const StackFrameContext * getStackFrame() const
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:161
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class, its categories, and its super classes (using a linear search).
Definition: DeclObjC.cpp:676
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:69
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1358
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method&#39;s selector.
Definition: DeclObjC.cpp:1256
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:130
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:233
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
bool isVoidType() const
Definition: Type.h:6333
SVal getCXXThisVal() const override
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:763
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
Definition: CFG.h:354
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:253
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1964
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
CFGElement - Represents a top-level expression in a basic block.
Definition: CFG.h:55
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:858
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1126
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:266
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2283
void emitCrossTUDiagnostics(const IndexError &IE)
Emit diagnostics for the user for potential configuration errors.
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:275
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:922
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:134
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:196
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:1939
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:972
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:3931
bool isPointerType() const
Definition: Type.h:6106
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:268
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:114
const void * Data
Definition: CallEvent.h:175
A trivial tuple used to represent a source range.
bool isPropertyAccessor() const
Definition: DeclObjC.h:459
AnalysisDeclContext * getAnalysisDeclContext() const
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1897
bool isFunctionPointerType() const
Definition: Type.h:6130
The receiver is a superclass.
Definition: ExprObjC.h:1057
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1194
SourceLocation getBegin() const
CFGTemporaryDtor - Represents C++ object destructor implicitly generated at the end of full expressio...
Definition: CFG.h:473
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:390
bool isUnknownOrUndef() const
Definition: SVals.h:145
SourceLocation getLocation() const
Definition: DeclBase.h:417
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:405
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:749
virtual AnalysisManager & getAnalysisManager()=0