clang  8.0.0svn
DynamicTypePropagation.cpp
Go to the documentation of this file.
1 //===- DynamicTypePropagation.cpp ------------------------------*- C++ -*--===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file contains two checkers. One helps the static analyzer core to track
11 // types, the other does type inference on Obj-C generics and report type
12 // errors.
13 //
14 // Dynamic Type Propagation:
15 // This checker defines the rules for dynamic type gathering and propagation.
16 //
17 // Generics Checker for Objective-C:
18 // This checker tries to find type errors that the compiler is not able to catch
19 // due to the implicit conversions that were introduced for backward
20 // compatibility.
21 //
22 //===----------------------------------------------------------------------===//
23 
24 #include "ClangSACheckers.h"
25 #include "clang/AST/ParentMap.h"
27 #include "clang/Basic/Builtins.h"
35 
36 using namespace clang;
37 using namespace ento;
38 
39 // ProgramState trait - The type inflation is tracked by DynamicTypeMap. This is
40 // an auxiliary map that tracks more information about generic types, because in
41 // some cases the most derived type is not the most informative one about the
42 // type parameters. This types that are stored for each symbol in this map must
43 // be specialized.
44 // TODO: In some case the type stored in this map is exactly the same that is
45 // stored in DynamicTypeMap. We should no store duplicated information in those
46 // cases.
47 REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef,
48  const ObjCObjectPointerType *)
49 
50 namespace {
51 class DynamicTypePropagation:
52  public Checker< check::PreCall,
53  check::PostCall,
54  check::DeadSymbols,
55  check::PostStmt<CastExpr>,
56  check::PostStmt<CXXNewExpr>,
57  check::PreObjCMessage,
58  check::PostObjCMessage > {
59  const ObjCObjectType *getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
60  CheckerContext &C) const;
61 
62  /// Return a better dynamic type if one can be derived from the cast.
63  const ObjCObjectPointerType *getBetterObjCType(const Expr *CastE,
64  CheckerContext &C) const;
65 
66  ExplodedNode *dynamicTypePropagationOnCasts(const CastExpr *CE,
68  CheckerContext &C) const;
69 
70  mutable std::unique_ptr<BugType> ObjCGenericsBugType;
71  void initBugType() const {
72  if (!ObjCGenericsBugType)
73  ObjCGenericsBugType.reset(
74  new BugType(this, "Generics", categories::CoreFoundationObjectiveC));
75  }
76 
77  class GenericsBugVisitor : public BugReporterVisitor {
78  public:
79  GenericsBugVisitor(SymbolRef S) : Sym(S) {}
80 
81  void Profile(llvm::FoldingSetNodeID &ID) const override {
82  static int X = 0;
83  ID.AddPointer(&X);
84  ID.AddPointer(Sym);
85  }
86 
87  std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
88  BugReporterContext &BRC,
89  BugReport &BR) override;
90 
91  private:
92  // The tracked symbol.
93  SymbolRef Sym;
94  };
95 
96  void reportGenericsBug(const ObjCObjectPointerType *From,
97  const ObjCObjectPointerType *To, ExplodedNode *N,
98  SymbolRef Sym, CheckerContext &C,
99  const Stmt *ReportedNode = nullptr) const;
100 
101 public:
102  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
103  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
104  void checkPostStmt(const CastExpr *CastE, CheckerContext &C) const;
105  void checkPostStmt(const CXXNewExpr *NewE, CheckerContext &C) const;
106  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
107  void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
108  void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
109 
110  /// This value is set to true, when the Generics checker is turned on.
111  DefaultBool CheckGenerics;
112 };
113 } // end anonymous namespace
114 
115 void DynamicTypePropagation::checkDeadSymbols(SymbolReaper &SR,
116  CheckerContext &C) const {
117  ProgramStateRef State = C.getState();
118  DynamicTypeMapImpl TypeMap = State->get<DynamicTypeMap>();
119  for (DynamicTypeMapImpl::iterator I = TypeMap.begin(), E = TypeMap.end();
120  I != E; ++I) {
121  if (!SR.isLiveRegion(I->first)) {
122  State = State->remove<DynamicTypeMap>(I->first);
123  }
124  }
125 
126  if (!SR.hasDeadSymbols()) {
127  C.addTransition(State);
128  return;
129  }
130 
131  MostSpecializedTypeArgsMapTy TyArgMap =
132  State->get<MostSpecializedTypeArgsMap>();
133  for (MostSpecializedTypeArgsMapTy::iterator I = TyArgMap.begin(),
134  E = TyArgMap.end();
135  I != E; ++I) {
136  if (SR.isDead(I->first)) {
137  State = State->remove<MostSpecializedTypeArgsMap>(I->first);
138  }
139  }
140 
141  C.addTransition(State);
142 }
143 
144 static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD,
145  CheckerContext &C) {
146  assert(Region);
147  assert(MD);
148 
149  ASTContext &Ctx = C.getASTContext();
150  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(MD->getParent()));
151 
152  ProgramStateRef State = C.getState();
153  State = setDynamicTypeInfo(State, Region, Ty, /*CanBeSubclass=*/false);
154  C.addTransition(State);
155 }
156 
157 void DynamicTypePropagation::checkPreCall(const CallEvent &Call,
158  CheckerContext &C) const {
159  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
160  // C++11 [class.cdtor]p4: When a virtual function is called directly or
161  // indirectly from a constructor or from a destructor, including during
162  // the construction or destruction of the class's non-static data members,
163  // and the object to which the call applies is the object under
164  // construction or destruction, the function called is the final overrider
165  // in the constructor's or destructor's class and not one overriding it in
166  // a more-derived class.
167 
168  switch (Ctor->getOriginExpr()->getConstructionKind()) {
171  // No additional type info necessary.
172  return;
175  if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion())
176  recordFixedType(Target, Ctor->getDecl(), C);
177  return;
178  }
179 
180  return;
181  }
182 
183  if (const CXXDestructorCall *Dtor = dyn_cast<CXXDestructorCall>(&Call)) {
184  // C++11 [class.cdtor]p4 (see above)
185  if (!Dtor->isBaseDestructor())
186  return;
187 
188  const MemRegion *Target = Dtor->getCXXThisVal().getAsRegion();
189  if (!Target)
190  return;
191 
192  const Decl *D = Dtor->getDecl();
193  if (!D)
194  return;
195 
196  recordFixedType(Target, cast<CXXDestructorDecl>(D), C);
197  return;
198  }
199 }
200 
201 void DynamicTypePropagation::checkPostCall(const CallEvent &Call,
202  CheckerContext &C) const {
203  // We can obtain perfect type info for return values from some calls.
204  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
205 
206  // Get the returned value if it's a region.
207  const MemRegion *RetReg = Call.getReturnValue().getAsRegion();
208  if (!RetReg)
209  return;
210 
211  ProgramStateRef State = C.getState();
212  const ObjCMethodDecl *D = Msg->getDecl();
213 
214  if (D && D->hasRelatedResultType()) {
215  switch (Msg->getMethodFamily()) {
216  default:
217  break;
218 
219  // We assume that the type of the object returned by alloc and new are the
220  // pointer to the object of the class specified in the receiver of the
221  // message.
222  case OMF_alloc:
223  case OMF_new: {
224  // Get the type of object that will get created.
225  const ObjCMessageExpr *MsgE = Msg->getOriginExpr();
226  const ObjCObjectType *ObjTy = getObjectTypeForAllocAndNew(MsgE, C);
227  if (!ObjTy)
228  return;
229  QualType DynResTy =
230  C.getASTContext().getObjCObjectPointerType(QualType(ObjTy, 0));
231  C.addTransition(setDynamicTypeInfo(State, RetReg, DynResTy, false));
232  break;
233  }
234  case OMF_init: {
235  // Assume, the result of the init method has the same dynamic type as
236  // the receiver and propagate the dynamic type info.
237  const MemRegion *RecReg = Msg->getReceiverSVal().getAsRegion();
238  if (!RecReg)
239  return;
240  DynamicTypeInfo RecDynType = getDynamicTypeInfo(State, RecReg);
241  C.addTransition(setDynamicTypeInfo(State, RetReg, RecDynType));
242  break;
243  }
244  }
245  }
246  return;
247  }
248 
249  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
250  // We may need to undo the effects of our pre-call check.
251  switch (Ctor->getOriginExpr()->getConstructionKind()) {
254  // No additional work necessary.
255  // Note: This will leave behind the actual type of the object for
256  // complete constructors, but arguably that's a good thing, since it
257  // means the dynamic type info will be correct even for objects
258  // constructed with operator new.
259  return;
262  if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion()) {
263  // We just finished a base constructor. Now we can use the subclass's
264  // type when resolving virtual calls.
265  const LocationContext *LCtx = C.getLocationContext();
266 
267  // FIXME: In C++17 classes with non-virtual bases may be treated as
268  // aggregates, and in such case no top-frame constructor will be called.
269  // Figure out if we need to do anything in this case.
270  // FIXME: Instead of relying on the ParentMap, we should have the
271  // trigger-statement (InitListExpr in this case) available in this
272  // callback, ideally as part of CallEvent.
273  if (dyn_cast_or_null<InitListExpr>(
274  LCtx->getParentMap().getParent(Ctor->getOriginExpr())))
275  return;
276 
277  recordFixedType(Target, cast<CXXConstructorDecl>(LCtx->getDecl()), C);
278  }
279  return;
280  }
281  }
282 }
283 
284 /// TODO: Handle explicit casts.
285 /// Handle C++ casts.
286 ///
287 /// Precondition: the cast is between ObjCObjectPointers.
288 ExplodedNode *DynamicTypePropagation::dynamicTypePropagationOnCasts(
289  const CastExpr *CE, ProgramStateRef &State, CheckerContext &C) const {
290  // We only track type info for regions.
291  const MemRegion *ToR = C.getSVal(CE).getAsRegion();
292  if (!ToR)
293  return C.getPredecessor();
294 
295  if (isa<ExplicitCastExpr>(CE))
296  return C.getPredecessor();
297 
298  if (const Type *NewTy = getBetterObjCType(CE, C)) {
299  State = setDynamicTypeInfo(State, ToR, QualType(NewTy, 0));
300  return C.addTransition(State);
301  }
302  return C.getPredecessor();
303 }
304 
305 void DynamicTypePropagation::checkPostStmt(const CXXNewExpr *NewE,
306  CheckerContext &C) const {
307  if (NewE->isArray())
308  return;
309 
310  // We only track dynamic type info for regions.
311  const MemRegion *MR = C.getSVal(NewE).getAsRegion();
312  if (!MR)
313  return;
314 
315  C.addTransition(setDynamicTypeInfo(C.getState(), MR, NewE->getType(),
316  /*CanBeSubclass=*/false));
317 }
318 
319 const ObjCObjectType *
320 DynamicTypePropagation::getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
321  CheckerContext &C) const {
322  if (MsgE->getReceiverKind() == ObjCMessageExpr::Class) {
323  if (const ObjCObjectType *ObjTy
324  = MsgE->getClassReceiver()->getAs<ObjCObjectType>())
325  return ObjTy;
326  }
327 
329  if (const ObjCObjectType *ObjTy
330  = MsgE->getSuperType()->getAs<ObjCObjectType>())
331  return ObjTy;
332  }
333 
334  const Expr *RecE = MsgE->getInstanceReceiver();
335  if (!RecE)
336  return nullptr;
337 
338  RecE= RecE->IgnoreParenImpCasts();
339  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(RecE)) {
340  const StackFrameContext *SFCtx = C.getStackFrame();
341  // Are we calling [self alloc]? If this is self, get the type of the
342  // enclosing ObjC class.
343  if (DRE->getDecl() == SFCtx->getSelfDecl()) {
344  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(SFCtx->getDecl()))
345  if (const ObjCObjectType *ObjTy =
346  dyn_cast<ObjCObjectType>(MD->getClassInterface()->getTypeForDecl()))
347  return ObjTy;
348  }
349  }
350  return nullptr;
351 }
352 
353 // Return a better dynamic type if one can be derived from the cast.
354 // Compare the current dynamic type of the region and the new type to which we
355 // are casting. If the new type is lower in the inheritance hierarchy, pick it.
356 const ObjCObjectPointerType *
357 DynamicTypePropagation::getBetterObjCType(const Expr *CastE,
358  CheckerContext &C) const {
359  const MemRegion *ToR = C.getSVal(CastE).getAsRegion();
360  assert(ToR);
361 
362  // Get the old and new types.
363  const ObjCObjectPointerType *NewTy =
364  CastE->getType()->getAs<ObjCObjectPointerType>();
365  if (!NewTy)
366  return nullptr;
367  QualType OldDTy = getDynamicTypeInfo(C.getState(), ToR).getType();
368  if (OldDTy.isNull()) {
369  return NewTy;
370  }
371  const ObjCObjectPointerType *OldTy =
372  OldDTy->getAs<ObjCObjectPointerType>();
373  if (!OldTy)
374  return nullptr;
375 
376  // Id the old type is 'id', the new one is more precise.
377  if (OldTy->isObjCIdType() && !NewTy->isObjCIdType())
378  return NewTy;
379 
380  // Return new if it's a subclass of old.
381  const ObjCInterfaceDecl *ToI = NewTy->getInterfaceDecl();
382  const ObjCInterfaceDecl *FromI = OldTy->getInterfaceDecl();
383  if (ToI && FromI && FromI->isSuperClassOf(ToI))
384  return NewTy;
385 
386  return nullptr;
387 }
388 
390  const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
391  const ObjCObjectPointerType *MostInformativeCandidate, ASTContext &C) {
392  // Checking if from and to are the same classes modulo specialization.
393  if (From->getInterfaceDecl()->getCanonicalDecl() ==
395  if (To->isSpecialized()) {
396  assert(MostInformativeCandidate->isSpecialized());
397  return MostInformativeCandidate;
398  }
399  return From;
400  }
401 
402  if (To->getObjectType()->getSuperClassType().isNull()) {
403  // If To has no super class and From and To aren't the same then
404  // To was not actually a descendent of From. In this case the best we can
405  // do is 'From'.
406  return From;
407  }
408 
409  const auto *SuperOfTo =
411  assert(SuperOfTo);
412  QualType SuperPtrOfToQual =
413  C.getObjCObjectPointerType(QualType(SuperOfTo, 0));
414  const auto *SuperPtrOfTo = SuperPtrOfToQual->getAs<ObjCObjectPointerType>();
415  if (To->isUnspecialized())
416  return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo, SuperPtrOfTo,
417  C);
418  else
419  return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo,
420  MostInformativeCandidate, C);
421 }
422 
423 /// A downcast may loose specialization information. E. g.:
424 /// MutableMap<T, U> : Map
425 /// The downcast to MutableMap looses the information about the types of the
426 /// Map (due to the type parameters are not being forwarded to Map), and in
427 /// general there is no way to recover that information from the
428 /// declaration. In order to have to most information, lets find the most
429 /// derived type that has all the type parameters forwarded.
430 ///
431 /// Get the a subclass of \p From (which has a lower bound \p To) that do not
432 /// loose information about type parameters. \p To has to be a subclass of
433 /// \p From. From has to be specialized.
434 static const ObjCObjectPointerType *
436  const ObjCObjectPointerType *To, ASTContext &C) {
437  return getMostInformativeDerivedClassImpl(From, To, To, C);
438 }
439 
440 /// Inputs:
441 /// \param StaticLowerBound Static lower bound for a symbol. The dynamic lower
442 /// bound might be the subclass of this type.
443 /// \param StaticUpperBound A static upper bound for a symbol.
444 /// \p StaticLowerBound expected to be the subclass of \p StaticUpperBound.
445 /// \param Current The type that was inferred for a symbol in a previous
446 /// context. Might be null when this is the first time that inference happens.
447 /// Precondition:
448 /// \p StaticLowerBound or \p StaticUpperBound is specialized. If \p Current
449 /// is not null, it is specialized.
450 /// Possible cases:
451 /// (1) The \p Current is null and \p StaticLowerBound <: \p StaticUpperBound
452 /// (2) \p StaticLowerBound <: \p Current <: \p StaticUpperBound
453 /// (3) \p Current <: \p StaticLowerBound <: \p StaticUpperBound
454 /// (4) \p StaticLowerBound <: \p StaticUpperBound <: \p Current
455 /// Effect:
456 /// Use getMostInformativeDerivedClass with the upper and lower bound of the
457 /// set {\p StaticLowerBound, \p Current, \p StaticUpperBound}. The computed
458 /// lower bound must be specialized. If the result differs from \p Current or
459 /// \p Current is null, store the result.
460 static bool
462  const ObjCObjectPointerType *const *Current,
463  const ObjCObjectPointerType *StaticLowerBound,
464  const ObjCObjectPointerType *StaticUpperBound,
465  ASTContext &C) {
466  // TODO: The above 4 cases are not exhaustive. In particular, it is possible
467  // for Current to be incomparable with StaticLowerBound, StaticUpperBound,
468  // or both.
469  //
470  // For example, suppose Foo<T> and Bar<T> are unrelated types.
471  //
472  // Foo<T> *f = ...
473  // Bar<T> *b = ...
474  //
475  // id t1 = b;
476  // f = t1;
477  // id t2 = f; // StaticLowerBound is Foo<T>, Current is Bar<T>
478  //
479  // We should either constrain the callers of this function so that the stated
480  // preconditions hold (and assert it) or rewrite the function to expicitly
481  // handle the additional cases.
482 
483  // Precondition
484  assert(StaticUpperBound->isSpecialized() ||
485  StaticLowerBound->isSpecialized());
486  assert(!Current || (*Current)->isSpecialized());
487 
488  // Case (1)
489  if (!Current) {
490  if (StaticUpperBound->isUnspecialized()) {
491  State = State->set<MostSpecializedTypeArgsMap>(Sym, StaticLowerBound);
492  return true;
493  }
494  // Upper bound is specialized.
495  const ObjCObjectPointerType *WithMostInfo =
496  getMostInformativeDerivedClass(StaticUpperBound, StaticLowerBound, C);
497  State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
498  return true;
499  }
500 
501  // Case (3)
502  if (C.canAssignObjCInterfaces(StaticLowerBound, *Current)) {
503  return false;
504  }
505 
506  // Case (4)
507  if (C.canAssignObjCInterfaces(*Current, StaticUpperBound)) {
508  // The type arguments might not be forwarded at any point of inheritance.
509  const ObjCObjectPointerType *WithMostInfo =
510  getMostInformativeDerivedClass(*Current, StaticUpperBound, C);
511  WithMostInfo =
512  getMostInformativeDerivedClass(WithMostInfo, StaticLowerBound, C);
513  if (WithMostInfo == *Current)
514  return false;
515  State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
516  return true;
517  }
518 
519  // Case (2)
520  const ObjCObjectPointerType *WithMostInfo =
521  getMostInformativeDerivedClass(*Current, StaticLowerBound, C);
522  if (WithMostInfo != *Current) {
523  State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
524  return true;
525  }
526 
527  return false;
528 }
529 
530 /// Type inference based on static type information that is available for the
531 /// cast and the tracked type information for the given symbol. When the tracked
532 /// symbol and the destination type of the cast are unrelated, report an error.
533 void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
534  CheckerContext &C) const {
535  if (CE->getCastKind() != CK_BitCast)
536  return;
537 
538  QualType OriginType = CE->getSubExpr()->getType();
539  QualType DestType = CE->getType();
540 
541  const auto *OrigObjectPtrType = OriginType->getAs<ObjCObjectPointerType>();
542  const auto *DestObjectPtrType = DestType->getAs<ObjCObjectPointerType>();
543 
544  if (!OrigObjectPtrType || !DestObjectPtrType)
545  return;
546 
547  ProgramStateRef State = C.getState();
548  ExplodedNode *AfterTypeProp = dynamicTypePropagationOnCasts(CE, State, C);
549 
550  ASTContext &ASTCtxt = C.getASTContext();
551 
552  // This checker detects the subtyping relationships using the assignment
553  // rules. In order to be able to do this the kindofness must be stripped
554  // first. The checker treats every type as kindof type anyways: when the
555  // tracked type is the subtype of the static type it tries to look up the
556  // methods in the tracked type first.
557  OrigObjectPtrType = OrigObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
558  DestObjectPtrType = DestObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
559 
560  if (OrigObjectPtrType->isUnspecialized() &&
561  DestObjectPtrType->isUnspecialized())
562  return;
563 
564  SymbolRef Sym = C.getSVal(CE).getAsSymbol();
565  if (!Sym)
566  return;
567 
568  const ObjCObjectPointerType *const *TrackedType =
569  State->get<MostSpecializedTypeArgsMap>(Sym);
570 
571  if (isa<ExplicitCastExpr>(CE)) {
572  // Treat explicit casts as an indication from the programmer that the
573  // Objective-C type system is not rich enough to express the needed
574  // invariant. In such cases, forget any existing information inferred
575  // about the type arguments. We don't assume the casted-to specialized
576  // type here because the invariant the programmer specifies in the cast
577  // may only hold at this particular program point and not later ones.
578  // We don't want a suppressing cast to require a cascade of casts down the
579  // line.
580  if (TrackedType) {
581  State = State->remove<MostSpecializedTypeArgsMap>(Sym);
582  C.addTransition(State, AfterTypeProp);
583  }
584  return;
585  }
586 
587  // Check which assignments are legal.
588  bool OrigToDest =
589  ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, OrigObjectPtrType);
590  bool DestToOrig =
591  ASTCtxt.canAssignObjCInterfaces(OrigObjectPtrType, DestObjectPtrType);
592 
593  // The tracked type should be the sub or super class of the static destination
594  // type. When an (implicit) upcast or a downcast happens according to static
595  // types, and there is no subtyping relationship between the tracked and the
596  // static destination types, it indicates an error.
597  if (TrackedType &&
598  !ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, *TrackedType) &&
599  !ASTCtxt.canAssignObjCInterfaces(*TrackedType, DestObjectPtrType)) {
600  static CheckerProgramPointTag IllegalConv(this, "IllegalConversion");
601  ExplodedNode *N = C.addTransition(State, AfterTypeProp, &IllegalConv);
602  reportGenericsBug(*TrackedType, DestObjectPtrType, N, Sym, C);
603  return;
604  }
605 
606  // Handle downcasts and upcasts.
607 
608  const ObjCObjectPointerType *LowerBound = DestObjectPtrType;
609  const ObjCObjectPointerType *UpperBound = OrigObjectPtrType;
610  if (OrigToDest && !DestToOrig)
611  std::swap(LowerBound, UpperBound);
612 
613  // The id type is not a real bound. Eliminate it.
614  LowerBound = LowerBound->isObjCIdType() ? UpperBound : LowerBound;
615  UpperBound = UpperBound->isObjCIdType() ? LowerBound : UpperBound;
616 
617  if (storeWhenMoreInformative(State, Sym, TrackedType, LowerBound, UpperBound,
618  ASTCtxt)) {
619  C.addTransition(State, AfterTypeProp);
620  }
621 }
622 
623 static const Expr *stripCastsAndSugar(const Expr *E) {
624  E = E->IgnoreParenImpCasts();
625  if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(E))
626  E = POE->getSyntacticForm()->IgnoreParenImpCasts();
627  if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E))
628  E = OVE->getSourceExpr()->IgnoreParenImpCasts();
629  return E;
630 }
631 
633  // It is illegal to typedef parameterized types inside an interface. Therefore
634  // an Objective-C type can only be dependent on a type parameter when the type
635  // parameter structurally present in the type itself.
636  class IsObjCTypeParamDependentTypeVisitor
637  : public RecursiveASTVisitor<IsObjCTypeParamDependentTypeVisitor> {
638  public:
639  IsObjCTypeParamDependentTypeVisitor() : Result(false) {}
640  bool VisitObjCTypeParamType(const ObjCTypeParamType *Type) {
641  if (isa<ObjCTypeParamDecl>(Type->getDecl())) {
642  Result = true;
643  return false;
644  }
645  return true;
646  }
647 
648  bool Result;
649  };
650 
651  IsObjCTypeParamDependentTypeVisitor Visitor;
652  Visitor.TraverseType(Type);
653  return Visitor.Result;
654 }
655 
656 /// A method might not be available in the interface indicated by the static
657 /// type. However it might be available in the tracked type. In order to
658 /// properly substitute the type parameters we need the declaration context of
659 /// the method. The more specialized the enclosing class of the method is, the
660 /// more likely that the parameter substitution will be successful.
661 static const ObjCMethodDecl *
662 findMethodDecl(const ObjCMessageExpr *MessageExpr,
663  const ObjCObjectPointerType *TrackedType, ASTContext &ASTCtxt) {
664  const ObjCMethodDecl *Method = nullptr;
665 
666  QualType ReceiverType = MessageExpr->getReceiverType();
667  const auto *ReceiverObjectPtrType =
668  ReceiverType->getAs<ObjCObjectPointerType>();
669 
670  // Do this "devirtualization" on instance and class methods only. Trust the
671  // static type on super and super class calls.
672  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Instance ||
673  MessageExpr->getReceiverKind() == ObjCMessageExpr::Class) {
674  // When the receiver type is id, Class, or some super class of the tracked
675  // type, look up the method in the tracked type, not in the receiver type.
676  // This way we preserve more information.
677  if (ReceiverType->isObjCIdType() || ReceiverType->isObjCClassType() ||
678  ASTCtxt.canAssignObjCInterfaces(ReceiverObjectPtrType, TrackedType)) {
679  const ObjCInterfaceDecl *InterfaceDecl = TrackedType->getInterfaceDecl();
680  // The method might not be found.
681  Selector Sel = MessageExpr->getSelector();
682  Method = InterfaceDecl->lookupInstanceMethod(Sel);
683  if (!Method)
684  Method = InterfaceDecl->lookupClassMethod(Sel);
685  }
686  }
687 
688  // Fallback to statick method lookup when the one based on the tracked type
689  // failed.
690  return Method ? Method : MessageExpr->getMethodDecl();
691 }
692 
693 /// Get the returned ObjCObjectPointerType by a method based on the tracked type
694 /// information, or null pointer when the returned type is not an
695 /// ObjCObjectPointerType.
697  const ObjCMethodDecl *Method, ArrayRef<QualType> TypeArgs,
698  const ObjCObjectPointerType *SelfType, ASTContext &C) {
699  QualType StaticResultType = Method->getReturnType();
700 
701  // Is the return type declared as instance type?
702  if (StaticResultType == C.getObjCInstanceType())
703  return QualType(SelfType, 0);
704 
705  // Check whether the result type depends on a type parameter.
706  if (!isObjCTypeParamDependent(StaticResultType))
707  return QualType();
708 
709  QualType ResultType = StaticResultType.substObjCTypeArgs(
710  C, TypeArgs, ObjCSubstitutionContext::Result);
711 
712  return ResultType;
713 }
714 
715 /// When the receiver has a tracked type, use that type to validate the
716 /// argumments of the message expression and the return value.
717 void DynamicTypePropagation::checkPreObjCMessage(const ObjCMethodCall &M,
718  CheckerContext &C) const {
719  ProgramStateRef State = C.getState();
720  SymbolRef Sym = M.getReceiverSVal().getAsSymbol();
721  if (!Sym)
722  return;
723 
724  const ObjCObjectPointerType *const *TrackedType =
725  State->get<MostSpecializedTypeArgsMap>(Sym);
726  if (!TrackedType)
727  return;
728 
729  // Get the type arguments from tracked type and substitute type arguments
730  // before do the semantic check.
731 
732  ASTContext &ASTCtxt = C.getASTContext();
733  const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
734  const ObjCMethodDecl *Method =
735  findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
736 
737  // It is possible to call non-existent methods in Obj-C.
738  if (!Method)
739  return;
740 
741  // If the method is declared on a class that has a non-invariant
742  // type parameter, don't warn about parameter mismatches after performing
743  // substitution. This prevents warning when the programmer has purposely
744  // casted the receiver to a super type or unspecialized type but the analyzer
745  // has a more precise tracked type than the programmer intends at the call
746  // site.
747  //
748  // For example, consider NSArray (which has a covariant type parameter)
749  // and NSMutableArray (a subclass of NSArray where the type parameter is
750  // invariant):
751  // NSMutableArray *a = [[NSMutableArray<NSString *> alloc] init;
752  //
753  // [a containsObject:number]; // Safe: -containsObject is defined on NSArray.
754  // NSArray<NSObject *> *other = [a arrayByAddingObject:number] // Safe
755  //
756  // [a addObject:number] // Unsafe: -addObject: is defined on NSMutableArray
757  //
758 
759  const ObjCInterfaceDecl *Interface = Method->getClassInterface();
760  if (!Interface)
761  return;
762 
763  ObjCTypeParamList *TypeParams = Interface->getTypeParamList();
764  if (!TypeParams)
765  return;
766 
767  for (ObjCTypeParamDecl *TypeParam : *TypeParams) {
768  if (TypeParam->getVariance() != ObjCTypeParamVariance::Invariant)
769  return;
770  }
771 
772  Optional<ArrayRef<QualType>> TypeArgs =
773  (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
774  // This case might happen when there is an unspecialized override of a
775  // specialized method.
776  if (!TypeArgs)
777  return;
778 
779  for (unsigned i = 0; i < Method->param_size(); i++) {
780  const Expr *Arg = MessageExpr->getArg(i);
781  const ParmVarDecl *Param = Method->parameters()[i];
782 
783  QualType OrigParamType = Param->getType();
784  if (!isObjCTypeParamDependent(OrigParamType))
785  continue;
786 
787  QualType ParamType = OrigParamType.substObjCTypeArgs(
788  ASTCtxt, *TypeArgs, ObjCSubstitutionContext::Parameter);
789  // Check if it can be assigned
790  const auto *ParamObjectPtrType = ParamType->getAs<ObjCObjectPointerType>();
791  const auto *ArgObjectPtrType =
793  if (!ParamObjectPtrType || !ArgObjectPtrType)
794  continue;
795 
796  // Check if we have more concrete tracked type that is not a super type of
797  // the static argument type.
798  SVal ArgSVal = M.getArgSVal(i);
799  SymbolRef ArgSym = ArgSVal.getAsSymbol();
800  if (ArgSym) {
801  const ObjCObjectPointerType *const *TrackedArgType =
802  State->get<MostSpecializedTypeArgsMap>(ArgSym);
803  if (TrackedArgType &&
804  ASTCtxt.canAssignObjCInterfaces(ArgObjectPtrType, *TrackedArgType)) {
805  ArgObjectPtrType = *TrackedArgType;
806  }
807  }
808 
809  // Warn when argument is incompatible with the parameter.
810  if (!ASTCtxt.canAssignObjCInterfaces(ParamObjectPtrType,
811  ArgObjectPtrType)) {
812  static CheckerProgramPointTag Tag(this, "ArgTypeMismatch");
813  ExplodedNode *N = C.addTransition(State, &Tag);
814  reportGenericsBug(ArgObjectPtrType, ParamObjectPtrType, N, Sym, C, Arg);
815  return;
816  }
817  }
818 }
819 
820 /// This callback is used to infer the types for Class variables. This info is
821 /// used later to validate messages that sent to classes. Class variables are
822 /// initialized with by invoking the 'class' method on a class.
823 /// This method is also used to infer the type information for the return
824 /// types.
825 // TODO: right now it only tracks generic types. Extend this to track every
826 // type in the DynamicTypeMap and diagnose type errors!
827 void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
828  CheckerContext &C) const {
829  const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
830 
831  SymbolRef RetSym = M.getReturnValue().getAsSymbol();
832  if (!RetSym)
833  return;
834 
835  Selector Sel = MessageExpr->getSelector();
836  ProgramStateRef State = C.getState();
837  // Inference for class variables.
838  // We are only interested in cases where the class method is invoked on a
839  // class. This method is provided by the runtime and available on all classes.
840  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Class &&
841  Sel.getAsString() == "class") {
842  QualType ReceiverType = MessageExpr->getClassReceiver();
843  const auto *ReceiverClassType = ReceiverType->getAs<ObjCObjectType>();
844  QualType ReceiverClassPointerType =
845  C.getASTContext().getObjCObjectPointerType(
846  QualType(ReceiverClassType, 0));
847 
848  if (!ReceiverClassType->isSpecialized())
849  return;
850  const auto *InferredType =
851  ReceiverClassPointerType->getAs<ObjCObjectPointerType>();
852  assert(InferredType);
853 
854  State = State->set<MostSpecializedTypeArgsMap>(RetSym, InferredType);
855  C.addTransition(State);
856  return;
857  }
858 
859  // Tracking for return types.
860  SymbolRef RecSym = M.getReceiverSVal().getAsSymbol();
861  if (!RecSym)
862  return;
863 
864  const ObjCObjectPointerType *const *TrackedType =
865  State->get<MostSpecializedTypeArgsMap>(RecSym);
866  if (!TrackedType)
867  return;
868 
869  ASTContext &ASTCtxt = C.getASTContext();
870  const ObjCMethodDecl *Method =
871  findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
872  if (!Method)
873  return;
874 
875  Optional<ArrayRef<QualType>> TypeArgs =
876  (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
877  if (!TypeArgs)
878  return;
879 
880  QualType ResultType =
881  getReturnTypeForMethod(Method, *TypeArgs, *TrackedType, ASTCtxt);
882  // The static type is the same as the deduced type.
883  if (ResultType.isNull())
884  return;
885 
886  const MemRegion *RetRegion = M.getReturnValue().getAsRegion();
887  ExplodedNode *Pred = C.getPredecessor();
888  // When there is an entry available for the return symbol in DynamicTypeMap,
889  // the call was inlined, and the information in the DynamicTypeMap is should
890  // be precise.
891  if (RetRegion && !State->get<DynamicTypeMap>(RetRegion)) {
892  // TODO: we have duplicated information in DynamicTypeMap and
893  // MostSpecializedTypeArgsMap. We should only store anything in the later if
894  // the stored data differs from the one stored in the former.
895  State = setDynamicTypeInfo(State, RetRegion, ResultType,
896  /*CanBeSubclass=*/true);
897  Pred = C.addTransition(State);
898  }
899 
900  const auto *ResultPtrType = ResultType->getAs<ObjCObjectPointerType>();
901 
902  if (!ResultPtrType || ResultPtrType->isUnspecialized())
903  return;
904 
905  // When the result is a specialized type and it is not tracked yet, track it
906  // for the result symbol.
907  if (!State->get<MostSpecializedTypeArgsMap>(RetSym)) {
908  State = State->set<MostSpecializedTypeArgsMap>(RetSym, ResultPtrType);
909  C.addTransition(State, Pred);
910  }
911 }
912 
913 void DynamicTypePropagation::reportGenericsBug(
914  const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
915  ExplodedNode *N, SymbolRef Sym, CheckerContext &C,
916  const Stmt *ReportedNode) const {
917  if (!CheckGenerics)
918  return;
919 
920  initBugType();
921  SmallString<192> Buf;
922  llvm::raw_svector_ostream OS(Buf);
923  OS << "Conversion from value of type '";
924  QualType::print(From, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
925  OS << "' to incompatible type '";
926  QualType::print(To, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
927  OS << "'";
928  std::unique_ptr<BugReport> R(
929  new BugReport(*ObjCGenericsBugType, OS.str(), N));
930  R->markInteresting(Sym);
931  R->addVisitor(llvm::make_unique<GenericsBugVisitor>(Sym));
932  if (ReportedNode)
933  R->addRange(ReportedNode->getSourceRange());
934  C.emitReport(std::move(R));
935 }
936 
937 std::shared_ptr<PathDiagnosticPiece>
938 DynamicTypePropagation::GenericsBugVisitor::VisitNode(const ExplodedNode *N,
939  BugReporterContext &BRC,
940  BugReport &BR) {
941  ProgramStateRef state = N->getState();
942  ProgramStateRef statePrev = N->getFirstPred()->getState();
943 
944  const ObjCObjectPointerType *const *TrackedType =
945  state->get<MostSpecializedTypeArgsMap>(Sym);
946  const ObjCObjectPointerType *const *TrackedTypePrev =
947  statePrev->get<MostSpecializedTypeArgsMap>(Sym);
948  if (!TrackedType)
949  return nullptr;
950 
951  if (TrackedTypePrev && *TrackedTypePrev == *TrackedType)
952  return nullptr;
953 
954  // Retrieve the associated statement.
956  if (!S)
957  return nullptr;
958 
959  const LangOptions &LangOpts = BRC.getASTContext().getLangOpts();
960 
961  SmallString<256> Buf;
962  llvm::raw_svector_ostream OS(Buf);
963  OS << "Type '";
964  QualType::print(*TrackedType, Qualifiers(), OS, LangOpts, llvm::Twine());
965  OS << "' is inferred from ";
966 
967  if (const auto *ExplicitCast = dyn_cast<ExplicitCastExpr>(S)) {
968  OS << "explicit cast (from '";
969  QualType::print(ExplicitCast->getSubExpr()->getType().getTypePtr(),
970  Qualifiers(), OS, LangOpts, llvm::Twine());
971  OS << "' to '";
972  QualType::print(ExplicitCast->getType().getTypePtr(), Qualifiers(), OS,
973  LangOpts, llvm::Twine());
974  OS << "')";
975  } else if (const auto *ImplicitCast = dyn_cast<ImplicitCastExpr>(S)) {
976  OS << "implicit cast (from '";
977  QualType::print(ImplicitCast->getSubExpr()->getType().getTypePtr(),
978  Qualifiers(), OS, LangOpts, llvm::Twine());
979  OS << "' to '";
980  QualType::print(ImplicitCast->getType().getTypePtr(), Qualifiers(), OS,
981  LangOpts, llvm::Twine());
982  OS << "')";
983  } else {
984  OS << "this context";
985  }
986 
987  // Generate the extra diagnostic.
988  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
989  N->getLocationContext());
990  return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true,
991  nullptr);
992 }
993 
994 /// Register checkers.
995 void ento::registerObjCGenericsChecker(CheckerManager &mgr) {
996  DynamicTypePropagation *checker =
997  mgr.registerChecker<DynamicTypePropagation>();
998  checker->CheckGenerics = true;
999 }
1000 
1001 void ento::registerDynamicTypePropagation(CheckerManager &mgr) {
1002  mgr.registerChecker<DynamicTypePropagation>();
1003 }
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:959
const char *const CoreFoundationObjectiveC
The receiver is an object instance.
Definition: ExprObjC.h:1055
Smart pointer class that efficiently represents Objective-C method names.
A (possibly-)qualified type.
Definition: Type.h:642
QualType substObjCTypeArgs(ASTContext &ctx, ArrayRef< QualType > typeArgs, ObjCSubstitutionContext context) const
Substitute type arguments for the Objective-C type parameters used in the subject type...
Definition: Type.cpp:1131
unsigned param_size() const
Definition: DeclObjC.h:341
Selector getSelector() const
Definition: ExprObjC.cpp:312
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1144
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine(), unsigned Indentation=0) const
Definition: Type.h:985
const SymExpr * SymbolRef
Stmt - This represents one statement.
Definition: Stmt.h:66
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
ObjCTypeParamList * getTypeParamList() const
Retrieve the type parameters of this class.
Definition: DeclObjC.cpp:308
The base class of the type hierarchy.
Definition: Type.h:1415
Stmt * getParent(Stmt *) const
Definition: ParentMap.cpp:123
bool isUnspecialized() const
Whether this type is unspecialized, meaning that is has no type arguments.
Definition: Type.h:5881
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6716
static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD, CheckerContext &C)
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
Represents a parameter to a function.
Definition: Decl.h:1551
The collection of all-type qualifiers we support.
Definition: Type.h:141
static const ObjCMethodDecl * findMethodDecl(const ObjCMessageExpr *MessageExpr, const ObjCObjectPointerType *TrackedType, ASTContext &ASTCtxt)
A method might not be available in the interface indicated by the static type.
Represents a class type in Objective C.
Definition: Type.h:5524
ObjCMethodDecl * lookupInstanceMethod(Selector Sel) const
Lookup an instance method for a given selector.
Definition: DeclObjC.h:1839
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
LineState State
bool isObjCIdType() const
Definition: Type.h:6408
bool isSpecialized() const
Whether this type is specialized, meaning that it has type arguments.
Definition: Type.h:5873
Expr * getSubExpr()
Definition: Expr.h:2968
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:50
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const ObjCObjectPointerType * stripObjCKindOfTypeAndQuals(const ASTContext &ctx) const
Strip off the Objective-C "kindof" type and (with it) any protocol qualifiers.
Definition: Type.cpp:709
static bool isObjCTypeParamDependent(QualType Type)
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:970
const ImplicitParamDecl * getSelfDecl() const
static QualType getReturnTypeForMethod(const ObjCMethodDecl *Method, ArrayRef< QualType > TypeArgs, const ObjCObjectPointerType *SelfType, ASTContext &C)
Get the returned ObjCObjectPointerType by a method based on the tracked type information, or null pointer when the returned type is not an ObjCObjectPointerType.
ObjCMethodDecl * lookupClassMethod(Selector Sel) const
Lookup a class method for a given selector.
Definition: DeclObjC.h:1844
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:2903
A class that does preorder or postorder depth-first traversal on the entire Clang AST and visits each...
Represents an ObjC class declaration.
Definition: DeclObjC.h:1164
QualType getReturnType() const
Definition: DeclObjC.h:323
llvm::ImmutableMap< const MemRegion *, DynamicTypeInfo > DynamicTypeMapImpl
ObjCTypeParamDecl * getDecl() const
Definition: Type.h:5493
This represents one expression.
Definition: Expr.h:106
static bool storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym, const ObjCObjectPointerType *const *Current, const ObjCObjectPointerType *StaticLowerBound, const ObjCObjectPointerType *StaticUpperBound, ASTContext &C)
Inputs:
Represents an implicit call to a C++ destructor.
Definition: CallEvent.h:800
bool hasRelatedResultType() const
Determine whether this method has a result type that is related to the message receiver&#39;s type...
Definition: DeclObjC.h:257
bool isObjCClassType() const
Definition: Type.h:6414
DeclContext * getDeclContext()
Definition: DeclBase.h:427
bool isObjCIdType() const
True if this is equivalent to the &#39;id&#39; type, i.e.
Definition: Type.h:5842
QualType getType() const
Definition: Expr.h:128
ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg, DynamicTypeInfo NewTy)
Set dynamic type information of the region; return the new state.
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:904
QualType getRecordType(const RecordDecl *Decl) const
ReceiverKind getReceiverKind() const
Determine the kind of receiver that this message is being sent to.
Definition: ExprObjC.h:1188
The result type of a method or function.
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:707
ParentMap & getParentMap() const
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: ExprObjC.h:1342
static const Stmt * getStmt(const ExplodedNode *N)
Given an exploded node, retrieve the statement that should be used for the diagnostic location...
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class...
Definition: Expr.h:939
std::string getAsString() const
Derive the full selector name (e.g.
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:5218
CastKind getCastKind() const
Definition: Expr.h:2962
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:1870
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2041
bool isArray() const
Definition: ExprCXX.h:1975
QualType getReceiverType() const
Retrieve the receiver type to which this message is being directed.
Definition: ExprObjC.cpp:319
bool isSuperClassOf(const ObjCInterfaceDecl *I) const
isSuperClassOf - Return true if this class is the specified class or is a super class of the specifie...
Definition: DeclObjC.h:1802
QualType getSuperClassType() const
Retrieve the type of the superclass of this object type.
Definition: Type.h:5652
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1303
QualType getObjCInstanceType()
Retrieve the Objective-C "instancetype" type, if already known; otherwise, returns a NULL type;...
Definition: ASTContext.h:1729
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1207
static const ObjCObjectPointerType * getMostInformativeDerivedClassImpl(const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, const ObjCObjectPointerType *MostInformativeCandidate, ASTContext &C)
virtual const ObjCMessageExpr * getOriginExpr() const
Definition: CallEvent.h:994
Dataflow Directional Tag Classes.
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg)
Get dynamic type information for a region.
QualType getSuperType() const
Retrieve the type referred to by &#39;super&#39;.
Definition: ExprObjC.h:1283
Represents the declaration of an Objective-C type parameter.
Definition: DeclObjC.h:551
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2166
const ObjCObjectType * getObjectType() const
Gets the type pointed to by this ObjC pointer.
Definition: Type.h:5821
const Decl * getDecl() const
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
Definition: Expr.cpp:2677
QualType getClassReceiver() const
Returns the type of a class message send, or NULL if the message is not a class message.
Definition: ExprObjC.h:1226
Represents a pointer to an Objective C object.
Definition: Type.h:5780
REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef, const ObjCObjectPointerType *) namespace
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5836
const StackFrameContext * getStackFrame() const
ObjCInterfaceDecl * getCanonicalDecl() override
Retrieves the canonical declaration of this Objective-C class.
Definition: DeclObjC.h:1907
bool canAssignObjCInterfaces(const ObjCObjectPointerType *LHSOPT, const ObjCObjectPointerType *RHSOPT)
canAssignObjCInterfaces - Return true if the two interface types are compatible for assignment from R...
X
Add a minimal nested name specifier fixit hint to allow lookup of a tag name from an outer enclosing ...
Definition: SemaDecl.cpp:13853
Represents a type parameter type in Objective C.
Definition: Type.h:5450
static const ObjCObjectPointerType * getMostInformativeDerivedClass(const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, ASTContext &C)
A downcast may loose specialization information.
The parameter type of a method or function.
static const Expr * stripCastsAndSugar(const Expr *E)
Stores a list of Objective-C type parameters for a parameterized class or a category/extension thereo...
Definition: DeclObjC.h:629
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
The receiver is a class.
Definition: ExprObjC.h:1052
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:268
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:1036
QualType getType() const
Definition: Decl.h:647
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
The receiver is a superclass.
Definition: ExprObjC.h:1058
Represents a call to a C++ constructor.
Definition: CallEvent.h:849
The parameter is invariant: must match exactly.
Defines enum values for all the target-independent builtin functions.
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:367