clang  8.0.0svn
MemRegion.h
Go to the documentation of this file.
1 //==- MemRegion.h - Abstract memory regions for static analysis -*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines MemRegion and its subclasses. MemRegion defines a
11 // partially-typed abstraction of memory useful for path-sensitive dataflow
12 // analyses.
13 //
14 //===----------------------------------------------------------------------===//
15 
16 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
17 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
18 
19 #include "clang/AST/ASTContext.h"
20 #include "clang/AST/CharUnits.h"
21 #include "clang/AST/Decl.h"
22 #include "clang/AST/DeclObjC.h"
24 #include "clang/AST/Expr.h"
25 #include "clang/AST/ExprObjC.h"
26 #include "clang/AST/Type.h"
27 #include "clang/Basic/LLVM.h"
31 #include "llvm/ADT/DenseMap.h"
32 #include "llvm/ADT/FoldingSet.h"
33 #include "llvm/ADT/Optional.h"
34 #include "llvm/ADT/PointerIntPair.h"
35 #include "llvm/Support/Allocator.h"
36 #include "llvm/Support/Casting.h"
37 #include <cassert>
38 #include <cstdint>
39 #include <limits>
40 #include <string>
41 #include <utility>
42 
43 namespace clang {
44 
45 class AnalysisDeclContext;
46 class CXXRecordDecl;
47 class Decl;
48 class LocationContext;
49 class StackFrameContext;
50 
51 namespace ento {
52 
53 class CodeTextRegion;
54 class MemRegion;
55 class MemRegionManager;
56 class MemSpaceRegion;
57 class SValBuilder;
58 class SymbolicRegion;
59 class VarRegion;
60 
61 /// Represent a region's offset within the top level base region.
62 class RegionOffset {
63  /// The base region.
64  const MemRegion *R = nullptr;
65 
66  /// The bit offset within the base region. Can be negative.
67  int64_t Offset;
68 
69 public:
70  // We're using a const instead of an enumeration due to the size required;
71  // Visual Studio will only create enumerations of size int, not long long.
72  static const int64_t Symbolic = std::numeric_limits<int64_t>::max();
73 
74  RegionOffset() = default;
75  RegionOffset(const MemRegion *r, int64_t off) : R(r), Offset(off) {}
76 
77  const MemRegion *getRegion() const { return R; }
78 
79  bool hasSymbolicOffset() const { return Offset == Symbolic; }
80 
81  int64_t getOffset() const {
82  assert(!hasSymbolicOffset());
83  return Offset;
84  }
85 
86  bool isValid() const { return R; }
87 };
88 
89 //===----------------------------------------------------------------------===//
90 // Base region classes.
91 //===----------------------------------------------------------------------===//
92 
93 /// MemRegion - The root abstract class for all memory regions.
94 class MemRegion : public llvm::FoldingSetNode {
95 public:
96  enum Kind {
97 #define REGION(Id, Parent) Id ## Kind,
98 #define REGION_RANGE(Id, First, Last) BEGIN_##Id = First, END_##Id = Last,
99 #include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
100  };
101 
102 private:
103  const Kind kind;
104  mutable Optional<RegionOffset> cachedOffset;
105 
106 protected:
107  MemRegion(Kind k) : kind(k) {}
108  virtual ~MemRegion();
109 
110 public:
111  ASTContext &getContext() const;
112 
113  virtual void Profile(llvm::FoldingSetNodeID& ID) const = 0;
114 
115  virtual MemRegionManager* getMemRegionManager() const = 0;
116 
117  const MemSpaceRegion *getMemorySpace() const;
118 
119  const MemRegion *getBaseRegion() const;
120 
121  /// Recursively retrieve the region of the most derived class instance of
122  /// regions of C++ base class instances.
123  const MemRegion *getMostDerivedObjectRegion() const;
124 
125  /// Check if the region is a subregion of the given region.
126  /// Each region is a subregion of itself.
127  virtual bool isSubRegionOf(const MemRegion *R) const;
128 
129  const MemRegion *StripCasts(bool StripBaseAndDerivedCasts = true) const;
130 
131  /// If this is a symbolic region, returns the region. Otherwise,
132  /// goes up the base chain looking for the first symbolic base region.
133  const SymbolicRegion *getSymbolicBase() const;
134 
135  bool hasGlobalsOrParametersStorage() const;
136 
137  bool hasStackStorage() const;
138 
139  bool hasStackNonParametersStorage() const;
140 
141  bool hasStackParametersStorage() const;
142 
143  /// Compute the offset within the top level memory object.
144  RegionOffset getAsOffset() const;
145 
146  /// Get a string representation of a region for debug use.
147  std::string getString() const;
148 
149  virtual void dumpToStream(raw_ostream &os) const;
150 
151  void dump() const;
152 
153  /// Returns true if this region can be printed in a user-friendly way.
154  virtual bool canPrintPretty() const;
155 
156  /// Print the region for use in diagnostics.
157  virtual void printPretty(raw_ostream &os) const;
158 
159  /// Returns true if this region's textual representation can be used
160  /// as part of a larger expression.
161  virtual bool canPrintPrettyAsExpr() const;
162 
163  /// Print the region as expression.
164  ///
165  /// When this region represents a subexpression, the method is for printing
166  /// an expression containing it.
167  virtual void printPrettyAsExpr(raw_ostream &os) const;
168 
169  Kind getKind() const { return kind; }
170 
171  template<typename RegionTy> const RegionTy* getAs() const;
172 
173  virtual bool isBoundable() const { return false; }
174 
175  /// Get descriptive name for memory region. The name is obtained from
176  /// the variable/field declaration retrieved from the memory region.
177  /// Regions that point to an element of an array are returned as: "arr[0]".
178  /// Regions that point to a struct are returned as: "st.var".
179  //
180  /// \param UseQuotes Set if the name should be quoted.
181  ///
182  /// \returns variable name for memory region
183  std::string getDescriptiveName(bool UseQuotes = true) const;
184 
185  /// Retrieve source range from memory region. The range retrieval
186  /// is based on the decl obtained from the memory region.
187  /// For a VarRegion the range of the base region is returned.
188  /// For a FieldRegion the range of the field is returned.
189  /// If no declaration is found, an empty source range is returned.
190  /// The client is responsible for checking if the returned range is valid.
191  ///
192  /// \returns source range for declaration retrieved from memory region
193  SourceRange sourceRange() const;
194 };
195 
196 /// MemSpaceRegion - A memory region that represents a "memory space";
197 /// for example, the set of global variables, the stack frame, etc.
198 class MemSpaceRegion : public MemRegion {
199 protected:
201 
202  MemSpaceRegion(MemRegionManager *mgr, Kind k) : MemRegion(k), Mgr(mgr) {
203  assert(classof(this));
204  assert(mgr);
205  }
206 
207  MemRegionManager* getMemRegionManager() const override { return Mgr; }
208 
209 public:
210  bool isBoundable() const override { return false; }
211 
212  void Profile(llvm::FoldingSetNodeID &ID) const override;
213 
214  static bool classof(const MemRegion *R) {
215  Kind k = R->getKind();
216  return k >= BEGIN_MEMSPACES && k <= END_MEMSPACES;
217  }
218 };
219 
220 /// CodeSpaceRegion - The memory space that holds the executable code of
221 /// functions and blocks.
223  friend class MemRegionManager;
224 
226  : MemSpaceRegion(mgr, CodeSpaceRegionKind) {}
227 
228 public:
229  void dumpToStream(raw_ostream &os) const override;
230 
231  static bool classof(const MemRegion *R) {
232  return R->getKind() == CodeSpaceRegionKind;
233  }
234 };
235 
237  virtual void anchor();
238 
239 protected:
241  assert(classof(this));
242  }
243 
244 public:
245  static bool classof(const MemRegion *R) {
246  Kind k = R->getKind();
247  return k >= BEGIN_GLOBAL_MEMSPACES && k <= END_GLOBAL_MEMSPACES;
248  }
249 };
250 
251 /// The region of the static variables within the current CodeTextRegion
252 /// scope.
253 ///
254 /// Currently, only the static locals are placed there, so we know that these
255 /// variables do not get invalidated by calls to other functions.
257  friend class MemRegionManager;
258 
259  const CodeTextRegion *CR;
260 
262  : GlobalsSpaceRegion(mgr, StaticGlobalSpaceRegionKind), CR(cr) {
263  assert(cr);
264  }
265 
266 public:
267  void Profile(llvm::FoldingSetNodeID &ID) const override;
268 
269  void dumpToStream(raw_ostream &os) const override;
270 
271  const CodeTextRegion *getCodeRegion() const { return CR; }
272 
273  static bool classof(const MemRegion *R) {
274  return R->getKind() == StaticGlobalSpaceRegionKind;
275  }
276 };
277 
278 /// The region for all the non-static global variables.
279 ///
280 /// This class is further split into subclasses for efficient implementation of
281 /// invalidating a set of related global values as is done in
282 /// RegionStoreManager::invalidateRegions (instead of finding all the dependent
283 /// globals, we invalidate the whole parent region).
285  void anchor() override;
286 
287 protected:
289  : GlobalsSpaceRegion(mgr, k) {
290  assert(classof(this));
291  }
292 
293 public:
294  static bool classof(const MemRegion *R) {
295  Kind k = R->getKind();
296  return k >= BEGIN_NON_STATIC_GLOBAL_MEMSPACES &&
297  k <= END_NON_STATIC_GLOBAL_MEMSPACES;
298  }
299 };
300 
301 /// The region containing globals which are defined in system/external
302 /// headers and are considered modifiable by system calls (ex: errno).
304  friend class MemRegionManager;
305 
307  : NonStaticGlobalSpaceRegion(mgr, GlobalSystemSpaceRegionKind) {}
308 
309 public:
310  void dumpToStream(raw_ostream &os) const override;
311 
312  static bool classof(const MemRegion *R) {
313  return R->getKind() == GlobalSystemSpaceRegionKind;
314  }
315 };
316 
317 /// The region containing globals which are considered not to be modified
318 /// or point to data which could be modified as a result of a function call
319 /// (system or internal). Ex: Const global scalars would be modeled as part of
320 /// this region. This region also includes most system globals since they have
321 /// low chance of being modified.
323  friend class MemRegionManager;
324 
326  : NonStaticGlobalSpaceRegion(mgr, GlobalImmutableSpaceRegionKind) {}
327 
328 public:
329  void dumpToStream(raw_ostream &os) const override;
330 
331  static bool classof(const MemRegion *R) {
332  return R->getKind() == GlobalImmutableSpaceRegionKind;
333  }
334 };
335 
336 /// The region containing globals which can be modified by calls to
337 /// "internally" defined functions - (for now just) functions other then system
338 /// calls.
340  friend class MemRegionManager;
341 
343  : NonStaticGlobalSpaceRegion(mgr, GlobalInternalSpaceRegionKind) {}
344 
345 public:
346  void dumpToStream(raw_ostream &os) const override;
347 
348  static bool classof(const MemRegion *R) {
349  return R->getKind() == GlobalInternalSpaceRegionKind;
350  }
351 };
352 
354  friend class MemRegionManager;
355 
357  : MemSpaceRegion(mgr, HeapSpaceRegionKind) {}
358 
359 public:
360  void dumpToStream(raw_ostream &os) const override;
361 
362  static bool classof(const MemRegion *R) {
363  return R->getKind() == HeapSpaceRegionKind;
364  }
365 };
366 
368  friend class MemRegionManager;
369 
371  : MemSpaceRegion(mgr, UnknownSpaceRegionKind) {}
372 
373 public:
374  void dumpToStream(raw_ostream &os) const override;
375 
376  static bool classof(const MemRegion *R) {
377  return R->getKind() == UnknownSpaceRegionKind;
378  }
379 };
380 
382  virtual void anchor();
383 
384  const StackFrameContext *SFC;
385 
386 protected:
388  : MemSpaceRegion(mgr, k), SFC(sfc) {
389  assert(classof(this));
390  assert(sfc);
391  }
392 
393 public:
394  const StackFrameContext *getStackFrame() const { return SFC; }
395 
396  void Profile(llvm::FoldingSetNodeID &ID) const override;
397 
398  static bool classof(const MemRegion *R) {
399  Kind k = R->getKind();
400  return k >= BEGIN_STACK_MEMSPACES && k <= END_STACK_MEMSPACES;
401  }
402 };
403 
405  friend class MemRegionManager;
406 
408  : StackSpaceRegion(mgr, StackLocalsSpaceRegionKind, sfc) {}
409 
410 public:
411  void dumpToStream(raw_ostream &os) const override;
412 
413  static bool classof(const MemRegion *R) {
414  return R->getKind() == StackLocalsSpaceRegionKind;
415  }
416 };
417 
419 private:
420  friend class MemRegionManager;
421 
423  : StackSpaceRegion(mgr, StackArgumentsSpaceRegionKind, sfc) {}
424 
425 public:
426  void dumpToStream(raw_ostream &os) const override;
427 
428  static bool classof(const MemRegion *R) {
429  return R->getKind() == StackArgumentsSpaceRegionKind;
430  }
431 };
432 
433 /// SubRegion - A region that subsets another larger region. Most regions
434 /// are subclasses of SubRegion.
435 class SubRegion : public MemRegion {
436  virtual void anchor();
437 
438 protected:
440 
441  SubRegion(const MemRegion *sReg, Kind k) : MemRegion(k), superRegion(sReg) {
442  assert(classof(this));
443  assert(sReg);
444  }
445 
446 public:
447  const MemRegion* getSuperRegion() const {
448  return superRegion;
449  }
450 
451  /// getExtent - Returns the size of the region in bytes.
452  virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const {
453  return UnknownVal();
454  }
455 
456  MemRegionManager* getMemRegionManager() const override;
457 
458  bool isSubRegionOf(const MemRegion* R) const override;
459 
460  static bool classof(const MemRegion* R) {
461  return R->getKind() > END_MEMSPACES;
462  }
463 };
464 
465 //===----------------------------------------------------------------------===//
466 // MemRegion subclasses.
467 //===----------------------------------------------------------------------===//
468 
469 /// AllocaRegion - A region that represents an untyped blob of bytes created
470 /// by a call to 'alloca'.
471 class AllocaRegion : public SubRegion {
472  friend class MemRegionManager;
473 
474  // Block counter. Used to distinguish different pieces of memory allocated by
475  // alloca at the same call site.
476  unsigned Cnt;
477 
478  const Expr *Ex;
479 
480  AllocaRegion(const Expr *ex, unsigned cnt, const MemSpaceRegion *superRegion)
481  : SubRegion(superRegion, AllocaRegionKind), Cnt(cnt), Ex(ex) {
482  assert(Ex);
483  }
484 
485  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Expr *Ex,
486  unsigned Cnt, const MemRegion *superRegion);
487 
488 public:
489  const Expr *getExpr() const { return Ex; }
490 
491  bool isBoundable() const override { return true; }
492 
493  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
494 
495  void Profile(llvm::FoldingSetNodeID& ID) const override;
496 
497  void dumpToStream(raw_ostream &os) const override;
498 
499  static bool classof(const MemRegion* R) {
500  return R->getKind() == AllocaRegionKind;
501  }
502 };
503 
504 /// TypedRegion - An abstract class representing regions that are typed.
505 class TypedRegion : public SubRegion {
506  void anchor() override;
507 
508 protected:
509  TypedRegion(const MemRegion *sReg, Kind k) : SubRegion(sReg, k) {
510  assert(classof(this));
511  }
512 
513 public:
514  virtual QualType getLocationType() const = 0;
515 
517  return getLocationType().getDesugaredType(Context);
518  }
519 
520  bool isBoundable() const override { return true; }
521 
522  static bool classof(const MemRegion* R) {
523  unsigned k = R->getKind();
524  return k >= BEGIN_TYPED_REGIONS && k <= END_TYPED_REGIONS;
525  }
526 };
527 
528 /// TypedValueRegion - An abstract class representing regions having a typed value.
530  void anchor() override;
531 
532 protected:
533  TypedValueRegion(const MemRegion* sReg, Kind k) : TypedRegion(sReg, k) {
534  assert(classof(this));
535  }
536 
537 public:
538  virtual QualType getValueType() const = 0;
539 
540  QualType getLocationType() const override {
541  // FIXME: We can possibly optimize this later to cache this value.
542  QualType T = getValueType();
543  ASTContext &ctx = getContext();
544  if (T->getAs<ObjCObjectType>())
545  return ctx.getObjCObjectPointerType(T);
546  return ctx.getPointerType(getValueType());
547  }
548 
550  QualType T = getValueType();
551  return T.getTypePtrOrNull() ? T.getDesugaredType(Context) : T;
552  }
553 
554  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
555 
556  static bool classof(const MemRegion* R) {
557  unsigned k = R->getKind();
558  return k >= BEGIN_TYPED_VALUE_REGIONS && k <= END_TYPED_VALUE_REGIONS;
559  }
560 };
561 
562 class CodeTextRegion : public TypedRegion {
563  void anchor() override;
564 
565 protected:
566  CodeTextRegion(const MemSpaceRegion *sreg, Kind k) : TypedRegion(sreg, k) {
567  assert(classof(this));
568  }
569 
570 public:
571  bool isBoundable() const override { return false; }
572 
573  static bool classof(const MemRegion* R) {
574  Kind k = R->getKind();
575  return k >= BEGIN_CODE_TEXT_REGIONS && k <= END_CODE_TEXT_REGIONS;
576  }
577 };
578 
579 /// FunctionCodeRegion - A region that represents code texts of function.
581  friend class MemRegionManager;
582 
583  const NamedDecl *FD;
584 
585  FunctionCodeRegion(const NamedDecl *fd, const CodeSpaceRegion* sreg)
586  : CodeTextRegion(sreg, FunctionCodeRegionKind), FD(fd) {
587  assert(isa<ObjCMethodDecl>(fd) || isa<FunctionDecl>(fd));
588  }
589 
590  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const NamedDecl *FD,
591  const MemRegion*);
592 
593 public:
594  QualType getLocationType() const override {
595  const ASTContext &Ctx = getContext();
596  if (const auto *D = dyn_cast<FunctionDecl>(FD)) {
597  return Ctx.getPointerType(D->getType());
598  }
599 
600  assert(isa<ObjCMethodDecl>(FD));
601  assert(false && "Getting the type of ObjCMethod is not supported yet");
602 
603  // TODO: We might want to return a different type here (ex: id (*ty)(...))
604  // depending on how it is used.
605  return {};
606  }
607 
608  const NamedDecl *getDecl() const {
609  return FD;
610  }
611 
612  void dumpToStream(raw_ostream &os) const override;
613 
614  void Profile(llvm::FoldingSetNodeID& ID) const override;
615 
616  static bool classof(const MemRegion* R) {
617  return R->getKind() == FunctionCodeRegionKind;
618  }
619 };
620 
621 /// BlockCodeRegion - A region that represents code texts of blocks (closures).
622 /// Blocks are represented with two kinds of regions. BlockCodeRegions
623 /// represent the "code", while BlockDataRegions represent instances of blocks,
624 /// which correspond to "code+data". The distinction is important, because
625 /// like a closure a block captures the values of externally referenced
626 /// variables.
628  friend class MemRegionManager;
629 
630  const BlockDecl *BD;
632  CanQualType locTy;
633 
634  BlockCodeRegion(const BlockDecl *bd, CanQualType lTy,
635  AnalysisDeclContext *ac, const CodeSpaceRegion* sreg)
636  : CodeTextRegion(sreg, BlockCodeRegionKind), BD(bd), AC(ac), locTy(lTy) {
637  assert(bd);
638  assert(ac);
639  assert(lTy->getTypePtr()->isBlockPointerType());
640  }
641 
642  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const BlockDecl *BD,
644  const MemRegion*);
645 
646 public:
647  QualType getLocationType() const override {
648  return locTy;
649  }
650 
651  const BlockDecl *getDecl() const {
652  return BD;
653  }
654 
656 
657  void dumpToStream(raw_ostream &os) const override;
658 
659  void Profile(llvm::FoldingSetNodeID& ID) const override;
660 
661  static bool classof(const MemRegion* R) {
662  return R->getKind() == BlockCodeRegionKind;
663  }
664 };
665 
666 /// BlockDataRegion - A region that represents a block instance.
667 /// Blocks are represented with two kinds of regions. BlockCodeRegions
668 /// represent the "code", while BlockDataRegions represent instances of blocks,
669 /// which correspond to "code+data". The distinction is important, because
670 /// like a closure a block captures the values of externally referenced
671 /// variables.
672 class BlockDataRegion : public TypedRegion {
673  friend class MemRegionManager;
674 
675  const BlockCodeRegion *BC;
676  const LocationContext *LC; // Can be null
677  unsigned BlockCount;
678  void *ReferencedVars = nullptr;
679  void *OriginalVars = nullptr;
680 
681  BlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc,
682  unsigned count, const MemSpaceRegion *sreg)
683  : TypedRegion(sreg, BlockDataRegionKind), BC(bc), LC(lc),
684  BlockCount(count) {
685  assert(bc);
686  assert(lc);
687  assert(isa<GlobalImmutableSpaceRegion>(sreg) ||
688  isa<StackLocalsSpaceRegion>(sreg) ||
689  isa<UnknownSpaceRegion>(sreg));
690  }
691 
692  static void ProfileRegion(llvm::FoldingSetNodeID&, const BlockCodeRegion *,
693  const LocationContext *, unsigned,
694  const MemRegion *);
695 
696 public:
697  const BlockCodeRegion *getCodeRegion() const { return BC; }
698 
699  const BlockDecl *getDecl() const { return BC->getDecl(); }
700 
701  QualType getLocationType() const override { return BC->getLocationType(); }
702 
704  const MemRegion * const *R;
705  const MemRegion * const *OriginalR;
706 
707  public:
708  explicit referenced_vars_iterator(const MemRegion * const *r,
709  const MemRegion * const *originalR)
710  : R(r), OriginalR(originalR) {}
711 
712  const VarRegion *getCapturedRegion() const {
713  return cast<VarRegion>(*R);
714  }
715 
716  const VarRegion *getOriginalRegion() const {
717  return cast<VarRegion>(*OriginalR);
718  }
719 
720  bool operator==(const referenced_vars_iterator &I) const {
721  assert((R == nullptr) == (I.R == nullptr));
722  return I.R == R;
723  }
724 
725  bool operator!=(const referenced_vars_iterator &I) const {
726  assert((R == nullptr) == (I.R == nullptr));
727  return I.R != R;
728  }
729 
731  ++R;
732  ++OriginalR;
733  return *this;
734  }
735  };
736 
737  /// Return the original region for a captured region, if
738  /// one exists.
739  const VarRegion *getOriginalRegion(const VarRegion *VR) const;
740 
741  referenced_vars_iterator referenced_vars_begin() const;
742  referenced_vars_iterator referenced_vars_end() const;
743 
744  void dumpToStream(raw_ostream &os) const override;
745 
746  void Profile(llvm::FoldingSetNodeID& ID) const override;
747 
748  static bool classof(const MemRegion* R) {
749  return R->getKind() == BlockDataRegionKind;
750  }
751 
752 private:
753  void LazyInitializeReferencedVars();
754  std::pair<const VarRegion *, const VarRegion *>
755  getCaptureRegions(const VarDecl *VD);
756 };
757 
758 /// SymbolicRegion - A special, "non-concrete" region. Unlike other region
759 /// classes, SymbolicRegion represents a region that serves as an alias for
760 /// either a real region, a NULL pointer, etc. It essentially is used to
761 /// map the concept of symbolic values into the domain of regions. Symbolic
762 /// regions do not need to be typed.
763 class SymbolicRegion : public SubRegion {
764  friend class MemRegionManager;
765 
766  const SymbolRef sym;
767 
768  SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg)
769  : SubRegion(sreg, SymbolicRegionKind), sym(s) {
770  // Because pointer arithmetic is represented by ElementRegion layers,
771  // the base symbol here should not contain any arithmetic.
772  assert(s && isa<SymbolData>(s));
773  assert(s->getType()->isAnyPointerType() ||
774  s->getType()->isReferenceType() ||
775  s->getType()->isBlockPointerType());
776 
777  // populateWorklistFromSymbol() relies on this assertion, and needs to be
778  // updated if more cases are introduced.
779  assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg));
780  }
781 
782 public:
783  SymbolRef getSymbol() const { return sym; }
784 
785  bool isBoundable() const override { return true; }
786 
787  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
788 
789  void Profile(llvm::FoldingSetNodeID& ID) const override;
790 
791  static void ProfileRegion(llvm::FoldingSetNodeID& ID,
792  SymbolRef sym,
793  const MemRegion* superRegion);
794 
795  void dumpToStream(raw_ostream &os) const override;
796 
797  static bool classof(const MemRegion* R) {
798  return R->getKind() == SymbolicRegionKind;
799  }
800 };
801 
802 /// StringRegion - Region associated with a StringLiteral.
804  friend class MemRegionManager;
805 
806  const StringLiteral *Str;
807 
809  : TypedValueRegion(sreg, StringRegionKind), Str(str) {
810  assert(str);
811  }
812 
813  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
814  const StringLiteral *Str,
815  const MemRegion *superRegion);
816 
817 public:
818  const StringLiteral *getStringLiteral() const { return Str; }
819 
820  QualType getValueType() const override { return Str->getType(); }
821 
822  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
823 
824  bool isBoundable() const override { return false; }
825 
826  void Profile(llvm::FoldingSetNodeID& ID) const override {
827  ProfileRegion(ID, Str, superRegion);
828  }
829 
830  void dumpToStream(raw_ostream &os) const override;
831 
832  static bool classof(const MemRegion* R) {
833  return R->getKind() == StringRegionKind;
834  }
835 };
836 
837 /// The region associated with an ObjCStringLiteral.
839  friend class MemRegionManager;
840 
841  const ObjCStringLiteral *Str;
842 
844  const GlobalInternalSpaceRegion *sreg)
845  : TypedValueRegion(sreg, ObjCStringRegionKind), Str(str) {
846  assert(str);
847  }
848 
849  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
850  const ObjCStringLiteral *Str,
851  const MemRegion *superRegion);
852 
853 public:
854  const ObjCStringLiteral *getObjCStringLiteral() const { return Str; }
855 
856  QualType getValueType() const override { return Str->getType(); }
857 
858  bool isBoundable() const override { return false; }
859 
860  void Profile(llvm::FoldingSetNodeID& ID) const override {
861  ProfileRegion(ID, Str, superRegion);
862  }
863 
864  void dumpToStream(raw_ostream &os) const override;
865 
866  static bool classof(const MemRegion* R) {
867  return R->getKind() == ObjCStringRegionKind;
868  }
869 };
870 
871 /// CompoundLiteralRegion - A memory region representing a compound literal.
872 /// Compound literals are essentially temporaries that are stack allocated
873 /// or in the global constant pool.
875  friend class MemRegionManager;
876 
877  const CompoundLiteralExpr *CL;
878 
880  const MemSpaceRegion *sReg)
881  : TypedValueRegion(sReg, CompoundLiteralRegionKind), CL(cl) {
882  assert(cl);
883  assert(isa<GlobalInternalSpaceRegion>(sReg) ||
884  isa<StackLocalsSpaceRegion>(sReg));
885  }
886 
887  static void ProfileRegion(llvm::FoldingSetNodeID& ID,
888  const CompoundLiteralExpr *CL,
889  const MemRegion* superRegion);
890 
891 public:
892  QualType getValueType() const override { return CL->getType(); }
893 
894  bool isBoundable() const override { return !CL->isFileScope(); }
895 
896  void Profile(llvm::FoldingSetNodeID& ID) const override;
897 
898  void dumpToStream(raw_ostream &os) const override;
899 
900  const CompoundLiteralExpr *getLiteralExpr() const { return CL; }
901 
902  static bool classof(const MemRegion* R) {
903  return R->getKind() == CompoundLiteralRegionKind;
904  }
905 };
906 
907 class DeclRegion : public TypedValueRegion {
908 protected:
909  const ValueDecl *D;
910 
911  DeclRegion(const ValueDecl *d, const MemRegion *sReg, Kind k)
912  : TypedValueRegion(sReg, k), D(d) {
913  assert(classof(this));
914  assert(d);
915  }
916 
917  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl *D,
918  const MemRegion* superRegion, Kind k);
919 
920 public:
921  const ValueDecl *getDecl() const { return D; }
922  void Profile(llvm::FoldingSetNodeID& ID) const override;
923 
924  static bool classof(const MemRegion* R) {
925  unsigned k = R->getKind();
926  return k >= BEGIN_DECL_REGIONS && k <= END_DECL_REGIONS;
927  }
928 };
929 
930 class VarRegion : public DeclRegion {
931  friend class MemRegionManager;
932 
933  // Constructors and private methods.
934  VarRegion(const VarDecl *vd, const MemRegion *sReg)
935  : DeclRegion(vd, sReg, VarRegionKind) {
936  // VarRegion appears in unknown space when it's a block variable as seen
937  // from a block using it, when this block is analyzed at top-level.
938  // Other block variables appear within block data regions,
939  // which, unlike everything else on this list, are not memory spaces.
940  assert(isa<GlobalsSpaceRegion>(sReg) || isa<StackSpaceRegion>(sReg) ||
941  isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg));
942  }
943 
944  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const VarDecl *VD,
945  const MemRegion *superRegion) {
946  DeclRegion::ProfileRegion(ID, VD, superRegion, VarRegionKind);
947  }
948 
949 public:
950  void Profile(llvm::FoldingSetNodeID& ID) const override;
951 
952  const VarDecl *getDecl() const { return cast<VarDecl>(D); }
953 
954  const StackFrameContext *getStackFrame() const;
955 
956  QualType getValueType() const override {
957  // FIXME: We can cache this if needed.
958  return getDecl()->getType();
959  }
960 
961  void dumpToStream(raw_ostream &os) const override;
962 
963  bool canPrintPrettyAsExpr() const override;
964 
965  void printPrettyAsExpr(raw_ostream &os) const override;
966 
967  static bool classof(const MemRegion* R) {
968  return R->getKind() == VarRegionKind;
969  }
970 };
971 
972 /// CXXThisRegion - Represents the region for the implicit 'this' parameter
973 /// in a call to a C++ method. This region doesn't represent the object
974 /// referred to by 'this', but rather 'this' itself.
976  friend class MemRegionManager;
977 
978  CXXThisRegion(const PointerType *thisPointerTy,
979  const StackArgumentsSpaceRegion *sReg)
980  : TypedValueRegion(sReg, CXXThisRegionKind),
981  ThisPointerTy(thisPointerTy) {
982  assert(ThisPointerTy->getPointeeType()->getAsCXXRecordDecl() &&
983  "Invalid region type!");
984  }
985 
986  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
987  const PointerType *PT,
988  const MemRegion *sReg);
989 
990 public:
991  void Profile(llvm::FoldingSetNodeID &ID) const override;
992 
993  QualType getValueType() const override {
994  return QualType(ThisPointerTy, 0);
995  }
996 
997  void dumpToStream(raw_ostream &os) const override;
998 
999  static bool classof(const MemRegion* R) {
1000  return R->getKind() == CXXThisRegionKind;
1001  }
1002 
1003 private:
1004  const PointerType *ThisPointerTy;
1005 };
1006 
1007 class FieldRegion : public DeclRegion {
1008  friend class MemRegionManager;
1009 
1010  FieldRegion(const FieldDecl *fd, const SubRegion* sReg)
1011  : DeclRegion(fd, sReg, FieldRegionKind) {}
1012 
1013  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const FieldDecl *FD,
1014  const MemRegion* superRegion) {
1015  DeclRegion::ProfileRegion(ID, FD, superRegion, FieldRegionKind);
1016  }
1017 
1018 public:
1019  const FieldDecl *getDecl() const { return cast<FieldDecl>(D); }
1020 
1021  QualType getValueType() const override {
1022  // FIXME: We can cache this if needed.
1023  return getDecl()->getType();
1024  }
1025 
1026  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
1027 
1028  void dumpToStream(raw_ostream &os) const override;
1029 
1030  bool canPrintPretty() const override;
1031  void printPretty(raw_ostream &os) const override;
1032  bool canPrintPrettyAsExpr() const override;
1033  void printPrettyAsExpr(raw_ostream &os) const override;
1034 
1035  static bool classof(const MemRegion* R) {
1036  return R->getKind() == FieldRegionKind;
1037  }
1038 };
1039 
1040 class ObjCIvarRegion : public DeclRegion {
1041  friend class MemRegionManager;
1042 
1043  ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg);
1044 
1045  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const ObjCIvarDecl *ivd,
1046  const MemRegion* superRegion);
1047 
1048 public:
1049  const ObjCIvarDecl *getDecl() const;
1050  QualType getValueType() const override;
1051 
1052  bool canPrintPrettyAsExpr() const override;
1053  void printPrettyAsExpr(raw_ostream &os) const override;
1054 
1055  void dumpToStream(raw_ostream &os) const override;
1056 
1057  static bool classof(const MemRegion* R) {
1058  return R->getKind() == ObjCIvarRegionKind;
1059  }
1060 };
1061 
1062 //===----------------------------------------------------------------------===//
1063 // Auxiliary data classes for use with MemRegions.
1064 //===----------------------------------------------------------------------===//
1065 
1067  friend class ElementRegion;
1068 
1069  const MemRegion *Region;
1070  CharUnits Offset;
1071 
1072  RegionRawOffset(const MemRegion* reg, CharUnits offset = CharUnits::Zero())
1073  : Region(reg), Offset(offset) {}
1074 
1075 public:
1076  // FIXME: Eventually support symbolic offsets.
1077  CharUnits getOffset() const { return Offset; }
1078  const MemRegion *getRegion() const { return Region; }
1079 
1080  void dumpToStream(raw_ostream &os) const;
1081  void dump() const;
1082 };
1083 
1084 /// ElementRegion is used to represent both array elements and casts.
1086  friend class MemRegionManager;
1087 
1088  QualType ElementType;
1089  NonLoc Index;
1090 
1091  ElementRegion(QualType elementType, NonLoc Idx, const SubRegion *sReg)
1092  : TypedValueRegion(sReg, ElementRegionKind), ElementType(elementType),
1093  Index(Idx) {
1094  assert((!Idx.getAs<nonloc::ConcreteInt>() ||
1095  Idx.castAs<nonloc::ConcreteInt>().getValue().isSigned()) &&
1096  "The index must be signed");
1097  assert(!elementType.isNull() && !elementType->isVoidType() &&
1098  "Invalid region type!");
1099  }
1100 
1101  static void ProfileRegion(llvm::FoldingSetNodeID& ID, QualType elementType,
1102  SVal Idx, const MemRegion* superRegion);
1103 
1104 public:
1105  NonLoc getIndex() const { return Index; }
1106 
1107  QualType getValueType() const override { return ElementType; }
1108 
1109  QualType getElementType() const { return ElementType; }
1110 
1111  /// Compute the offset within the array. The array might also be a subobject.
1112  RegionRawOffset getAsArrayOffset() const;
1113 
1114  void dumpToStream(raw_ostream &os) const override;
1115 
1116  void Profile(llvm::FoldingSetNodeID& ID) const override;
1117 
1118  static bool classof(const MemRegion* R) {
1119  return R->getKind() == ElementRegionKind;
1120  }
1121 };
1122 
1123 // C++ temporary object associated with an expression.
1125  friend class MemRegionManager;
1126 
1127  Expr const *Ex;
1128 
1129  CXXTempObjectRegion(Expr const *E, MemSpaceRegion const *sReg)
1130  : TypedValueRegion(sReg, CXXTempObjectRegionKind), Ex(E) {
1131  assert(E);
1132  assert(isa<StackLocalsSpaceRegion>(sReg) ||
1133  isa<GlobalInternalSpaceRegion>(sReg));
1134  }
1135 
1136  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
1137  Expr const *E, const MemRegion *sReg);
1138 
1139 public:
1140  const Expr *getExpr() const { return Ex; }
1141 
1142  QualType getValueType() const override { return Ex->getType(); }
1143 
1144  void dumpToStream(raw_ostream &os) const override;
1145 
1146  void Profile(llvm::FoldingSetNodeID &ID) const override;
1147 
1148  static bool classof(const MemRegion* R) {
1149  return R->getKind() == CXXTempObjectRegionKind;
1150  }
1151 };
1152 
1153 // CXXBaseObjectRegion represents a base object within a C++ object. It is
1154 // identified by the base class declaration and the region of its parent object.
1156  friend class MemRegionManager;
1157 
1158  llvm::PointerIntPair<const CXXRecordDecl *, 1, bool> Data;
1159 
1160  CXXBaseObjectRegion(const CXXRecordDecl *RD, bool IsVirtual,
1161  const SubRegion *SReg)
1162  : TypedValueRegion(SReg, CXXBaseObjectRegionKind), Data(RD, IsVirtual) {
1163  assert(RD);
1164  }
1165 
1166  static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
1167  bool IsVirtual, const MemRegion *SReg);
1168 
1169 public:
1170  const CXXRecordDecl *getDecl() const { return Data.getPointer(); }
1171  bool isVirtual() const { return Data.getInt(); }
1172 
1173  QualType getValueType() const override;
1174 
1175  void dumpToStream(raw_ostream &os) const override;
1176 
1177  void Profile(llvm::FoldingSetNodeID &ID) const override;
1178 
1179  bool canPrintPrettyAsExpr() const override;
1180 
1181  void printPrettyAsExpr(raw_ostream &os) const override;
1182 
1183  static bool classof(const MemRegion *region) {
1184  return region->getKind() == CXXBaseObjectRegionKind;
1185  }
1186 };
1187 
1188 // CXXDerivedObjectRegion represents a derived-class object that surrounds
1189 // a C++ object. It is identified by the derived class declaration and the
1190 // region of its parent object. It is a bit counter-intuitive (but not otherwise
1191 // unseen) that this region represents a larger segment of memory that its
1192 // super-region.
1194  friend class MemRegionManager;
1195 
1196  const CXXRecordDecl *DerivedD;
1197 
1198  CXXDerivedObjectRegion(const CXXRecordDecl *DerivedD, const SubRegion *SReg)
1199  : TypedValueRegion(SReg, CXXDerivedObjectRegionKind), DerivedD(DerivedD) {
1200  assert(DerivedD);
1201  // In case of a concrete region, it should always be possible to model
1202  // the base-to-derived cast by undoing a previous derived-to-base cast,
1203  // otherwise the cast is most likely ill-formed.
1204  assert(SReg->getSymbolicBase() &&
1205  "Should have unwrapped a base region instead!");
1206  }
1207 
1208  static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
1209  const MemRegion *SReg);
1210 
1211 public:
1212  const CXXRecordDecl *getDecl() const { return DerivedD; }
1213 
1214  QualType getValueType() const override;
1215 
1216  void dumpToStream(raw_ostream &os) const override;
1217 
1218  void Profile(llvm::FoldingSetNodeID &ID) const override;
1219 
1220  bool canPrintPrettyAsExpr() const override;
1221 
1222  void printPrettyAsExpr(raw_ostream &os) const override;
1223 
1224  static bool classof(const MemRegion *region) {
1225  return region->getKind() == CXXDerivedObjectRegionKind;
1226  }
1227 };
1228 
1229 template<typename RegionTy>
1230 const RegionTy* MemRegion::getAs() const {
1231  if (const auto *RT = dyn_cast<RegionTy>(this))
1232  return RT;
1233 
1234  return nullptr;
1235 }
1236 
1237 //===----------------------------------------------------------------------===//
1238 // MemRegionManager - Factory object for creating regions.
1239 //===----------------------------------------------------------------------===//
1240 
1242  ASTContext &C;
1243  llvm::BumpPtrAllocator& A;
1244  llvm::FoldingSet<MemRegion> Regions;
1245 
1246  GlobalInternalSpaceRegion *InternalGlobals = nullptr;
1247  GlobalSystemSpaceRegion *SystemGlobals = nullptr;
1248  GlobalImmutableSpaceRegion *ImmutableGlobals = nullptr;
1249 
1250  llvm::DenseMap<const StackFrameContext *, StackLocalsSpaceRegion *>
1251  StackLocalsSpaceRegions;
1252  llvm::DenseMap<const StackFrameContext *, StackArgumentsSpaceRegion *>
1253  StackArgumentsSpaceRegions;
1254  llvm::DenseMap<const CodeTextRegion *, StaticGlobalSpaceRegion *>
1255  StaticsGlobalSpaceRegions;
1256 
1257  HeapSpaceRegion *heap = nullptr;
1258  UnknownSpaceRegion *unknown = nullptr;
1259  CodeSpaceRegion *code = nullptr;
1260 
1261 public:
1262  MemRegionManager(ASTContext &c, llvm::BumpPtrAllocator &a) : C(c), A(a) {}
1263  ~MemRegionManager();
1264 
1265  ASTContext &getContext() { return C; }
1266 
1267  llvm::BumpPtrAllocator &getAllocator() { return A; }
1268 
1269  /// getStackLocalsRegion - Retrieve the memory region associated with the
1270  /// specified stack frame.
1271  const StackLocalsSpaceRegion *
1272  getStackLocalsRegion(const StackFrameContext *STC);
1273 
1274  /// getStackArgumentsRegion - Retrieve the memory region associated with
1275  /// function/method arguments of the specified stack frame.
1277  getStackArgumentsRegion(const StackFrameContext *STC);
1278 
1279  /// getGlobalsRegion - Retrieve the memory region associated with
1280  /// global variables.
1281  const GlobalsSpaceRegion *getGlobalsRegion(
1282  MemRegion::Kind K = MemRegion::GlobalInternalSpaceRegionKind,
1283  const CodeTextRegion *R = nullptr);
1284 
1285  /// getHeapRegion - Retrieve the memory region associated with the
1286  /// generic "heap".
1287  const HeapSpaceRegion *getHeapRegion();
1288 
1289  /// getUnknownRegion - Retrieve the memory region associated with unknown
1290  /// memory space.
1291  const UnknownSpaceRegion *getUnknownRegion();
1292 
1293  const CodeSpaceRegion *getCodeRegion();
1294 
1295  /// getAllocaRegion - Retrieve a region associated with a call to alloca().
1296  const AllocaRegion *getAllocaRegion(const Expr *Ex, unsigned Cnt,
1297  const LocationContext *LC);
1298 
1299  /// getCompoundLiteralRegion - Retrieve the region associated with a
1300  /// given CompoundLiteral.
1301  const CompoundLiteralRegion*
1302  getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
1303  const LocationContext *LC);
1304 
1305  /// getCXXThisRegion - Retrieve the [artificial] region associated with the
1306  /// parameter 'this'.
1307  const CXXThisRegion *getCXXThisRegion(QualType thisPointerTy,
1308  const LocationContext *LC);
1309 
1310  /// Retrieve or create a "symbolic" memory region.
1311  const SymbolicRegion* getSymbolicRegion(SymbolRef Sym);
1312 
1313  /// Return a unique symbolic region belonging to heap memory space.
1314  const SymbolicRegion *getSymbolicHeapRegion(SymbolRef sym);
1315 
1316  const StringRegion *getStringRegion(const StringLiteral *Str);
1317 
1318  const ObjCStringRegion *getObjCStringRegion(const ObjCStringLiteral *Str);
1319 
1320  /// getVarRegion - Retrieve or create the memory region associated with
1321  /// a specified VarDecl and LocationContext.
1322  const VarRegion* getVarRegion(const VarDecl *D, const LocationContext *LC);
1323 
1324  /// getVarRegion - Retrieve or create the memory region associated with
1325  /// a specified VarDecl and super region.
1326  const VarRegion *getVarRegion(const VarDecl *D, const MemRegion *superR);
1327 
1328  /// getElementRegion - Retrieve the memory region associated with the
1329  /// associated element type, index, and super region.
1330  const ElementRegion *getElementRegion(QualType elementType, NonLoc Idx,
1331  const SubRegion *superRegion,
1332  ASTContext &Ctx);
1333 
1335  const SubRegion *superRegion) {
1336  return getElementRegion(ER->getElementType(), ER->getIndex(),
1337  superRegion, ER->getContext());
1338  }
1339 
1340  /// getFieldRegion - Retrieve or create the memory region associated with
1341  /// a specified FieldDecl. 'superRegion' corresponds to the containing
1342  /// memory region (which typically represents the memory representing
1343  /// a structure or class).
1344  const FieldRegion *getFieldRegion(const FieldDecl *fd,
1345  const SubRegion* superRegion);
1346 
1348  const SubRegion *superRegion) {
1349  return getFieldRegion(FR->getDecl(), superRegion);
1350  }
1351 
1352  /// getObjCIvarRegion - Retrieve or create the memory region associated with
1353  /// a specified Objective-c instance variable. 'superRegion' corresponds
1354  /// to the containing region (which typically represents the Objective-C
1355  /// object).
1356  const ObjCIvarRegion *getObjCIvarRegion(const ObjCIvarDecl *ivd,
1357  const SubRegion* superRegion);
1358 
1359  const CXXTempObjectRegion *getCXXTempObjectRegion(Expr const *Ex,
1360  LocationContext const *LC);
1361 
1362  /// Create a CXXBaseObjectRegion with the given base class for region
1363  /// \p Super.
1364  ///
1365  /// The type of \p Super is assumed be a class deriving from \p BaseClass.
1366  const CXXBaseObjectRegion *
1367  getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super,
1368  bool IsVirtual);
1369 
1370  /// Create a CXXBaseObjectRegion with the same CXXRecordDecl but a different
1371  /// super region.
1372  const CXXBaseObjectRegion *
1374  const SubRegion *superRegion) {
1375  return getCXXBaseObjectRegion(baseReg->getDecl(), superRegion,
1376  baseReg->isVirtual());
1377  }
1378 
1379  /// Create a CXXDerivedObjectRegion with the given derived class for region
1380  /// \p Super. This should not be used for casting an existing
1381  /// CXXBaseObjectRegion back to the derived type; instead, CXXBaseObjectRegion
1382  /// should be removed.
1383  const CXXDerivedObjectRegion *
1384  getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass,
1385  const SubRegion *Super);
1386 
1387  const FunctionCodeRegion *getFunctionCodeRegion(const NamedDecl *FD);
1388  const BlockCodeRegion *getBlockCodeRegion(const BlockDecl *BD,
1389  CanQualType locTy,
1390  AnalysisDeclContext *AC);
1391 
1392  /// getBlockDataRegion - Get the memory region associated with an instance
1393  /// of a block. Unlike many other MemRegions, the LocationContext*
1394  /// argument is allowed to be NULL for cases where we have no known
1395  /// context.
1396  const BlockDataRegion *getBlockDataRegion(const BlockCodeRegion *bc,
1397  const LocationContext *lc,
1398  unsigned blockCount);
1399 
1400  /// Create a CXXTempObjectRegion for temporaries which are lifetime-extended
1401  /// by static references. This differs from getCXXTempObjectRegion in the
1402  /// super-region used.
1403  const CXXTempObjectRegion *getCXXStaticTempObjectRegion(const Expr *Ex);
1404 
1405 private:
1406  template <typename RegionTy, typename SuperTy,
1407  typename Arg1Ty>
1408  RegionTy* getSubRegion(const Arg1Ty arg1,
1409  const SuperTy* superRegion);
1410 
1411  template <typename RegionTy, typename SuperTy,
1412  typename Arg1Ty, typename Arg2Ty>
1413  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
1414  const SuperTy* superRegion);
1415 
1416  template <typename RegionTy, typename SuperTy,
1417  typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
1418  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
1419  const Arg3Ty arg3,
1420  const SuperTy* superRegion);
1421 
1422  template <typename REG>
1423  const REG* LazyAllocate(REG*& region);
1424 
1425  template <typename REG, typename ARG>
1426  const REG* LazyAllocate(REG*& region, ARG a);
1427 };
1428 
1429 //===----------------------------------------------------------------------===//
1430 // Out-of-line member definitions.
1431 //===----------------------------------------------------------------------===//
1432 
1434  return getMemRegionManager()->getContext();
1435 }
1436 
1437 //===----------------------------------------------------------------------===//
1438 // Means for storing region/symbol handling traits.
1439 //===----------------------------------------------------------------------===//
1440 
1441 /// Information about invalidation for a particular region/symbol.
1443  using StorageTypeForKinds = unsigned char;
1444 
1445  llvm::DenseMap<const MemRegion *, StorageTypeForKinds> MRTraitsMap;
1446  llvm::DenseMap<SymbolRef, StorageTypeForKinds> SymTraitsMap;
1447 
1448  using const_region_iterator =
1449  llvm::DenseMap<const MemRegion *, StorageTypeForKinds>::const_iterator;
1450  using const_symbol_iterator =
1451  llvm::DenseMap<SymbolRef, StorageTypeForKinds>::const_iterator;
1452 
1453 public:
1454  /// Describes different invalidation traits.
1456  /// Tells that a region's contents is not changed.
1457  TK_PreserveContents = 0x1,
1458 
1459  /// Suppress pointer-escaping of a region.
1460  TK_SuppressEscape = 0x2,
1461 
1462  // Do not invalidate super region.
1463  TK_DoNotInvalidateSuperRegion = 0x4,
1464 
1465  /// When applied to a MemSpaceRegion, indicates the entire memory space
1466  /// should be invalidated.
1467  TK_EntireMemSpace = 0x8
1468 
1469  // Do not forget to extend StorageTypeForKinds if number of traits exceed
1470  // the number of bits StorageTypeForKinds can store.
1471  };
1472 
1473  void setTrait(SymbolRef Sym, InvalidationKinds IK);
1474  void setTrait(const MemRegion *MR, InvalidationKinds IK);
1475  bool hasTrait(SymbolRef Sym, InvalidationKinds IK) const;
1476  bool hasTrait(const MemRegion *MR, InvalidationKinds IK) const;
1477 };
1478 
1479 //===----------------------------------------------------------------------===//
1480 // Pretty-printing regions.
1481 //===----------------------------------------------------------------------===//
1482 inline raw_ostream &operator<<(raw_ostream &os, const MemRegion *R) {
1483  R->dumpToStream(os);
1484  return os;
1485 }
1486 
1487 } // namespace ento
1488 
1489 } // namespace clang
1490 
1491 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
RegionOffset(const MemRegion *r, int64_t off)
Definition: MemRegion.h:75
const ElementRegion * getElementRegionWithSuper(const ElementRegion *ER, const SubRegion *superRegion)
Definition: MemRegion.h:1334
bool isBoundable() const override
Definition: MemRegion.h:894
Defines the clang::ASTContext interface.
CodeTextRegion(const MemSpaceRegion *sreg, Kind k)
Definition: MemRegion.h:566
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:529
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1035
CompoundLiteralRegion - A memory region representing a compound literal.
Definition: MemRegion.h:874
QualType getValueType() const override
Definition: MemRegion.h:993
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2541
A (possibly-)qualified type.
Definition: Type.h:638
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6308
const CXXRecordDecl * getDecl() const
Definition: MemRegion.h:1212
QualType getDesugaredType(const ASTContext &Context) const
Return the specified type with any "sugar" removed from the type.
Definition: Type.h:938
SubRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:441
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1442
NonLoc getIndex() const
Definition: MemRegion.h:1105
MemRegionManager * getMemRegionManager() const override
Definition: MemRegion.h:207
C Language Family Type Representation.
virtual void dumpToStream(raw_ostream &os) const
Definition: MemRegion.cpp:455
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:627
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
const ValueDecl * D
Definition: MemRegion.h:909
static bool classof(const MemRegion *R)
Definition: MemRegion.h:902
static bool classof(const MemRegion *R)
Definition: MemRegion.h:999
const ValueDecl * getDecl() const
Definition: MemRegion.h:921
QualType getLocationType() const override
Definition: MemRegion.h:701
const NamedDecl * getDecl() const
Definition: MemRegion.h:608
const MemRegion * getRegion() const
Definition: MemRegion.h:77
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
MemSpaceRegion - A memory region that represents a "memory space"; for example, the set of global var...
Definition: MemRegion.h:198
static bool classof(const MemRegion *region)
Definition: MemRegion.h:1183
const ObjCStringLiteral * getObjCStringLiteral() const
Definition: MemRegion.h:854
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1118
Value representing integer constant.
Definition: SVals.h:377
const CXXBaseObjectRegion * getCXXBaseObjectRegionWithSuper(const CXXBaseObjectRegion *baseReg, const SubRegion *superRegion)
Create a CXXBaseObjectRegion with the same CXXRecordDecl but a different super region.
Definition: MemRegion.h:1373
AllocaRegion - A region that represents an untyped blob of bytes created by a call to &#39;alloca&#39;...
Definition: MemRegion.h:471
static bool classof(const MemRegion *R)
Definition: MemRegion.h:556
bool operator==(const referenced_vars_iterator &I) const
Definition: MemRegion.h:720
CodeSpaceRegion - The memory space that holds the executable code of functions and blocks...
Definition: MemRegion.h:222
CharUnits getOffset() const
Definition: MemRegion.h:1077
Represents a variable declaration or definition.
Definition: Decl.h:812
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:2859
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6734
DeclRegion(const ValueDecl *d, const MemRegion *sReg, Kind k)
Definition: MemRegion.h:911
QualType getElementType() const
Definition: MemRegion.h:1109
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: MemRegion.h:655
Symbolic value.
Definition: SymExpr.h:30
CXXThisRegion - Represents the region for the implicit &#39;this&#39; parameter in a call to a C++ method...
Definition: MemRegion.h:975
const MemRegion * getSuperRegion() const
Definition: MemRegion.h:447
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
Definition: MemRegion.cpp:1218
GlobalsSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:240
The region containing globals which can be modified by calls to "internally" defined functions - (for...
Definition: MemRegion.h:339
The region associated with an ObjCStringLiteral.
Definition: MemRegion.h:838
Represents a class type in Objective C.
Definition: Type.h:5542
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
bool isFileScope() const
Definition: Expr.h:2889
bool isValid() const
Definition: MemRegion.h:86
const FieldDecl * getDecl() const
Definition: MemRegion.h:1019
Represents a member of a struct/union/class.
Definition: Decl.h:2588
ASTContext & getContext() const
Definition: MemRegion.h:1433
AnalysisDeclContext contains the context data for the function or method under analysis.
QualType getLocationType() const override
Definition: MemRegion.h:594
bool isReferenceType() const
Definition: Type.h:6312
static CharUnits Zero()
Zero - Construct a CharUnits quantity of zero.
Definition: CharUnits.h:53
virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.h:452
QualType getValueType() const override
Definition: MemRegion.h:892
bool isBoundable() const override
Definition: MemRegion.h:858
The region containing globals which are considered not to be modified or point to data which could be...
Definition: MemRegion.h:322
static bool classof(const MemRegion *R)
Definition: MemRegion.h:245
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:672
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1057
static bool classof(const MemRegion *region)
Definition: MemRegion.h:1224
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
static void dump(llvm::raw_ostream &OS, StringRef FunctionName, ArrayRef< CounterExpression > Expressions, ArrayRef< CounterMappingRegion > Regions)
const CXXRecordDecl * getDecl() const
Definition: MemRegion.h:1170
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
referenced_vars_iterator(const MemRegion *const *r, const MemRegion *const *originalR)
Definition: MemRegion.h:708
static bool classof(const MemRegion *R)
Definition: MemRegion.h:413
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1148
ObjCStringLiteral, used for Objective-C string literals i.e.
Definition: ExprObjC.h:51
static bool classof(const MemRegion *R)
Definition: MemRegion.h:273
const StringLiteral * getStringLiteral() const
Definition: MemRegion.h:818
QualType getValueType() const override
Definition: MemRegion.h:956
Represent a region&#39;s offset within the top level base region.
Definition: MemRegion.h:62
const T * getTypePtr() const
Retrieve the underlying type pointer, which refers to a canonical type.
Definition: CanonicalType.h:84
static void ProfileRegion(llvm::FoldingSetNodeID &ID, const Decl *D, const MemRegion *superRegion, Kind k)
Definition: MemRegion.cpp:309
virtual QualType getType() const =0
static bool classof(const MemRegion *R)
Definition: MemRegion.h:832
QualType getValueType() const override
Definition: MemRegion.h:820
return Out str()
bool operator!=(const referenced_vars_iterator &I) const
Definition: MemRegion.h:725
static bool classof(const MemRegion *R)
Definition: MemRegion.h:376
const RegionTy * getAs() const
Definition: MemRegion.h:1230
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:763
unsigned Offset
Definition: Format.cpp:1631
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3867
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:636
This represents one expression.
Definition: Expr.h:106
TypedValueRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:533
static const int64_t Symbolic
Definition: MemRegion.h:72
llvm::BumpPtrAllocator & getAllocator()
Definition: MemRegion.h:1267
static bool classof(const MemRegion *R)
Definition: MemRegion.h:748
QualType getType() const
Definition: Expr.h:128
QualType getDesugaredValueType(ASTContext &Context) const
Definition: MemRegion.h:549
const BlockCodeRegion * getCodeRegion() const
Definition: MemRegion.h:697
static bool classof(const MemRegion *R)
Definition: MemRegion.h:924
static bool classof(const MemRegion *R)
Definition: MemRegion.h:573
static bool classof(const MemRegion *R)
Definition: MemRegion.h:661
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:703
static bool classof(const MemRegion *R)
Definition: MemRegion.h:499
TypedRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:509
const StackFrameContext * getStackFrame() const
Definition: MemRegion.h:394
The region of the static variables within the current CodeTextRegion scope.
Definition: MemRegion.h:256
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:112
const VarDecl * getDecl() const
Definition: MemRegion.h:952
virtual bool isBoundable() const
Definition: MemRegion.h:173
The region for all the non-static global variables.
Definition: MemRegion.h:284
Kind getKind() const
Definition: MemRegion.h:169
static bool classof(const MemRegion *R)
Definition: MemRegion.h:866
const BlockDecl * getDecl() const
Definition: MemRegion.h:651
QualType getValueType() const override
Definition: MemRegion.h:1142
Kind
static bool classof(const MemRegion *R)
Definition: MemRegion.h:797
FunctionCodeRegion - A region that represents code texts of function.
Definition: MemRegion.h:580
SymbolRef getSymbol() const
Definition: MemRegion.h:783
const CompoundLiteralExpr * getLiteralExpr() const
Definition: MemRegion.h:900
bool isBoundable() const override
Definition: MemRegion.h:520
static bool classof(const MemRegion *R)
Definition: MemRegion.h:398
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
bool isBoundable() const override
Definition: MemRegion.h:785
bool isAnyPointerType() const
Definition: Type.h:6304
QualType getLocationType() const override
Definition: MemRegion.h:540
static bool classof(const MemRegion *R)
Definition: MemRegion.h:331
static bool classof(const MemRegion *R)
Definition: MemRegion.h:460
bool isBoundable() const override
Definition: MemRegion.h:491
static bool classof(const MemRegion *R)
Definition: MemRegion.h:294
Dataflow Directional Tag Classes.
raw_ostream & operator<<(raw_ostream &Out, const CheckerBase &Checker)
Dump checker name to stream.
Definition: Checker.cpp:36
QualType getValueType() const override
Definition: MemRegion.h:856
InvalidationKinds
Describes different invalidation traits.
Definition: MemRegion.h:1455
const MemRegion * getRegion() const
Definition: MemRegion.h:1078
bool isBoundable() const override
Definition: MemRegion.h:210
QualType getLocationType() const override
Definition: MemRegion.h:647
static bool classof(const MemRegion *R)
Definition: MemRegion.h:616
static bool classof(const MemRegion *R)
Definition: MemRegion.h:348
const Expr * getExpr() const
Definition: MemRegion.h:1140
static bool classof(const MemRegion *R)
Definition: MemRegion.h:362
static bool classof(const OMPClause *T)
bool isBoundable() const override
Definition: MemRegion.h:824
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:104
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:435
The region containing globals which are defined in system/external headers and are considered modifia...
Definition: MemRegion.h:303
StackSpaceRegion(MemRegionManager *mgr, Kind k, const StackFrameContext *sfc)
Definition: MemRegion.h:387
int64_t getOffset() const
Definition: MemRegion.h:81
const Type * getTypePtrOrNull() const
Definition: Type.h:6080
const CodeTextRegion * getCodeRegion() const
Definition: MemRegion.h:271
const BlockDecl * getDecl() const
Definition: MemRegion.h:699
MemSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:202
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: MemRegion.h:860
const Expr * getExpr() const
Definition: MemRegion.h:489
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
bool isVoidType() const
Definition: Type.h:6548
static bool classof(const MemRegion *R)
Definition: MemRegion.h:231
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: MemRegion.h:826
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1937
QualType getValueType() const override
Definition: MemRegion.h:1107
static bool classof(const MemRegion *R)
Definition: MemRegion.h:967
static bool classof(const MemRegion *R)
Definition: MemRegion.h:522
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
unsigned kind
All of the diagnostics that can be emitted by the frontend.
Definition: DiagnosticIDs.h:61
StringLiteral - This represents a string literal expression, e.g.
Definition: Expr.h:1577
QualType getDesugaredLocationType(ASTContext &Context) const
Definition: MemRegion.h:516
StringRegion - Region associated with a StringLiteral.
Definition: MemRegion.h:803
const FieldRegion * getFieldRegionWithSuper(const FieldRegion *FR, const SubRegion *superRegion)
Definition: MemRegion.h:1347
ElementRegion is used to represent both array elements and casts.
Definition: MemRegion.h:1085
__DEVICE__ int max(int __a, int __b)
QualType getValueType() const override
Definition: MemRegion.h:1021
MemRegionManager(ASTContext &c, llvm::BumpPtrAllocator &a)
Definition: MemRegion.h:1262
const llvm::APSInt & getValue() const
Definition: SVals.h:381
A trivial tuple used to represent a source range.
This represents a decl that may have a name.
Definition: Decl.h:248
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
static bool classof(const MemRegion *R)
Definition: MemRegion.h:312
const MemRegion * superRegion
Definition: MemRegion.h:439
static bool classof(const MemRegion *R)
Definition: MemRegion.h:428
bool isBoundable() const override
Definition: MemRegion.h:571
MemRegionManager * Mgr
Definition: MemRegion.h:200
bool hasSymbolicOffset() const
Definition: MemRegion.h:79
NonStaticGlobalSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:288
TypedRegion - An abstract class representing regions that are typed.
Definition: MemRegion.h:505
static bool classof(const MemRegion *R)
Definition: MemRegion.h:214