ASTUtils.cpp

Go to the documentation of this file.

//=======- ASTUtils.cpp ------------------------------------------*- C++ -*-==//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
 
#include "ASTUtils.h"
#include "PtrTypesSemantics.h"
#include "clang/AST/Attr.h"
#include "clang/AST/Decl.h"
#include "clang/AST/DeclCXX.h"
#include "clang/AST/ExprCXX.h"
#include "clang/AST/ExprObjC.h"
#include "clang/AST/StmtVisitor.h"
#include "clang/Analysis/Analyses/LifetimeSafety/LifetimeAnnotations.h"
#include <optional>
#include <utility>
 
namespace clang {
 
bool isSafePtr(clang::CXXRecordDecl *Decl) {
  return isRefCounted(Decl) || isCheckedPtr(Decl);
}
 
static bool tryToFindPtrOriginImpl(
    const Expr *E, bool StopAtFirstRefCountedObj, bool FollowLifetimeBound,
    std::function<bool(const clang::CXXRecordDecl *)> isSafePtr,
    std::function<bool(const clang::QualType)> isSafePtrType,
    std::function<bool(const clang::Decl *)> isSafeGlobalDecl,
    std::function<bool(const clang::Expr *, bool /*IsSafe*/,
                       bool /*OriginDependsOnFullExpressionTemporary*/,
                       bool /*PtrIsLifetimeBoundToOrigin*/)>
        callback,
    bool OriginDependsOnFullExpressionTemporary,
    bool PtrIsLifetimeBoundToOrigin);
 
namespace {
 
bool isStdViewType(QualType T) {
  return !T.isNull() &&
         isStdView(T.getNonReferenceType()->getAsCXXRecordDecl());
}
 
void appendPresumedBorrowSources(
    const FunctionDecl *Callee, ArrayRef<const Expr *> Args,
    SmallVectorImpl<const Expr *> &LifetimeBoundArgs) {
  for (unsigned I = 0; I < Args.size(); ++I) {
    QualType ParamType;
    if (Callee && I < Callee->getNumParams())
      ParamType = Callee->getParamDecl(I)->getType();
    QualType ArgType = Args[I]->getType();
    if ((!ParamType.isNull() && ParamType->isReferenceType()) ||
        (!ArgType.isNull() && isView(ArgType)))
      LifetimeBoundArgs.push_back(Args[I]);
  }
}
 
/// Collects the entries of \p Args that \p Callee declares
/// [[clang::lifetimebound]].
void findLifetimeBoundArgs(const FunctionDecl *Callee,
                           ArrayRef<const Expr *> Args,
                           SmallVectorImpl<const Expr *> &LifetimeBoundArgs) {
  if (!Callee)
    return;
  const FunctionDecl *Canon =
      lifetimes::getDeclWithMergedLifetimeBoundAttrs(Callee);
  unsigned Count = std::min<unsigned>(Canon->getNumParams(), Args.size());
  for (unsigned I = 0; I < Count; ++I) {
    if (Canon->getParamDecl(I)->hasAttr<LifetimeBoundAttr>())
      LifetimeBoundArgs.push_back(Args[I]);
  }
}
 
/// Collects the arguments that \p Construct declares [[clang::lifetimebound]].
/// Absent annotations, a std view constructor is treated as if libc++ had
/// annotated it.
void findLifetimeBoundArgs(const CXXConstructExpr *Construct,
                           SmallVectorImpl<const Expr *> &LifetimeBoundArgs) {
  const auto *Ctor = Construct->getConstructor();
  ArrayRef<const Expr *> Args(Construct->getArgs(), Construct->getNumArgs());
  findLifetimeBoundArgs(Ctor, Args, LifetimeBoundArgs);
  if (!LifetimeBoundArgs.empty() || !Ctor || !isStdView(Ctor->getParent()))
    return;
  appendPresumedBorrowSources(Ctor, Args, LifetimeBoundArgs);
}
 
/// Collects the arguments that \p Call declares [[clang::lifetimebound]],
/// including the implicit 'this' argument. Absent annotations, a call that
/// returns or operates on a std view, or to std::data or std::get, is treated
/// as if libc++ had annotated it.
void findLifetimeBoundArgs(const CallExpr *Call,
                           SmallVectorImpl<const Expr *> &LifetimeBoundArgs) {
  const FunctionDecl *Callee = Call->getDirectCallee();
 
  const Expr *ObjectArg = nullptr;
  unsigned ArgOffset = 0;
  if (isa<CXXOperatorCallExpr>(Call) && Callee &&
      Callee->isCXXInstanceMember() && Call->getNumArgs()) {
    ObjectArg = Call->getArg(0);
    ArgOffset = 1;
  } else if (auto *MemberCall = dyn_cast<CXXMemberCallExpr>(Call))
    ObjectArg = MemberCall->getImplicitObjectArgument();
  ArrayRef<const Expr *> Args(Call->getArgs() + ArgOffset,
                              Call->getNumArgs() - ArgOffset);
 
  if (auto *MD = dyn_cast_or_null<CXXMethodDecl>(Callee)) {
    if (ObjectArg && lifetimes::implicitObjectParamIsLifetimeBound(MD))
      LifetimeBoundArgs.push_back(ObjectArg);
  }
  findLifetimeBoundArgs(Callee, Args, LifetimeBoundArgs);
  if (!LifetimeBoundArgs.empty() || !Callee)
    return;
 
  bool IsStdAccessor =
      Callee->isInStdNamespace() &&
      (safeGetName(Callee) == "data" || safeGetName(Callee) == "get");
  if (!isStdViewType(Callee->getReturnType()) &&
      !(ObjectArg && isStdViewType(ObjectArg->getType())) && !IsStdAccessor)
    return;
 
  if (ObjectArg)
    LifetimeBoundArgs.push_back(ObjectArg);
  appendPresumedBorrowSources(Callee, Args, LifetimeBoundArgs);
}
 
/// Traces each of \p Args independently and requires every one to be safe.
bool tryToFindPtrOriginOfEach(
    ArrayRef<const Expr *> Args, bool StopAtFirstRefCountedObj,
    const std::function<bool(const clang::CXXRecordDecl *)> &isSafePtr,
    const std::function<bool(const clang::QualType)> &isSafePtrType,
    const std::function<bool(const clang::Decl *)> &isSafeGlobalDecl,
    const std::function<bool(const clang::Expr *, bool, bool, bool)> &callback,
    bool OriginDependsOnFullExpressionTemporary,
    bool PtrIsLifetimeBoundToOrigin) {
  for (const Expr *Arg : Args) {
    if (!tryToFindPtrOriginImpl(
            Arg, StopAtFirstRefCountedObj, /*FollowLifetimeBound=*/true,
            isSafePtr, isSafePtrType, isSafeGlobalDecl, callback,
            OriginDependsOnFullExpressionTemporary, PtrIsLifetimeBoundToOrigin))
      return false;
  }
  return true;
}
 
} // namespace
 
static bool tryToFindPtrOriginImpl(
    const Expr *E, bool StopAtFirstRefCountedObj, bool FollowLifetimeBound,
    std::function<bool(const clang::CXXRecordDecl *)> isSafePtr,
    std::function<bool(const clang::QualType)> isSafePtrType,
    std::function<bool(const clang::Decl *)> isSafeGlobalDecl,
    std::function<bool(const clang::Expr *, bool /*IsSafe*/,
                       bool /*OriginDependsOnFullExpressionTemporary*/,
                       bool /*PtrIsLifetimeBoundToOrigin*/)>
        callback,
    bool OriginDependsOnFullExpressionTemporary,
    bool PtrIsLifetimeBoundToOrigin) {
  while (E) {
    if (auto *DRE = dyn_cast<DeclRefExpr>(E)) {
      if (auto *VD = dyn_cast_or_null<VarDecl>(DRE->getDecl())) {
        auto QT = VD->getType();
        auto IsImmortal = safeGetName(VD) == "NSApp";
        if (VD->hasGlobalStorage() && (IsImmortal || QT.isConstQualified()))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
        if (VD->hasGlobalStorage() && isSafeGlobalDecl(VD))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
 
        if (FollowLifetimeBound && VD->isImplicit() && VD->isLocalVarDecl()) {
          if (auto *Init = VD->getInit()) {
            E = Init;
            continue;
          }
        }
      }
    }
    if (auto *Cleanups = dyn_cast<ExprWithCleanups>(E)) {
      E = Cleanups->getSubExpr();
      continue;
    }
    if (auto *tempExpr = dyn_cast<MaterializeTemporaryExpr>(E)) {
      if (tempExpr->getStorageDuration() == SD_FullExpression)
        OriginDependsOnFullExpressionTemporary = true;
      E = tempExpr->getSubExpr();
      continue;
    }
    if (auto *tempExpr = dyn_cast<CXXBindTemporaryExpr>(E)) {
      E = tempExpr->getSubExpr();
      continue;
    }
    if (auto *tempExpr = dyn_cast<CXXConstructExpr>(E)) {
      if (auto *C = tempExpr->getConstructor()) {
        if (auto *Class = C->getParent(); Class && isSafePtr(Class))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
 
        if (FollowLifetimeBound) {
          SmallVector<const Expr *, 2> LifetimeBoundArgs;
          findLifetimeBoundArgs(tempExpr, LifetimeBoundArgs);
          if (!LifetimeBoundArgs.empty())
            return tryToFindPtrOriginOfEach(
                LifetimeBoundArgs, StopAtFirstRefCountedObj, isSafePtr,
                isSafePtrType, isSafeGlobalDecl, callback,
                /*OriginDependsOnFullExpressionTemporary=*/false,
                /*PtrIsLifetimeBoundToOrigin=*/true);
        }
        break;
      }
    }
    if (auto *TempExpr = dyn_cast<CXXUnresolvedConstructExpr>(E)) {
      if (isSafePtrType(TempExpr->getTypeAsWritten()))
        return callback(TempExpr, /*IsSafe=*/true,
                        OriginDependsOnFullExpressionTemporary,
                        PtrIsLifetimeBoundToOrigin);
    }
    if (auto *POE = dyn_cast<PseudoObjectExpr>(E)) {
      if (auto *RF = POE->getResultExpr()) {
        E = RF;
        continue;
      }
    }
    if (auto *tempExpr = dyn_cast<ParenExpr>(E)) {
      E = tempExpr->getSubExpr();
      continue;
    }
    if (auto *OpaqueValue = dyn_cast<OpaqueValueExpr>(E)) {
      E = OpaqueValue->getSourceExpr();
      continue;
    }
    if (auto *Expr = dyn_cast<ConditionalOperator>(E)) {
      return tryToFindPtrOriginImpl(Expr->getTrueExpr(),
                                    StopAtFirstRefCountedObj,
                                    FollowLifetimeBound, isSafePtr,
                                    isSafePtrType, isSafeGlobalDecl, callback,
                                    OriginDependsOnFullExpressionTemporary,
                                    PtrIsLifetimeBoundToOrigin) &&
             tryToFindPtrOriginImpl(Expr->getFalseExpr(),
                                    StopAtFirstRefCountedObj,
                                    FollowLifetimeBound, isSafePtr,
                                    isSafePtrType, isSafeGlobalDecl, callback,
                                    OriginDependsOnFullExpressionTemporary,
                                    PtrIsLifetimeBoundToOrigin);
    }
    if (auto *cast = dyn_cast<CastExpr>(E)) {
      if (StopAtFirstRefCountedObj) {
        if (auto *ConversionFunc =
                dyn_cast_or_null<FunctionDecl>(cast->getConversionFunction())) {
          if (isCtorOfSafePtr(ConversionFunc))
            return callback(E, /*IsSafe=*/true,
                            OriginDependsOnFullExpressionTemporary,
                            PtrIsLifetimeBoundToOrigin);
        }
        if (isa<CXXFunctionalCastExpr>(E) && isSafePtrType(cast->getType()))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
      }
      // FIXME: This can give false "origin" that would lead to false negatives
      // in checkers. See https://reviews.llvm.org/D37023 for reference.
      E = cast->getSubExpr();
      continue;
    }
    if (auto *call = dyn_cast<CallExpr>(E)) {
      if (auto *Callee = call->getCalleeDecl()) {
        if (Callee->hasAttr<CFReturnsRetainedAttr>() ||
            Callee->hasAttr<NSReturnsRetainedAttr>() ||
            Callee->hasAttr<NSReturnsAutoreleasedAttr>()) {
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
        }
      }
 
      if (isSafePtrType(call->getType()))
        return callback(E, /*IsSafe=*/true,
                        OriginDependsOnFullExpressionTemporary,
                        PtrIsLifetimeBoundToOrigin);
 
      if (auto *memberCall = dyn_cast<CXXMemberCallExpr>(call)) {
        if (auto *decl = memberCall->getMethodDecl()) {
          std::optional<bool> IsGetterOfRefCt = isGetterOfSafePtr(decl);
          if (IsGetterOfRefCt && *IsGetterOfRefCt) {
            E = memberCall->getImplicitObjectArgument();
            if (StopAtFirstRefCountedObj) {
              return callback(E, /*IsSafe=*/true,
                              OriginDependsOnFullExpressionTemporary,
                              PtrIsLifetimeBoundToOrigin);
            }
            continue;
          }
          if (isGetterOfUniquePtr(decl)) {
            E = memberCall->getImplicitObjectArgument();
            continue;
          }
        }
      }
 
      if (auto *operatorCall = dyn_cast<CXXOperatorCallExpr>(E)) {
        if (auto *Callee = operatorCall->getDirectCallee()) {
          auto ClsName = safeGetName(Callee->getParent());
          if (isRefType(ClsName) || isCheckedPtr(ClsName) ||
              isRetainPtrOrOSPtr(ClsName) || ClsName == "unique_ptr" ||
              ClsName == "UniqueRef" || ClsName == "WeakPtr" ||
              ClsName == "WeakRef") {
            if (operatorCall->getNumArgs() == 1) {
              E = operatorCall->getArg(0);
              continue;
            }
          }
        }
      }
 
      if (auto *callee = call->getDirectCallee()) {
        if (isCtorOfSafePtr(callee)) {
          if (StopAtFirstRefCountedObj)
            return callback(E, /*IsSafe=*/true,
                            OriginDependsOnFullExpressionTemporary,
                            PtrIsLifetimeBoundToOrigin);
 
          E = call->getArg(0);
          continue;
        }
 
        if (isStdOrWTFMove(callee) && call->getNumArgs() == 1) {
          E = call->getArg(0)->IgnoreParenCasts();
          continue;
        }
 
        if (isSafePtrType(callee->getReturnType()))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
 
        if (isSingleton(callee))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
 
        if (callee->isInStdNamespace() && safeGetName(callee) == "forward") {
          E = call->getArg(0);
          continue;
        }
 
        if (isPtrConversion(callee)) {
          E = call->getArg(0);
          continue;
        }
 
        auto Name = safeGetName(callee);
        if (Name == "__builtin___CFStringMakeConstantString" ||
            Name == "NSStringFromSelector" || Name == "NSSelectorFromString" ||
            Name == "NSStringFromClass" || Name == "NSClassFromString" ||
            Name == "NSStringFromProtocol" || Name == "NSProtocolFromString")
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
      } else if (auto *CalleeE = call->getCallee()) {
        if (auto *E = dyn_cast<DeclRefExpr>(CalleeE->IgnoreParenCasts())) {
          if (isSingleton(E->getFoundDecl()))
            return callback(E, /*IsSafe=*/true,
                            OriginDependsOnFullExpressionTemporary,
                            PtrIsLifetimeBoundToOrigin);
        }
 
        if (auto *MemberExpr = dyn_cast<CXXDependentScopeMemberExpr>(CalleeE)) {
          auto *Base = MemberExpr->getBase();
          auto MemberName = MemberExpr->getMember().getAsString();
          bool IsGetter = MemberName == "get" || MemberName == "ptr";
          if (Base && isSafePtrType(Base->getType()) && IsGetter)
            return callback(E, /*IsSafe=*/true,
                            OriginDependsOnFullExpressionTemporary,
                            PtrIsLifetimeBoundToOrigin);
        }
      }
 
      // Sometimes, canonical type erroneously turns Ref<T> into T.
      // Workaround this problem by checking again if the original type was
      // a SubstTemplateTypeParmType of a safe smart pointer type (e.g. Ref).
      if (auto *CalleeDecl = call->getCalleeDecl()) {
        if (auto *FD = dyn_cast<FunctionDecl>(CalleeDecl)) {
          auto RetType = FD->getReturnType();
          if (auto *Subst = dyn_cast<SubstTemplateTypeParmType>(RetType)) {
            if (auto *SubstType = Subst->desugar().getTypePtr()) {
              if (auto *RD = dyn_cast<RecordType>(SubstType)) {
                if (auto *CXX = dyn_cast<CXXRecordDecl>(RD->getDecl()))
                  if (isSafePtr(CXX))
                    return callback(E, /*IsSafe=*/true,
                                    OriginDependsOnFullExpressionTemporary,
                                    PtrIsLifetimeBoundToOrigin);
              }
            }
          }
        }
      }
 
      if (FollowLifetimeBound) {
        SmallVector<const Expr *, 2> LifetimeBoundArgs;
        findLifetimeBoundArgs(call, LifetimeBoundArgs);
        if (!LifetimeBoundArgs.empty())
          return tryToFindPtrOriginOfEach(
              LifetimeBoundArgs, StopAtFirstRefCountedObj, isSafePtr,
              isSafePtrType, isSafeGlobalDecl, callback,
              /*OriginDependsOnFullExpressionTemporary=*/false,
              /*PtrIsLifetimeBoundToOrigin=*/true);
      }
    }
    if (auto *ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(E)) {
      if (auto *Method = ObjCMsgExpr->getMethodDecl()) {
        if (isSafePtrType(Method->getReturnType()))
          return callback(E, /*IsSafe=*/true,
                          OriginDependsOnFullExpressionTemporary,
                          PtrIsLifetimeBoundToOrigin);
      }
      auto Selector = ObjCMsgExpr->getSelector();
      auto NameForFirstSlot = Selector.getNameForSlot(0);
      if ((NameForFirstSlot == "class" || NameForFirstSlot == "superclass") &&
          !Selector.getNumArgs())
        return callback(E, /*IsSafe=*/true,
                        OriginDependsOnFullExpressionTemporary,
                        PtrIsLifetimeBoundToOrigin);
    }
    if (auto *ObjCProtocol = dyn_cast<ObjCProtocolExpr>(E))
      return callback(ObjCProtocol, /*IsSafe=*/true,
                      OriginDependsOnFullExpressionTemporary,
                      PtrIsLifetimeBoundToOrigin);
    if (auto *ObjCDict = dyn_cast<ObjCDictionaryLiteral>(E))
      return callback(ObjCDict, /*IsSafe=*/true,
                      OriginDependsOnFullExpressionTemporary,
                      PtrIsLifetimeBoundToOrigin);
    if (auto *ObjCArray = dyn_cast<ObjCArrayLiteral>(E))
      return callback(ObjCArray, /*IsSafe=*/true,
                      OriginDependsOnFullExpressionTemporary,
                      PtrIsLifetimeBoundToOrigin);
    if (auto *ObjCStr = dyn_cast<ObjCStringLiteral>(E))
      return callback(ObjCStr, /*IsSafe=*/true,
                      OriginDependsOnFullExpressionTemporary,
                      PtrIsLifetimeBoundToOrigin);
    if (auto *unaryOp = dyn_cast<UnaryOperator>(E)) {
      // FIXME: Currently accepts ANY unary operator. Is it OK?
      E = unaryOp->getSubExpr();
      continue;
    }
    if (auto *BoxedExpr = dyn_cast<ObjCBoxedExpr>(E)) {
      if (StopAtFirstRefCountedObj)
        return callback(BoxedExpr, /*IsSafe=*/true,
                        OriginDependsOnFullExpressionTemporary,
                        PtrIsLifetimeBoundToOrigin);
      E = BoxedExpr->getSubExpr();
      continue;
    }
    break;
  }
  // Some other expression.
  return callback(E, /*IsSafe=*/false, OriginDependsOnFullExpressionTemporary,
                  PtrIsLifetimeBoundToOrigin);
}
 
bool tryToFindPtrOrigin(
    const Expr *E, bool StopAtFirstRefCountedObj, bool FollowLifetimeBound,
    std::function<bool(const clang::CXXRecordDecl *)> isSafePtr,
    std::function<bool(const clang::QualType)> isSafePtrType,
    std::function<bool(const clang::Decl *)> isSafeGlobalDecl,
    std::function<bool(const clang::Expr *, bool /*IsSafe*/,
                       bool /*OriginDependsOnFullExpressionTemporary*/,
                       bool /*PtrIsLifetimeBoundToOrigin*/)>
        callback) {
  return tryToFindPtrOriginImpl(
      E, StopAtFirstRefCountedObj, FollowLifetimeBound, std::move(isSafePtr),
      std::move(isSafePtrType), std::move(isSafeGlobalDecl),
      std::move(callback),
      /*OriginDependsOnFullExpressionTemporary=*/false,
      /*PtrIsLifetimeBoundToOrigin=*/false);
}
 
bool originOutlivesCall(const Expr *E) {
  assert(E);
  auto IsCheckedLocalVarOrParam = [](const VarDecl *Decl) {
    auto Ty = Decl->getType();
    const CXXRecordDecl *CXXRD = Ty->getAsCXXRecordDecl();
    if (!CXXRD)
      CXXRD = Ty->getPointeeCXXRecordDecl();
    if (CXXRD && isWeakPtr(CXXRD))
      return false;
    return Decl->isLocalVarDeclOrParm();
  };
  if (auto *Ref = dyn_cast<DeclRefExpr>(E)) {
    auto *FoundDecl = Ref->getFoundDecl();
    if (auto *D = dyn_cast_or_null<VarDecl>(FoundDecl)) {
      if (IsCheckedLocalVarOrParam(D))
        return true;
      if (auto *ImplicitP = dyn_cast<ImplicitParamDecl>(D)) {
        auto Kind = ImplicitP->getParameterKind();
        if (Kind == ImplicitParamKind::ObjCSelf ||
            Kind == ImplicitParamKind::ObjCCmd ||
            Kind == ImplicitParamKind::CXXThis ||
            Kind == ImplicitParamKind::CXXVTT)
          return true;
      }
    } else if (auto *BD = dyn_cast_or_null<BindingDecl>(FoundDecl)) {
      if (VarDecl *VD = BD->getHoldingVar()) {
        if (IsCheckedLocalVarOrParam(VD))
          return true;
      }
    }
  }
  if (isa<CXXTemporaryObjectExpr>(E))
    return true; // A temporary lives until the end of this statement.
  if (isConstOwnerPtrMemberExpr(E))
    return true;
 
  // TODO: checker for method calls on non-refcounted objects
  return isa<CXXThisExpr>(E);
}
 
bool isNullPtr(const clang::Expr *E) {
  if (isa<CXXNullPtrLiteralExpr>(E) || isa<GNUNullExpr>(E))
    return true;
  if (auto *Int = dyn_cast_or_null<IntegerLiteral>(E)) {
    if (Int->getValue().isZero())
      return true;
  }
  return false;
}
 
bool isConstOwnerPtrMemberExpr(const clang::Expr *E) {
  if (auto *MCE = dyn_cast<CXXMemberCallExpr>(E)) {
    if (auto *Callee = MCE->getDirectCallee()) {
      auto Name = safeGetName(Callee);
      if (Name == "get" || Name == "ptr")
        E = MCE->getImplicitObjectArgument();
      if (isa<CXXConversionDecl>(Callee))
        E = MCE->getImplicitObjectArgument();
    }
  } else if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(E)) {
    if (OCE->getOperator() == OO_Star && OCE->getNumArgs() == 1)
      E = OCE->getArg(0);
  }
  const ValueDecl *D = nullptr;
  if (auto *ME = dyn_cast<MemberExpr>(E))
    D = ME->getMemberDecl();
  else if (auto *IVR = dyn_cast<ObjCIvarRefExpr>(E))
    D = IVR->getDecl();
  if (!D)
    return false;
  auto T = D->getType();
  return isOwnerPtrType(T) && T.isConstQualified();
}
 
bool isExprToGetCheckedPtrCapableMember(const clang::Expr *E) {
  auto *ME = dyn_cast<MemberExpr>(E);
  if (!ME)
    return false;
  auto *Base = ME->getBase();
  if (!Base)
    return false;
  if (!isa<CXXThisExpr>(Base->IgnoreParenCasts()))
    return false;
  auto *D = ME->getMemberDecl();
  if (!D)
    return false;
  auto T = D->getType();
  auto *CXXRD = T->getAsCXXRecordDecl();
  if (!CXXRD)
    return false;
  auto result = isCheckedPtrCapable(CXXRD);
  return result && *result;
}
 
bool isAllocInit(const Expr *E, const Expr **InnerExpr) {
  auto *ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(E);
  if (auto *POE = dyn_cast<PseudoObjectExpr>(E)) {
    if (unsigned ExprCount = POE->getNumSemanticExprs()) {
      auto *Expr = POE->getSemanticExpr(ExprCount - 1)->IgnoreParenCasts();
      ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(Expr);
      if (InnerExpr)
        *InnerExpr = ObjCMsgExpr;
    }
  }
  if (!ObjCMsgExpr)
    return false;
  auto Selector = ObjCMsgExpr->getSelector();
  auto NameForFirstSlot = Selector.getNameForSlot(0);
  if (NameForFirstSlot.starts_with("alloc") ||
      NameForFirstSlot.starts_with("copy") ||
      NameForFirstSlot.starts_with("mutableCopy")) {
    if (auto *MD = ObjCMsgExpr->getMethodDecl()) {
      if (MD->getReturnType()->isVoidType())
        return false;
    }
    return true;
  }
  if (!NameForFirstSlot.starts_with("init") &&
      !NameForFirstSlot.starts_with("_init"))
    return false;
  if (!ObjCMsgExpr->isInstanceMessage())
    return false;
  auto *Receiver = ObjCMsgExpr->getInstanceReceiver();
  if (!Receiver)
    return false;
  Receiver = Receiver->IgnoreParenCasts();
  if (auto *Inner = dyn_cast<ObjCMessageExpr>(Receiver)) {
    if (InnerExpr)
      *InnerExpr = Inner;
    auto InnerSelector = Inner->getSelector();
    return InnerSelector.getNameForSlot(0).starts_with("alloc");
  } else if (auto *CE = dyn_cast<CallExpr>(Receiver)) {
    if (InnerExpr)
      *InnerExpr = CE;
    if (auto *Callee = CE->getDirectCallee()) {
      if (Callee->getDeclName().isIdentifier()) {
        auto CalleeName = Callee->getName();
        return CalleeName.starts_with("alloc");
      }
    }
  }
  return false;
}
 
ObjCInterfaceDecl *getObjCDeclFromObjCPtr(const Type *TypePtr) {
  auto *PointeeType = TypePtr->getPointeeType().getTypePtrOrNull();
  if (!PointeeType)
    return nullptr;
  auto *Desugared = PointeeType->getUnqualifiedDesugaredType();
  if (!Desugared)
    return nullptr;
  if (auto *ObjCType = dyn_cast<ObjCInterfaceType>(Desugared))
    return ObjCType->getDecl();
  if (auto *ObjCType = dyn_cast<ObjCObjectType>(Desugared))
    return ObjCType->getInterface();
  return nullptr;
}
 
class EnsureFunctionVisitor
    : public ConstStmtVisitor<EnsureFunctionVisitor, bool> {
public:
  bool VisitStmt(const Stmt *S) {
    for (const Stmt *Child : S->children()) {
      if (Child && !Visit(Child))
        return false;
    }
    return true;
  }
 
  bool VisitReturnStmt(const ReturnStmt *RS) {
    if (auto *RV = RS->getRetValue()) {
      RV = RV->IgnoreParenCasts();
      if (isNullPtr(RV))
        return true;
      return isConstOwnerPtrMemberExpr(RV);
    }
    return false;
  }
};
 
bool EnsureFunctionAnalysis::isACallToEnsureFn(const clang::Expr *E) const {
  auto *MCE = dyn_cast<CXXMemberCallExpr>(E);
  if (!MCE)
    return false;
  auto *Callee = MCE->getDirectCallee();
  if (!Callee)
    return false;
  auto *Body = Callee->getBody();
  if (!Body || Callee->isVirtualAsWritten())
    return false;
  auto [CacheIt, IsNew] = Cache.insert(std::make_pair(Callee, false));
  if (IsNew)
    CacheIt->second = EnsureFunctionVisitor().Visit(Body);
  return CacheIt->second;
}
 
} // namespace clang