clang  14.0.0git
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
29 #include "clang/Analysis/CFG.h"
34 #include "clang/Basic/LLVM.h"
37 #include "clang/Basic/Specifiers.h"
49 #include "llvm/ADT/ArrayRef.h"
50 #include "llvm/ADT/DenseMap.h"
51 #include "llvm/ADT/ImmutableList.h"
52 #include "llvm/ADT/None.h"
53 #include "llvm/ADT/Optional.h"
54 #include "llvm/ADT/PointerIntPair.h"
55 #include "llvm/ADT/SmallSet.h"
56 #include "llvm/ADT/SmallVector.h"
57 #include "llvm/ADT/StringExtras.h"
58 #include "llvm/ADT/StringRef.h"
59 #include "llvm/Support/Casting.h"
60 #include "llvm/Support/Compiler.h"
61 #include "llvm/Support/Debug.h"
62 #include "llvm/Support/ErrorHandling.h"
63 #include "llvm/Support/raw_ostream.h"
64 #include <cassert>
65 #include <utility>
66 
67 #define DEBUG_TYPE "static-analyzer-call-event"
68 
69 using namespace clang;
70 using namespace ento;
71 
73  ASTContext &Ctx = getState()->getStateManager().getContext();
74  const Expr *E = getOriginExpr();
75  if (!E)
76  return Ctx.VoidTy;
77  return Ctx.getReferenceQualifiedType(E);
78 }
79 
80 static bool isCallback(QualType T) {
81  // If a parameter is a block or a callback, assume it can modify pointer.
82  if (T->isBlockPointerType() ||
83  T->isFunctionPointerType() ||
84  T->isObjCSelType())
85  return true;
86 
87  // Check if a callback is passed inside a struct (for both, struct passed by
88  // reference and by value). Dig just one level into the struct for now.
89 
90  if (T->isAnyPointerType() || T->isReferenceType())
91  T = T->getPointeeType();
92 
93  if (const RecordType *RT = T->getAsStructureType()) {
94  const RecordDecl *RD = RT->getDecl();
95  for (const auto *I : RD->fields()) {
96  QualType FieldT = I->getType();
97  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
98  return true;
99  }
100  }
101  return false;
102 }
103 
105  if (const auto *PT = T->getAs<PointerType>()) {
106  QualType PointeeTy = PT->getPointeeType();
107  if (PointeeTy.isConstQualified())
108  return false;
109  return PointeeTy->isVoidType();
110  } else
111  return false;
112 }
113 
114 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
115  unsigned NumOfArgs = getNumArgs();
116 
117  // If calling using a function pointer, assume the function does not
118  // satisfy the callback.
119  // TODO: We could check the types of the arguments here.
120  if (!getDecl())
121  return false;
122 
123  unsigned Idx = 0;
125  E = param_type_end();
126  I != E && Idx < NumOfArgs; ++I, ++Idx) {
127  // If the parameter is 0, it's harmless.
128  if (getArgSVal(Idx).isZeroConstant())
129  continue;
130 
131  if (Condition(*I))
132  return true;
133  }
134  return false;
135 }
136 
139 }
140 
143 }
144 
145 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
146  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
147  if (!FD)
148  return false;
149 
150  return CheckerContext::isCLibraryFunction(FD, FunctionName);
151 }
152 
154  const Decl *D = getDecl();
155  if (!D)
156  return nullptr;
157 
158  AnalysisDeclContext *ADC =
160 
161  return ADC;
162 }
163 
164 const StackFrameContext *
165 CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
167  if (!ADC)
168  return nullptr;
169 
170  const Expr *E = getOriginExpr();
171  if (!E)
172  return nullptr;
173 
174  // Recover CFG block via reverse lookup.
175  // TODO: If we were to keep CFG element information as part of the CallEvent
176  // instead of doing this reverse lookup, we would be able to build the stack
177  // frame for non-expression-based calls, and also we wouldn't need the reverse
178  // lookup.
180  const CFGBlock *B = Map->getBlock(E);
181  assert(B);
182 
183  // Also recover CFG index by scanning the CFG block.
184  unsigned Idx = 0, Sz = B->size();
185  for (; Idx < Sz; ++Idx)
186  if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
187  if (StmtElem->getStmt() == E)
188  break;
189  assert(Idx < Sz);
190 
191  return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
192 }
193 
194 const ParamVarRegion
195 *CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
196  const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
197  // We cannot construct a VarRegion without a stack frame.
198  if (!SFC)
199  return nullptr;
200 
201  const ParamVarRegion *PVR =
202  State->getStateManager().getRegionManager().getParamVarRegion(
203  getOriginExpr(), Index, SFC);
204  return PVR;
205 }
206 
207 /// Returns true if a type is a pointer-to-const or reference-to-const
208 /// with no further indirection.
209 static bool isPointerToConst(QualType Ty) {
210  QualType PointeeTy = Ty->getPointeeType();
211  if (PointeeTy == QualType())
212  return false;
213  if (!PointeeTy.isConstQualified())
214  return false;
215  if (PointeeTy->isAnyPointerType())
216  return false;
217  return true;
218 }
219 
220 // Try to retrieve the function declaration and find the function parameter
221 // types which are pointers/references to a non-pointer const.
222 // We will not invalidate the corresponding argument regions.
223 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
224  const CallEvent &Call) {
225  unsigned Idx = 0;
226  for (CallEvent::param_type_iterator I = Call.param_type_begin(),
227  E = Call.param_type_end();
228  I != E; ++I, ++Idx) {
229  if (isPointerToConst(*I))
230  PreserveArgs.insert(Idx);
231  }
232 }
233 
235  ProgramStateRef Orig) const {
236  ProgramStateRef Result = (Orig ? Orig : getState());
237 
238  // Don't invalidate anything if the callee is marked pure/const.
239  if (const Decl *callee = getDecl())
240  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
241  return Result;
242 
243  SmallVector<SVal, 8> ValuesToInvalidate;
245 
246  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
247 
248  // Indexes of arguments whose values will be preserved by the call.
249  llvm::SmallSet<unsigned, 4> PreserveArgs;
250  if (!argumentsMayEscape())
251  findPtrToConstParams(PreserveArgs, *this);
252 
253  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
254  // Mark this region for invalidation. We batch invalidate regions
255  // below for efficiency.
256  if (PreserveArgs.count(Idx))
257  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
258  ETraits.setTrait(MR->getBaseRegion(),
260  // TODO: Factor this out + handle the lower level const pointers.
261 
262  ValuesToInvalidate.push_back(getArgSVal(Idx));
263 
264  // If a function accepts an object by argument (which would of course be a
265  // temporary that isn't lifetime-extended), invalidate the object itself,
266  // not only other objects reachable from it. This is necessary because the
267  // destructor has access to the temporary object after the call.
268  // TODO: Support placement arguments once we start
269  // constructing them directly.
270  // TODO: This is unnecessary when there's no destructor, but that's
271  // currently hard to figure out.
272  if (getKind() != CE_CXXAllocator)
274  if (auto AdjIdx = getAdjustedParameterIndex(Idx))
275  if (const TypedValueRegion *TVR =
276  getParameterLocation(*AdjIdx, BlockCount))
277  ValuesToInvalidate.push_back(loc::MemRegionVal(TVR));
278  }
279 
280  // Invalidate designated regions using the batch invalidation API.
281  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
282  // global variables.
283  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
284  BlockCount, getLocationContext(),
285  /*CausedByPointerEscape*/ true,
286  /*Symbols=*/nullptr, this, &ETraits);
287 }
288 
290  const ProgramPointTag *Tag) const {
291  if (const Expr *E = getOriginExpr()) {
292  if (IsPreVisit)
293  return PreStmt(E, getLocationContext(), Tag);
294  return PostStmt(E, getLocationContext(), Tag);
295  }
296 
297  const Decl *D = getDecl();
298  assert(D && "Cannot get a program point without a statement or decl");
299 
301  if (IsPreVisit)
302  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
303  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
304 }
305 
306 SVal CallEvent::getArgSVal(unsigned Index) const {
307  const Expr *ArgE = getArgExpr(Index);
308  if (!ArgE)
309  return UnknownVal();
310  return getSVal(ArgE);
311 }
312 
314  const Expr *ArgE = getArgExpr(Index);
315  if (!ArgE)
316  return {};
317  return ArgE->getSourceRange();
318 }
319 
321  const Expr *E = getOriginExpr();
322  if (!E)
323  return UndefinedVal();
324  return getSVal(E);
325 }
326 
327 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
328 
329 void CallEvent::dump(raw_ostream &Out) const {
330  ASTContext &Ctx = getState()->getStateManager().getContext();
331  if (const Expr *E = getOriginExpr()) {
332  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
333  return;
334  }
335 
336  if (const Decl *D = getDecl()) {
337  Out << "Call to ";
338  D->print(Out, Ctx.getPrintingPolicy());
339  return;
340  }
341 
342  Out << "Unknown call (type " << getKindAsString() << ")";
343 }
344 
345 bool CallEvent::isCallStmt(const Stmt *S) {
346  return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(S);
347 }
348 
350  assert(D);
351  if (const auto *FD = dyn_cast<FunctionDecl>(D))
352  return FD->getReturnType();
353  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
354  return MD->getReturnType();
355  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
356  // Blocks are difficult because the return type may not be stored in the
357  // BlockDecl itself. The AST should probably be enhanced, but for now we
358  // just do what we can.
359  // If the block is declared without an explicit argument list, the
360  // signature-as-written just includes the return type, not the entire
361  // function type.
362  // FIXME: All blocks should have signatures-as-written, even if the return
363  // type is inferred. (That's signified with a dependent result type.)
364  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
365  QualType Ty = TSI->getType();
366  if (const FunctionType *FT = Ty->getAs<FunctionType>())
367  Ty = FT->getReturnType();
368  if (!Ty->isDependentType())
369  return Ty;
370  }
371 
372  return {};
373  }
374 
375  llvm_unreachable("unknown callable kind");
376 }
377 
378 bool CallEvent::isVariadic(const Decl *D) {
379  assert(D);
380 
381  if (const auto *FD = dyn_cast<FunctionDecl>(D))
382  return FD->isVariadic();
383  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
384  return MD->isVariadic();
385  if (const auto *BD = dyn_cast<BlockDecl>(D))
386  return BD->isVariadic();
387 
388  llvm_unreachable("unknown callable kind");
389 }
390 
391 static bool isTransparentUnion(QualType T) {
392  const RecordType *UT = T->getAsUnionType();
393  return UT && UT->getDecl()->hasAttr<TransparentUnionAttr>();
394 }
395 
396 // In some cases, symbolic cases should be transformed before we associate
397 // them with parameters. This function incapsulates such cases.
398 static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
399  const ParmVarDecl *Parameter, SValBuilder &SVB) {
400  QualType ParamType = Parameter->getType();
401  QualType ArgumentType = ArgumentExpr->getType();
402 
403  // Transparent unions allow users to easily convert values of union field
404  // types into union-typed objects.
405  //
406  // Also, more importantly, they allow users to define functions with different
407  // different parameter types, substituting types matching transparent union
408  // field types with the union type itself.
409  //
410  // Here, we check specifically for latter cases and prevent binding
411  // field-typed values to union-typed regions.
412  if (isTransparentUnion(ParamType) &&
413  // Let's check that we indeed trying to bind different types.
414  !isTransparentUnion(ArgumentType)) {
415  BasicValueFactory &BVF = SVB.getBasicValueFactory();
416 
417  llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
418  CompoundSVals = BVF.prependSVal(Value, CompoundSVals);
419 
420  // Wrap it with compound value.
421  return SVB.makeCompoundVal(ParamType, CompoundSVals);
422  }
423 
424  return Value;
425 }
426 
427 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
429  SValBuilder &SVB,
430  const CallEvent &Call,
431  ArrayRef<ParmVarDecl*> parameters) {
432  MemRegionManager &MRMgr = SVB.getRegionManager();
433 
434  // If the function has fewer parameters than the call has arguments, we simply
435  // do not bind any values to them.
436  unsigned NumArgs = Call.getNumArgs();
437  unsigned Idx = 0;
438  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
439  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
440  assert(*I && "Formal parameter has no decl?");
441 
442  // TODO: Support allocator calls.
443  if (Call.getKind() != CE_CXXAllocator)
444  if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx)))
445  continue;
446 
447  // TODO: Allocators should receive the correct size and possibly alignment,
448  // determined in compile-time but not represented as arg-expressions,
449  // which makes getArgSVal() fail and return UnknownVal.
450  SVal ArgVal = Call.getArgSVal(Idx);
451  const Expr *ArgExpr = Call.getArgExpr(Idx);
452  if (!ArgVal.isUnknown()) {
453  Loc ParamLoc = SVB.makeLoc(
454  MRMgr.getParamVarRegion(Call.getOriginExpr(), Idx, CalleeCtx));
455  Bindings.push_back(
456  std::make_pair(ParamLoc, processArgument(ArgVal, ArgExpr, *I, SVB)));
457  }
458  }
459 
460  // FIXME: Variadic arguments are not handled at all right now.
461 }
462 
464  const StackFrameContext *StackFrame = getCalleeStackFrame(0);
465  if (!StackFrame)
466  return nullptr;
467 
468  const CFGElement Element = StackFrame->getCallSiteCFGElement();
469  if (const auto Ctor = Element.getAs<CFGConstructor>()) {
470  return Ctor->getConstructionContext();
471  }
472 
473  if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
474  return RecCall->getConstructionContext();
475  }
476 
477  return nullptr;
478 }
479 
482  const auto *CC = getConstructionContext();
483  if (!CC)
484  return None;
485 
486  EvalCallOptions CallOpts;
487  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
488  SVal RetVal =
490  getLocationContext(), CC, CallOpts);
491  return RetVal;
492 }
493 
495  const FunctionDecl *D = getDecl();
496  if (!D)
497  return None;
498  return D->parameters();
499 }
500 
502  const FunctionDecl *FD = getDecl();
503  if (!FD)
504  return {};
505 
506  // Note that the AnalysisDeclContext will have the FunctionDecl with
507  // the definition (if one exists).
508  AnalysisDeclContext *AD =
510  getManager()->getContext(FD);
511  bool IsAutosynthesized;
512  Stmt* Body = AD->getBody(IsAutosynthesized);
513  LLVM_DEBUG({
514  if (IsAutosynthesized)
515  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
516  << "\n";
517  });
518  if (Body) {
519  const Decl* Decl = AD->getDecl();
520  return RuntimeDefinition(Decl);
521  }
522 
523  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
524  AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
525 
526  // Try to get CTU definition only if CTUDir is provided.
527  if (!Opts.IsNaiveCTUEnabled)
528  return {};
529 
532  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
533  CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
534  Opts.DisplayCTUProgress);
535 
536  if (!CTUDeclOrError) {
537  handleAllErrors(CTUDeclOrError.takeError(),
538  [&](const cross_tu::IndexError &IE) {
539  CTUCtx.emitCrossTUDiagnostics(IE);
540  });
541  return {};
542  }
543 
544  return RuntimeDefinition(*CTUDeclOrError);
545 }
546 
548  const StackFrameContext *CalleeCtx,
549  BindingsTy &Bindings) const {
550  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
551  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
552  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
553  D->parameters());
554 }
555 
558  return true;
559 
560  const FunctionDecl *D = getDecl();
561  if (!D)
562  return true;
563 
564  const IdentifierInfo *II = D->getIdentifier();
565  if (!II)
566  return false;
567 
568  // This set of "escaping" APIs is
569 
570  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
571  // value into thread local storage. The value can later be retrieved with
572  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
573  // parameter is 'const void *', the region escapes through the call.
574  if (II->isStr("pthread_setspecific"))
575  return true;
576 
577  // - xpc_connection_set_context stores a value which can be retrieved later
578  // with xpc_connection_get_context.
579  if (II->isStr("xpc_connection_set_context"))
580  return true;
581 
582  // - funopen - sets a buffer for future IO calls.
583  if (II->isStr("funopen"))
584  return true;
585 
586  // - __cxa_demangle - can reallocate memory and can return the pointer to
587  // the input buffer.
588  if (II->isStr("__cxa_demangle"))
589  return true;
590 
591  StringRef FName = II->getName();
592 
593  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
594  // buffer even if it is const.
595  if (FName.endswith("NoCopy"))
596  return true;
597 
598  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
599  // be deallocated by NSMapRemove.
600  if (FName.startswith("NS") && FName.contains("Insert"))
601  return true;
602 
603  // - Many CF containers allow objects to escape through custom
604  // allocators/deallocators upon container construction. (PR12101)
605  if (FName.startswith("CF") || FName.startswith("CG")) {
606  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
607  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
608  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
609  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
610  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
611  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
612  }
613 
614  return false;
615 }
616 
619  if (D)
620  return D;
621 
622  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
623 }
624 
626  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
627  if (!CE)
628  return AnyFunctionCall::getDecl();
629 
630  const FunctionDecl *D = CE->getDirectCallee();
631  if (D)
632  return D;
633 
634  return getSVal(CE->getCallee()).getAsFunctionDecl();
635 }
636 
638  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
639  SVal ThisVal = getCXXThisVal();
640  Values.push_back(ThisVal);
641 
642  // Don't invalidate if the method is const and there are no mutable fields.
643  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
644  if (!D->isConst())
645  return;
646  // Get the record decl for the class of 'This'. D->getParent() may return a
647  // base class decl, rather than the class of the instance which needs to be
648  // checked for mutable fields.
649  // TODO: We might as well look at the dynamic type of the object.
650  const Expr *Ex = getCXXThisExpr()->IgnoreParenBaseCasts();
651  QualType T = Ex->getType();
652  if (T->isPointerType()) // Arrow or implicit-this syntax?
653  T = T->getPointeeType();
654  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
655  assert(ParentRecord);
656  if (ParentRecord->hasMutableFields())
657  return;
658  // Preserve CXXThis.
659  const MemRegion *ThisRegion = ThisVal.getAsRegion();
660  if (!ThisRegion)
661  return;
662 
663  ETraits->setTrait(ThisRegion->getBaseRegion(),
665  }
666 }
667 
669  const Expr *Base = getCXXThisExpr();
670  // FIXME: This doesn't handle an overloaded ->* operator.
671  if (!Base)
672  return UnknownVal();
673 
674  SVal ThisVal = getSVal(Base);
675  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
676  return ThisVal;
677 }
678 
680  // Do we have a decl at all?
681  const Decl *D = getDecl();
682  if (!D)
683  return {};
684 
685  // If the method is non-virtual, we know we can inline it.
686  const auto *MD = cast<CXXMethodDecl>(D);
687  if (!MD->isVirtual())
689 
690  // Do we know the implicit 'this' object being called?
691  const MemRegion *R = getCXXThisVal().getAsRegion();
692  if (!R)
693  return {};
694 
695  // Do we know anything about the type of 'this'?
697  if (!DynType.isValid())
698  return {};
699 
700  // Is the type a C++ class? (This is mostly a defensive check.)
701  QualType RegionType = DynType.getType()->getPointeeType();
702  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
703 
704  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
705  if (!RD || !RD->hasDefinition())
706  return {};
707 
708  // Find the decl for this method in that class.
709  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
710  if (!Result) {
711  // We might not even get the original statically-resolved method due to
712  // some particularly nasty casting (e.g. casts to sister classes).
713  // However, we should at least be able to search up and down our own class
714  // hierarchy, and some real bugs have been caught by checking this.
715  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
716 
717  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
718  // the static type. However, because we currently don't update
719  // DynamicTypeInfo when an object is cast, we can't actually be sure the
720  // DynamicTypeInfo is up to date. This assert should be re-enabled once
721  // this is fixed. <rdar://problem/12287087>
722  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
723 
724  return {};
725  }
726 
727  // Does the decl that we found have an implementation?
728  const FunctionDecl *Definition;
729  if (!Result->hasBody(Definition)) {
730  if (!DynType.canBeASubClass())
732  return {};
733  }
734 
735  // We found a definition. If we're not sure that this devirtualization is
736  // actually what will happen at runtime, make sure to provide the region so
737  // that ExprEngine can decide what to do with it.
738  if (DynType.canBeASubClass())
739  return RuntimeDefinition(Definition, R->StripCasts());
740  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
741 }
742 
744  const StackFrameContext *CalleeCtx,
745  BindingsTy &Bindings) const {
747 
748  // Handle the binding of 'this' in the new stack frame.
749  SVal ThisVal = getCXXThisVal();
750  if (!ThisVal.isUnknown()) {
751  ProgramStateManager &StateMgr = getState()->getStateManager();
752  SValBuilder &SVB = StateMgr.getSValBuilder();
753 
754  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
755  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
756 
757  // If we devirtualized to a different member function, we need to make sure
758  // we have the proper layering of CXXBaseObjectRegions.
759  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
760  ASTContext &Ctx = SVB.getContext();
761  const CXXRecordDecl *Class = MD->getParent();
762  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
763 
764  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
765  bool Failed;
766  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
767  if (Failed) {
768  // We might have suffered some sort of placement new earlier, so
769  // we're constructing in a completely unexpected storage.
770  // Fall back to a generic pointer cast for this-value.
771  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
772  const CXXRecordDecl *StaticClass = StaticMD->getParent();
773  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
774  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
775  }
776  }
777 
778  if (!ThisVal.isUnknown())
779  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
780  }
781 }
782 
785 }
786 
788  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
789  // id-expression in the class member access expression is a qualified-id,
790  // that function is called. Otherwise, its final overrider in the dynamic type
791  // of the object expression is called.
792  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
793  if (ME->hasQualifier())
795 
797 }
798 
800  return getOriginExpr()->getArg(0);
801 }
802 
804  const Expr *Callee = getOriginExpr()->getCallee();
805  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
806 
807  return dyn_cast_or_null<BlockDataRegion>(DataReg);
808 }
809 
811  const BlockDecl *D = getDecl();
812  if (!D)
813  return None;
814  return D->parameters();
815 }
816 
818  RegionAndSymbolInvalidationTraits *ETraits) const {
819  // FIXME: This also needs to invalidate captured globals.
820  if (const MemRegion *R = getBlockRegion())
821  Values.push_back(loc::MemRegionVal(R));
822 }
823 
825  BindingsTy &Bindings) const {
826  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
827  ArrayRef<ParmVarDecl*> Params;
828  if (isConversionFromLambda()) {
829  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
830  Params = LambdaOperatorDecl->parameters();
831 
832  // For blocks converted from a C++ lambda, the callee declaration is the
833  // operator() method on the lambda so we bind "this" to
834  // the lambda captured by the block.
835  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
836  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
837  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
838  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
839  } else {
840  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
841  }
842 
843  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
844  Params);
845 }
846 
848  if (Data)
849  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
850  return UnknownVal();
851 }
852 
854  RegionAndSymbolInvalidationTraits *ETraits) const {
855  SVal V = getCXXThisVal();
856  if (SymbolRef Sym = V.getAsSymbol(true))
857  ETraits->setTrait(Sym,
859  Values.push_back(V);
860 }
861 
863  const StackFrameContext *CalleeCtx,
864  BindingsTy &Bindings) const {
866 
867  SVal ThisVal = getCXXThisVal();
868  if (!ThisVal.isUnknown()) {
869  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
870  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
871  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
872  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
873  }
874 }
875 
876 const StackFrameContext *
879  while (isa<CXXInheritedCtorInitExpr>(SFC->getCallSite()))
880  SFC = SFC->getParent()->getStackFrame();
881  return SFC;
882 }
883 
885  if (Data)
886  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
887  return UnknownVal();
888 }
889 
891  // Base destructors are always called non-virtually.
892  // Skip CXXInstanceCall's devirtualization logic in this case.
893  if (isBaseDestructor())
895 
897 }
898 
900  const ObjCMethodDecl *D = getDecl();
901  if (!D)
902  return None;
903  return D->parameters();
904 }
905 
907  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
908 
909  // If the method call is a setter for property known to be backed by
910  // an instance variable, don't invalidate the entire receiver, just
911  // the storage for that instance variable.
912  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
913  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
914  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
915  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
916  ETraits->setTrait(
917  IvarRegion,
919  ETraits->setTrait(
920  IvarRegion,
922  Values.push_back(IvarLVal);
923  }
924  return;
925  }
926  }
927 
928  Values.push_back(getReceiverSVal());
929 }
930 
932  // FIXME: Is this the best way to handle class receivers?
933  if (!isInstanceMessage())
934  return UnknownVal();
935 
936  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
937  return getSVal(RecE);
938 
939  // An instance message with no expression means we are sending to super.
940  // In this case the object reference is the same as 'self'.
941  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
942  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
943  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
944  return SelfVal;
945 }
946 
948  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
949  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
950  return true;
951 
952  if (!isInstanceMessage())
953  return false;
954 
955  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
956  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
957 
958  return (RecVal == SelfVal);
959 }
960 
962  switch (getMessageKind()) {
963  case OCM_Message:
964  return getOriginExpr()->getSourceRange();
965  case OCM_PropertyAccess:
966  case OCM_Subscript:
967  return getContainingPseudoObjectExpr()->getSourceRange();
968  }
969  llvm_unreachable("unknown message kind");
970 }
971 
972 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
973 
974 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
975  assert(Data && "Lazy lookup not yet performed.");
976  assert(getMessageKind() != OCM_Message && "Explicit message send.");
977  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
978 }
979 
980 static const Expr *
982  const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
983 
984  // This handles the funny case of assigning to the result of a getter.
985  // This can happen if the getter returns a non-const reference.
986  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
987  Syntactic = BO->getLHS()->IgnoreParens();
988 
989  return Syntactic;
990 }
991 
993  if (!Data) {
994  // Find the parent, ignoring implicit casts.
995  const ParentMap &PM = getLocationContext()->getParentMap();
997 
998  // Check if parent is a PseudoObjectExpr.
999  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1000  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1001 
1002  ObjCMessageKind K;
1003  switch (Syntactic->getStmtClass()) {
1004  case Stmt::ObjCPropertyRefExprClass:
1005  K = OCM_PropertyAccess;
1006  break;
1007  case Stmt::ObjCSubscriptRefExprClass:
1008  K = OCM_Subscript;
1009  break;
1010  default:
1011  // FIXME: Can this ever happen?
1012  K = OCM_Message;
1013  break;
1014  }
1015 
1016  if (K != OCM_Message) {
1017  const_cast<ObjCMethodCall *>(this)->Data
1018  = ObjCMessageDataTy(POE, K).getOpaqueValue();
1019  assert(getMessageKind() == K);
1020  return K;
1021  }
1022  }
1023 
1024  const_cast<ObjCMethodCall *>(this)->Data
1025  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1026  assert(getMessageKind() == OCM_Message);
1027  return OCM_Message;
1028  }
1029 
1030  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1031  if (!Info.getPointer())
1032  return OCM_Message;
1033  return static_cast<ObjCMessageKind>(Info.getInt());
1034 }
1035 
1037  // Look for properties accessed with property syntax (foo.bar = ...)
1039  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1040  assert(POE && "Property access without PseudoObjectExpr?");
1041 
1042  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1043  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1044 
1045  if (RefExpr->isExplicitProperty())
1046  return RefExpr->getExplicitProperty();
1047  }
1048 
1049  // Look for properties accessed with method syntax ([foo setBar:...]).
1050  const ObjCMethodDecl *MD = getDecl();
1051  if (!MD || !MD->isPropertyAccessor())
1052  return nullptr;
1053 
1054  // Note: This is potentially quite slow.
1055  return MD->findPropertyDecl();
1056 }
1057 
1059  Selector Sel) const {
1060  assert(IDecl);
1061  AnalysisManager &AMgr =
1062  getState()->getStateManager().getOwningEngine().getAnalysisManager();
1063  // If the class interface is declared inside the main file, assume it is not
1064  // subcassed.
1065  // TODO: It could actually be subclassed if the subclass is private as well.
1066  // This is probably very rare.
1067  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1068  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1069  return false;
1070 
1071  // Assume that property accessors are not overridden.
1073  return false;
1074 
1075  // We assume that if the method is public (declared outside of main file) or
1076  // has a parent which publicly declares the method, the method could be
1077  // overridden in a subclass.
1078 
1079  // Find the first declaration in the class hierarchy that declares
1080  // the selector.
1081  ObjCMethodDecl *D = nullptr;
1082  while (true) {
1083  D = IDecl->lookupMethod(Sel, true);
1084 
1085  // Cannot find a public definition.
1086  if (!D)
1087  return false;
1088 
1089  // If outside the main file,
1090  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1091  return true;
1092 
1093  if (D->isOverriding()) {
1094  // Search in the superclass on the next iteration.
1095  IDecl = D->getClassInterface();
1096  if (!IDecl)
1097  return false;
1098 
1099  IDecl = IDecl->getSuperClass();
1100  if (!IDecl)
1101  return false;
1102 
1103  continue;
1104  }
1105 
1106  return false;
1107  };
1108 
1109  llvm_unreachable("The while loop should always terminate.");
1110 }
1111 
1113  if (!MD)
1114  return MD;
1115 
1116  // Find the redeclaration that defines the method.
1117  if (!MD->hasBody()) {
1118  for (auto I : MD->redecls())
1119  if (I->hasBody())
1120  MD = cast<ObjCMethodDecl>(I);
1121  }
1122  return MD;
1123 }
1124 
1129 };
1130 
1131 namespace llvm {
1132 template <> struct DenseMapInfo<PrivateMethodKey> {
1133  using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1134  using SelectorInfo = DenseMapInfo<Selector>;
1135 
1136  static inline PrivateMethodKey getEmptyKey() {
1137  return {InterfaceInfo::getEmptyKey(), SelectorInfo::getEmptyKey(), false};
1138  }
1139 
1141  return {InterfaceInfo::getTombstoneKey(), SelectorInfo::getTombstoneKey(),
1142  true};
1143  }
1144 
1145  static unsigned getHashValue(const PrivateMethodKey &Key) {
1146  return llvm::hash_combine(
1147  llvm::hash_code(InterfaceInfo::getHashValue(Key.Interface)),
1148  llvm::hash_code(SelectorInfo::getHashValue(Key.LookupSelector)),
1149  Key.IsClassMethod);
1150  }
1151 
1152  static bool isEqual(const PrivateMethodKey &LHS,
1153  const PrivateMethodKey &RHS) {
1154  return InterfaceInfo::isEqual(LHS.Interface, RHS.Interface) &&
1155  SelectorInfo::isEqual(LHS.LookupSelector, RHS.LookupSelector) &&
1156  LHS.IsClassMethod == RHS.IsClassMethod;
1157  }
1158 };
1159 } // end namespace llvm
1160 
1161 static const ObjCMethodDecl *
1163  Selector LookupSelector, bool InstanceMethod) {
1164  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1165  // when in many cases it returns null. We cache the results so
1166  // that repeated queries on the same ObjCIntefaceDecl and Selector
1167  // don't incur the same cost. On some test cases, we can see the
1168  // same query being issued thousands of times.
1169  //
1170  // NOTE: This cache is essentially a "global" variable, but it
1171  // only gets lazily created when we get here. The value of the
1172  // cache probably comes from it being global across ExprEngines,
1173  // where the same queries may get issued. If we are worried about
1174  // concurrency, or possibly loading/unloading ASTs, etc., we may
1175  // need to revisit this someday. In terms of memory, this table
1176  // stays around until clang quits, which also may be bad if we
1177  // need to release memory.
1178  using PrivateMethodCache =
1179  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1180 
1181  static PrivateMethodCache PMC;
1183  PMC[{Interface, LookupSelector, InstanceMethod}];
1184 
1185  // Query lookupPrivateMethod() if the cache does not hit.
1186  if (!Val.hasValue()) {
1187  Val = Interface->lookupPrivateMethod(LookupSelector, InstanceMethod);
1188 
1189  if (!*Val) {
1190  // Query 'lookupMethod' as a backup.
1191  Val = Interface->lookupMethod(LookupSelector, InstanceMethod);
1192  }
1193  }
1194 
1195  return Val.getValue();
1196 }
1197 
1199  const ObjCMessageExpr *E = getOriginExpr();
1200  assert(E);
1201  Selector Sel = E->getSelector();
1202 
1203  if (E->isInstanceMessage()) {
1204  // Find the receiver type.
1205  const ObjCObjectType *ReceiverT = nullptr;
1206  bool CanBeSubClassed = false;
1207  bool LookingForInstanceMethod = true;
1208  QualType SupersType = E->getSuperType();
1209  const MemRegion *Receiver = nullptr;
1210 
1211  if (!SupersType.isNull()) {
1212  // The receiver is guaranteed to be 'super' in this case.
1213  // Super always means the type of immediate predecessor to the method
1214  // where the call occurs.
1215  ReceiverT = cast<ObjCObjectPointerType>(SupersType)->getObjectType();
1216  } else {
1217  Receiver = getReceiverSVal().getAsRegion();
1218  if (!Receiver)
1219  return {};
1220 
1221  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1222  if (!DTI.isValid()) {
1223  assert(isa<AllocaRegion>(Receiver) &&
1224  "Unhandled untyped region class!");
1225  return {};
1226  }
1227 
1228  QualType DynType = DTI.getType();
1229  CanBeSubClassed = DTI.canBeASubClass();
1230 
1231  const auto *ReceiverDynT =
1232  dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1233 
1234  if (ReceiverDynT) {
1235  ReceiverT = ReceiverDynT->getObjectType();
1236 
1237  // It can be actually class methods called with Class object as a
1238  // receiver. This type of messages is treated by the compiler as
1239  // instance (not class).
1240  if (ReceiverT->isObjCClass()) {
1241 
1242  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1243  // For [self classMethod], return compiler visible declaration.
1244  if (Receiver == SelfVal.getAsRegion()) {
1246  }
1247 
1248  // Otherwise, let's check if we know something about the type
1249  // inside of this class object.
1250  if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1251  DynamicTypeInfo DTI =
1252  getClassObjectDynamicTypeInfo(getState(), ReceiverSym);
1253  if (DTI.isValid()) {
1254  // Let's use this type for lookup.
1255  ReceiverT =
1256  cast<ObjCObjectType>(DTI.getType().getCanonicalType());
1257 
1258  CanBeSubClassed = DTI.canBeASubClass();
1259  // And it should be a class method instead.
1260  LookingForInstanceMethod = false;
1261  }
1262  }
1263  }
1264 
1265  if (CanBeSubClassed)
1266  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1267  // Even if `DynamicTypeInfo` told us that it can be
1268  // not necessarily this type, but its descendants, we still want
1269  // to check again if this selector can be actually overridden.
1270  CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1271  }
1272  }
1273 
1274  // Lookup the instance method implementation.
1275  if (ReceiverT)
1276  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1277  const ObjCMethodDecl *MD =
1278  lookupRuntimeDefinition(IDecl, Sel, LookingForInstanceMethod);
1279 
1280  if (MD && !MD->hasBody())
1281  MD = MD->getCanonicalDecl();
1282 
1283  if (CanBeSubClassed)
1284  return RuntimeDefinition(MD, Receiver);
1285  else
1286  return RuntimeDefinition(MD, nullptr);
1287  }
1288  } else {
1289  // This is a class method.
1290  // If we have type info for the receiver class, we are calling via
1291  // class name.
1292  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1293  // Find/Return the method implementation.
1294  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1295  }
1296  }
1297 
1298  return {};
1299 }
1300 
1302  if (isInSystemHeader() && !isInstanceMessage()) {
1303  Selector Sel = getSelector();
1304  if (Sel.getNumArgs() == 1 &&
1305  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1306  return true;
1307  }
1308 
1310 }
1311 
1313  const StackFrameContext *CalleeCtx,
1314  BindingsTy &Bindings) const {
1315  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1316  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1317  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1318  D->parameters());
1319 
1320  SVal SelfVal = getReceiverSVal();
1321  if (!SelfVal.isUnknown()) {
1322  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1323  MemRegionManager &MRMgr = SVB.getRegionManager();
1324  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1325  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1326  }
1327 }
1328 
1331  const LocationContext *LCtx) {
1332  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1333  return create<CXXMemberCall>(MCE, State, LCtx);
1334 
1335  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1336  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1337  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1338  if (MD->isInstance())
1339  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1340 
1341  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1342  return create<BlockCall>(CE, State, LCtx);
1343  }
1344 
1345  // Otherwise, it's a normal function call, static member function call, or
1346  // something we can't reason about.
1347  return create<SimpleFunctionCall>(CE, State, LCtx);
1348 }
1349 
1353  const LocationContext *ParentCtx = CalleeCtx->getParent();
1354  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1355  assert(CallerCtx && "This should not be used for top-level stack frames");
1356 
1357  const Stmt *CallSite = CalleeCtx->getCallSite();
1358 
1359  if (CallSite) {
1360  if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1361  return Out;
1362 
1363  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1364  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1365  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1366  SVal ThisVal = State->getSVal(ThisPtr);
1367 
1368  if (const auto *CE = dyn_cast<CXXConstructExpr>(CallSite))
1369  return getCXXConstructorCall(CE, ThisVal.getAsRegion(), State, CallerCtx);
1370  else if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(CallSite))
1371  return getCXXInheritedConstructorCall(CIE, ThisVal.getAsRegion(), State,
1372  CallerCtx);
1373  else {
1374  // All other cases are handled by getCall.
1375  llvm_unreachable("This is not an inlineable statement");
1376  }
1377  }
1378 
1379  // Fall back to the CFG. The only thing we haven't handled yet is
1380  // destructors, though this could change in the future.
1381  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1382  CFGElement E = (*B)[CalleeCtx->getIndex()];
1383  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1384  "All other CFG elements should have exprs");
1385 
1386  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1387  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1388  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1389  SVal ThisVal = State->getSVal(ThisPtr);
1390 
1391  const Stmt *Trigger;
1393  Trigger = AutoDtor->getTriggerStmt();
1394  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1395  Trigger = DeleteDtor->getDeleteExpr();
1396  else
1397  Trigger = Dtor->getBody();
1398 
1399  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1400  E.getAs<CFGBaseDtor>().hasValue(), State,
1401  CallerCtx);
1402 }
1403 
1405  const LocationContext *LC) {
1406  if (const auto *CE = dyn_cast<CallExpr>(S)) {
1407  return getSimpleCall(CE, State, LC);
1408  } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1409  return getCXXAllocatorCall(NE, State, LC);
1410  } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1411  return getObjCMethodCall(ME, State, LC);
1412  } else {
1413  return nullptr;
1414  }
1415 }
clang::AnalysisDeclContext::getCFGStmtMap
CFGStmtMap * getCFGStmtMap()
Definition: AnalysisDeclContext.cpp:251
clang::ento::AnyCXXConstructorCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:853
clang::ObjCMessageExpr::SuperInstance
@ SuperInstance
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1097
clang::ObjCInterfaceDecl
Represents an ObjC class declaration.
Definition: DeclObjC.h:1151
clang::ento::SVal::isValid
bool isValid() const
Definition: SVals.h:148
findPtrToConstParams
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:223
clang::ObjCMessageExpr::isInstanceMessage
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1238
clang::ObjCMessageExpr::getReceiverInterface
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:314
clang::ento::BlockCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:810
clang::ento::ObjCMethodCall::getMessageKind
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:992
clang::BlockDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:4248
clang::ento::UndefinedVal
Definition: SVals.h:224
addParameterValuesToBindings
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl * > parameters)
Definition: CallEvent.cpp:427
llvm
Definition: Dominators.h:30
clang::ento::CallEventManager::getCall
CallEventRef getCall(const Stmt *S, ProgramStateRef State, const LocationContext *LC)
Gets a call event for a function call, Objective-C method call, or a 'new' call.
Definition: CallEvent.cpp:1404
clang::ento::CXXMemberCall::getOriginExpr
const CXXMemberCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:695
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6684
clang::ento::ObjCMethodCall::getOriginExpr
const ObjCMessageExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:1130
clang::ento::CallEvent::isArgumentConstructedDirectly
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:402
Specifiers.h
clang::ento::CallEventRef
Definition: CallEvent.h:82
clang::ento::DynamicTypeInfo::getType
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
Definition: DynamicTypeInfo.h:34
clang::ento::AnyCXXConstructorCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:862
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::OCM_Subscript
@ OCM_Subscript
Definition: CallEvent.h:1099
CallDescription.h
clang::LocationContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: AnalysisDeclContext.cpp:463
clang::ento::CallEventManager::getCXXDestructorCall
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1309
clang::ObjCInterfaceDecl::lookupMethod
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class,...
Definition: DeclObjC.cpp:680
SVals.h
clang::SourceRange
A trivial tuple used to represent a source range.
Definition: SourceLocation.h:210
clang::ento::SVal::getAsFunctionDecl
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:65
clang::ObjCSubstitutionContext::Parameter
@ Parameter
The parameter type of a method or function.
clang::ento::BlockCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:817
clang::Decl::hasAttr
bool hasAttr() const
Definition: DeclBase.h:547
clang::QualType::isConstQualified
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6487
clang::ObjCMessageExpr::getSelector
Selector getSelector() const
Definition: ExprObjC.cpp:293
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:39
PrivateMethodKey::Interface
const ObjCInterfaceDecl * Interface
Definition: CallEvent.cpp:1126
AnalysisDeclContext.h
clang::ento::DynamicTypeInfo
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
Definition: DynamicTypeInfo.h:19
clang::ento::CallEvent::getOriginExpr
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:228
clang::ASTContext::VoidTy
CanQualType VoidTy
Definition: ASTContext.h:1075
llvm::SmallVector
Definition: LLVM.h:38
clang::AnalysisDeclContextManager::getStackFrame
const StackFrameContext * getStackFrame(const Decl *D)
Obtain the beginning context of the analysis.
Definition: AnalysisDeclContext.h:466
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1328
clang::ParentMap::getParentIgnoreParenCasts
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:145
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
llvm::DenseMapInfo< PrivateMethodKey >::getEmptyKey
static PrivateMethodKey getEmptyKey()
Definition: CallEvent.cpp:1136
clang::ento::AnyFunctionCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:501
clang::SourceRange::getBegin
SourceLocation getBegin() const
Definition: SourceLocation.h:219
clang::ento::ProgramStateManager::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ProgramState.h:513
clang::ento::RegionAndSymbolInvalidationTraits::TK_SuppressEscape
@ TK_SuppressEscape
Suppress pointer-escaping of a region.
Definition: MemRegion.h:1534
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:324
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:673
Attr.h
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:236
clang::ento::CallEventManager::getObjCMethodCall
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1290
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::AnalysisDeclContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.cpp:148
clang::Decl::hasBody
virtual bool hasBody() const
Returns true if this Decl represents a declaration for a body of code, such as a function or method d...
Definition: DeclBase.h:1016
clang::ento::ExprEngine::getCrossTranslationUnitContext
cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()
Definition: ExprEngine.h:223
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6467
clang::ento::ObjCMethodCall::getReceiverSVal
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:931
clang::ParmVarDecl
Represents a parameter to a function.
Definition: Decl.h:1665
clang::ento::CallEvent::hasVoidPointerToNonConstArg
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:141
DeclCXX.h
clang::StackFrameContext::getCallSiteCFGElement
CFGElement getCallSiteCFGElement() const
Definition: AnalysisDeclContext.h:329
clang::Type::isObjCSelType
bool isObjCSelType() const
Definition: Type.h:6843
clang::ObjCMethodDecl::getClassInterface
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1164
ProgramState_Fwd.h
clang::StackFrameContext::getCallSiteBlock
const CFGBlock * getCallSiteBlock() const
Definition: AnalysisDeclContext.h:323
llvm::Optional
Definition: LLVM.h:40
clang::ento::CallEvent::param_type_end
param_type_iterator param_type_end() const
Definition: CallEvent.h:459
clang::ento::CallEvent::getConstructionContext
const ConstructionContext * getConstructionContext() const
Returns the construction context of the call, if it is a C++ constructor call or a call of a function...
Definition: CallEvent.cpp:463
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
SourceManager.h
clang::ento::CallEvent::isGlobalCFunction
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CallEvent.cpp:145
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:6959
clang::ento::ObjCMethodCall::getAccessedProperty
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1036
llvm::Expected
Definition: LLVM.h:41
clang::ento::UnknownVal
Definition: SVals.h:257
clang::StackFrameContext::getIndex
unsigned getIndex() const
Definition: AnalysisDeclContext.h:327
clang::ento::CallEvent::getDeclaredResultType
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:349
clang::FunctionType
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3546
clang::ento::CallEvent::getReturnValueUnderConstruction
Optional< SVal > getReturnValueUnderConstruction() const
If the call returns a C++ record type then the region of its return value can be retrieved from its c...
Definition: CallEvent.cpp:481
clang::ento::loc::MemRegionVal
Definition: SVals.h:606
clang::ento::CallEvent::isCallStmt
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:345
clang::ObjCMessageExpr::SuperClass
@ SuperClass
The receiver is a superclass.
Definition: ExprObjC.h:1094
clang::ObjCObjectType::getInterface
ObjCInterfaceDecl * getInterface() const
Gets the interface declaration for this object type, if the base type really is an interface.
Definition: Type.h:6055
clang::ento::MemRegionManager::getVarRegion
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:946
clang::ento::CallEvent::argumentsMayEscape
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:302
clang::ObjCMethodDecl::isOverriding
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:467
clang::PostImplicitCall
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:600
clang::ento::RuntimeDefinition
Definition: CallEvent.h:106
clang::ento::ObjCMethodCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:1198
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:111
Decl.h
clang::ObjCObjectType
Represents a class type in Objective C.
Definition: Type.h:5820
CallEvent.h
DeclObjC.h
clang::Type::getAsStructureType
const RecordType * getAsStructureType() const
Definition: Type.cpp:641
clang::ento::CXXInstanceCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:637
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::CallEvent::getState
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:213
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
clang::CXXRecordDecl::hasMutableFields
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1178
clang::ento::ObjCMethodCall::getDecl
const ObjCMethodDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:1134
PrivateMethodKey
Definition: CallEvent.cpp:1125
lookupRuntimeDefinition
static const ObjCMethodDecl * lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface, Selector LookupSelector, bool InstanceMethod)
Definition: CallEvent.cpp:1162
llvm::DenseMapInfo< PrivateMethodKey >::SelectorInfo
DenseMapInfo< Selector > SelectorInfo
Definition: CallEvent.cpp:1134
clang::CXXMemberCallExpr::getImplicitObjectArgument
Expr * getImplicitObjectArgument() const
Retrieve the implicit object argument for the member call.
Definition: ExprCXX.cpp:650
clang::ASTContext::getReferenceQualifiedType
QualType getReferenceQualifiedType(const Expr *e) const
getReferenceQualifiedType - Given an expr, will return the type for that expression,...
Definition: ASTContext.cpp:5511
clang::IdentifierInfo::isStr
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Definition: IdentifierTable.h:176
DynamicTypeInfo.h
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6688
clang::CallExpr::getCallee
Expr * getCallee()
Definition: Expr.h:2945
V
#define V(N, I)
Definition: ASTContext.h:3127
clang::ento::CallEvent::getReturnValue
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:320
clang::ento::CallEvent::getLocationContext
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:218
clang::ento::ObjCMethodCall::getSelector
Selector getSelector() const
Definition: CallEvent.h:1154
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:100
ProgramPoint.h
clang::ento::OCM_PropertyAccess
@ OCM_PropertyAccess
Definition: CallEvent.h:1098
clang::CallExpr::getDirectCallee
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return null.
Definition: Expr.h:2965
clang::RecordType
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4613
llvm::DenseMapInfo< PrivateMethodKey >::isEqual
static bool isEqual(const PrivateMethodKey &LHS, const PrivateMethodKey &RHS)
Definition: CallEvent.cpp:1152
clang::ento::CallEvent::getArgSourceRange
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:313
clang::ento::BlockCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:557
clang::ento::CXXMemberOperatorCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:799
clang::ento::AnalysisManager::isInCodeFile
static bool isInCodeFile(SourceLocation SL, const SourceManager &SM)
Definition: AnalysisManager.h:125
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4162
clang::CFGConstructor
Represents C++ constructor call.
Definition: CFG.h:156
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::CXXInstanceCall::getCXXThisExpr
virtual const Expr * getCXXThisExpr() const
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.h:662
clang::ento::CallEvent::getSourceRange
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:262
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:168
DeclBase.h
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:125
clang::ento::ObjCMethodCall::isReceiverSelfOrSuper
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to 'self' or 'super'.
Definition: CallEvent.cpp:947
clang::Type::isFunctionPointerType
bool isFunctionPointerType() const
Definition: Type.h:6710
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:112
clang::ento::RegionAndSymbolInvalidationTraits::setTrait
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1718
ObjCMessageDataTy
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:972
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:212
clang::ento::SValBuilder::getCXXThis
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
Definition: SValBuilder.cpp:295
clang::ento::CXXMemberCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:787
clang::ObjCInterfaceDecl::lookupPrivateMethod
ObjCMethodDecl * lookupPrivateMethod(const Selector &Sel, bool Instance=true) const
Lookup a method in the classes implementation hierarchy.
Definition: DeclObjC.cpp:737
clang::ento::BlockCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:824
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::CallEvent::BindingsTy
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:350
clang::ento::BlockCall::getBlockRegion
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:803
clang::Selector::getNumArgs
unsigned getNumArgs() const
Definition: IdentifierTable.cpp:480
clang::CFGBlock::size
unsigned size() const
Definition: CFG.h:917
clang::Type::getAs
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7165
Store.h
clang::CallExpr::getArg
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2986
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
clang::ento::SValBuilder::getRegionManager
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:187
clang::CFGStmtMap::getBlock
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:26
processArgument
static SVal processArgument(SVal Value, const Expr *ArgumentExpr, const ParmVarDecl *Parameter, SValBuilder &SVB)
Definition: CallEvent.cpp:398
clang::ento::CXXMemberOperatorCall::getOriginExpr
const CXXOperatorCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:739
clang::PseudoObjectExpr
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:6095
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
IdentifierTable.h
clang::ento::CallEventManager::getCXXInheritedConstructorCall
CallEventRef< CXXInheritedConstructorCall > getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1302
clang::ento::VarRegion
Definition: MemRegion.h:906
clang::ento::CallEventManager::getCXXConstructorCall
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1296
clang::ento::CXXInstanceCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:743
Type.h
clang::ento::CallEvent::invalidateRegions
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:234
Expr.h
isPointerToConst
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection.
Definition: CallEvent.cpp:209
clang::ento::AnyCXXConstructorCall::getCXXThisVal
SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:847
ASTContext.h
clang::ASTContext::getRecordType
QualType getRecordType(const RecordDecl *Decl) const
Definition: ASTContext.cpp:4596
findDefiningRedecl
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1112
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:876
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::CFGCXXRecordTypedCall
Represents a function call that returns a C++ object by value.
Definition: CFG.h:184
clang::CXXRecordDecl::isDerivedFrom
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Definition: CXXInheritance.cpp:68
clang::Type::getAsCXXRecordDecl
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1760
clang::ento::CallEventManager::getCXXAllocatorCall
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1316
clang::ento::DynamicTypeInfo::isValid
bool isValid() const
Returns true if the dynamic type info is available.
Definition: DynamicTypeInfo.h:31
PathDiagnostic.h
clang::Decl::redecls
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:972
ExprObjC.h
ExprCXX.h
Base
clang::CFGStmtMap
Definition: CFGStmtMap.h:24
clang::ento::CallEvent::getDecl
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:208
clang::ento::CallEventManager::getCaller
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1351
clang::ObjCMethodDecl::getCanonicalDecl
ObjCMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclObjC.cpp:965
clang::ento::CXXDestructorCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:890
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:940
isVoidPointerToNonConst
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:104
clang::AnalysisDeclContextManager::getContext
AnalysisDeclContext * getContext(const Decl *D)
Definition: AnalysisDeclContext.cpp:295
clang::ento::CXXInstanceCall::getCXXThisVal
virtual SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:668
clang::ento::CallEventManager::getSimpleCall
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1330
clang::ento::AnyFunctionCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:547
clang::ento::ObjCMethodCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:906
CFGStmtMap.h
clang::ento::Loc
Definition: SVals.h:327
clang::format::hash_combine
static void hash_combine(std::size_t &seed, const T &v)
Definition: UnwrappedLineParser.cpp:646
clang::ento::CallEvent::hasNonZeroCallbackArg
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:137
clang::AnalysisDeclContext::getManager
AnalysisDeclContextManager * getManager() const
Definition: AnalysisDeclContext.h:108
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
clang::ento::SValBuilder
Definition: SValBuilder.h:53
getSyntacticFromForPseudoObjectExpr
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:981
clang::LocationContext::getParent
const LocationContext * getParent() const
Definition: AnalysisDeclContext.h:243
clang::ento::BlockCall::isConversionFromLambda
bool isConversionFromLambda() const
Definition: CallEvent.h:579
clang::ento::CallEvent::getArgExpr
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:271
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
clang::ParentMap
Definition: ParentMap.h:20
clang::PostStmt
Definition: ProgramPoint.h:311
SourceLocation.h
clang::Type::getAsUnionType
const RecordType * getAsUnionType() const
NOTE: getAs*ArrayType are methods on ASTContext.
Definition: Type.cpp:660
clang::PreStmt
Definition: ProgramPoint.h:295
clang::Type::isDependentType
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2174
clang::PseudoObjectExpr::getSyntacticForm
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:6139
clang::Stmt::getStmtClass
StmtClass getStmtClass() const
Definition: Stmt.h:1163
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6676
clang::ento::ObjCMessageKind
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:1097
clang::ento::ProgramStateManager
Definition: ProgramState.h:463
clang::ento::CXXDestructorCall::getCXXThisVal
SVal getCXXThisVal() const override
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:884
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:579
SValBuilder.h
clang::ento::CallEvent::param_type_iterator
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:448
clang::ento::AnalysisManager::options
AnalyzerOptions & options
Definition: AnalysisManager.h:47
clang::ObjCObjectType::isObjCClass
bool isObjCClass() const
Definition: Type.h:5889
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:270
clang::CFGElement::getAs
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
getCanonicalDecl
static const Decl * getCanonicalDecl(const Decl *D)
Definition: IndexingContext.cpp:301
clang::ASTContext::getPrintingPolicy
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:687
clang::RecordDecl::fields
field_range fields() const
Definition: Decl.h:4088
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:738
llvm::DenseMapInfo< PrivateMethodKey >::InterfaceInfo
DenseMapInfo< const ObjCInterfaceDecl * > InterfaceInfo
Definition: CallEvent.cpp:1133
llvm::ArrayRef
Definition: LLVM.h:34
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::CallEvent::param_type_begin
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call's formal parameters.
Definition: CallEvent.h:455
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:89
PrivateMethodKey::IsClassMethod
bool IsClassMethod
Definition: CallEvent.cpp:1128
clang::ObjCPropertyDecl
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:732
clang::ento::CallEvent::hasNonNullArgumentsWithType
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:114
clang::ento::CallEvent::getExtraInvalidatedValues
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.h:195
clang::StackFrameContext::getCallSite
const Stmt * getCallSite() const
Definition: AnalysisDeclContext.h:321
clang::ento::ObjCMethodCall::canBeOverridenInSubclass
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1058
clang::ento::SimpleFunctionCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:519
clang::PreImplicitCall
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:583
clang::ento::ObjCMethodCall::getSourceRange
SourceRange getSourceRange() const override
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.cpp:961
LLVM.h
clang::ento::CallEvent::getAdjustedParameterIndex
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:413
clang::ento::CallEvent::getKindAsString
virtual StringRef getKindAsString() const =0
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:163
clang::Selector::getIdentifierInfoForSlot
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
Definition: IdentifierTable.cpp:491
State
LineState State
Definition: UnwrappedLineFormatter.cpp:987
clang::ento::SimpleFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:617
clang::ObjCInterfaceDecl::getSuperClass
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:339
clang::ento::CallEvent::getProgramPoint
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:289
clang::ento::ObjCMethodCall
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1106
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::CallEvent::getNumArgs
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
clang::ento::CallEvent::Data
const void * Data
Definition: CallEvent.h:154
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:84
clang::ento::ExprEngine::getAnalysisManager
AnalysisManager & getAnalysisManager()
Definition: ExprEngine.h:208
clang::ento::CXXMemberCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:783
clang::ento::ObjCMethodCall::isInstanceMessage
bool isInstanceMessage() const
Definition: CallEvent.h:1146
clang::AnalysisDeclContext::getBody
Stmt * getBody() const
Definition: AnalysisDeclContext.cpp:126
clang::ento::AnyFunctionCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:494
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
CheckerContext.h
clang::cross_tu::CrossTranslationUnitContext::getCrossTUDefinition
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName, bool DisplayCTUProgress=false)
This function loads a function or variable definition from an external AST file and merges it into th...
Definition: CrossTranslationUnit.cpp:329
clang::ento::CallEvent::getResultType
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:72
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ento::CE_CXXAllocator
@ CE_CXXAllocator
Definition: CallEvent.h:70
clang::ento::ExprEngine
Definition: ExprEngine.h:127
ProgramState.h
clang::ento::CallEvent::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:187
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:539
clang::ento::MemRegionManager
Definition: MemRegion.h:1302
clang::ento::BlockCall::getDecl
const BlockDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:572
clang::ento::CallEvent::getKind
virtual Kind getKind() const =0
Returns the kind of call this is.
clang::ObjCMethodDecl
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
clang::PointerType
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2640
clang::ento::ObjCMethodCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:899
clang::ObjCMethodDecl::hasBody
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:527
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:225
clang::ObjCInterfaceDecl::getEndOfDefinitionLoc
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1857
clang::ento::RegionAndSymbolInvalidationTraits::TK_PreserveContents
@ TK_PreserveContents
Tells that a region's contents is not changed.
Definition: MemRegion.h:1531
ParentMap.h
clang::ObjCMethodDecl::findPropertyDecl
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method's selector.
Definition: DeclObjC.cpp:1331
clang::ento::OCM_Message
@ OCM_Message
Definition: CallEvent.h:1100
clang::IdentifierInfo::getName
StringRef getName() const
Return the actual identifier string.
Definition: IdentifierTable.h:195
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2912
PrivateMethodKey::LookupSelector
Selector LookupSelector
Definition: CallEvent.cpp:1127
clang
Definition: CalledOnceCheck.h:17
clang::Type::isAnyPointerType
bool isAnyPointerType() const
Definition: Type.h:6680
clang::ento::CallEvent::isVariadic
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:378
clang::ento::CallEvent::isInSystemHeader
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:240
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
clang::Selector
Smart pointer class that efficiently represents Objective-C method names.
Definition: IdentifierTable.h:748
clang::ento::StoreManager::attemptDownCast
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:317
CFG.h
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:144
clang::AnalysisDeclContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:106
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ObjCIvarDecl
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1924
llvm::DenseMapInfo< PrivateMethodKey >::getHashValue
static unsigned getHashValue(const PrivateMethodKey &Key)
Definition: CallEvent.cpp:1145
clang::DeclaratorContext::Condition
@ Condition
clang::ento::AnyFunctionCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:556
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
clang::ento::RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion
@ TK_DoNotInvalidateSuperRegion
Definition: MemRegion.h:1537
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:136
MemRegion.h
clang::Expr::IgnoreParenBaseCasts
Expr * IgnoreParenBaseCasts() LLVM_READONLY
Skip past any parentheses and derived-to-base casts until reaching a fixed point.
Definition: Expr.cpp:2938
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::SourceLocation::isValid
bool isValid() const
Return true if this is a valid SourceLocation object.
Definition: SourceLocation.h:110
clang::CXXRecordDecl::hasDefinition
bool hasDefinition() const
Definition: DeclCXX.h:542
clang::TypeSourceInfo
A container of type source information.
Definition: Type.h:6399
clang::ObjCMessageExpr::getMethodDecl
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1346
isTransparentUnion
static bool isTransparentUnion(QualType T)
Definition: CallEvent.cpp:391
clang::ento::CallEvent::getArgSVal
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:306
clang::ento::BlockCall::getRegionStoringCapturedLambda
const VarRegion * getRegionStoringCapturedLambda() const
For a block converted from a C++ lambda, returns the block VarRegion for the variable holding the cap...
Definition: CallEvent.h:589
clang::cross_tu::IndexError
Definition: CrossTranslationUnit.h:61
clang::ento::DynamicTypeInfo::canBeASubClass
bool canBeASubClass() const
Returns false if the type information is precise (the type 'DynTy' is the only type in the lattice),...
Definition: DynamicTypeInfo.h:28
clang::ObjCMethodDecl::isPropertyAccessor
bool isPropertyAccessor() const
Definition: DeclObjC.h:441
clang::ento::CXXInstanceCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:679
clang::RecordType::getDecl
RecordDecl * getDecl() const
Definition: Type.h:4623
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3249
clang::ento::CallEvent::getCalleeAnalysisDeclContext
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:153
clang::ObjCMethodDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:376
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:75
clang::ento::ObjCMethodCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:1312
Stmt.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
isCallback
static bool isCallback(QualType T)
Definition: CallEvent.cpp:80
llvm::SmallVectorImpl
Definition: LLVM.h:39
clang::ento::getDynamicTypeInfo
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
clang::ento::AnyFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:483
clang::ObjCMessageExpr::getSuperType
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1326
DynamicType.h
clang::ento::MemRegion::getBaseRegion
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1292
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1516
clang::ento::CXXInstanceCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:625
clang::Expr
This represents one expression.
Definition: Expr.h:109
CrossTranslationUnit.h
clang::ento::getClassObjectDynamicTypeInfo
DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym)
Get dynamic type information stored in a class object represented by Sym.
clang::ento::CallEvent::getParameterLocation
const ParamVarRegion * getParameterLocation(unsigned Index, unsigned BlockCount) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:195
llvm::DenseMapInfo< PrivateMethodKey >::getTombstoneKey
static PrivateMethodKey getTombstoneKey()
Definition: CallEvent.cpp:1140
clang::ento::ObjCMethodCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:1301
clang::FunctionDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2488
clang::Decl::getLocation
SourceLocation getLocation() const
Definition: DeclBase.h:430
clang::ento::CallEvent::dump
void dump() const
Definition: CallEvent.cpp:327
clang::LocationContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:247
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1857
clang::RecordDecl
Represents a struct/union/class.
Definition: Decl.h:3868
clang::ProgramPoint
Definition: ProgramPoint.h:59
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2795
clang::ento::CallEvent::getCalleeStackFrame
const StackFrameContext * getCalleeStackFrame(unsigned BlockCount) const
Returns the callee stack frame.
Definition: CallEvent.cpp:165
clang::ento::CXXDestructorCall::isBaseDestructor
bool isBaseDestructor() const
Returns true if this is a call to a base class destructor.
Definition: CallEvent.h:818
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::CXXInheritedConstructorCall::getInheritingStackFrame
const StackFrameContext * getInheritingStackFrame() const
Obtain the stack frame of the inheriting constructor.
Definition: CallEvent.cpp:877
clang::ento::SValBuilder::makeLoc
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:376
clang::ento::ParamVarRegion
ParamVarRegion - Represents a region for paremters.
Definition: MemRegion.h:986
clang::LocationContext::getParentMap
const ParentMap & getParentMap() const
Definition: AnalysisDeclContext.h:253
clang::CXXMethodDecl::getParent
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined.
Definition: DeclCXX.h:2063
clang::CXXMethodDecl
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1948
clang::NamedDecl::getName
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:276