clang  6.0.0svn
CallEvent.cpp
Go to the documentation of this file.
1 //===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "clang/AST/ParentMap.h"
21 #include "llvm/ADT/SmallSet.h"
22 #include "llvm/ADT/StringExtras.h"
23 #include "llvm/Support/raw_ostream.h"
24 #include "llvm/Support/Debug.h"
25 
26 #define DEBUG_TYPE "static-analyzer-call-event"
27 
28 using namespace clang;
29 using namespace ento;
30 
32  const Expr *E = getOriginExpr();
33  assert(E && "Calls without origin expressions do not have results");
34  QualType ResultTy = E->getType();
35 
36  ASTContext &Ctx = getState()->getStateManager().getContext();
37 
38  // A function that returns a reference to 'int' will have a result type
39  // of simply 'int'. Check the origin expr's value kind to recover the
40  // proper type.
41  switch (E->getValueKind()) {
42  case VK_LValue:
43  ResultTy = Ctx.getLValueReferenceType(ResultTy);
44  break;
45  case VK_XValue:
46  ResultTy = Ctx.getRValueReferenceType(ResultTy);
47  break;
48  case VK_RValue:
49  // No adjustment is necessary.
50  break;
51  }
52 
53  return ResultTy;
54 }
55 
56 static bool isCallback(QualType T) {
57  // If a parameter is a block or a callback, assume it can modify pointer.
58  if (T->isBlockPointerType() ||
59  T->isFunctionPointerType() ||
60  T->isObjCSelType())
61  return true;
62 
63  // Check if a callback is passed inside a struct (for both, struct passed by
64  // reference and by value). Dig just one level into the struct for now.
65 
66  if (T->isAnyPointerType() || T->isReferenceType())
67  T = T->getPointeeType();
68 
69  if (const RecordType *RT = T->getAsStructureType()) {
70  const RecordDecl *RD = RT->getDecl();
71  for (const auto *I : RD->fields()) {
72  QualType FieldT = I->getType();
73  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
74  return true;
75  }
76  }
77  return false;
78 }
79 
81  if (const PointerType *PT = T->getAs<PointerType>()) {
82  QualType PointeeTy = PT->getPointeeType();
83  if (PointeeTy.isConstQualified())
84  return false;
85  return PointeeTy->isVoidType();
86  } else
87  return false;
88 }
89 
90 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
91  unsigned NumOfArgs = getNumArgs();
92 
93  // If calling using a function pointer, assume the function does not
94  // satisfy the callback.
95  // TODO: We could check the types of the arguments here.
96  if (!getDecl())
97  return false;
98 
99  unsigned Idx = 0;
101  E = param_type_end();
102  I != E && Idx < NumOfArgs; ++I, ++Idx) {
103  // If the parameter is 0, it's harmless.
104  if (getArgSVal(Idx).isZeroConstant())
105  continue;
106 
107  if (Condition(*I))
108  return true;
109  }
110  return false;
111 }
112 
115 }
116 
119 }
120 
121 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
122  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
123  if (!FD)
124  return false;
125 
126  return CheckerContext::isCLibraryFunction(FD, FunctionName);
127 }
128 
129 /// \brief Returns true if a type is a pointer-to-const or reference-to-const
130 /// with no further indirection.
131 static bool isPointerToConst(QualType Ty) {
132  QualType PointeeTy = Ty->getPointeeType();
133  if (PointeeTy == QualType())
134  return false;
135  if (!PointeeTy.isConstQualified())
136  return false;
137  if (PointeeTy->isAnyPointerType())
138  return false;
139  return true;
140 }
141 
142 // Try to retrieve the function declaration and find the function parameter
143 // types which are pointers/references to a non-pointer const.
144 // We will not invalidate the corresponding argument regions.
145 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
146  const CallEvent &Call) {
147  unsigned Idx = 0;
149  E = Call.param_type_end();
150  I != E; ++I, ++Idx) {
151  if (isPointerToConst(*I))
152  PreserveArgs.insert(Idx);
153  }
154 }
155 
157  ProgramStateRef Orig) const {
158  ProgramStateRef Result = (Orig ? Orig : getState());
159 
160  // Don't invalidate anything if the callee is marked pure/const.
161  if (const Decl *callee = getDecl())
162  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
163  return Result;
164 
165  SmallVector<SVal, 8> ValuesToInvalidate;
167 
168  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
169 
170  // Indexes of arguments whose values will be preserved by the call.
171  llvm::SmallSet<unsigned, 4> PreserveArgs;
172  if (!argumentsMayEscape())
173  findPtrToConstParams(PreserveArgs, *this);
174 
175  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
176  // Mark this region for invalidation. We batch invalidate regions
177  // below for efficiency.
178  if (PreserveArgs.count(Idx))
179  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
180  ETraits.setTrait(MR->getBaseRegion(),
182  // TODO: Factor this out + handle the lower level const pointers.
183 
184  ValuesToInvalidate.push_back(getArgSVal(Idx));
185  }
186 
187  // Invalidate designated regions using the batch invalidation API.
188  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
189  // global variables.
190  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
191  BlockCount, getLocationContext(),
192  /*CausedByPointerEscape*/ true,
193  /*Symbols=*/nullptr, this, &ETraits);
194 }
195 
197  const ProgramPointTag *Tag) const {
198  if (const Expr *E = getOriginExpr()) {
199  if (IsPreVisit)
200  return PreStmt(E, getLocationContext(), Tag);
201  return PostStmt(E, getLocationContext(), Tag);
202  }
203 
204  const Decl *D = getDecl();
205  assert(D && "Cannot get a program point without a statement or decl");
206 
208  if (IsPreVisit)
209  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
210  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
211 }
212 
213 bool CallEvent::isCalled(const CallDescription &CD) const {
214  // FIXME: Add ObjC Message support.
215  if (getKind() == CE_ObjCMessage)
216  return false;
217  if (!CD.IsLookupDone) {
218  CD.IsLookupDone = true;
219  CD.II = &getState()->getStateManager().getContext().Idents.get(CD.FuncName);
220  }
221  const IdentifierInfo *II = getCalleeIdentifier();
222  if (!II || II != CD.II)
223  return false;
224  return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
225  CD.RequiredArgs == getNumArgs());
226 }
227 
228 SVal CallEvent::getArgSVal(unsigned Index) const {
229  const Expr *ArgE = getArgExpr(Index);
230  if (!ArgE)
231  return UnknownVal();
232  return getSVal(ArgE);
233 }
234 
236  const Expr *ArgE = getArgExpr(Index);
237  if (!ArgE)
238  return SourceRange();
239  return ArgE->getSourceRange();
240 }
241 
243  const Expr *E = getOriginExpr();
244  if (!E)
245  return UndefinedVal();
246  return getSVal(E);
247 }
248 
249 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
250 
251 void CallEvent::dump(raw_ostream &Out) const {
252  ASTContext &Ctx = getState()->getStateManager().getContext();
253  if (const Expr *E = getOriginExpr()) {
254  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
255  Out << "\n";
256  return;
257  }
258 
259  if (const Decl *D = getDecl()) {
260  Out << "Call to ";
261  D->print(Out, Ctx.getPrintingPolicy());
262  return;
263  }
264 
265  // FIXME: a string representation of the kind would be nice.
266  Out << "Unknown call (type " << getKind() << ")";
267 }
268 
269 
270 bool CallEvent::isCallStmt(const Stmt *S) {
271  return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
272  || isa<CXXConstructExpr>(S)
273  || isa<CXXNewExpr>(S);
274 }
275 
277  assert(D);
278  if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D))
279  return FD->getReturnType();
280  if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D))
281  return MD->getReturnType();
282  if (const BlockDecl *BD = dyn_cast<BlockDecl>(D)) {
283  // Blocks are difficult because the return type may not be stored in the
284  // BlockDecl itself. The AST should probably be enhanced, but for now we
285  // just do what we can.
286  // If the block is declared without an explicit argument list, the
287  // signature-as-written just includes the return type, not the entire
288  // function type.
289  // FIXME: All blocks should have signatures-as-written, even if the return
290  // type is inferred. (That's signified with a dependent result type.)
291  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
292  QualType Ty = TSI->getType();
293  if (const FunctionType *FT = Ty->getAs<FunctionType>())
294  Ty = FT->getReturnType();
295  if (!Ty->isDependentType())
296  return Ty;
297  }
298 
299  return QualType();
300  }
301 
302  llvm_unreachable("unknown callable kind");
303 }
304 
305 bool CallEvent::isVariadic(const Decl *D) {
306  assert(D);
307 
308  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
309  return FD->isVariadic();
310  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D))
311  return MD->isVariadic();
312  if (const BlockDecl *BD = dyn_cast<BlockDecl>(D))
313  return BD->isVariadic();
314 
315  llvm_unreachable("unknown callable kind");
316 }
317 
318 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
319  CallEvent::BindingsTy &Bindings,
320  SValBuilder &SVB,
321  const CallEvent &Call,
323  MemRegionManager &MRMgr = SVB.getRegionManager();
324 
325  // If the function has fewer parameters than the call has arguments, we simply
326  // do not bind any values to them.
327  unsigned NumArgs = Call.getNumArgs();
328  unsigned Idx = 0;
329  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
330  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
331  const ParmVarDecl *ParamDecl = *I;
332  assert(ParamDecl && "Formal parameter has no decl?");
333 
334  SVal ArgVal = Call.getArgSVal(Idx);
335  if (!ArgVal.isUnknown()) {
336  Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
337  Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
338  }
339  }
340 
341  // FIXME: Variadic arguments are not handled at all right now.
342 }
343 
345  const FunctionDecl *D = getDecl();
346  if (!D)
347  return None;
348  return D->parameters();
349 }
350 
352  const FunctionDecl *FD = getDecl();
353  // Note that the AnalysisDeclContext will have the FunctionDecl with
354  // the definition (if one exists).
355  if (FD) {
356  AnalysisDeclContext *AD =
358  getManager()->getContext(FD);
359  bool IsAutosynthesized;
360  Stmt* Body = AD->getBody(IsAutosynthesized);
361  DEBUG({
362  if (IsAutosynthesized)
363  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
364  << "\n";
365  });
366  if (Body) {
367  const Decl* Decl = AD->getDecl();
368  return RuntimeDefinition(Decl);
369  }
370  }
371 
372  return RuntimeDefinition();
373 }
374 
376  const StackFrameContext *CalleeCtx,
377  BindingsTy &Bindings) const {
378  const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl());
379  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
380  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
381  D->parameters());
382 }
383 
386  return true;
387 
388  const FunctionDecl *D = getDecl();
389  if (!D)
390  return true;
391 
392  const IdentifierInfo *II = D->getIdentifier();
393  if (!II)
394  return false;
395 
396  // This set of "escaping" APIs is
397 
398  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
399  // value into thread local storage. The value can later be retrieved with
400  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
401  // parameter is 'const void *', the region escapes through the call.
402  if (II->isStr("pthread_setspecific"))
403  return true;
404 
405  // - xpc_connection_set_context stores a value which can be retrieved later
406  // with xpc_connection_get_context.
407  if (II->isStr("xpc_connection_set_context"))
408  return true;
409 
410  // - funopen - sets a buffer for future IO calls.
411  if (II->isStr("funopen"))
412  return true;
413 
414  // - __cxa_demangle - can reallocate memory and can return the pointer to
415  // the input buffer.
416  if (II->isStr("__cxa_demangle"))
417  return true;
418 
419  StringRef FName = II->getName();
420 
421  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
422  // buffer even if it is const.
423  if (FName.endswith("NoCopy"))
424  return true;
425 
426  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
427  // be deallocated by NSMapRemove.
428  if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
429  return true;
430 
431  // - Many CF containers allow objects to escape through custom
432  // allocators/deallocators upon container construction. (PR12101)
433  if (FName.startswith("CF") || FName.startswith("CG")) {
434  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
435  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
436  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
437  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
438  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
439  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
440  }
441 
442  return false;
443 }
444 
445 
447  const FunctionDecl *D = getOriginExpr()->getDirectCallee();
448  if (D)
449  return D;
450 
451  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
452 }
453 
454 
456  const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr());
457  if (!CE)
458  return AnyFunctionCall::getDecl();
459 
460  const FunctionDecl *D = CE->getDirectCallee();
461  if (D)
462  return D;
463 
464  return getSVal(CE->getCallee()).getAsFunctionDecl();
465 }
466 
468  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
469  SVal ThisVal = getCXXThisVal();
470  Values.push_back(ThisVal);
471 
472  // Don't invalidate if the method is const and there are no mutable fields.
473  if (const CXXMethodDecl *D = cast_or_null<CXXMethodDecl>(getDecl())) {
474  if (!D->isConst())
475  return;
476  // Get the record decl for the class of 'This'. D->getParent() may return a
477  // base class decl, rather than the class of the instance which needs to be
478  // checked for mutable fields.
479  const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
480  const CXXRecordDecl *ParentRecord = Ex->getType()->getAsCXXRecordDecl();
481  if (!ParentRecord || ParentRecord->hasMutableFields())
482  return;
483  // Preserve CXXThis.
484  const MemRegion *ThisRegion = ThisVal.getAsRegion();
485  if (!ThisRegion)
486  return;
487 
488  ETraits->setTrait(ThisRegion->getBaseRegion(),
490  }
491 }
492 
494  const Expr *Base = getCXXThisExpr();
495  // FIXME: This doesn't handle an overloaded ->* operator.
496  if (!Base)
497  return UnknownVal();
498 
499  SVal ThisVal = getSVal(Base);
500  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
501  return ThisVal;
502 }
503 
504 
506  // Do we have a decl at all?
507  const Decl *D = getDecl();
508  if (!D)
509  return RuntimeDefinition();
510 
511  // If the method is non-virtual, we know we can inline it.
512  const CXXMethodDecl *MD = cast<CXXMethodDecl>(D);
513  if (!MD->isVirtual())
515 
516  // Do we know the implicit 'this' object being called?
517  const MemRegion *R = getCXXThisVal().getAsRegion();
518  if (!R)
519  return RuntimeDefinition();
520 
521  // Do we know anything about the type of 'this'?
523  if (!DynType.isValid())
524  return RuntimeDefinition();
525 
526  // Is the type a C++ class? (This is mostly a defensive check.)
527  QualType RegionType = DynType.getType()->getPointeeType();
528  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
529 
530  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
531  if (!RD || !RD->hasDefinition())
532  return RuntimeDefinition();
533 
534  // Find the decl for this method in that class.
535  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
536  if (!Result) {
537  // We might not even get the original statically-resolved method due to
538  // some particularly nasty casting (e.g. casts to sister classes).
539  // However, we should at least be able to search up and down our own class
540  // hierarchy, and some real bugs have been caught by checking this.
541  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
542 
543  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
544  // the static type. However, because we currently don't update
545  // DynamicTypeInfo when an object is cast, we can't actually be sure the
546  // DynamicTypeInfo is up to date. This assert should be re-enabled once
547  // this is fixed. <rdar://problem/12287087>
548  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
549 
550  return RuntimeDefinition();
551  }
552 
553  // Does the decl that we found have an implementation?
554  const FunctionDecl *Definition;
555  if (!Result->hasBody(Definition))
556  return RuntimeDefinition();
557 
558  // We found a definition. If we're not sure that this devirtualization is
559  // actually what will happen at runtime, make sure to provide the region so
560  // that ExprEngine can decide what to do with it.
561  if (DynType.canBeASubClass())
562  return RuntimeDefinition(Definition, R->StripCasts());
563  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
564 }
565 
567  const StackFrameContext *CalleeCtx,
568  BindingsTy &Bindings) const {
570 
571  // Handle the binding of 'this' in the new stack frame.
572  SVal ThisVal = getCXXThisVal();
573  if (!ThisVal.isUnknown()) {
574  ProgramStateManager &StateMgr = getState()->getStateManager();
575  SValBuilder &SVB = StateMgr.getSValBuilder();
576 
577  const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
578  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
579 
580  // If we devirtualized to a different member function, we need to make sure
581  // we have the proper layering of CXXBaseObjectRegions.
582  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
583  ASTContext &Ctx = SVB.getContext();
584  const CXXRecordDecl *Class = MD->getParent();
585  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
586 
587  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
588  bool Failed;
589  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
590  assert(!Failed && "Calling an incorrectly devirtualized method");
591  }
592 
593  if (!ThisVal.isUnknown())
594  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
595  }
596 }
597 
598 
599 
601  return getOriginExpr()->getImplicitObjectArgument();
602 }
603 
605  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
606  // id-expression in the class member access expression is a qualified-id,
607  // that function is called. Otherwise, its final overrider in the dynamic type
608  // of the object expression is called.
609  if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
610  if (ME->hasQualifier())
612 
614 }
615 
616 
618  return getOriginExpr()->getArg(0);
619 }
620 
621 
623  const Expr *Callee = getOriginExpr()->getCallee();
624  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
625 
626  return dyn_cast_or_null<BlockDataRegion>(DataReg);
627 }
628 
630  const BlockDecl *D = getDecl();
631  if (!D)
632  return nullptr;
633  return D->parameters();
634 }
635 
637  RegionAndSymbolInvalidationTraits *ETraits) const {
638  // FIXME: This also needs to invalidate captured globals.
639  if (const MemRegion *R = getBlockRegion())
640  Values.push_back(loc::MemRegionVal(R));
641 }
642 
644  BindingsTy &Bindings) const {
645  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
646  ArrayRef<ParmVarDecl*> Params;
647  if (isConversionFromLambda()) {
648  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
649  Params = LambdaOperatorDecl->parameters();
650 
651  // For blocks converted from a C++ lambda, the callee declaration is the
652  // operator() method on the lambda so we bind "this" to
653  // the lambda captured by the block.
654  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
655  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
656  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
657  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
658  } else {
659  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
660  }
661 
662  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
663  Params);
664 }
665 
666 
668  if (Data)
669  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
670  return UnknownVal();
671 }
672 
674  RegionAndSymbolInvalidationTraits *ETraits) const {
675  if (Data)
676  Values.push_back(loc::MemRegionVal(static_cast<const MemRegion *>(Data)));
677 }
678 
680  const StackFrameContext *CalleeCtx,
681  BindingsTy &Bindings) const {
683 
684  SVal ThisVal = getCXXThisVal();
685  if (!ThisVal.isUnknown()) {
686  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
687  const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
688  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
689  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
690  }
691 }
692 
694  if (Data)
695  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
696  return UnknownVal();
697 }
698 
700  // Base destructors are always called non-virtually.
701  // Skip CXXInstanceCall's devirtualization logic in this case.
702  if (isBaseDestructor())
704 
706 }
707 
709  const ObjCMethodDecl *D = getDecl();
710  if (!D)
711  return None;
712  return D->parameters();
713 }
714 
716  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
717 
718  // If the method call is a setter for property known to be backed by
719  // an instance variable, don't invalidate the entire receiver, just
720  // the storage for that instance variable.
721  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
722  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
723  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
724  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
725  ETraits->setTrait(
726  IvarRegion,
728  ETraits->setTrait(
729  IvarRegion,
731  Values.push_back(IvarLVal);
732  }
733  return;
734  }
735  }
736 
737  Values.push_back(getReceiverSVal());
738 }
739 
741  const LocationContext *LCtx = getLocationContext();
742  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
743  if (!SelfDecl)
744  return SVal();
745  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
746 }
747 
749  // FIXME: Is this the best way to handle class receivers?
750  if (!isInstanceMessage())
751  return UnknownVal();
752 
753  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
754  return getSVal(RecE);
755 
756  // An instance message with no expression means we are sending to super.
757  // In this case the object reference is the same as 'self'.
758  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
759  SVal SelfVal = getSelfSVal();
760  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
761  return SelfVal;
762 }
763 
765  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
766  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
767  return true;
768 
769  if (!isInstanceMessage())
770  return false;
771 
772  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
773 
774  return (RecVal == getSelfSVal());
775 }
776 
778  switch (getMessageKind()) {
779  case OCM_Message:
780  return getOriginExpr()->getSourceRange();
781  case OCM_PropertyAccess:
782  case OCM_Subscript:
783  return getContainingPseudoObjectExpr()->getSourceRange();
784  }
785  llvm_unreachable("unknown message kind");
786 }
787 
788 typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
789 
790 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
791  assert(Data && "Lazy lookup not yet performed.");
792  assert(getMessageKind() != OCM_Message && "Explicit message send.");
793  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
794 }
795 
796 static const Expr *
798  const Expr *Syntactic = POE->getSyntacticForm();
799 
800  // This handles the funny case of assigning to the result of a getter.
801  // This can happen if the getter returns a non-const reference.
802  if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic))
803  Syntactic = BO->getLHS();
804 
805  return Syntactic;
806 }
807 
809  if (!Data) {
810 
811  // Find the parent, ignoring implicit casts.
814 
815  // Check if parent is a PseudoObjectExpr.
816  if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
817  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
818 
819  ObjCMessageKind K;
820  switch (Syntactic->getStmtClass()) {
821  case Stmt::ObjCPropertyRefExprClass:
822  K = OCM_PropertyAccess;
823  break;
824  case Stmt::ObjCSubscriptRefExprClass:
825  K = OCM_Subscript;
826  break;
827  default:
828  // FIXME: Can this ever happen?
829  K = OCM_Message;
830  break;
831  }
832 
833  if (K != OCM_Message) {
834  const_cast<ObjCMethodCall *>(this)->Data
835  = ObjCMessageDataTy(POE, K).getOpaqueValue();
836  assert(getMessageKind() == K);
837  return K;
838  }
839  }
840 
841  const_cast<ObjCMethodCall *>(this)->Data
842  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
843  assert(getMessageKind() == OCM_Message);
844  return OCM_Message;
845  }
846 
847  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
848  if (!Info.getPointer())
849  return OCM_Message;
850  return static_cast<ObjCMessageKind>(Info.getInt());
851 }
852 
854  // Look for properties accessed with property syntax (foo.bar = ...)
855  if ( getMessageKind() == OCM_PropertyAccess) {
856  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
857  assert(POE && "Property access without PseudoObjectExpr?");
858 
859  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
860  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
861 
862  if (RefExpr->isExplicitProperty())
863  return RefExpr->getExplicitProperty();
864  }
865 
866  // Look for properties accessed with method syntax ([foo setBar:...]).
867  const ObjCMethodDecl *MD = getDecl();
868  if (!MD || !MD->isPropertyAccessor())
869  return nullptr;
870 
871  // Note: This is potentially quite slow.
872  return MD->findPropertyDecl();
873 }
874 
876  Selector Sel) const {
877  assert(IDecl);
878  const SourceManager &SM =
879  getState()->getStateManager().getContext().getSourceManager();
880 
881  // If the class interface is declared inside the main file, assume it is not
882  // subcassed.
883  // TODO: It could actually be subclassed if the subclass is private as well.
884  // This is probably very rare.
885  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
886  if (InterfLoc.isValid() && SM.isInMainFile(InterfLoc))
887  return false;
888 
889  // Assume that property accessors are not overridden.
890  if (getMessageKind() == OCM_PropertyAccess)
891  return false;
892 
893  // We assume that if the method is public (declared outside of main file) or
894  // has a parent which publicly declares the method, the method could be
895  // overridden in a subclass.
896 
897  // Find the first declaration in the class hierarchy that declares
898  // the selector.
899  ObjCMethodDecl *D = nullptr;
900  while (true) {
901  D = IDecl->lookupMethod(Sel, true);
902 
903  // Cannot find a public definition.
904  if (!D)
905  return false;
906 
907  // If outside the main file,
908  if (D->getLocation().isValid() && !SM.isInMainFile(D->getLocation()))
909  return true;
910 
911  if (D->isOverriding()) {
912  // Search in the superclass on the next iteration.
913  IDecl = D->getClassInterface();
914  if (!IDecl)
915  return false;
916 
917  IDecl = IDecl->getSuperClass();
918  if (!IDecl)
919  return false;
920 
921  continue;
922  }
923 
924  return false;
925  };
926 
927  llvm_unreachable("The while loop should always terminate.");
928 }
929 
931  if (!MD)
932  return MD;
933 
934  // Find the redeclaration that defines the method.
935  if (!MD->hasBody()) {
936  for (auto I : MD->redecls())
937  if (I->hasBody())
938  MD = cast<ObjCMethodDecl>(I);
939  }
940  return MD;
941 }
942 
943 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
944  const Expr* InstRec = ME->getInstanceReceiver();
945  if (!InstRec)
946  return false;
947  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
948 
949  // Check that receiver is called 'self'.
950  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
951  !InstRecIg->getFoundDecl()->getName().equals("self"))
952  return false;
953 
954  // Check that the method name is 'class'.
955  if (ME->getSelector().getNumArgs() != 0 ||
956  !ME->getSelector().getNameForSlot(0).equals("class"))
957  return false;
958 
959  return true;
960 }
961 
963  const ObjCMessageExpr *E = getOriginExpr();
964  assert(E);
965  Selector Sel = E->getSelector();
966 
967  if (E->isInstanceMessage()) {
968 
969  // Find the receiver type.
970  const ObjCObjectPointerType *ReceiverT = nullptr;
971  bool CanBeSubClassed = false;
972  QualType SupersType = E->getSuperType();
973  const MemRegion *Receiver = nullptr;
974 
975  if (!SupersType.isNull()) {
976  // The receiver is guaranteed to be 'super' in this case.
977  // Super always means the type of immediate predecessor to the method
978  // where the call occurs.
979  ReceiverT = cast<ObjCObjectPointerType>(SupersType);
980  } else {
981  Receiver = getReceiverSVal().getAsRegion();
982  if (!Receiver)
983  return RuntimeDefinition();
984 
985  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
986  if (!DTI.isValid()) {
987  assert(isa<AllocaRegion>(Receiver) &&
988  "Unhandled untyped region class!");
989  return RuntimeDefinition();
990  }
991 
992  QualType DynType = DTI.getType();
993  CanBeSubClassed = DTI.canBeASubClass();
994  ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
995 
996  if (ReceiverT && CanBeSubClassed)
997  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
998  if (!canBeOverridenInSubclass(IDecl, Sel))
999  CanBeSubClassed = false;
1000  }
1001 
1002  // Handle special cases of '[self classMethod]' and
1003  // '[[self class] classMethod]', which are treated by the compiler as
1004  // instance (not class) messages. We will statically dispatch to those.
1005  if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1006  // For [self classMethod], return the compiler visible declaration.
1007  if (PT->getObjectType()->isObjCClass() &&
1008  Receiver == getSelfSVal().getAsRegion())
1010 
1011  // Similarly, handle [[self class] classMethod].
1012  // TODO: We are currently doing a syntactic match for this pattern with is
1013  // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1014  // shows. A better way would be to associate the meta type with the symbol
1015  // using the dynamic type info tracking and use it here. We can add a new
1016  // SVal for ObjC 'Class' values that know what interface declaration they
1017  // come from. Then 'self' in a class method would be filled in with
1018  // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1019  // do proper dynamic dispatch for class methods just like we do for
1020  // instance methods now.
1021  if (E->getInstanceReceiver())
1022  if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1023  if (isCallToSelfClass(M))
1025  }
1026 
1027  // Lookup the instance method implementation.
1028  if (ReceiverT)
1029  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1030  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1031  // when in many cases it returns null. We cache the results so
1032  // that repeated queries on the same ObjCIntefaceDecl and Selector
1033  // don't incur the same cost. On some test cases, we can see the
1034  // same query being issued thousands of times.
1035  //
1036  // NOTE: This cache is essentially a "global" variable, but it
1037  // only gets lazily created when we get here. The value of the
1038  // cache probably comes from it being global across ExprEngines,
1039  // where the same queries may get issued. If we are worried about
1040  // concurrency, or possibly loading/unloading ASTs, etc., we may
1041  // need to revisit this someday. In terms of memory, this table
1042  // stays around until clang quits, which also may be bad if we
1043  // need to release memory.
1044  typedef std::pair<const ObjCInterfaceDecl*, Selector>
1045  PrivateMethodKey;
1046  typedef llvm::DenseMap<PrivateMethodKey,
1048  PrivateMethodCache;
1049 
1050  static PrivateMethodCache PMC;
1051  Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1052 
1053  // Query lookupPrivateMethod() if the cache does not hit.
1054  if (!Val.hasValue()) {
1055  Val = IDecl->lookupPrivateMethod(Sel);
1056 
1057  // If the method is a property accessor, we should try to "inline" it
1058  // even if we don't actually have an implementation.
1059  if (!*Val)
1060  if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1061  if (CompileTimeMD->isPropertyAccessor()) {
1062  if (!CompileTimeMD->getSelfDecl() &&
1063  isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1064  // If the method is an accessor in a category, and it doesn't
1065  // have a self declaration, first
1066  // try to find the method in a class extension. This
1067  // works around a bug in Sema where multiple accessors
1068  // are synthesized for properties in class
1069  // extensions that are redeclared in a category and the
1070  // the implicit parameters are not filled in for
1071  // the method on the category.
1072  // This ensures we find the accessor in the extension, which
1073  // has the implicit parameters filled in.
1074  auto *ID = CompileTimeMD->getClassInterface();
1075  for (auto *CatDecl : ID->visible_extensions()) {
1076  Val = CatDecl->getMethod(Sel,
1077  CompileTimeMD->isInstanceMethod());
1078  if (*Val)
1079  break;
1080  }
1081  }
1082  if (!*Val)
1083  Val = IDecl->lookupInstanceMethod(Sel);
1084  }
1085  }
1086 
1087  const ObjCMethodDecl *MD = Val.getValue();
1088  if (CanBeSubClassed)
1089  return RuntimeDefinition(MD, Receiver);
1090  else
1091  return RuntimeDefinition(MD, nullptr);
1092  }
1093 
1094  } else {
1095  // This is a class method.
1096  // If we have type info for the receiver class, we are calling via
1097  // class name.
1098  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1099  // Find/Return the method implementation.
1100  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1101  }
1102  }
1103 
1104  return RuntimeDefinition();
1105 }
1106 
1108  if (isInSystemHeader() && !isInstanceMessage()) {
1109  Selector Sel = getSelector();
1110  if (Sel.getNumArgs() == 1 &&
1111  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1112  return true;
1113  }
1114 
1116 }
1117 
1119  const StackFrameContext *CalleeCtx,
1120  BindingsTy &Bindings) const {
1121  const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1122  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1123  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1124  D->parameters());
1125 
1126  SVal SelfVal = getReceiverSVal();
1127  if (!SelfVal.isUnknown()) {
1128  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1129  MemRegionManager &MRMgr = SVB.getRegionManager();
1130  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1131  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1132  }
1133 }
1134 
1137  const LocationContext *LCtx) {
1138  if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1139  return create<CXXMemberCall>(MCE, State, LCtx);
1140 
1141  if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1142  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1143  if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1144  if (MD->isInstance())
1145  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1146 
1147  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1148  return create<BlockCall>(CE, State, LCtx);
1149  }
1150 
1151  // Otherwise, it's a normal function call, static member function call, or
1152  // something we can't reason about.
1153  return create<SimpleFunctionCall>(CE, State, LCtx);
1154 }
1155 
1156 
1159  ProgramStateRef State) {
1160  const LocationContext *ParentCtx = CalleeCtx->getParent();
1161  const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame();
1162  assert(CallerCtx && "This should not be used for top-level stack frames");
1163 
1164  const Stmt *CallSite = CalleeCtx->getCallSite();
1165 
1166  if (CallSite) {
1167  if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
1168  return getSimpleCall(CE, State, CallerCtx);
1169 
1170  switch (CallSite->getStmtClass()) {
1171  case Stmt::CXXConstructExprClass:
1172  case Stmt::CXXTemporaryObjectExprClass: {
1173  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1174  const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1175  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1176  SVal ThisVal = State->getSVal(ThisPtr);
1177 
1178  return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1179  ThisVal.getAsRegion(), State, CallerCtx);
1180  }
1181  case Stmt::CXXNewExprClass:
1182  return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
1183  case Stmt::ObjCMessageExprClass:
1184  return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
1185  State, CallerCtx);
1186  default:
1187  llvm_unreachable("This is not an inlineable statement.");
1188  }
1189  }
1190 
1191  // Fall back to the CFG. The only thing we haven't handled yet is
1192  // destructors, though this could change in the future.
1193  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1194  CFGElement E = (*B)[CalleeCtx->getIndex()];
1195  assert(E.getAs<CFGImplicitDtor>() &&
1196  "All other CFG elements should have exprs");
1197  assert(!E.getAs<CFGTemporaryDtor>() && "We don't handle temporaries yet");
1198 
1199  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1200  const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1201  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1202  SVal ThisVal = State->getSVal(ThisPtr);
1203 
1204  const Stmt *Trigger;
1206  Trigger = AutoDtor->getTriggerStmt();
1207  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1208  Trigger = cast<Stmt>(DeleteDtor->getDeleteExpr());
1209  else
1210  Trigger = Dtor->getBody();
1211 
1212  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1213  E.getAs<CFGBaseDtor>().hasValue(), State,
1214  CallerCtx);
1215 }
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:788
A call to an overloaded operator written using operator syntax.
Definition: ExprCXX.h:78
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1060
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:296
SVal getSelfSVal() const
Return the value of &#39;self&#39; if available.
Definition: CallEvent.cpp:740
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:748
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:673
An instance of this class is created to represent a function declaration or definition.
Definition: Decl.h:1697
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:5013
Smart pointer class that efficiently represents Objective-C method names.
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2285
A (possibly-)qualified type.
Definition: Type.h:653
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
bool isBlockPointerType() const
Definition: Type.h:5952
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:384
Selector getSelector() const
Definition: ExprObjC.cpp:312
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1101
Stmt * getBody() const
Get the body of the Declaration.
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:797
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1383
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:196
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3058
static bool isCallToSelfClass(const ObjCMessageExpr *ME)
Definition: CallEvent.cpp:943
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:456
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:333
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
bool isVirtual() const
Definition: DeclCXX.h:2009
const RecordType * getAsStructureType() const
Definition: Type.cpp:472
CFGDeleteDtor - Represents C++ object destructor generated from a call to delete. ...
Definition: CFG.h:279
SourceRange getSourceRange() const override
Definition: CallEvent.cpp:777
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:552
A container of type source information.
Definition: Decl.h:86
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1136
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:566
Expr * ignoreParenBaseCasts() LLVM_READONLY
Ignore parentheses and derived-to-base casts.
Definition: Expr.cpp:2535
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:472
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:225
VarDecl - An instance of this class is created to represent a variable declaration or definition...
Definition: Decl.h:806
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6307
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1490
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:185
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:80
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:617
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:399
ArrayRef< ParmVarDecl * > parameters() const override
Return call&#39;s formal parameters.
Definition: CallEvent.cpp:344
ParmVarDecl - Represents a parameter to a function.
Definition: Decl.h:1513
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:636
IdentifierInfo * getIdentifier() const
getIdentifier - Get the identifier that names this declaration, if there is one.
Definition: Decl.h:265
RecordDecl - Represents a struct/union/class.
Definition: Decl.h:3478
bool isValid() const
Return false if no dynamic type info is available.
One of these records is kept for each identifier that is lexed.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:604
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:150
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:354
param_type_iterator param_type_end() const
Definition: CallEvent.h:410
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:149
field_range fields() const
Definition: Decl.h:3609
AnalysisDeclContext contains the context data for the function or method under analysis.
CFGAutomaticObjDtor - Represents C++ object destructor implicitly generated for automatic object or t...
Definition: CFG.h:253
CXXMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclCXX.h:2046
bool isReferenceType() const
Definition: Type.h:5956
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:275
bool isObjCSelType() const
Definition: Type.h:6082
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:107
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2161
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl *> parameters)
Definition: CallEvent.cpp:318
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:656
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:870
virtual Kind getKind() const =0
Returns the kind of call this is.
Stmt * getBody(const FunctionDecl *&Definition) const
Retrieve the body (definition) of the function.
Definition: Decl.cpp:2612
const ImplicitParamDecl * getSelfDecl() const
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:113
An x-value expression is a reference to an object with independent storage but which can be "moved"...
Definition: Specifiers.h:116
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:405
const StackFrameContext * getCurrentStackFrame() const
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:145
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:635
const LocationContext * getParent() const
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2985
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection...
Definition: CallEvent.cpp:131
bool isUnknown() const
Definition: SVals.h:125
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:930
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:242
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:435
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call&#39;s formal parameters.
Definition: CallEvent.h:406
Represents an ObjC class declaration.
Definition: DeclObjC.h:1191
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:305
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:865
CXXMethodDecl * getCorrespondingMethodInClass(const CXXRecordDecl *RD, bool MayBeBase=false)
Find the method in RD that corresponds to this one.
Definition: DeclCXX.cpp:1657
const CFGBlock * getCallSiteBlock() const
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:600
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:861
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:764
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1590
const Stmt * getCallSite() const
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:708
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:422
bool argumentsMayEscape() const override
Definition: CallEvent.cpp:1107
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:329
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:629
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:215
static bool isCallback(QualType T)
Definition: CallEvent.cpp:56
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Definition: Decl.h:3685
bool canBeASubClass() const
Returns false if the type information is precise (the type T is the only type in the lattice)...
Expr - This represents one expression.
Definition: Expr.h:106
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call&#39;s formal parameters.
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:1118
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:446
const FunctionProtoType * T
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Definition: CallEvent.cpp:1158
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2620
const Expr * getCallee() const
Definition: Expr.h:2249
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:237
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
bool isValid() const
Definition: SVals.h:137
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:330
virtual SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:493
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:335
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:643
bool hasBody(const FunctionDecl *&Definition) const
Returns true if the function has a body (definition).
Definition: Decl.cpp:2576
QualType getType() const
Definition: Expr.h:128
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:205
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:903
QualType getRecordType(const RecordDecl *Decl) const
unsigned getNumArgs() const
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:715
CFGBaseDtor - Represents C++ object destructor implicitly generated for base object in destructor...
Definition: CFG.h:305
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:719
const SourceManager & SM
Definition: Format.cpp:1337
ParentMap & getParentMap() const
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:306
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:505
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:5779
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:266
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
Definition: CallEvent.cpp:375
const MemRegion * StripCasts(bool StripBaseCasts=true) const
Definition: MemRegion.cpp:1119
const ImplicitParamDecl * getSelfDecl() const
Return the ImplicitParamDecl* associated with &#39;self&#39; if this AnalysisDeclContext wraps an ObjCMethodD...
Defines the runtime definition of the called function.
Definition: CallEvent.h:104
QualType getCanonicalType() const
Definition: Type.h:5759
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:4969
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:55
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:467
Encodes a location in the source.
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:455
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:270
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
Represents a call to a member function that may be written either with member call syntax (e...
Definition: ExprCXX.h:164
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1964
ASTContext & getContext()
Definition: SValBuilder.h:131
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
bool isInMainFile(SourceLocation Loc) const
Returns whether the PresumedLoc for a given SourceLocation is in the main file.
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:5948
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:746
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:699
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1302
Tells that a region&#39;s contents is not changed.
Definition: MemRegion.h:1397
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:194
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:101
StringRef getName() const
Return the actual identifier string.
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1206
static const unsigned NoArgRequirement
Definition: CallEvent.h:63
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:936
SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:667
Dataflow Directional Tag Classes.
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:875
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:622
bool isValid() const
Return true if this is a valid SourceLocation object.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:235
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:569
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return 0.
Definition: Expr.cpp:1216
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg)
Get dynamic type information for a region.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:962
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:783
QualType getSuperType() const
Retrieve the type referred to by &#39;super&#39;.
Definition: ExprObjC.h:1282
StmtClass getStmtClass() const
Definition: Stmt.h:378
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:117
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2085
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:808
const Decl * getDecl() const
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
Definition: Expr.cpp:2552
Represents a pointer to an Objective C object.
Definition: Type.h:5442
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:52
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:3978
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5498
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:524
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:276
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:121
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class, its categories, and its super classes (using a linear search).
Definition: DeclObjC.cpp:675
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:31
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1304
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method&#39;s selector.
Definition: DeclObjC.cpp:1261
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:90
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:210
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:2387
Represents a C++ struct/union/class.
Definition: DeclCXX.h:299
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
bool isVoidType() const
Definition: Type.h:6171
SVal getCXXThisVal() const override
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:693
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
Definition: CFG.h:228
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:213
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1964
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
CFGElement - Represents a top-level expression in a basic block.
Definition: CFG.h:54
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1093
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:265
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2209
StringRef getName() const
getName - Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:270
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:853
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:133
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:156
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:1860
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:956
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:3770
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:228
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:111
const void * Data
Definition: CallEvent.h:153
A trivial tuple used to represent a source range.
bool isPropertyAccessor() const
Definition: DeclObjC.h:459
AnalysisDeclContext * getAnalysisDeclContext() const
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1897
bool isFunctionPointerType() const
Definition: Type.h:5968
The receiver is a superclass.
Definition: ExprObjC.h:1057
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1194
SourceLocation getBegin() const
This class handles loading and caching of source files into memory.
CFGTemporaryDtor - Represents C++ object destructor implicitly generated at the end of full expressio...
Definition: CFG.h:347
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:351
bool isUnknownOrUndef() const
Definition: SVals.h:133
SourceLocation getLocation() const
Definition: DeclBase.h:416
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:405
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:679