clang  15.0.0git
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
29 #include "clang/Analysis/CFG.h"
34 #include "clang/Basic/LLVM.h"
37 #include "clang/Basic/Specifiers.h"
49 #include "llvm/ADT/ArrayRef.h"
50 #include "llvm/ADT/DenseMap.h"
51 #include "llvm/ADT/ImmutableList.h"
52 #include "llvm/ADT/None.h"
53 #include "llvm/ADT/Optional.h"
54 #include "llvm/ADT/PointerIntPair.h"
55 #include "llvm/ADT/SmallSet.h"
56 #include "llvm/ADT/SmallVector.h"
57 #include "llvm/ADT/StringExtras.h"
58 #include "llvm/ADT/StringRef.h"
59 #include "llvm/Support/Casting.h"
60 #include "llvm/Support/Compiler.h"
61 #include "llvm/Support/Debug.h"
62 #include "llvm/Support/ErrorHandling.h"
63 #include "llvm/Support/raw_ostream.h"
64 #include <cassert>
65 #include <utility>
66 
67 #define DEBUG_TYPE "static-analyzer-call-event"
68 
69 using namespace clang;
70 using namespace ento;
71 
73  ASTContext &Ctx = getState()->getStateManager().getContext();
74  const Expr *E = getOriginExpr();
75  if (!E)
76  return Ctx.VoidTy;
77  return Ctx.getReferenceQualifiedType(E);
78 }
79 
80 static bool isCallback(QualType T) {
81  // If a parameter is a block or a callback, assume it can modify pointer.
82  if (T->isBlockPointerType() ||
83  T->isFunctionPointerType() ||
84  T->isObjCSelType())
85  return true;
86 
87  // Check if a callback is passed inside a struct (for both, struct passed by
88  // reference and by value). Dig just one level into the struct for now.
89 
90  if (T->isAnyPointerType() || T->isReferenceType())
91  T = T->getPointeeType();
92 
93  if (const RecordType *RT = T->getAsStructureType()) {
94  const RecordDecl *RD = RT->getDecl();
95  for (const auto *I : RD->fields()) {
96  QualType FieldT = I->getType();
97  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
98  return true;
99  }
100  }
101  return false;
102 }
103 
105  if (const auto *PT = T->getAs<PointerType>()) {
106  QualType PointeeTy = PT->getPointeeType();
107  if (PointeeTy.isConstQualified())
108  return false;
109  return PointeeTy->isVoidType();
110  } else
111  return false;
112 }
113 
114 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
115  unsigned NumOfArgs = getNumArgs();
116 
117  // If calling using a function pointer, assume the function does not
118  // satisfy the callback.
119  // TODO: We could check the types of the arguments here.
120  if (!getDecl())
121  return false;
122 
123  unsigned Idx = 0;
125  E = param_type_end();
126  I != E && Idx < NumOfArgs; ++I, ++Idx) {
127  // If the parameter is 0, it's harmless.
128  if (getArgSVal(Idx).isZeroConstant())
129  continue;
130 
131  if (Condition(*I))
132  return true;
133  }
134  return false;
135 }
136 
139 }
140 
143 }
144 
145 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
146  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
147  if (!FD)
148  return false;
149 
150  return CheckerContext::isCLibraryFunction(FD, FunctionName);
151 }
152 
154  const Decl *D = getDecl();
155  if (!D)
156  return nullptr;
157 
158  AnalysisDeclContext *ADC =
160 
161  return ADC;
162 }
163 
164 const StackFrameContext *
165 CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
167  if (!ADC)
168  return nullptr;
169 
170  const Expr *E = getOriginExpr();
171  if (!E)
172  return nullptr;
173 
174  // Recover CFG block via reverse lookup.
175  // TODO: If we were to keep CFG element information as part of the CallEvent
176  // instead of doing this reverse lookup, we would be able to build the stack
177  // frame for non-expression-based calls, and also we wouldn't need the reverse
178  // lookup.
180  const CFGBlock *B = Map->getBlock(E);
181  assert(B);
182 
183  // Also recover CFG index by scanning the CFG block.
184  unsigned Idx = 0, Sz = B->size();
185  for (; Idx < Sz; ++Idx)
186  if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
187  if (StmtElem->getStmt() == E)
188  break;
189  assert(Idx < Sz);
190 
191  return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
192 }
193 
194 const ParamVarRegion
195 *CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
196  const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
197  // We cannot construct a VarRegion without a stack frame.
198  if (!SFC)
199  return nullptr;
200 
201  const ParamVarRegion *PVR =
202  State->getStateManager().getRegionManager().getParamVarRegion(
203  getOriginExpr(), Index, SFC);
204  return PVR;
205 }
206 
207 /// Returns true if a type is a pointer-to-const or reference-to-const
208 /// with no further indirection.
209 static bool isPointerToConst(QualType Ty) {
210  QualType PointeeTy = Ty->getPointeeType();
211  if (PointeeTy == QualType())
212  return false;
213  if (!PointeeTy.isConstQualified())
214  return false;
215  if (PointeeTy->isAnyPointerType())
216  return false;
217  return true;
218 }
219 
220 // Try to retrieve the function declaration and find the function parameter
221 // types which are pointers/references to a non-pointer const.
222 // We will not invalidate the corresponding argument regions.
223 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
224  const CallEvent &Call) {
225  unsigned Idx = 0;
226  for (CallEvent::param_type_iterator I = Call.param_type_begin(),
227  E = Call.param_type_end();
228  I != E; ++I, ++Idx) {
229  if (isPointerToConst(*I))
230  PreserveArgs.insert(Idx);
231  }
232 }
233 
235  ProgramStateRef Orig) const {
236  ProgramStateRef Result = (Orig ? Orig : getState());
237 
238  // Don't invalidate anything if the callee is marked pure/const.
239  if (const Decl *callee = getDecl())
240  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
241  return Result;
242 
243  SmallVector<SVal, 8> ValuesToInvalidate;
245 
246  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
247 
248  // Indexes of arguments whose values will be preserved by the call.
249  llvm::SmallSet<unsigned, 4> PreserveArgs;
250  if (!argumentsMayEscape())
251  findPtrToConstParams(PreserveArgs, *this);
252 
253  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
254  // Mark this region for invalidation. We batch invalidate regions
255  // below for efficiency.
256  if (PreserveArgs.count(Idx))
257  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
258  ETraits.setTrait(MR->getBaseRegion(),
260  // TODO: Factor this out + handle the lower level const pointers.
261 
262  ValuesToInvalidate.push_back(getArgSVal(Idx));
263 
264  // If a function accepts an object by argument (which would of course be a
265  // temporary that isn't lifetime-extended), invalidate the object itself,
266  // not only other objects reachable from it. This is necessary because the
267  // destructor has access to the temporary object after the call.
268  // TODO: Support placement arguments once we start
269  // constructing them directly.
270  // TODO: This is unnecessary when there's no destructor, but that's
271  // currently hard to figure out.
272  if (getKind() != CE_CXXAllocator)
274  if (auto AdjIdx = getAdjustedParameterIndex(Idx))
275  if (const TypedValueRegion *TVR =
276  getParameterLocation(*AdjIdx, BlockCount))
277  ValuesToInvalidate.push_back(loc::MemRegionVal(TVR));
278  }
279 
280  // Invalidate designated regions using the batch invalidation API.
281  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
282  // global variables.
283  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
284  BlockCount, getLocationContext(),
285  /*CausedByPointerEscape*/ true,
286  /*Symbols=*/nullptr, this, &ETraits);
287 }
288 
290  const ProgramPointTag *Tag) const {
291  if (const Expr *E = getOriginExpr()) {
292  if (IsPreVisit)
293  return PreStmt(E, getLocationContext(), Tag);
294  return PostStmt(E, getLocationContext(), Tag);
295  }
296 
297  const Decl *D = getDecl();
298  assert(D && "Cannot get a program point without a statement or decl");
299 
301  if (IsPreVisit)
302  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
303  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
304 }
305 
306 SVal CallEvent::getArgSVal(unsigned Index) const {
307  const Expr *ArgE = getArgExpr(Index);
308  if (!ArgE)
309  return UnknownVal();
310  return getSVal(ArgE);
311 }
312 
314  const Expr *ArgE = getArgExpr(Index);
315  if (!ArgE)
316  return {};
317  return ArgE->getSourceRange();
318 }
319 
321  const Expr *E = getOriginExpr();
322  if (!E)
323  return UndefinedVal();
324  return getSVal(E);
325 }
326 
327 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
328 
329 void CallEvent::dump(raw_ostream &Out) const {
330  ASTContext &Ctx = getState()->getStateManager().getContext();
331  if (const Expr *E = getOriginExpr()) {
332  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
333  return;
334  }
335 
336  if (const Decl *D = getDecl()) {
337  Out << "Call to ";
338  D->print(Out, Ctx.getPrintingPolicy());
339  return;
340  }
341 
342  Out << "Unknown call (type " << getKindAsString() << ")";
343 }
344 
345 bool CallEvent::isCallStmt(const Stmt *S) {
346  return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(S);
347 }
348 
350  assert(D);
351  if (const auto *FD = dyn_cast<FunctionDecl>(D))
352  return FD->getReturnType();
353  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
354  return MD->getReturnType();
355  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
356  // Blocks are difficult because the return type may not be stored in the
357  // BlockDecl itself. The AST should probably be enhanced, but for now we
358  // just do what we can.
359  // If the block is declared without an explicit argument list, the
360  // signature-as-written just includes the return type, not the entire
361  // function type.
362  // FIXME: All blocks should have signatures-as-written, even if the return
363  // type is inferred. (That's signified with a dependent result type.)
364  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
365  QualType Ty = TSI->getType();
366  if (const FunctionType *FT = Ty->getAs<FunctionType>())
367  Ty = FT->getReturnType();
368  if (!Ty->isDependentType())
369  return Ty;
370  }
371 
372  return {};
373  }
374 
375  llvm_unreachable("unknown callable kind");
376 }
377 
378 bool CallEvent::isVariadic(const Decl *D) {
379  assert(D);
380 
381  if (const auto *FD = dyn_cast<FunctionDecl>(D))
382  return FD->isVariadic();
383  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
384  return MD->isVariadic();
385  if (const auto *BD = dyn_cast<BlockDecl>(D))
386  return BD->isVariadic();
387 
388  llvm_unreachable("unknown callable kind");
389 }
390 
391 static bool isTransparentUnion(QualType T) {
392  const RecordType *UT = T->getAsUnionType();
393  return UT && UT->getDecl()->hasAttr<TransparentUnionAttr>();
394 }
395 
396 // In some cases, symbolic cases should be transformed before we associate
397 // them with parameters. This function incapsulates such cases.
398 static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
399  const ParmVarDecl *Parameter, SValBuilder &SVB) {
400  QualType ParamType = Parameter->getType();
401  QualType ArgumentType = ArgumentExpr->getType();
402 
403  // Transparent unions allow users to easily convert values of union field
404  // types into union-typed objects.
405  //
406  // Also, more importantly, they allow users to define functions with different
407  // different parameter types, substituting types matching transparent union
408  // field types with the union type itself.
409  //
410  // Here, we check specifically for latter cases and prevent binding
411  // field-typed values to union-typed regions.
412  if (isTransparentUnion(ParamType) &&
413  // Let's check that we indeed trying to bind different types.
414  !isTransparentUnion(ArgumentType)) {
415  BasicValueFactory &BVF = SVB.getBasicValueFactory();
416 
417  llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
418  CompoundSVals = BVF.prependSVal(Value, CompoundSVals);
419 
420  // Wrap it with compound value.
421  return SVB.makeCompoundVal(ParamType, CompoundSVals);
422  }
423 
424  return Value;
425 }
426 
427 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
429  SValBuilder &SVB,
430  const CallEvent &Call,
431  ArrayRef<ParmVarDecl*> parameters) {
432  MemRegionManager &MRMgr = SVB.getRegionManager();
433 
434  // If the function has fewer parameters than the call has arguments, we simply
435  // do not bind any values to them.
436  unsigned NumArgs = Call.getNumArgs();
437  unsigned Idx = 0;
438  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
439  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
440  assert(*I && "Formal parameter has no decl?");
441 
442  // TODO: Support allocator calls.
443  if (Call.getKind() != CE_CXXAllocator)
444  if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx)))
445  continue;
446 
447  // TODO: Allocators should receive the correct size and possibly alignment,
448  // determined in compile-time but not represented as arg-expressions,
449  // which makes getArgSVal() fail and return UnknownVal.
450  SVal ArgVal = Call.getArgSVal(Idx);
451  const Expr *ArgExpr = Call.getArgExpr(Idx);
452  if (!ArgVal.isUnknown()) {
453  Loc ParamLoc = SVB.makeLoc(
454  MRMgr.getParamVarRegion(Call.getOriginExpr(), Idx, CalleeCtx));
455  Bindings.push_back(
456  std::make_pair(ParamLoc, processArgument(ArgVal, ArgExpr, *I, SVB)));
457  }
458  }
459 
460  // FIXME: Variadic arguments are not handled at all right now.
461 }
462 
464  const StackFrameContext *StackFrame = getCalleeStackFrame(0);
465  if (!StackFrame)
466  return nullptr;
467 
468  const CFGElement Element = StackFrame->getCallSiteCFGElement();
469  if (const auto Ctor = Element.getAs<CFGConstructor>()) {
470  return Ctor->getConstructionContext();
471  }
472 
473  if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
474  return RecCall->getConstructionContext();
475  }
476 
477  return nullptr;
478 }
479 
482  const auto *CC = getConstructionContext();
483  if (!CC)
484  return None;
485 
486  EvalCallOptions CallOpts;
487  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
488  SVal RetVal =
490  getLocationContext(), CC, CallOpts);
491  return RetVal;
492 }
493 
495  const FunctionDecl *D = getDecl();
496  if (!D)
497  return None;
498  return D->parameters();
499 }
500 
502  const FunctionDecl *FD = getDecl();
503  if (!FD)
504  return {};
505 
506  // Note that the AnalysisDeclContext will have the FunctionDecl with
507  // the definition (if one exists).
508  AnalysisDeclContext *AD =
510  getManager()->getContext(FD);
511  bool IsAutosynthesized;
512  Stmt* Body = AD->getBody(IsAutosynthesized);
513  LLVM_DEBUG({
514  if (IsAutosynthesized)
515  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
516  << "\n";
517  });
518 
519  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
521  *Engine.getCrossTranslationUnitContext();
522 
523  AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
524 
525  if (Body) {
526  const Decl* Decl = AD->getDecl();
527  if (Opts.IsNaiveCTUEnabled && CTUCtx.isImportedAsNew(Decl)) {
528  // A newly created definition, but we had error(s) during the import.
529  if (CTUCtx.hasError(Decl))
530  return {};
531  return RuntimeDefinition(Decl, /*Foreign=*/true);
532  }
533  return RuntimeDefinition(Decl, /*Foreign=*/false);
534  }
535 
536  // Try to get CTU definition only if CTUDir is provided.
537  if (!Opts.IsNaiveCTUEnabled)
538  return {};
539 
540  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
541  CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
542  Opts.DisplayCTUProgress);
543 
544  if (!CTUDeclOrError) {
545  handleAllErrors(CTUDeclOrError.takeError(),
546  [&](const cross_tu::IndexError &IE) {
547  CTUCtx.emitCrossTUDiagnostics(IE);
548  });
549  return {};
550  }
551 
552  return RuntimeDefinition(*CTUDeclOrError, /*Foreign=*/true);
553 }
554 
556  const StackFrameContext *CalleeCtx,
557  BindingsTy &Bindings) const {
558  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
559  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
560  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
561  D->parameters());
562 }
563 
566  return true;
567 
568  const FunctionDecl *D = getDecl();
569  if (!D)
570  return true;
571 
572  const IdentifierInfo *II = D->getIdentifier();
573  if (!II)
574  return false;
575 
576  // This set of "escaping" APIs is
577 
578  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
579  // value into thread local storage. The value can later be retrieved with
580  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
581  // parameter is 'const void *', the region escapes through the call.
582  if (II->isStr("pthread_setspecific"))
583  return true;
584 
585  // - xpc_connection_set_context stores a value which can be retrieved later
586  // with xpc_connection_get_context.
587  if (II->isStr("xpc_connection_set_context"))
588  return true;
589 
590  // - funopen - sets a buffer for future IO calls.
591  if (II->isStr("funopen"))
592  return true;
593 
594  // - __cxa_demangle - can reallocate memory and can return the pointer to
595  // the input buffer.
596  if (II->isStr("__cxa_demangle"))
597  return true;
598 
599  StringRef FName = II->getName();
600 
601  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
602  // buffer even if it is const.
603  if (FName.endswith("NoCopy"))
604  return true;
605 
606  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
607  // be deallocated by NSMapRemove.
608  if (FName.startswith("NS") && FName.contains("Insert"))
609  return true;
610 
611  // - Many CF containers allow objects to escape through custom
612  // allocators/deallocators upon container construction. (PR12101)
613  if (FName.startswith("CF") || FName.startswith("CG")) {
614  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
615  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
616  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
617  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
618  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
619  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
620  }
621 
622  return false;
623 }
624 
627  if (D)
628  return D;
629 
630  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
631 }
632 
634  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
635  if (!CE)
636  return AnyFunctionCall::getDecl();
637 
638  const FunctionDecl *D = CE->getDirectCallee();
639  if (D)
640  return D;
641 
642  return getSVal(CE->getCallee()).getAsFunctionDecl();
643 }
644 
646  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
647  SVal ThisVal = getCXXThisVal();
648  Values.push_back(ThisVal);
649 
650  // Don't invalidate if the method is const and there are no mutable fields.
651  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
652  if (!D->isConst())
653  return;
654  // Get the record decl for the class of 'This'. D->getParent() may return a
655  // base class decl, rather than the class of the instance which needs to be
656  // checked for mutable fields.
657  // TODO: We might as well look at the dynamic type of the object.
658  const Expr *Ex = getCXXThisExpr()->IgnoreParenBaseCasts();
659  QualType T = Ex->getType();
660  if (T->isPointerType()) // Arrow or implicit-this syntax?
661  T = T->getPointeeType();
662  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
663  assert(ParentRecord);
664  if (ParentRecord->hasMutableFields())
665  return;
666  // Preserve CXXThis.
667  const MemRegion *ThisRegion = ThisVal.getAsRegion();
668  if (!ThisRegion)
669  return;
670 
671  ETraits->setTrait(ThisRegion->getBaseRegion(),
673  }
674 }
675 
677  const Expr *Base = getCXXThisExpr();
678  // FIXME: This doesn't handle an overloaded ->* operator.
679  if (!Base)
680  return UnknownVal();
681 
682  SVal ThisVal = getSVal(Base);
683  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
684  return ThisVal;
685 }
686 
688  // Do we have a decl at all?
689  const Decl *D = getDecl();
690  if (!D)
691  return {};
692 
693  // If the method is non-virtual, we know we can inline it.
694  const auto *MD = cast<CXXMethodDecl>(D);
695  if (!MD->isVirtual())
697 
698  // Do we know the implicit 'this' object being called?
699  const MemRegion *R = getCXXThisVal().getAsRegion();
700  if (!R)
701  return {};
702 
703  // Do we know anything about the type of 'this'?
705  if (!DynType.isValid())
706  return {};
707 
708  // Is the type a C++ class? (This is mostly a defensive check.)
709  QualType RegionType = DynType.getType()->getPointeeType();
710  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
711 
712  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
713  if (!RD || !RD->hasDefinition())
714  return {};
715 
716  // Find the decl for this method in that class.
717  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
718  if (!Result) {
719  // We might not even get the original statically-resolved method due to
720  // some particularly nasty casting (e.g. casts to sister classes).
721  // However, we should at least be able to search up and down our own class
722  // hierarchy, and some real bugs have been caught by checking this.
723  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
724 
725  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
726  // the static type. However, because we currently don't update
727  // DynamicTypeInfo when an object is cast, we can't actually be sure the
728  // DynamicTypeInfo is up to date. This assert should be re-enabled once
729  // this is fixed. <rdar://problem/12287087>
730  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
731 
732  return {};
733  }
734 
735  // Does the decl that we found have an implementation?
736  const FunctionDecl *Definition;
737  if (!Result->hasBody(Definition)) {
738  if (!DynType.canBeASubClass())
740  return {};
741  }
742 
743  // We found a definition. If we're not sure that this devirtualization is
744  // actually what will happen at runtime, make sure to provide the region so
745  // that ExprEngine can decide what to do with it.
746  if (DynType.canBeASubClass())
747  return RuntimeDefinition(Definition, R->StripCasts());
748  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
749 }
750 
752  const StackFrameContext *CalleeCtx,
753  BindingsTy &Bindings) const {
755 
756  // Handle the binding of 'this' in the new stack frame.
757  SVal ThisVal = getCXXThisVal();
758  if (!ThisVal.isUnknown()) {
759  ProgramStateManager &StateMgr = getState()->getStateManager();
760  SValBuilder &SVB = StateMgr.getSValBuilder();
761 
762  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
763  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
764 
765  // If we devirtualized to a different member function, we need to make sure
766  // we have the proper layering of CXXBaseObjectRegions.
767  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
768  ASTContext &Ctx = SVB.getContext();
769  const CXXRecordDecl *Class = MD->getParent();
770  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
771 
772  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
773  Optional<SVal> V =
774  StateMgr.getStoreManager().evalBaseToDerived(ThisVal, Ty);
775  if (!V.hasValue()) {
776  // We might have suffered some sort of placement new earlier, so
777  // we're constructing in a completely unexpected storage.
778  // Fall back to a generic pointer cast for this-value.
779  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
780  const CXXRecordDecl *StaticClass = StaticMD->getParent();
781  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
782  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
783  } else
784  ThisVal = *V;
785  }
786 
787  if (!ThisVal.isUnknown())
788  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
789  }
790 }
791 
794 }
795 
797  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
798  // id-expression in the class member access expression is a qualified-id,
799  // that function is called. Otherwise, its final overrider in the dynamic type
800  // of the object expression is called.
801  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
802  if (ME->hasQualifier())
804 
806 }
807 
809  return getOriginExpr()->getArg(0);
810 }
811 
813  const Expr *Callee = getOriginExpr()->getCallee();
814  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
815 
816  return dyn_cast_or_null<BlockDataRegion>(DataReg);
817 }
818 
820  const BlockDecl *D = getDecl();
821  if (!D)
822  return None;
823  return D->parameters();
824 }
825 
827  RegionAndSymbolInvalidationTraits *ETraits) const {
828  // FIXME: This also needs to invalidate captured globals.
829  if (const MemRegion *R = getBlockRegion())
830  Values.push_back(loc::MemRegionVal(R));
831 }
832 
834  BindingsTy &Bindings) const {
835  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
836  ArrayRef<ParmVarDecl*> Params;
837  if (isConversionFromLambda()) {
838  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
839  Params = LambdaOperatorDecl->parameters();
840 
841  // For blocks converted from a C++ lambda, the callee declaration is the
842  // operator() method on the lambda so we bind "this" to
843  // the lambda captured by the block.
844  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
845  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
846  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
847  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
848  } else {
849  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
850  }
851 
852  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
853  Params);
854 }
855 
857  if (Data)
858  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
859  return UnknownVal();
860 }
861 
863  RegionAndSymbolInvalidationTraits *ETraits) const {
864  SVal V = getCXXThisVal();
865  if (SymbolRef Sym = V.getAsSymbol(true))
866  ETraits->setTrait(Sym,
868  Values.push_back(V);
869 }
870 
872  const StackFrameContext *CalleeCtx,
873  BindingsTy &Bindings) const {
875 
876  SVal ThisVal = getCXXThisVal();
877  if (!ThisVal.isUnknown()) {
878  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
879  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
880  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
881  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
882  }
883 }
884 
885 const StackFrameContext *
888  while (isa<CXXInheritedCtorInitExpr>(SFC->getCallSite()))
889  SFC = SFC->getParent()->getStackFrame();
890  return SFC;
891 }
892 
894  if (Data)
895  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
896  return UnknownVal();
897 }
898 
900  // Base destructors are always called non-virtually.
901  // Skip CXXInstanceCall's devirtualization logic in this case.
902  if (isBaseDestructor())
904 
906 }
907 
909  const ObjCMethodDecl *D = getDecl();
910  if (!D)
911  return None;
912  return D->parameters();
913 }
914 
916  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
917 
918  // If the method call is a setter for property known to be backed by
919  // an instance variable, don't invalidate the entire receiver, just
920  // the storage for that instance variable.
921  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
922  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
923  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
924  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
925  ETraits->setTrait(
926  IvarRegion,
928  ETraits->setTrait(
929  IvarRegion,
931  Values.push_back(IvarLVal);
932  }
933  return;
934  }
935  }
936 
937  Values.push_back(getReceiverSVal());
938 }
939 
941  // FIXME: Is this the best way to handle class receivers?
942  if (!isInstanceMessage())
943  return UnknownVal();
944 
945  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
946  return getSVal(RecE);
947 
948  // An instance message with no expression means we are sending to super.
949  // In this case the object reference is the same as 'self'.
950  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
951  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
952  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
953  return SelfVal;
954 }
955 
957  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
958  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
959  return true;
960 
961  if (!isInstanceMessage())
962  return false;
963 
964  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
965  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
966 
967  return (RecVal == SelfVal);
968 }
969 
971  switch (getMessageKind()) {
972  case OCM_Message:
973  return getOriginExpr()->getSourceRange();
974  case OCM_PropertyAccess:
975  case OCM_Subscript:
976  return getContainingPseudoObjectExpr()->getSourceRange();
977  }
978  llvm_unreachable("unknown message kind");
979 }
980 
981 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
982 
983 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
984  assert(Data && "Lazy lookup not yet performed.");
985  assert(getMessageKind() != OCM_Message && "Explicit message send.");
986  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
987 }
988 
989 static const Expr *
991  const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
992 
993  // This handles the funny case of assigning to the result of a getter.
994  // This can happen if the getter returns a non-const reference.
995  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
996  Syntactic = BO->getLHS()->IgnoreParens();
997 
998  return Syntactic;
999 }
1000 
1002  if (!Data) {
1003  // Find the parent, ignoring implicit casts.
1004  const ParentMap &PM = getLocationContext()->getParentMap();
1005  const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1006 
1007  // Check if parent is a PseudoObjectExpr.
1008  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1009  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1010 
1011  ObjCMessageKind K;
1012  switch (Syntactic->getStmtClass()) {
1013  case Stmt::ObjCPropertyRefExprClass:
1014  K = OCM_PropertyAccess;
1015  break;
1016  case Stmt::ObjCSubscriptRefExprClass:
1017  K = OCM_Subscript;
1018  break;
1019  default:
1020  // FIXME: Can this ever happen?
1021  K = OCM_Message;
1022  break;
1023  }
1024 
1025  if (K != OCM_Message) {
1026  const_cast<ObjCMethodCall *>(this)->Data
1027  = ObjCMessageDataTy(POE, K).getOpaqueValue();
1028  assert(getMessageKind() == K);
1029  return K;
1030  }
1031  }
1032 
1033  const_cast<ObjCMethodCall *>(this)->Data
1034  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1035  assert(getMessageKind() == OCM_Message);
1036  return OCM_Message;
1037  }
1038 
1039  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1040  if (!Info.getPointer())
1041  return OCM_Message;
1042  return static_cast<ObjCMessageKind>(Info.getInt());
1043 }
1044 
1046  // Look for properties accessed with property syntax (foo.bar = ...)
1048  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1049  assert(POE && "Property access without PseudoObjectExpr?");
1050 
1051  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1052  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1053 
1054  if (RefExpr->isExplicitProperty())
1055  return RefExpr->getExplicitProperty();
1056  }
1057 
1058  // Look for properties accessed with method syntax ([foo setBar:...]).
1059  const ObjCMethodDecl *MD = getDecl();
1060  if (!MD || !MD->isPropertyAccessor())
1061  return nullptr;
1062 
1063  // Note: This is potentially quite slow.
1064  return MD->findPropertyDecl();
1065 }
1066 
1068  Selector Sel) const {
1069  assert(IDecl);
1070  AnalysisManager &AMgr =
1071  getState()->getStateManager().getOwningEngine().getAnalysisManager();
1072  // If the class interface is declared inside the main file, assume it is not
1073  // subcassed.
1074  // TODO: It could actually be subclassed if the subclass is private as well.
1075  // This is probably very rare.
1076  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1077  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1078  return false;
1079 
1080  // Assume that property accessors are not overridden.
1082  return false;
1083 
1084  // We assume that if the method is public (declared outside of main file) or
1085  // has a parent which publicly declares the method, the method could be
1086  // overridden in a subclass.
1087 
1088  // Find the first declaration in the class hierarchy that declares
1089  // the selector.
1090  ObjCMethodDecl *D = nullptr;
1091  while (true) {
1092  D = IDecl->lookupMethod(Sel, true);
1093 
1094  // Cannot find a public definition.
1095  if (!D)
1096  return false;
1097 
1098  // If outside the main file,
1099  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1100  return true;
1101 
1102  if (D->isOverriding()) {
1103  // Search in the superclass on the next iteration.
1104  IDecl = D->getClassInterface();
1105  if (!IDecl)
1106  return false;
1107 
1108  IDecl = IDecl->getSuperClass();
1109  if (!IDecl)
1110  return false;
1111 
1112  continue;
1113  }
1114 
1115  return false;
1116  };
1117 
1118  llvm_unreachable("The while loop should always terminate.");
1119 }
1120 
1122  if (!MD)
1123  return MD;
1124 
1125  // Find the redeclaration that defines the method.
1126  if (!MD->hasBody()) {
1127  for (auto I : MD->redecls())
1128  if (I->hasBody())
1129  MD = cast<ObjCMethodDecl>(I);
1130  }
1131  return MD;
1132 }
1133 
1138 };
1139 
1140 namespace llvm {
1141 template <> struct DenseMapInfo<PrivateMethodKey> {
1142  using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1143  using SelectorInfo = DenseMapInfo<Selector>;
1144 
1145  static inline PrivateMethodKey getEmptyKey() {
1146  return {InterfaceInfo::getEmptyKey(), SelectorInfo::getEmptyKey(), false};
1147  }
1148 
1150  return {InterfaceInfo::getTombstoneKey(), SelectorInfo::getTombstoneKey(),
1151  true};
1152  }
1153 
1154  static unsigned getHashValue(const PrivateMethodKey &Key) {
1155  return llvm::hash_combine(
1156  llvm::hash_code(InterfaceInfo::getHashValue(Key.Interface)),
1157  llvm::hash_code(SelectorInfo::getHashValue(Key.LookupSelector)),
1158  Key.IsClassMethod);
1159  }
1160 
1161  static bool isEqual(const PrivateMethodKey &LHS,
1162  const PrivateMethodKey &RHS) {
1163  return InterfaceInfo::isEqual(LHS.Interface, RHS.Interface) &&
1164  SelectorInfo::isEqual(LHS.LookupSelector, RHS.LookupSelector) &&
1165  LHS.IsClassMethod == RHS.IsClassMethod;
1166  }
1167 };
1168 } // end namespace llvm
1169 
1170 static const ObjCMethodDecl *
1172  Selector LookupSelector, bool InstanceMethod) {
1173  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1174  // when in many cases it returns null. We cache the results so
1175  // that repeated queries on the same ObjCIntefaceDecl and Selector
1176  // don't incur the same cost. On some test cases, we can see the
1177  // same query being issued thousands of times.
1178  //
1179  // NOTE: This cache is essentially a "global" variable, but it
1180  // only gets lazily created when we get here. The value of the
1181  // cache probably comes from it being global across ExprEngines,
1182  // where the same queries may get issued. If we are worried about
1183  // concurrency, or possibly loading/unloading ASTs, etc., we may
1184  // need to revisit this someday. In terms of memory, this table
1185  // stays around until clang quits, which also may be bad if we
1186  // need to release memory.
1187  using PrivateMethodCache =
1188  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1189 
1190  static PrivateMethodCache PMC;
1192  PMC[{Interface, LookupSelector, InstanceMethod}];
1193 
1194  // Query lookupPrivateMethod() if the cache does not hit.
1195  if (!Val.hasValue()) {
1196  Val = Interface->lookupPrivateMethod(LookupSelector, InstanceMethod);
1197 
1198  if (!*Val) {
1199  // Query 'lookupMethod' as a backup.
1200  Val = Interface->lookupMethod(LookupSelector, InstanceMethod);
1201  }
1202  }
1203 
1204  return Val.getValue();
1205 }
1206 
1208  const ObjCMessageExpr *E = getOriginExpr();
1209  assert(E);
1210  Selector Sel = E->getSelector();
1211 
1212  if (E->isInstanceMessage()) {
1213  // Find the receiver type.
1214  const ObjCObjectType *ReceiverT = nullptr;
1215  bool CanBeSubClassed = false;
1216  bool LookingForInstanceMethod = true;
1217  QualType SupersType = E->getSuperType();
1218  const MemRegion *Receiver = nullptr;
1219 
1220  if (!SupersType.isNull()) {
1221  // The receiver is guaranteed to be 'super' in this case.
1222  // Super always means the type of immediate predecessor to the method
1223  // where the call occurs.
1224  ReceiverT = cast<ObjCObjectPointerType>(SupersType)->getObjectType();
1225  } else {
1226  Receiver = getReceiverSVal().getAsRegion();
1227  if (!Receiver)
1228  return {};
1229 
1230  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1231  if (!DTI.isValid()) {
1232  assert(isa<AllocaRegion>(Receiver) &&
1233  "Unhandled untyped region class!");
1234  return {};
1235  }
1236 
1237  QualType DynType = DTI.getType();
1238  CanBeSubClassed = DTI.canBeASubClass();
1239 
1240  const auto *ReceiverDynT =
1241  dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1242 
1243  if (ReceiverDynT) {
1244  ReceiverT = ReceiverDynT->getObjectType();
1245 
1246  // It can be actually class methods called with Class object as a
1247  // receiver. This type of messages is treated by the compiler as
1248  // instance (not class).
1249  if (ReceiverT->isObjCClass()) {
1250 
1251  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1252  // For [self classMethod], return compiler visible declaration.
1253  if (Receiver == SelfVal.getAsRegion()) {
1255  }
1256 
1257  // Otherwise, let's check if we know something about the type
1258  // inside of this class object.
1259  if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1260  DynamicTypeInfo DTI =
1261  getClassObjectDynamicTypeInfo(getState(), ReceiverSym);
1262  if (DTI.isValid()) {
1263  // Let's use this type for lookup.
1264  ReceiverT =
1265  cast<ObjCObjectType>(DTI.getType().getCanonicalType());
1266 
1267  CanBeSubClassed = DTI.canBeASubClass();
1268  // And it should be a class method instead.
1269  LookingForInstanceMethod = false;
1270  }
1271  }
1272  }
1273 
1274  if (CanBeSubClassed)
1275  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1276  // Even if `DynamicTypeInfo` told us that it can be
1277  // not necessarily this type, but its descendants, we still want
1278  // to check again if this selector can be actually overridden.
1279  CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1280  }
1281  }
1282 
1283  // Lookup the instance method implementation.
1284  if (ReceiverT)
1285  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1286  const ObjCMethodDecl *MD =
1287  lookupRuntimeDefinition(IDecl, Sel, LookingForInstanceMethod);
1288 
1289  if (MD && !MD->hasBody())
1290  MD = MD->getCanonicalDecl();
1291 
1292  if (CanBeSubClassed)
1293  return RuntimeDefinition(MD, Receiver);
1294  else
1295  return RuntimeDefinition(MD, nullptr);
1296  }
1297  } else {
1298  // This is a class method.
1299  // If we have type info for the receiver class, we are calling via
1300  // class name.
1301  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1302  // Find/Return the method implementation.
1303  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1304  }
1305  }
1306 
1307  return {};
1308 }
1309 
1311  if (isInSystemHeader() && !isInstanceMessage()) {
1312  Selector Sel = getSelector();
1313  if (Sel.getNumArgs() == 1 &&
1314  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1315  return true;
1316  }
1317 
1319 }
1320 
1322  const StackFrameContext *CalleeCtx,
1323  BindingsTy &Bindings) const {
1324  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1325  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1326  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1327  D->parameters());
1328 
1329  SVal SelfVal = getReceiverSVal();
1330  if (!SelfVal.isUnknown()) {
1331  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1332  MemRegionManager &MRMgr = SVB.getRegionManager();
1333  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1334  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1335  }
1336 }
1337 
1340  const LocationContext *LCtx) {
1341  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1342  return create<CXXMemberCall>(MCE, State, LCtx);
1343 
1344  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1345  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1346  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1347  if (MD->isInstance())
1348  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1349 
1350  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1351  return create<BlockCall>(CE, State, LCtx);
1352  }
1353 
1354  // Otherwise, it's a normal function call, static member function call, or
1355  // something we can't reason about.
1356  return create<SimpleFunctionCall>(CE, State, LCtx);
1357 }
1358 
1362  const LocationContext *ParentCtx = CalleeCtx->getParent();
1363  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1364  assert(CallerCtx && "This should not be used for top-level stack frames");
1365 
1366  const Stmt *CallSite = CalleeCtx->getCallSite();
1367 
1368  if (CallSite) {
1369  if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1370  return Out;
1371 
1372  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1373  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1374  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1375  SVal ThisVal = State->getSVal(ThisPtr);
1376 
1377  if (const auto *CE = dyn_cast<CXXConstructExpr>(CallSite))
1378  return getCXXConstructorCall(CE, ThisVal.getAsRegion(), State, CallerCtx);
1379  else if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(CallSite))
1380  return getCXXInheritedConstructorCall(CIE, ThisVal.getAsRegion(), State,
1381  CallerCtx);
1382  else {
1383  // All other cases are handled by getCall.
1384  llvm_unreachable("This is not an inlineable statement");
1385  }
1386  }
1387 
1388  // Fall back to the CFG. The only thing we haven't handled yet is
1389  // destructors, though this could change in the future.
1390  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1391  CFGElement E = (*B)[CalleeCtx->getIndex()];
1392  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1393  "All other CFG elements should have exprs");
1394 
1395  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1396  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1397  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1398  SVal ThisVal = State->getSVal(ThisPtr);
1399 
1400  const Stmt *Trigger;
1402  Trigger = AutoDtor->getTriggerStmt();
1403  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1404  Trigger = DeleteDtor->getDeleteExpr();
1405  else
1406  Trigger = Dtor->getBody();
1407 
1408  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1409  E.getAs<CFGBaseDtor>().hasValue(), State,
1410  CallerCtx);
1411 }
1412 
1414  const LocationContext *LC) {
1415  if (const auto *CE = dyn_cast<CallExpr>(S)) {
1416  return getSimpleCall(CE, State, LC);
1417  } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1418  return getCXXAllocatorCall(NE, State, LC);
1419  } else if (const auto *DE = dyn_cast<CXXDeleteExpr>(S)) {
1420  return getCXXDeallocatorCall(DE, State, LC);
1421  } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1422  return getObjCMethodCall(ME, State, LC);
1423  } else {
1424  return nullptr;
1425  }
1426 }
clang::AnalysisDeclContext::getCFGStmtMap
CFGStmtMap * getCFGStmtMap()
Definition: AnalysisDeclContext.cpp:251
clang::ento::AnyCXXConstructorCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:862
clang::ObjCMessageExpr::SuperInstance
@ SuperInstance
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1097
clang::ObjCInterfaceDecl
Represents an ObjC class declaration.
Definition: DeclObjC.h:1150
clang::ento::SVal::isValid
bool isValid() const
Definition: SVals.h:147
findPtrToConstParams
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:223
clang::ObjCMessageExpr::isInstanceMessage
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1238
clang::ObjCMessageExpr::getReceiverInterface
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:314
clang::ento::BlockCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:819
clang::ento::ObjCMethodCall::getMessageKind
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1001
clang::BlockDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:4287
clang::ento::UndefinedVal
Definition: SVals.h:223
addParameterValuesToBindings
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl * > parameters)
Definition: CallEvent.cpp:427
llvm
YAML serialization mapping.
Definition: Dominators.h:30
clang::ento::CallEventManager::getCall
CallEventRef getCall(const Stmt *S, ProgramStateRef State, const LocationContext *LC)
Gets a call event for a function call, Objective-C method call, a 'new', or a 'delete' call.
Definition: CallEvent.cpp:1413
clang::ento::CXXMemberCall::getOriginExpr
const CXXMemberCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:707
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6756
clang::ento::ObjCMethodCall::getOriginExpr
const ObjCMessageExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:1142
clang::ento::CallEvent::isArgumentConstructedDirectly
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:414
Specifiers.h
clang::ento::CallEventRef
Definition: CallEvent.h:81
clang::ento::DynamicTypeInfo::getType
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
Definition: DynamicTypeInfo.h:34
clang::ento::AnyCXXConstructorCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:871
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::OCM_Subscript
@ OCM_Subscript
Definition: CallEvent.h:1111
CallDescription.h
clang::LocationContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: AnalysisDeclContext.cpp:463
clang::ento::CallEventManager::getCXXDestructorCall
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1321
clang::ObjCInterfaceDecl::lookupMethod
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class,...
Definition: DeclObjC.cpp:692
SVals.h
clang::SourceRange
A trivial tuple used to represent a source range.
Definition: SourceLocation.h:210
clang::ento::SVal::getAsFunctionDecl
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:65
clang::ObjCSubstitutionContext::Parameter
@ Parameter
The parameter type of a method or function.
clang::ento::BlockCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:826
clang::Decl::hasAttr
bool hasAttr() const
Definition: DeclBase.h:542
clang::QualType::isConstQualified
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6559
clang::ObjCMessageExpr::getSelector
Selector getSelector() const
Definition: ExprObjC.cpp:293
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:131
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
PrivateMethodKey::Interface
const ObjCInterfaceDecl * Interface
Definition: CallEvent.cpp:1135
AnalysisDeclContext.h
clang::ento::DynamicTypeInfo
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
Definition: DynamicTypeInfo.h:19
clang::ento::CallEvent::getOriginExpr
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:240
clang::ASTContext::VoidTy
CanQualType VoidTy
Definition: ASTContext.h:1096
llvm::SmallVector
Definition: LLVM.h:38
clang::AnalysisDeclContextManager::getStackFrame
const StackFrameContext * getStackFrame(const Decl *D)
Obtain the beginning context of the analysis.
Definition: AnalysisDeclContext.h:466
clang::ento::MemRegion::StripCasts
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1333
clang::ParentMap::getParentIgnoreParenCasts
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:144
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
llvm::DenseMapInfo< PrivateMethodKey >::getEmptyKey
static PrivateMethodKey getEmptyKey()
Definition: CallEvent.cpp:1145
clang::ento::CallEventManager::getCXXDeallocatorCall
CallEventRef< CXXDeallocatorCall > getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1334
clang::ento::AnyFunctionCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:501
clang::SourceRange::getBegin
SourceLocation getBegin() const
Definition: SourceLocation.h:219
clang::ento::ProgramStateManager::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ProgramState.h:548
clang::ento::RegionAndSymbolInvalidationTraits::TK_SuppressEscape
@ TK_SuppressEscape
Suppress pointer-escaping of a region.
Definition: MemRegion.h:1537
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:324
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:482
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:675
Attr.h
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:237
clang::ento::CallEventManager::getObjCMethodCall
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1302
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::AnalysisDeclContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.cpp:148
clang::Decl::hasBody
virtual bool hasBody() const
Returns true if this Decl represents a declaration for a body of code, such as a function or method d...
Definition: DeclBase.h:1025
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6539
clang::ento::ObjCMethodCall::getReceiverSVal
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:940
clang::ParmVarDecl
Represents a parameter to a function.
Definition: Decl.h:1680
clang::ento::CallEvent::hasVoidPointerToNonConstArg
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:141
DeclCXX.h
clang::StackFrameContext::getCallSiteCFGElement
CFGElement getCallSiteCFGElement() const
Definition: AnalysisDeclContext.h:329
clang::Type::isObjCSelType
bool isObjCSelType() const
Definition: Type.h:6921
clang::ObjCMethodDecl::getClassInterface
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1176
ProgramState_Fwd.h
clang::StackFrameContext::getCallSiteBlock
const CFGBlock * getCallSiteBlock() const
Definition: AnalysisDeclContext.h:323
llvm::Optional
Definition: LLVM.h:40
clang::ento::CallEvent::param_type_end
param_type_iterator param_type_end() const
Definition: CallEvent.h:471
clang::ento::CallEvent::getConstructionContext
const ConstructionContext * getConstructionContext() const
Returns the construction context of the call, if it is a C++ constructor call or a call of a function...
Definition: CallEvent.cpp:463
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:295
SourceManager.h
clang::ento::CallEvent::isGlobalCFunction
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CallEvent.cpp:145
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:7037
clang::ento::ObjCMethodCall::getAccessedProperty
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1045
llvm::Expected
Definition: LLVM.h:41
clang::ento::UnknownVal
Definition: SVals.h:256
clang::StackFrameContext::getIndex
unsigned getIndex() const
Definition: AnalysisDeclContext.h:327
clang::ento::CallEvent::getDeclaredResultType
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:349
clang::FunctionType
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3559
clang::ento::CallEvent::getReturnValueUnderConstruction
Optional< SVal > getReturnValueUnderConstruction() const
If the call returns a C++ record type then the region of its return value can be retrieved from its c...
Definition: CallEvent.cpp:481
clang::ento::loc::MemRegionVal
Definition: SVals.h:598
clang::ento::CallEvent::isCallStmt
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:345
clang::ObjCMessageExpr::SuperClass
@ SuperClass
The receiver is a superclass.
Definition: ExprObjC.h:1094
clang::ObjCObjectType::getInterface
ObjCInterfaceDecl * getInterface() const
Gets the interface declaration for this object type, if the base type really is an interface.
Definition: Type.h:6127
clang::ento::MemRegionManager::getVarRegion
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:946
clang::ento::CallEvent::argumentsMayEscape
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:314
clang::ObjCMethodDecl::isOverriding
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:467
clang::PostImplicitCall
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:599
clang::ento::RuntimeDefinition
Definition: CallEvent.h:105
clang::ento::ObjCMethodCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:1207
clang::ento::SVal::getAs
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type.
Definition: SVals.h:110
Decl.h
clang::ObjCObjectType
Represents a class type in Objective C.
Definition: Type.h:5892
CallEvent.h
DeclObjC.h
clang::Type::getAsStructureType
const RecordType * getAsStructureType() const
Definition: Type.cpp:641
clang::ento::CXXInstanceCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:645
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
clang::ento::CallEvent::getState
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:225
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:576
clang::CXXRecordDecl::hasMutableFields
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1188
clang::ento::ObjCMethodCall::getDecl
const ObjCMethodDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:1146
PrivateMethodKey
Definition: CallEvent.cpp:1134
lookupRuntimeDefinition
static const ObjCMethodDecl * lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface, Selector LookupSelector, bool InstanceMethod)
Definition: CallEvent.cpp:1171
llvm::DenseMapInfo< PrivateMethodKey >::SelectorInfo
DenseMapInfo< Selector > SelectorInfo
Definition: CallEvent.cpp:1143
clang::CXXMemberCallExpr::getImplicitObjectArgument
Expr * getImplicitObjectArgument() const
Retrieve the implicit object argument for the member call.
Definition: ExprCXX.cpp:650
clang::ASTContext::getReferenceQualifiedType
QualType getReferenceQualifiedType(const Expr *e) const
getReferenceQualifiedType - Given an expr, will return the type for that expression,...
Definition: ASTContext.cpp:5588
clang::IdentifierInfo::isStr
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Definition: IdentifierTable.h:176
DynamicTypeInfo.h
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6760
clang::CallExpr::getCallee
Expr * getCallee()
Definition: Expr.h:2951
V
#define V(N, I)
Definition: ASTContext.h:3176
clang::ento::CallEvent::getReturnValue
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:320
clang::ento::CallEvent::getLocationContext
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:230
clang::ento::ObjCMethodCall::getSelector
Selector getSelector() const
Definition: CallEvent.h:1166
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
ProgramPoint.h
clang::ento::OCM_PropertyAccess
@ OCM_PropertyAccess
Definition: CallEvent.h:1110
clang::CallExpr::getDirectCallee
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return null.
Definition: Expr.h:2971
clang::RecordType
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4647
llvm::DenseMapInfo< PrivateMethodKey >::isEqual
static bool isEqual(const PrivateMethodKey &LHS, const PrivateMethodKey &RHS)
Definition: CallEvent.cpp:1161
clang::ento::CallEvent::getArgSourceRange
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:313
clang::ento::BlockCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:569
clang::ento::CXXMemberOperatorCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:808
clang::ento::AnalysisManager::isInCodeFile
static bool isInCodeFile(SourceLocation SL, const SourceManager &SM)
Definition: AnalysisManager.h:125
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4201
clang::CFGConstructor
Represents C++ constructor call.
Definition: CFG.h:156
clang::LocationContext::getAnalysisDeclContext
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:241
clang::ento::CXXInstanceCall::getCXXThisExpr
virtual const Expr * getCXXThisExpr() const
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.h:674
clang::ento::CallEvent::getSourceRange
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:274
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:167
DeclBase.h
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:127
clang::ento::ObjCMethodCall::isReceiverSelfOrSuper
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to 'self' or 'super'.
Definition: CallEvent.cpp:956
clang::Type::isFunctionPointerType
bool isFunctionPointerType() const
Definition: Type.h:6782
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:112
clang::ento::RegionAndSymbolInvalidationTraits::setTrait
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1723
ObjCMessageDataTy
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:981
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:208
clang::ento::SValBuilder::getCXXThis
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
Definition: SValBuilder.cpp:298
clang::ento::CXXMemberCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:796
clang::ObjCInterfaceDecl::lookupPrivateMethod
ObjCMethodDecl * lookupPrivateMethod(const Selector &Sel, bool Instance=true) const
Lookup a method in the classes implementation hierarchy.
Definition: DeclObjC.cpp:749
clang::ento::BlockCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:833
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::CallEvent::BindingsTy
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:362
clang::ento::BlockCall::getBlockRegion
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:812
clang::Selector::getNumArgs
unsigned getNumArgs() const
Definition: IdentifierTable.cpp:492
clang::CFGBlock::size
unsigned size() const
Definition: CFG.h:917
clang::Type::getAs
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7243
Store.h
clang::CallExpr::getArg
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:2992
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:389
clang::ento::SValBuilder::getRegionManager
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:186
clang::CFGStmtMap::getBlock
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:26
processArgument
static SVal processArgument(SVal Value, const Expr *ArgumentExpr, const ParmVarDecl *Parameter, SValBuilder &SVB)
Definition: CallEvent.cpp:398
clang::ento::CXXMemberOperatorCall::getOriginExpr
const CXXOperatorCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:751
clang::PseudoObjectExpr
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:6100
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:663
IdentifierTable.h
clang::ento::CallEventManager::getCXXInheritedConstructorCall
CallEventRef< CXXInheritedConstructorCall > getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1314
clang::ento::VarRegion
Definition: MemRegion.h:907
clang::ento::CallEventManager::getCXXConstructorCall
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1308
clang::ento::CXXInstanceCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:751
Type.h
clang::ento::CallEvent::invalidateRegions
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:234
Expr.h
isPointerToConst
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection.
Definition: CallEvent.cpp:209
clang::ento::AnyCXXConstructorCall::getCXXThisVal
SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:856
ASTContext.h
clang::ASTContext::getRecordType
QualType getRecordType(const RecordDecl *Decl) const
Definition: ASTContext.cpp:4638
findDefiningRedecl
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1121
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:874
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::CFGCXXRecordTypedCall
Represents a function call that returns a C++ object by value.
Definition: CFG.h:184
clang::CXXRecordDecl::isDerivedFrom
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Definition: CXXInheritance.cpp:68
clang::Type::getAsCXXRecordDecl
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1759
clang::ento::CallEventManager::getCXXAllocatorCall
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1328
clang::ento::DynamicTypeInfo::isValid
bool isValid() const
Returns true if the dynamic type info is available.
Definition: DynamicTypeInfo.h:31
PathDiagnostic.h
clang::Decl::redecls
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:981
ExprObjC.h
ExprCXX.h
Base
clang::CFGStmtMap
Definition: CFGStmtMap.h:24
clang::ento::CallEvent::getDecl
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:214
clang::ento::CallEventManager::getCaller
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1360
clang::ObjCMethodDecl::getCanonicalDecl
ObjCMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclObjC.cpp:977
clang::ento::CXXDestructorCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:899
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:940
isVoidPointerToNonConst
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:104
clang::AnalysisDeclContextManager::getContext
AnalysisDeclContext * getContext(const Decl *D)
Definition: AnalysisDeclContext.cpp:295
clang::ento::CXXInstanceCall::getCXXThisVal
virtual SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:676
clang::ento::CallEventManager::getSimpleCall
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1339
clang::ento::AnyFunctionCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:555
clang::ento::ObjCMethodCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:915
CFGStmtMap.h
clang::ento::Loc
Definition: SVals.h:326
clang::format::hash_combine
static void hash_combine(std::size_t &seed, const T &v)
Definition: UnwrappedLineParser.cpp:743
clang::ento::CallEvent::hasNonZeroCallbackArg
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:137
clang::AnalysisDeclContext::getManager
AnalysisDeclContextManager * getManager() const
Definition: AnalysisDeclContext.h:108
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:364
clang::ento::SValBuilder
Definition: SValBuilder.h:53
getSyntacticFromForPseudoObjectExpr
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:990
clang::LocationContext::getParent
const LocationContext * getParent() const
Definition: AnalysisDeclContext.h:243
clang::ento::BlockCall::isConversionFromLambda
bool isConversionFromLambda() const
Definition: CallEvent.h:591
clang::ento::CallEvent::getArgExpr
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:283
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
clang::ParentMap
Definition: ParentMap.h:20
clang::PostStmt
Definition: ProgramPoint.h:310
SourceLocation.h
clang::Type::getAsUnionType
const RecordType * getAsUnionType() const
NOTE: getAs*ArrayType are methods on ASTContext.
Definition: Type.cpp:660
clang::PreStmt
Definition: ProgramPoint.h:294
clang::Type::isDependentType
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2185
clang::ento::SValBuilder::makeLoc
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:384
clang::PseudoObjectExpr::getSyntacticForm
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:6144
clang::Stmt::getStmtClass
StmtClass getStmtClass() const
Definition: Stmt.h:1160
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6748
clang::ento::ObjCMessageKind
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:1109
clang::ento::ProgramStateManager
Definition: ProgramState.h:498
clang::ento::CXXDestructorCall::getCXXThisVal
SVal getCXXThisVal() const override
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:893
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:591
SValBuilder.h
clang::ento::CallEvent::param_type_iterator
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:460
clang::ObjCObjectType::isObjCClass
bool isObjCClass() const
Definition: Type.h:5961
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
clang::CFGElement::getAs
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
getCanonicalDecl
static const Decl * getCanonicalDecl(const Decl *D)
Definition: IndexingContext.cpp:297
clang::ASTContext::getPrintingPolicy
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:708
clang::RecordDecl::fields
field_range fields() const
Definition: Decl.h:4127
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:740
llvm::DenseMapInfo< PrivateMethodKey >::InterfaceInfo
DenseMapInfo< const ObjCInterfaceDecl * > InterfaceInfo
Definition: CallEvent.cpp:1142
llvm::ArrayRef
Definition: LLVM.h:34
Value
Value
Definition: UninitializedValues.cpp:102
clang::ento::CallEvent::param_type_begin
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call's formal parameters.
Definition: CallEvent.h:467
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
PrivateMethodKey::IsClassMethod
bool IsClassMethod
Definition: CallEvent.cpp:1137
clang::ObjCPropertyDecl
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:732
clang::ento::CallEvent::hasNonNullArgumentsWithType
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:114
clang::ento::CallEvent::getExtraInvalidatedValues
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.h:201
clang::StackFrameContext::getCallSite
const Stmt * getCallSite() const
Definition: AnalysisDeclContext.h:321
clang::ento::ObjCMethodCall::canBeOverridenInSubclass
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1067
clang::ento::SimpleFunctionCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:531
clang::PreImplicitCall
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:582
clang::cross_tu::CrossTranslationUnitContext::hasError
bool hasError(const Decl *ToDecl) const
Returns true if the given Decl is mapped (or created) during an import but there was an unrecoverable...
Definition: CrossTranslationUnit.cpp:810
clang::ento::ObjCMethodCall::getSourceRange
SourceRange getSourceRange() const override
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.cpp:970
LLVM.h
clang::ento::CallEvent::getAdjustedParameterIndex
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:425
clang::ento::CallEvent::getKindAsString
virtual StringRef getKindAsString() const =0
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:165
clang::Selector::getIdentifierInfoForSlot
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
Definition: IdentifierTable.cpp:503
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1090
clang::ento::SimpleFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:625
clang::ObjCInterfaceDecl::getSuperClass
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:351
clang::ento::CallEvent::getProgramPoint
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:289
clang::ento::ObjCMethodCall
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1118
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::CallEvent::getNumArgs
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
clang::ento::CallEvent::Data
const void * Data
Definition: CallEvent.h:160
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:84
clang::ento::CXXMemberCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:792
clang::ento::ObjCMethodCall::isInstanceMessage
bool isInstanceMessage() const
Definition: CallEvent.h:1158
clang::AnalysisDeclContext::getBody
Stmt * getBody() const
Definition: AnalysisDeclContext.cpp:126
clang::ento::AnyFunctionCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:494
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
CheckerContext.h
clang::cross_tu::CrossTranslationUnitContext::getCrossTUDefinition
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName, bool DisplayCTUProgress=false)
This function loads a function or variable definition from an external AST file and merges it into th...
Definition: CrossTranslationUnit.cpp:353
clang::ento::CallEvent::getResultType
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:72
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ento::CE_CXXAllocator
@ CE_CXXAllocator
Definition: CallEvent.h:70
clang::ento::ExprEngine
Definition: ExprEngine.h:123
ProgramState.h
clang::ento::CallEvent::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:193
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:574
clang::ento::MemRegionManager
Definition: MemRegion.h:1303
clang::ento::BlockCall::getDecl
const BlockDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:584
clang::ento::CallEvent::getKind
virtual Kind getKind() const =0
Returns the kind of call this is.
clang::ObjCMethodDecl
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
clang::PointerType
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2653
clang::ento::ObjCMethodCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:908
clang::ObjCMethodDecl::hasBody
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:527
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:225
clang::ObjCInterfaceDecl::getEndOfDefinitionLoc
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1856
clang::ento::RegionAndSymbolInvalidationTraits::TK_PreserveContents
@ TK_PreserveContents
Tells that a region's contents is not changed.
Definition: MemRegion.h:1534
ParentMap.h
clang::ObjCMethodDecl::findPropertyDecl
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method's selector.
Definition: DeclObjC.cpp:1343
clang::ento::OCM_Message
@ OCM_Message
Definition: CallEvent.h:1112
clang::IdentifierInfo::getName
StringRef getName() const
Return the actual identifier string.
Definition: IdentifierTable.h:195
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:2943
PrivateMethodKey::LookupSelector
Selector LookupSelector
Definition: CallEvent.cpp:1136
clang
Definition: CalledOnceCheck.h:17
clang::Type::isAnyPointerType
bool isAnyPointerType() const
Definition: Type.h:6752
clang::ento::CallEvent::isVariadic
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:378
clang::ento::CallEvent::isInSystemHeader
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:252
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:414
clang::Selector
Smart pointer class that efficiently represents Objective-C method names.
Definition: IdentifierTable.h:752
CFG.h
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:143
clang::AnalysisDeclContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:106
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:69
clang::ObjCIvarDecl
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1923
llvm::DenseMapInfo< PrivateMethodKey >::getHashValue
static unsigned getHashValue(const PrivateMethodKey &Key)
Definition: CallEvent.cpp:1154
clang::DeclaratorContext::Condition
@ Condition
clang::ento::AnyFunctionCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:564
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:440
clang::ento::RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion
@ TK_DoNotInvalidateSuperRegion
Definition: MemRegion.h:1540
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:135
MemRegion.h
clang::Expr::IgnoreParenBaseCasts
Expr * IgnoreParenBaseCasts() LLVM_READONLY
Skip past any parentheses and derived-to-base casts until reaching a fixed point.
Definition: Expr.cpp:2969
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::SourceLocation::isValid
bool isValid() const
Return true if this is a valid SourceLocation object.
Definition: SourceLocation.h:110
clang::CXXRecordDecl::hasDefinition
bool hasDefinition() const
Definition: DeclCXX.h:549
clang::TypeSourceInfo
A container of type source information.
Definition: Type.h:6471
clang::ObjCMessageExpr::getMethodDecl
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1346
isTransparentUnion
static bool isTransparentUnion(QualType T)
Definition: CallEvent.cpp:391
clang::ento::CallEvent::getArgSVal
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:306
clang::ento::BlockCall::getRegionStoringCapturedLambda
const VarRegion * getRegionStoringCapturedLambda() const
For a block converted from a C++ lambda, returns the block VarRegion for the variable holding the cap...
Definition: CallEvent.h:601
clang::cross_tu::IndexError
Definition: CrossTranslationUnit.h:61
clang::ento::DynamicTypeInfo::canBeASubClass
bool canBeASubClass() const
Returns false if the type information is precise (the type 'DynTy' is the only type in the lattice),...
Definition: DynamicTypeInfo.h:28
clang::ObjCMethodDecl::isPropertyAccessor
bool isPropertyAccessor() const
Definition: DeclObjC.h:441
clang::ento::CXXInstanceCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:687
clang::RecordType::getDecl
RecordDecl * getDecl() const
Definition: Type.h:4657
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3260
clang::ento::CallEvent::getCalleeAnalysisDeclContext
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:153
clang::ObjCMethodDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:376
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:74
clang::ento::ObjCMethodCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:1321
Stmt.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:522
isCallback
static bool isCallback(QualType T)
Definition: CallEvent.cpp:80
llvm::SmallVectorImpl
Definition: Randstruct.h:18
clang::ento::getDynamicTypeInfo
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
clang::ento::AnyFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:495
clang::ObjCMessageExpr::getSuperType
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1326
DynamicType.h
clang::ento::MemRegion::getBaseRegion
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1297
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1519
clang::ento::CXXInstanceCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:633
clang::Expr
This represents one expression.
Definition: Expr.h:109
CrossTranslationUnit.h
clang::ento::getClassObjectDynamicTypeInfo
DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym)
Get dynamic type information stored in a class object represented by Sym.
clang::cross_tu::CrossTranslationUnitContext::isImportedAsNew
bool isImportedAsNew(const Decl *ToDecl) const
Returns true if the given Decl is newly created during the import.
Definition: CrossTranslationUnit.cpp:804
clang::ento::CallEvent::getParameterLocation
const ParamVarRegion * getParameterLocation(unsigned Index, unsigned BlockCount) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:195
llvm::DenseMapInfo< PrivateMethodKey >::getTombstoneKey
static PrivateMethodKey getTombstoneKey()
Definition: CallEvent.cpp:1149
clang::ento::ObjCMethodCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:1310
clang::ento::StoreManager::evalBaseToDerived
Optional< SVal > evalBaseToDerived(SVal Base, QualType DerivedPtrType)
Attempts to do a down cast.
Definition: Store.cpp:317
clang::FunctionDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2503
clang::Decl::getLocation
SourceLocation getLocation() const
Definition: DeclBase.h:425
clang::ento::CallEvent::dump
void dump() const
Definition: CallEvent.cpp:327
clang::LocationContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:247
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1872
clang::RecordDecl
Represents a struct/union/class.
Definition: Decl.h:3901
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2801
clang::ento::CallEvent::getCalleeStackFrame
const StackFrameContext * getCalleeStackFrame(unsigned BlockCount) const
Returns the callee stack frame.
Definition: CallEvent.cpp:165
clang::ento::CXXDestructorCall::isBaseDestructor
bool isBaseDestructor() const
Returns true if this is a call to a base class destructor.
Definition: CallEvent.h:830
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::CXXInheritedConstructorCall::getInheritingStackFrame
const StackFrameContext * getInheritingStackFrame() const
Obtain the stack frame of the inheriting constructor.
Definition: CallEvent.cpp:886
clang::ento::ParamVarRegion
ParamVarRegion - Represents a region for paremters.
Definition: MemRegion.h:987
clang::LocationContext::getParentMap
const ParentMap & getParentMap() const
Definition: AnalysisDeclContext.h:253
clang::CXXMethodDecl::getParent
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined.
Definition: DeclCXX.h:2083
clang::CXXMethodDecl
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1968
clang::NamedDecl::getName
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:274