clang  16.0.0git
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14 
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
29 #include "clang/Analysis/CFG.h"
34 #include "clang/Basic/LLVM.h"
37 #include "clang/Basic/Specifiers.h"
49 #include "llvm/ADT/ArrayRef.h"
50 #include "llvm/ADT/DenseMap.h"
51 #include "llvm/ADT/ImmutableList.h"
52 #include "llvm/ADT/None.h"
53 #include "llvm/ADT/Optional.h"
54 #include "llvm/ADT/PointerIntPair.h"
55 #include "llvm/ADT/SmallSet.h"
56 #include "llvm/ADT/SmallVector.h"
57 #include "llvm/ADT/StringExtras.h"
58 #include "llvm/ADT/StringRef.h"
59 #include "llvm/Support/Casting.h"
60 #include "llvm/Support/Compiler.h"
61 #include "llvm/Support/Debug.h"
62 #include "llvm/Support/ErrorHandling.h"
63 #include "llvm/Support/raw_ostream.h"
64 #include <cassert>
65 #include <utility>
66 
67 #define DEBUG_TYPE "static-analyzer-call-event"
68 
69 using namespace clang;
70 using namespace ento;
71 
73  ASTContext &Ctx = getState()->getStateManager().getContext();
74  const Expr *E = getOriginExpr();
75  if (!E)
76  return Ctx.VoidTy;
77  return Ctx.getReferenceQualifiedType(E);
78 }
79 
80 static bool isCallback(QualType T) {
81  // If a parameter is a block or a callback, assume it can modify pointer.
82  if (T->isBlockPointerType() ||
83  T->isFunctionPointerType() ||
84  T->isObjCSelType())
85  return true;
86 
87  // Check if a callback is passed inside a struct (for both, struct passed by
88  // reference and by value). Dig just one level into the struct for now.
89 
90  if (T->isAnyPointerType() || T->isReferenceType())
91  T = T->getPointeeType();
92 
93  if (const RecordType *RT = T->getAsStructureType()) {
94  const RecordDecl *RD = RT->getDecl();
95  for (const auto *I : RD->fields()) {
96  QualType FieldT = I->getType();
97  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
98  return true;
99  }
100  }
101  return false;
102 }
103 
105  if (const auto *PT = T->getAs<PointerType>()) {
106  QualType PointeeTy = PT->getPointeeType();
107  if (PointeeTy.isConstQualified())
108  return false;
109  return PointeeTy->isVoidType();
110  } else
111  return false;
112 }
113 
114 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
115  unsigned NumOfArgs = getNumArgs();
116 
117  // If calling using a function pointer, assume the function does not
118  // satisfy the callback.
119  // TODO: We could check the types of the arguments here.
120  if (!getDecl())
121  return false;
122 
123  unsigned Idx = 0;
125  E = param_type_end();
126  I != E && Idx < NumOfArgs; ++I, ++Idx) {
127  // If the parameter is 0, it's harmless.
128  if (getArgSVal(Idx).isZeroConstant())
129  continue;
130 
131  if (Condition(*I))
132  return true;
133  }
134  return false;
135 }
136 
139 }
140 
143 }
144 
145 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
146  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
147  if (!FD)
148  return false;
149 
150  return CheckerContext::isCLibraryFunction(FD, FunctionName);
151 }
152 
154  const Decl *D = getDecl();
155  if (!D)
156  return nullptr;
157 
158  AnalysisDeclContext *ADC =
160 
161  return ADC;
162 }
163 
164 const StackFrameContext *
165 CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
167  if (!ADC)
168  return nullptr;
169 
170  const Expr *E = getOriginExpr();
171  if (!E)
172  return nullptr;
173 
174  // Recover CFG block via reverse lookup.
175  // TODO: If we were to keep CFG element information as part of the CallEvent
176  // instead of doing this reverse lookup, we would be able to build the stack
177  // frame for non-expression-based calls, and also we wouldn't need the reverse
178  // lookup.
180  const CFGBlock *B = Map->getBlock(E);
181  assert(B);
182 
183  // Also recover CFG index by scanning the CFG block.
184  unsigned Idx = 0, Sz = B->size();
185  for (; Idx < Sz; ++Idx)
186  if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
187  if (StmtElem->getStmt() == E)
188  break;
189  assert(Idx < Sz);
190 
191  return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
192 }
193 
194 const ParamVarRegion
195 *CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
196  const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
197  // We cannot construct a VarRegion without a stack frame.
198  if (!SFC)
199  return nullptr;
200 
201  const ParamVarRegion *PVR =
202  State->getStateManager().getRegionManager().getParamVarRegion(
203  getOriginExpr(), Index, SFC);
204  return PVR;
205 }
206 
207 /// Returns true if a type is a pointer-to-const or reference-to-const
208 /// with no further indirection.
209 static bool isPointerToConst(QualType Ty) {
210  QualType PointeeTy = Ty->getPointeeType();
211  if (PointeeTy == QualType())
212  return false;
213  if (!PointeeTy.isConstQualified())
214  return false;
215  if (PointeeTy->isAnyPointerType())
216  return false;
217  return true;
218 }
219 
220 // Try to retrieve the function declaration and find the function parameter
221 // types which are pointers/references to a non-pointer const.
222 // We will not invalidate the corresponding argument regions.
223 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
224  const CallEvent &Call) {
225  unsigned Idx = 0;
226  for (CallEvent::param_type_iterator I = Call.param_type_begin(),
227  E = Call.param_type_end();
228  I != E; ++I, ++Idx) {
229  if (isPointerToConst(*I))
230  PreserveArgs.insert(Idx);
231  }
232 }
233 
235  ProgramStateRef Orig) const {
236  ProgramStateRef Result = (Orig ? Orig : getState());
237 
238  // Don't invalidate anything if the callee is marked pure/const.
239  if (const Decl *callee = getDecl())
240  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
241  return Result;
242 
243  SmallVector<SVal, 8> ValuesToInvalidate;
245 
246  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
247 
248  // Indexes of arguments whose values will be preserved by the call.
249  llvm::SmallSet<unsigned, 4> PreserveArgs;
250  if (!argumentsMayEscape())
251  findPtrToConstParams(PreserveArgs, *this);
252 
253  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
254  // Mark this region for invalidation. We batch invalidate regions
255  // below for efficiency.
256  if (PreserveArgs.count(Idx))
257  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
258  ETraits.setTrait(MR->getBaseRegion(),
260  // TODO: Factor this out + handle the lower level const pointers.
261 
262  ValuesToInvalidate.push_back(getArgSVal(Idx));
263 
264  // If a function accepts an object by argument (which would of course be a
265  // temporary that isn't lifetime-extended), invalidate the object itself,
266  // not only other objects reachable from it. This is necessary because the
267  // destructor has access to the temporary object after the call.
268  // TODO: Support placement arguments once we start
269  // constructing them directly.
270  // TODO: This is unnecessary when there's no destructor, but that's
271  // currently hard to figure out.
272  if (getKind() != CE_CXXAllocator)
274  if (auto AdjIdx = getAdjustedParameterIndex(Idx))
275  if (const TypedValueRegion *TVR =
276  getParameterLocation(*AdjIdx, BlockCount))
277  ValuesToInvalidate.push_back(loc::MemRegionVal(TVR));
278  }
279 
280  // Invalidate designated regions using the batch invalidation API.
281  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
282  // global variables.
283  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
284  BlockCount, getLocationContext(),
285  /*CausedByPointerEscape*/ true,
286  /*Symbols=*/nullptr, this, &ETraits);
287 }
288 
290  const ProgramPointTag *Tag) const {
291  if (const Expr *E = getOriginExpr()) {
292  if (IsPreVisit)
293  return PreStmt(E, getLocationContext(), Tag);
294  return PostStmt(E, getLocationContext(), Tag);
295  }
296 
297  const Decl *D = getDecl();
298  assert(D && "Cannot get a program point without a statement or decl");
299 
301  if (IsPreVisit)
302  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
303  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
304 }
305 
306 SVal CallEvent::getArgSVal(unsigned Index) const {
307  const Expr *ArgE = getArgExpr(Index);
308  if (!ArgE)
309  return UnknownVal();
310  return getSVal(ArgE);
311 }
312 
314  const Expr *ArgE = getArgExpr(Index);
315  if (!ArgE)
316  return {};
317  return ArgE->getSourceRange();
318 }
319 
321  const Expr *E = getOriginExpr();
322  if (!E)
323  return UndefinedVal();
324  return getSVal(E);
325 }
326 
327 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
328 
329 void CallEvent::dump(raw_ostream &Out) const {
330  ASTContext &Ctx = getState()->getStateManager().getContext();
331  if (const Expr *E = getOriginExpr()) {
332  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
333  return;
334  }
335 
336  if (const Decl *D = getDecl()) {
337  Out << "Call to ";
338  D->print(Out, Ctx.getPrintingPolicy());
339  return;
340  }
341 
342  Out << "Unknown call (type " << getKindAsString() << ")";
343 }
344 
345 bool CallEvent::isCallStmt(const Stmt *S) {
346  return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(S);
347 }
348 
350  assert(D);
351  if (const auto *FD = dyn_cast<FunctionDecl>(D))
352  return FD->getReturnType();
353  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
354  return MD->getReturnType();
355  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
356  // Blocks are difficult because the return type may not be stored in the
357  // BlockDecl itself. The AST should probably be enhanced, but for now we
358  // just do what we can.
359  // If the block is declared without an explicit argument list, the
360  // signature-as-written just includes the return type, not the entire
361  // function type.
362  // FIXME: All blocks should have signatures-as-written, even if the return
363  // type is inferred. (That's signified with a dependent result type.)
364  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
365  QualType Ty = TSI->getType();
366  if (const FunctionType *FT = Ty->getAs<FunctionType>())
367  Ty = FT->getReturnType();
368  if (!Ty->isDependentType())
369  return Ty;
370  }
371 
372  return {};
373  }
374 
375  llvm_unreachable("unknown callable kind");
376 }
377 
378 bool CallEvent::isVariadic(const Decl *D) {
379  assert(D);
380 
381  if (const auto *FD = dyn_cast<FunctionDecl>(D))
382  return FD->isVariadic();
383  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
384  return MD->isVariadic();
385  if (const auto *BD = dyn_cast<BlockDecl>(D))
386  return BD->isVariadic();
387 
388  llvm_unreachable("unknown callable kind");
389 }
390 
391 static bool isTransparentUnion(QualType T) {
392  const RecordType *UT = T->getAsUnionType();
393  return UT && UT->getDecl()->hasAttr<TransparentUnionAttr>();
394 }
395 
396 // In some cases, symbolic cases should be transformed before we associate
397 // them with parameters. This function incapsulates such cases.
398 static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
399  const ParmVarDecl *Parameter, SValBuilder &SVB) {
400  QualType ParamType = Parameter->getType();
401  QualType ArgumentType = ArgumentExpr->getType();
402 
403  // Transparent unions allow users to easily convert values of union field
404  // types into union-typed objects.
405  //
406  // Also, more importantly, they allow users to define functions with different
407  // different parameter types, substituting types matching transparent union
408  // field types with the union type itself.
409  //
410  // Here, we check specifically for latter cases and prevent binding
411  // field-typed values to union-typed regions.
412  if (isTransparentUnion(ParamType) &&
413  // Let's check that we indeed trying to bind different types.
414  !isTransparentUnion(ArgumentType)) {
415  BasicValueFactory &BVF = SVB.getBasicValueFactory();
416 
417  llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
418  CompoundSVals = BVF.prependSVal(Value, CompoundSVals);
419 
420  // Wrap it with compound value.
421  return SVB.makeCompoundVal(ParamType, CompoundSVals);
422  }
423 
424  return Value;
425 }
426 
427 /// Cast the argument value to the type of the parameter at the function
428 /// declaration.
429 /// Returns the argument value if it didn't need a cast.
430 /// Or returns the cast argument if it needed a cast.
431 /// Or returns 'Unknown' if it would need a cast but the callsite and the
432 /// runtime definition don't match in terms of argument and parameter count.
433 static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx,
434  SVal ArgVal, SValBuilder &SVB) {
435  const FunctionDecl *RTDecl =
436  Call.getRuntimeDefinition().getDecl()->getAsFunction();
437  const auto *CallExprDecl = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
438 
439  if (!RTDecl || !CallExprDecl)
440  return ArgVal;
441 
442  // The function decl of the Call (in the AST) will not have any parameter
443  // declarations, if it was 'only' declared without a prototype. However, the
444  // engine will find the appropriate runtime definition - basically a
445  // redeclaration, which has a function body (and a function prototype).
446  if (CallExprDecl->hasPrototype() || !RTDecl->hasPrototype())
447  return ArgVal;
448 
449  // Only do this cast if the number arguments at the callsite matches with
450  // the parameters at the runtime definition.
451  if (Call.getNumArgs() != RTDecl->getNumParams())
452  return UnknownVal();
453 
454  const Expr *ArgExpr = Call.getArgExpr(ArgIdx);
455  const ParmVarDecl *Param = RTDecl->getParamDecl(ArgIdx);
456  return SVB.evalCast(ArgVal, Param->getType(), ArgExpr->getType());
457 }
458 
459 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
461  SValBuilder &SVB,
462  const CallEvent &Call,
463  ArrayRef<ParmVarDecl*> parameters) {
464  MemRegionManager &MRMgr = SVB.getRegionManager();
465 
466  // If the function has fewer parameters than the call has arguments, we simply
467  // do not bind any values to them.
468  unsigned NumArgs = Call.getNumArgs();
469  unsigned Idx = 0;
470  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
471  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
472  assert(*I && "Formal parameter has no decl?");
473 
474  // TODO: Support allocator calls.
475  if (Call.getKind() != CE_CXXAllocator)
476  if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx)))
477  continue;
478 
479  // TODO: Allocators should receive the correct size and possibly alignment,
480  // determined in compile-time but not represented as arg-expressions,
481  // which makes getArgSVal() fail and return UnknownVal.
482  SVal ArgVal = Call.getArgSVal(Idx);
483  const Expr *ArgExpr = Call.getArgExpr(Idx);
484 
485  if (ArgVal.isUnknown())
486  continue;
487 
488  // Cast the argument value to match the type of the parameter in some
489  // edge-cases.
490  ArgVal = castArgToParamTypeIfNeeded(Call, Idx, ArgVal, SVB);
491 
492  Loc ParamLoc = SVB.makeLoc(
493  MRMgr.getParamVarRegion(Call.getOriginExpr(), Idx, CalleeCtx));
494  Bindings.push_back(
495  std::make_pair(ParamLoc, processArgument(ArgVal, ArgExpr, *I, SVB)));
496  }
497 
498  // FIXME: Variadic arguments are not handled at all right now.
499 }
500 
502  const StackFrameContext *StackFrame = getCalleeStackFrame(0);
503  if (!StackFrame)
504  return nullptr;
505 
506  const CFGElement Element = StackFrame->getCallSiteCFGElement();
507  if (const auto Ctor = Element.getAs<CFGConstructor>()) {
508  return Ctor->getConstructionContext();
509  }
510 
511  if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
512  return RecCall->getConstructionContext();
513  }
514 
515  return nullptr;
516 }
517 
520  const auto *CC = getConstructionContext();
521  if (!CC)
522  return std::nullopt;
523 
524  EvalCallOptions CallOpts;
525  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
526  SVal RetVal = Engine.computeObjectUnderConstruction(
527  getOriginExpr(), getState(), &Engine.getBuilderContext(),
528  getLocationContext(), CC, CallOpts);
529  return RetVal;
530 }
531 
533  const FunctionDecl *D = getDecl();
534  if (!D)
535  return std::nullopt;
536  return D->parameters();
537 }
538 
540  const FunctionDecl *FD = getDecl();
541  if (!FD)
542  return {};
543 
544  // Note that the AnalysisDeclContext will have the FunctionDecl with
545  // the definition (if one exists).
546  AnalysisDeclContext *AD =
548  getManager()->getContext(FD);
549  bool IsAutosynthesized;
550  Stmt* Body = AD->getBody(IsAutosynthesized);
551  LLVM_DEBUG({
552  if (IsAutosynthesized)
553  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
554  << "\n";
555  });
556 
557  ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
559  *Engine.getCrossTranslationUnitContext();
560 
561  AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
562 
563  if (Body) {
564  const Decl* Decl = AD->getDecl();
565  if (Opts.IsNaiveCTUEnabled && CTUCtx.isImportedAsNew(Decl)) {
566  // A newly created definition, but we had error(s) during the import.
567  if (CTUCtx.hasError(Decl))
568  return {};
569  return RuntimeDefinition(Decl, /*Foreign=*/true);
570  }
571  return RuntimeDefinition(Decl, /*Foreign=*/false);
572  }
573 
574  // Try to get CTU definition only if CTUDir is provided.
575  if (!Opts.IsNaiveCTUEnabled)
576  return {};
577 
578  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
579  CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
580  Opts.DisplayCTUProgress);
581 
582  if (!CTUDeclOrError) {
583  handleAllErrors(CTUDeclOrError.takeError(),
584  [&](const cross_tu::IndexError &IE) {
585  CTUCtx.emitCrossTUDiagnostics(IE);
586  });
587  return {};
588  }
589 
590  return RuntimeDefinition(*CTUDeclOrError, /*Foreign=*/true);
591 }
592 
594  const StackFrameContext *CalleeCtx,
595  BindingsTy &Bindings) const {
596  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
597  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
598  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
599  D->parameters());
600 }
601 
604  return true;
605 
606  const FunctionDecl *D = getDecl();
607  if (!D)
608  return true;
609 
610  const IdentifierInfo *II = D->getIdentifier();
611  if (!II)
612  return false;
613 
614  // This set of "escaping" APIs is
615 
616  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
617  // value into thread local storage. The value can later be retrieved with
618  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
619  // parameter is 'const void *', the region escapes through the call.
620  if (II->isStr("pthread_setspecific"))
621  return true;
622 
623  // - xpc_connection_set_context stores a value which can be retrieved later
624  // with xpc_connection_get_context.
625  if (II->isStr("xpc_connection_set_context"))
626  return true;
627 
628  // - funopen - sets a buffer for future IO calls.
629  if (II->isStr("funopen"))
630  return true;
631 
632  // - __cxa_demangle - can reallocate memory and can return the pointer to
633  // the input buffer.
634  if (II->isStr("__cxa_demangle"))
635  return true;
636 
637  StringRef FName = II->getName();
638 
639  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
640  // buffer even if it is const.
641  if (FName.endswith("NoCopy"))
642  return true;
643 
644  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
645  // be deallocated by NSMapRemove.
646  if (FName.startswith("NS") && FName.contains("Insert"))
647  return true;
648 
649  // - Many CF containers allow objects to escape through custom
650  // allocators/deallocators upon container construction. (PR12101)
651  if (FName.startswith("CF") || FName.startswith("CG")) {
652  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
653  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
654  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
655  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
656  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
657  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
658  }
659 
660  return false;
661 }
662 
665  if (D)
666  return D;
667 
668  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
669 }
670 
672  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
673  if (!CE)
674  return AnyFunctionCall::getDecl();
675 
676  const FunctionDecl *D = CE->getDirectCallee();
677  if (D)
678  return D;
679 
680  return getSVal(CE->getCallee()).getAsFunctionDecl();
681 }
682 
684  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
685  SVal ThisVal = getCXXThisVal();
686  Values.push_back(ThisVal);
687 
688  // Don't invalidate if the method is const and there are no mutable fields.
689  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
690  if (!D->isConst())
691  return;
692  // Get the record decl for the class of 'This'. D->getParent() may return a
693  // base class decl, rather than the class of the instance which needs to be
694  // checked for mutable fields.
695  // TODO: We might as well look at the dynamic type of the object.
696  const Expr *Ex = getCXXThisExpr()->IgnoreParenBaseCasts();
697  QualType T = Ex->getType();
698  if (T->isPointerType()) // Arrow or implicit-this syntax?
699  T = T->getPointeeType();
700  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
701  assert(ParentRecord);
702  if (ParentRecord->hasMutableFields())
703  return;
704  // Preserve CXXThis.
705  const MemRegion *ThisRegion = ThisVal.getAsRegion();
706  if (!ThisRegion)
707  return;
708 
709  ETraits->setTrait(ThisRegion->getBaseRegion(),
711  }
712 }
713 
715  const Expr *Base = getCXXThisExpr();
716  // FIXME: This doesn't handle an overloaded ->* operator.
717  if (!Base)
718  return UnknownVal();
719 
720  SVal ThisVal = getSVal(Base);
721  assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal));
722  return ThisVal;
723 }
724 
726  // Do we have a decl at all?
727  const Decl *D = getDecl();
728  if (!D)
729  return {};
730 
731  // If the method is non-virtual, we know we can inline it.
732  const auto *MD = cast<CXXMethodDecl>(D);
733  if (!MD->isVirtual())
735 
736  // Do we know the implicit 'this' object being called?
737  const MemRegion *R = getCXXThisVal().getAsRegion();
738  if (!R)
739  return {};
740 
741  // Do we know anything about the type of 'this'?
743  if (!DynType.isValid())
744  return {};
745 
746  // Is the type a C++ class? (This is mostly a defensive check.)
747  QualType RegionType = DynType.getType()->getPointeeType();
748  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
749 
750  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
751  if (!RD || !RD->hasDefinition())
752  return {};
753 
754  // Find the decl for this method in that class.
755  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
756  if (!Result) {
757  // We might not even get the original statically-resolved method due to
758  // some particularly nasty casting (e.g. casts to sister classes).
759  // However, we should at least be able to search up and down our own class
760  // hierarchy, and some real bugs have been caught by checking this.
761  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
762 
763  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
764  // the static type. However, because we currently don't update
765  // DynamicTypeInfo when an object is cast, we can't actually be sure the
766  // DynamicTypeInfo is up to date. This assert should be re-enabled once
767  // this is fixed. <rdar://problem/12287087>
768  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
769 
770  return {};
771  }
772 
773  // Does the decl that we found have an implementation?
774  const FunctionDecl *Definition;
775  if (!Result->hasBody(Definition)) {
776  if (!DynType.canBeASubClass())
778  return {};
779  }
780 
781  // We found a definition. If we're not sure that this devirtualization is
782  // actually what will happen at runtime, make sure to provide the region so
783  // that ExprEngine can decide what to do with it.
784  if (DynType.canBeASubClass())
785  return RuntimeDefinition(Definition, R->StripCasts());
786  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
787 }
788 
790  const StackFrameContext *CalleeCtx,
791  BindingsTy &Bindings) const {
793 
794  // Handle the binding of 'this' in the new stack frame.
795  SVal ThisVal = getCXXThisVal();
796  if (!ThisVal.isUnknown()) {
797  ProgramStateManager &StateMgr = getState()->getStateManager();
798  SValBuilder &SVB = StateMgr.getSValBuilder();
799 
800  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
801  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
802 
803  // If we devirtualized to a different member function, we need to make sure
804  // we have the proper layering of CXXBaseObjectRegions.
805  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
806  ASTContext &Ctx = SVB.getContext();
807  const CXXRecordDecl *Class = MD->getParent();
808  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
809 
810  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
811  Optional<SVal> V =
812  StateMgr.getStoreManager().evalBaseToDerived(ThisVal, Ty);
813  if (!V) {
814  // We might have suffered some sort of placement new earlier, so
815  // we're constructing in a completely unexpected storage.
816  // Fall back to a generic pointer cast for this-value.
817  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
818  const CXXRecordDecl *StaticClass = StaticMD->getParent();
819  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
820  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
821  } else
822  ThisVal = *V;
823  }
824 
825  if (!ThisVal.isUnknown())
826  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
827  }
828 }
829 
832 }
833 
835  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
836  // id-expression in the class member access expression is a qualified-id,
837  // that function is called. Otherwise, its final overrider in the dynamic type
838  // of the object expression is called.
839  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
840  if (ME->hasQualifier())
842 
844 }
845 
847  return getOriginExpr()->getArg(0);
848 }
849 
851  const Expr *Callee = getOriginExpr()->getCallee();
852  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
853 
854  return dyn_cast_or_null<BlockDataRegion>(DataReg);
855 }
856 
858  const BlockDecl *D = getDecl();
859  if (!D)
860  return std::nullopt;
861  return D->parameters();
862 }
863 
865  RegionAndSymbolInvalidationTraits *ETraits) const {
866  // FIXME: This also needs to invalidate captured globals.
867  if (const MemRegion *R = getBlockRegion())
868  Values.push_back(loc::MemRegionVal(R));
869 }
870 
872  BindingsTy &Bindings) const {
873  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
874  ArrayRef<ParmVarDecl*> Params;
875  if (isConversionFromLambda()) {
876  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
877  Params = LambdaOperatorDecl->parameters();
878 
879  // For blocks converted from a C++ lambda, the callee declaration is the
880  // operator() method on the lambda so we bind "this" to
881  // the lambda captured by the block.
882  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
883  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
884  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
885  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
886  } else {
887  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
888  }
889 
890  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
891  Params);
892 }
893 
895  if (Data)
896  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
897  return UnknownVal();
898 }
899 
901  RegionAndSymbolInvalidationTraits *ETraits) const {
902  SVal V = getCXXThisVal();
903  if (SymbolRef Sym = V.getAsSymbol(true))
904  ETraits->setTrait(Sym,
906  Values.push_back(V);
907 }
908 
910  const StackFrameContext *CalleeCtx,
911  BindingsTy &Bindings) const {
913 
914  SVal ThisVal = getCXXThisVal();
915  if (!ThisVal.isUnknown()) {
916  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
917  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
918  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
919  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
920  }
921 }
922 
923 const StackFrameContext *
926  while (isa<CXXInheritedCtorInitExpr>(SFC->getCallSite()))
927  SFC = SFC->getParent()->getStackFrame();
928  return SFC;
929 }
930 
932  if (Data)
933  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
934  return UnknownVal();
935 }
936 
938  // Base destructors are always called non-virtually.
939  // Skip CXXInstanceCall's devirtualization logic in this case.
940  if (isBaseDestructor())
942 
944 }
945 
947  const ObjCMethodDecl *D = getDecl();
948  if (!D)
949  return std::nullopt;
950  return D->parameters();
951 }
952 
954  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
955 
956  // If the method call is a setter for property known to be backed by
957  // an instance variable, don't invalidate the entire receiver, just
958  // the storage for that instance variable.
959  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
960  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
961  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
962  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
963  ETraits->setTrait(
964  IvarRegion,
966  ETraits->setTrait(
967  IvarRegion,
969  Values.push_back(IvarLVal);
970  }
971  return;
972  }
973  }
974 
975  Values.push_back(getReceiverSVal());
976 }
977 
979  // FIXME: Is this the best way to handle class receivers?
980  if (!isInstanceMessage())
981  return UnknownVal();
982 
983  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
984  return getSVal(RecE);
985 
986  // An instance message with no expression means we are sending to super.
987  // In this case the object reference is the same as 'self'.
988  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
989  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
990  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
991  return SelfVal;
992 }
993 
995  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
996  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
997  return true;
998 
999  if (!isInstanceMessage())
1000  return false;
1001 
1002  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
1003  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1004 
1005  return (RecVal == SelfVal);
1006 }
1007 
1009  switch (getMessageKind()) {
1010  case OCM_Message:
1011  return getOriginExpr()->getSourceRange();
1012  case OCM_PropertyAccess:
1013  case OCM_Subscript:
1014  return getContainingPseudoObjectExpr()->getSourceRange();
1015  }
1016  llvm_unreachable("unknown message kind");
1017 }
1018 
1019 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1020 
1021 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1022  assert(Data && "Lazy lookup not yet performed.");
1023  assert(getMessageKind() != OCM_Message && "Explicit message send.");
1024  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
1025 }
1026 
1027 static const Expr *
1029  const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
1030 
1031  // This handles the funny case of assigning to the result of a getter.
1032  // This can happen if the getter returns a non-const reference.
1033  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1034  Syntactic = BO->getLHS()->IgnoreParens();
1035 
1036  return Syntactic;
1037 }
1038 
1040  if (!Data) {
1041  // Find the parent, ignoring implicit casts.
1042  const ParentMap &PM = getLocationContext()->getParentMap();
1043  const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1044 
1045  // Check if parent is a PseudoObjectExpr.
1046  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1047  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1048 
1049  ObjCMessageKind K;
1050  switch (Syntactic->getStmtClass()) {
1051  case Stmt::ObjCPropertyRefExprClass:
1052  K = OCM_PropertyAccess;
1053  break;
1054  case Stmt::ObjCSubscriptRefExprClass:
1055  K = OCM_Subscript;
1056  break;
1057  default:
1058  // FIXME: Can this ever happen?
1059  K = OCM_Message;
1060  break;
1061  }
1062 
1063  if (K != OCM_Message) {
1064  const_cast<ObjCMethodCall *>(this)->Data
1065  = ObjCMessageDataTy(POE, K).getOpaqueValue();
1066  assert(getMessageKind() == K);
1067  return K;
1068  }
1069  }
1070 
1071  const_cast<ObjCMethodCall *>(this)->Data
1072  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1073  assert(getMessageKind() == OCM_Message);
1074  return OCM_Message;
1075  }
1076 
1077  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1078  if (!Info.getPointer())
1079  return OCM_Message;
1080  return static_cast<ObjCMessageKind>(Info.getInt());
1081 }
1082 
1084  // Look for properties accessed with property syntax (foo.bar = ...)
1086  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1087  assert(POE && "Property access without PseudoObjectExpr?");
1088 
1089  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1090  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1091 
1092  if (RefExpr->isExplicitProperty())
1093  return RefExpr->getExplicitProperty();
1094  }
1095 
1096  // Look for properties accessed with method syntax ([foo setBar:...]).
1097  const ObjCMethodDecl *MD = getDecl();
1098  if (!MD || !MD->isPropertyAccessor())
1099  return nullptr;
1100 
1101  // Note: This is potentially quite slow.
1102  return MD->findPropertyDecl();
1103 }
1104 
1106  Selector Sel) const {
1107  assert(IDecl);
1108  AnalysisManager &AMgr =
1109  getState()->getStateManager().getOwningEngine().getAnalysisManager();
1110  // If the class interface is declared inside the main file, assume it is not
1111  // subcassed.
1112  // TODO: It could actually be subclassed if the subclass is private as well.
1113  // This is probably very rare.
1114  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1115  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1116  return false;
1117 
1118  // Assume that property accessors are not overridden.
1120  return false;
1121 
1122  // We assume that if the method is public (declared outside of main file) or
1123  // has a parent which publicly declares the method, the method could be
1124  // overridden in a subclass.
1125 
1126  // Find the first declaration in the class hierarchy that declares
1127  // the selector.
1128  ObjCMethodDecl *D = nullptr;
1129  while (true) {
1130  D = IDecl->lookupMethod(Sel, true);
1131 
1132  // Cannot find a public definition.
1133  if (!D)
1134  return false;
1135 
1136  // If outside the main file,
1137  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1138  return true;
1139 
1140  if (D->isOverriding()) {
1141  // Search in the superclass on the next iteration.
1142  IDecl = D->getClassInterface();
1143  if (!IDecl)
1144  return false;
1145 
1146  IDecl = IDecl->getSuperClass();
1147  if (!IDecl)
1148  return false;
1149 
1150  continue;
1151  }
1152 
1153  return false;
1154  };
1155 
1156  llvm_unreachable("The while loop should always terminate.");
1157 }
1158 
1160  if (!MD)
1161  return MD;
1162 
1163  // Find the redeclaration that defines the method.
1164  if (!MD->hasBody()) {
1165  for (auto *I : MD->redecls())
1166  if (I->hasBody())
1167  MD = cast<ObjCMethodDecl>(I);
1168  }
1169  return MD;
1170 }
1171 
1176 };
1177 
1178 namespace llvm {
1179 template <> struct DenseMapInfo<PrivateMethodKey> {
1180  using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1181  using SelectorInfo = DenseMapInfo<Selector>;
1182 
1183  static inline PrivateMethodKey getEmptyKey() {
1184  return {InterfaceInfo::getEmptyKey(), SelectorInfo::getEmptyKey(), false};
1185  }
1186 
1188  return {InterfaceInfo::getTombstoneKey(), SelectorInfo::getTombstoneKey(),
1189  true};
1190  }
1191 
1192  static unsigned getHashValue(const PrivateMethodKey &Key) {
1193  return llvm::hash_combine(
1194  llvm::hash_code(InterfaceInfo::getHashValue(Key.Interface)),
1195  llvm::hash_code(SelectorInfo::getHashValue(Key.LookupSelector)),
1196  Key.IsClassMethod);
1197  }
1198 
1199  static bool isEqual(const PrivateMethodKey &LHS,
1200  const PrivateMethodKey &RHS) {
1201  return InterfaceInfo::isEqual(LHS.Interface, RHS.Interface) &&
1202  SelectorInfo::isEqual(LHS.LookupSelector, RHS.LookupSelector) &&
1203  LHS.IsClassMethod == RHS.IsClassMethod;
1204  }
1205 };
1206 } // end namespace llvm
1207 
1208 static const ObjCMethodDecl *
1210  Selector LookupSelector, bool InstanceMethod) {
1211  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1212  // when in many cases it returns null. We cache the results so
1213  // that repeated queries on the same ObjCIntefaceDecl and Selector
1214  // don't incur the same cost. On some test cases, we can see the
1215  // same query being issued thousands of times.
1216  //
1217  // NOTE: This cache is essentially a "global" variable, but it
1218  // only gets lazily created when we get here. The value of the
1219  // cache probably comes from it being global across ExprEngines,
1220  // where the same queries may get issued. If we are worried about
1221  // concurrency, or possibly loading/unloading ASTs, etc., we may
1222  // need to revisit this someday. In terms of memory, this table
1223  // stays around until clang quits, which also may be bad if we
1224  // need to release memory.
1225  using PrivateMethodCache =
1226  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1227 
1228  static PrivateMethodCache PMC;
1230  PMC[{Interface, LookupSelector, InstanceMethod}];
1231 
1232  // Query lookupPrivateMethod() if the cache does not hit.
1233  if (!Val) {
1234  Val = Interface->lookupPrivateMethod(LookupSelector, InstanceMethod);
1235 
1236  if (!*Val) {
1237  // Query 'lookupMethod' as a backup.
1238  Val = Interface->lookupMethod(LookupSelector, InstanceMethod);
1239  }
1240  }
1241 
1242  return *Val;
1243 }
1244 
1246  const ObjCMessageExpr *E = getOriginExpr();
1247  assert(E);
1248  Selector Sel = E->getSelector();
1249 
1250  if (E->isInstanceMessage()) {
1251  // Find the receiver type.
1252  const ObjCObjectType *ReceiverT = nullptr;
1253  bool CanBeSubClassed = false;
1254  bool LookingForInstanceMethod = true;
1255  QualType SupersType = E->getSuperType();
1256  const MemRegion *Receiver = nullptr;
1257 
1258  if (!SupersType.isNull()) {
1259  // The receiver is guaranteed to be 'super' in this case.
1260  // Super always means the type of immediate predecessor to the method
1261  // where the call occurs.
1262  ReceiverT = cast<ObjCObjectPointerType>(SupersType)->getObjectType();
1263  } else {
1264  Receiver = getReceiverSVal().getAsRegion();
1265  if (!Receiver)
1266  return {};
1267 
1268  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1269  if (!DTI.isValid()) {
1270  assert(isa<AllocaRegion>(Receiver) &&
1271  "Unhandled untyped region class!");
1272  return {};
1273  }
1274 
1275  QualType DynType = DTI.getType();
1276  CanBeSubClassed = DTI.canBeASubClass();
1277 
1278  const auto *ReceiverDynT =
1279  dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1280 
1281  if (ReceiverDynT) {
1282  ReceiverT = ReceiverDynT->getObjectType();
1283 
1284  // It can be actually class methods called with Class object as a
1285  // receiver. This type of messages is treated by the compiler as
1286  // instance (not class).
1287  if (ReceiverT->isObjCClass()) {
1288 
1289  SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1290  // For [self classMethod], return compiler visible declaration.
1291  if (Receiver == SelfVal.getAsRegion()) {
1293  }
1294 
1295  // Otherwise, let's check if we know something about the type
1296  // inside of this class object.
1297  if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1298  DynamicTypeInfo DTI =
1299  getClassObjectDynamicTypeInfo(getState(), ReceiverSym);
1300  if (DTI.isValid()) {
1301  // Let's use this type for lookup.
1302  ReceiverT =
1303  cast<ObjCObjectType>(DTI.getType().getCanonicalType());
1304 
1305  CanBeSubClassed = DTI.canBeASubClass();
1306  // And it should be a class method instead.
1307  LookingForInstanceMethod = false;
1308  }
1309  }
1310  }
1311 
1312  if (CanBeSubClassed)
1313  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1314  // Even if `DynamicTypeInfo` told us that it can be
1315  // not necessarily this type, but its descendants, we still want
1316  // to check again if this selector can be actually overridden.
1317  CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1318  }
1319  }
1320 
1321  // Lookup the instance method implementation.
1322  if (ReceiverT)
1323  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1324  const ObjCMethodDecl *MD =
1325  lookupRuntimeDefinition(IDecl, Sel, LookingForInstanceMethod);
1326 
1327  if (MD && !MD->hasBody())
1328  MD = MD->getCanonicalDecl();
1329 
1330  if (CanBeSubClassed)
1331  return RuntimeDefinition(MD, Receiver);
1332  else
1333  return RuntimeDefinition(MD, nullptr);
1334  }
1335  } else {
1336  // This is a class method.
1337  // If we have type info for the receiver class, we are calling via
1338  // class name.
1339  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1340  // Find/Return the method implementation.
1341  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1342  }
1343  }
1344 
1345  return {};
1346 }
1347 
1349  if (isInSystemHeader() && !isInstanceMessage()) {
1350  Selector Sel = getSelector();
1351  if (Sel.getNumArgs() == 1 &&
1352  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1353  return true;
1354  }
1355 
1357 }
1358 
1360  const StackFrameContext *CalleeCtx,
1361  BindingsTy &Bindings) const {
1362  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1363  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1364  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1365  D->parameters());
1366 
1367  SVal SelfVal = getReceiverSVal();
1368  if (!SelfVal.isUnknown()) {
1369  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1370  MemRegionManager &MRMgr = SVB.getRegionManager();
1371  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1372  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1373  }
1374 }
1375 
1378  const LocationContext *LCtx) {
1379  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1380  return create<CXXMemberCall>(MCE, State, LCtx);
1381 
1382  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1383  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1384  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1385  if (MD->isInstance())
1386  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1387 
1388  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1389  return create<BlockCall>(CE, State, LCtx);
1390  }
1391 
1392  // Otherwise, it's a normal function call, static member function call, or
1393  // something we can't reason about.
1394  return create<SimpleFunctionCall>(CE, State, LCtx);
1395 }
1396 
1400  const LocationContext *ParentCtx = CalleeCtx->getParent();
1401  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1402  assert(CallerCtx && "This should not be used for top-level stack frames");
1403 
1404  const Stmt *CallSite = CalleeCtx->getCallSite();
1405 
1406  if (CallSite) {
1407  if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1408  return Out;
1409 
1410  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1411  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1412  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1413  SVal ThisVal = State->getSVal(ThisPtr);
1414 
1415  if (const auto *CE = dyn_cast<CXXConstructExpr>(CallSite))
1416  return getCXXConstructorCall(CE, ThisVal.getAsRegion(), State, CallerCtx);
1417  else if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(CallSite))
1418  return getCXXInheritedConstructorCall(CIE, ThisVal.getAsRegion(), State,
1419  CallerCtx);
1420  else {
1421  // All other cases are handled by getCall.
1422  llvm_unreachable("This is not an inlineable statement");
1423  }
1424  }
1425 
1426  // Fall back to the CFG. The only thing we haven't handled yet is
1427  // destructors, though this could change in the future.
1428  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1429  CFGElement E = (*B)[CalleeCtx->getIndex()];
1430  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1431  "All other CFG elements should have exprs");
1432 
1433  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1434  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1435  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1436  SVal ThisVal = State->getSVal(ThisPtr);
1437 
1438  const Stmt *Trigger;
1440  Trigger = AutoDtor->getTriggerStmt();
1441  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1442  Trigger = DeleteDtor->getDeleteExpr();
1443  else
1444  Trigger = Dtor->getBody();
1445 
1446  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1447  E.getAs<CFGBaseDtor>().has_value(), State,
1448  CallerCtx);
1449 }
1450 
1452  const LocationContext *LC) {
1453  if (const auto *CE = dyn_cast<CallExpr>(S)) {
1454  return getSimpleCall(CE, State, LC);
1455  } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1456  return getCXXAllocatorCall(NE, State, LC);
1457  } else if (const auto *DE = dyn_cast<CXXDeleteExpr>(S)) {
1458  return getCXXDeallocatorCall(DE, State, LC);
1459  } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1460  return getObjCMethodCall(ME, State, LC);
1461  } else {
1462  return nullptr;
1463  }
1464 }
clang::AnalysisDeclContext::getCFGStmtMap
CFGStmtMap * getCFGStmtMap()
Definition: AnalysisDeclContext.cpp:250
clang::ento::AnyCXXConstructorCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:900
clang::ObjCMessageExpr::SuperInstance
@ SuperInstance
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1098
clang::ObjCInterfaceDecl
Represents an ObjC class declaration.
Definition: DeclObjC.h:1148
clang::ento::SVal::isValid
bool isValid() const
Definition: SVals.h:137
findPtrToConstParams
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:223
clang::ObjCMessageExpr::isInstanceMessage
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1239
clang::ObjCMessageExpr::getReceiverInterface
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:314
clang::ento::BlockCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:857
clang::ento::ObjCMethodCall::getMessageKind
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1039
clang::BlockDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:4397
clang::ento::UndefinedVal
Definition: SVals.h:215
addParameterValuesToBindings
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl * > parameters)
Definition: CallEvent.cpp:459
llvm
YAML serialization mapping.
Definition: Dominators.h:30
clang::ento::CallEventManager::getCall
CallEventRef getCall(const Stmt *S, ProgramStateRef State, const LocationContext *LC)
Gets a call event for a function call, Objective-C method call, a 'new', or a 'delete' call.
Definition: CallEvent.cpp:1451
clang::ento::CXXMemberCall::getOriginExpr
const CXXMemberCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:708
clang::FunctionDecl::getNumParams
unsigned getNumParams() const
Return the number of parameters this function must have based on its FunctionType.
Definition: Decl.cpp:3466
clang::Type::isBlockPointerType
bool isBlockPointerType() const
Definition: Type.h:6891
clang::ento::ObjCMethodCall::getOriginExpr
const ObjCMessageExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:1155
clang::ento::CallEvent::isArgumentConstructedDirectly
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:414
Specifiers.h
clang::ento::CallEventRef
Definition: CallEvent.h:81
clang::ento::DynamicTypeInfo::getType
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
Definition: DynamicTypeInfo.h:34
clang::ento::AnyCXXConstructorCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:909
clang::LocationContext
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
Definition: AnalysisDeclContext.h:215
clang::ento::OCM_Subscript
@ OCM_Subscript
Definition: CallEvent.h:1124
CallDescription.h
clang::LocationContext::getStackFrame
const StackFrameContext * getStackFrame() const
Definition: AnalysisDeclContext.cpp:462
clang::ento::CallEventManager::getCXXDestructorCall
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1334
clang::ObjCInterfaceDecl::lookupMethod
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class,...
Definition: DeclObjC.cpp:690
SVals.h
clang::SourceRange
A trivial tuple used to represent a source range.
Definition: SourceLocation.h:210
clang::ento::SVal::getAsFunctionDecl
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:46
clang::ObjCSubstitutionContext::Parameter
@ Parameter
The parameter type of a method or function.
clang::ento::BlockCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:864
clang::Decl::hasAttr
bool hasAttr() const
Definition: DeclBase.h:560
clang::QualType::isConstQualified
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6694
clang::ObjCMessageExpr::getSelector
Selector getSelector() const
Definition: ExprObjC.cpp:293
clang::ento::SVal::getAsRegion
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
clang::ProgramPointTag
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
PrivateMethodKey::Interface
const ObjCInterfaceDecl * Interface
Definition: CallEvent.cpp:1173
AnalysisDeclContext.h
clang::ento::DynamicTypeInfo
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
Definition: DynamicTypeInfo.h:19
clang::ento::CallEvent::getOriginExpr
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:240
clang::ASTContext::VoidTy
CanQualType VoidTy
Definition: ASTContext.h:1080
llvm::SmallVector
Definition: LLVM.h:38
clang::AnalysisDeclContextManager::getStackFrame
const StackFrameContext * getStackFrame(const Decl *D)
Obtain the beginning context of the analysis.
Definition: AnalysisDeclContext.h:470
clang::ento::MemRegion::StripCasts
const LLVM_ATTRIBUTE_RETURNS_NONNULL MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1342
clang::ParentMap::getParentIgnoreParenCasts
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:146
clang::SourceLocation
Encodes a location in the source.
Definition: SourceLocation.h:86
llvm::DenseMapInfo< PrivateMethodKey >::getEmptyKey
static PrivateMethodKey getEmptyKey()
Definition: CallEvent.cpp:1183
clang::ento::CallEventManager::getCXXDeallocatorCall
CallEventRef< CXXDeallocatorCall > getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1347
clang::ento::AnyFunctionCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:539
clang::SourceRange::getBegin
SourceLocation getBegin() const
Definition: SourceLocation.h:219
clang::ento::ProgramStateManager::getSValBuilder
SValBuilder & getSValBuilder()
Definition: ProgramState.h:552
clang::ento::RegionAndSymbolInvalidationTraits::TK_SuppressEscape
@ TK_SuppressEscape
Suppress pointer-escaping of a region.
Definition: MemRegion.h:1588
clang::Stmt::getSourceRange
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:324
clang::CFGTemporaryDtor
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:484
clang::QualType
A (possibly-)qualified type.
Definition: Type.h:737
Attr.h
clang::FunctionDecl::getParamDecl
const ParmVarDecl * getParamDecl(unsigned i) const
Definition: Decl.h:2594
clang::ConstructionContext
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Definition: ConstructionContext.h:243
clang::ento::CallEventManager::getObjCMethodCall
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1315
clang::AnalysisDeclContext
AnalysisDeclContext contains the context data for the function, method or block under analysis.
Definition: AnalysisDeclContext.h:72
clang::AnalysisDeclContext::getSelfDecl
const ImplicitParamDecl * getSelfDecl() const
Definition: AnalysisDeclContext.cpp:148
clang::Decl::hasBody
virtual bool hasBody() const
Returns true if this Decl represents a declaration for a body of code, such as a function or method d...
Definition: DeclBase.h:1058
clang::QualType::getCanonicalType
QualType getCanonicalType() const
Definition: Type.h:6674
clang::ento::ObjCMethodCall::getReceiverSVal
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:978
clang::ParmVarDecl
Represents a parameter to a function.
Definition: Decl.h:1712
clang::ento::CallEvent::hasVoidPointerToNonConstArg
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:141
DeclCXX.h
clang::StackFrameContext::getCallSiteCFGElement
CFGElement getCallSiteCFGElement() const
Definition: AnalysisDeclContext.h:333
clang::Type::isObjCSelType
bool isObjCSelType() const
Definition: Type.h:7056
clang::ObjCMethodDecl::getClassInterface
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1174
ProgramState_Fwd.h
clang::StackFrameContext::getCallSiteBlock
const CFGBlock * getCallSiteBlock() const
Definition: AnalysisDeclContext.h:327
llvm::Optional
Definition: LLVM.h:40
clang::ento::CallEvent::param_type_end
param_type_iterator param_type_end() const
Definition: CallEvent.h:472
clang::ento::CallEvent::getConstructionContext
const ConstructionContext * getConstructionContext() const
Returns the construction context of the call, if it is a C++ constructor call or a call of a function...
Definition: CallEvent.cpp:501
clang::StackFrameContext
It represents a stack frame of the call stack (based on CallEvent).
Definition: AnalysisDeclContext.h:299
SourceManager.h
clang::ento::CallEvent::isGlobalCFunction
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CallEvent.cpp:145
clang::Type::isVoidType
bool isVoidType() const
Definition: Type.h:7180
clang::ento::ObjCMethodCall::getAccessedProperty
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1083
llvm::Expected
Definition: LLVM.h:41
clang::ento::UnknownVal
Definition: SVals.h:236
clang::StackFrameContext::getIndex
unsigned getIndex() const
Definition: AnalysisDeclContext.h:331
clang::ento::CallEvent::getDeclaredResultType
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:349
clang::FunctionType
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3675
clang::ento::CallEvent::getReturnValueUnderConstruction
Optional< SVal > getReturnValueUnderConstruction() const
If the call returns a C++ record type then the region of its return value can be retrieved from its c...
Definition: CallEvent.cpp:519
clang::ento::loc::MemRegionVal
Definition: SVals.h:506
clang::ento::CallEvent::isCallStmt
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:345
clang::ObjCMessageExpr::SuperClass
@ SuperClass
The receiver is a superclass.
Definition: ExprObjC.h:1095
clang::ObjCObjectType::getInterface
ObjCInterfaceDecl * getInterface() const
Gets the interface declaration for this object type, if the base type really is an interface.
Definition: Type.h:6249
clang::ento::MemRegionManager::getVarRegion
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:964
clang::ento::CallEvent::argumentsMayEscape
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:314
clang::ObjCMethodDecl::isOverriding
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:466
clang::PostImplicitCall
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:599
clang::ento::RuntimeDefinition
Definition: CallEvent.h:105
clang::ento::ObjCMethodCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:1245
clang::FunctionDecl::hasPrototype
bool hasPrototype() const
Whether this function has a prototype, either because one was explicitly written or because it was "i...
Definition: Decl.h:2327
Decl.h
clang::ObjCObjectType
Represents a class type in Objective C.
Definition: Type.h:6014
CallEvent.h
DeclObjC.h
clang::Type::getAsStructureType
const RecordType * getAsStructureType() const
Definition: Type.cpp:641
clang::ento::CXXInstanceCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:683
clang::ento::MemRegion
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:95
clang::ento::CallEvent::getState
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:225
clang::CFGBlock
Represents a single basic block in a source-level CFG.
Definition: CFG.h:578
clang::CXXRecordDecl::hasMutableFields
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1190
clang::ento::ObjCMethodCall::getDecl
const ObjCMethodDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:1159
PrivateMethodKey
Definition: CallEvent.cpp:1172
lookupRuntimeDefinition
static const ObjCMethodDecl * lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface, Selector LookupSelector, bool InstanceMethod)
Definition: CallEvent.cpp:1209
llvm::DenseMapInfo< PrivateMethodKey >::SelectorInfo
DenseMapInfo< Selector > SelectorInfo
Definition: CallEvent.cpp:1181
clang::CXXMemberCallExpr::getImplicitObjectArgument
Expr * getImplicitObjectArgument() const
Retrieve the implicit object argument for the member call.
Definition: ExprCXX.cpp:650
clang::ASTContext::getReferenceQualifiedType
QualType getReferenceQualifiedType(const Expr *e) const
getReferenceQualifiedType - Given an expr, will return the type for that expression,...
Definition: ASTContext.cpp:5702
clang::IdentifierInfo::isStr
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Definition: IdentifierTable.h:177
DynamicTypeInfo.h
clang::Type::isReferenceType
bool isReferenceType() const
Definition: Type.h:6895
clang::CallExpr::getCallee
Expr * getCallee()
Definition: Expr.h:2961
V
#define V(N, I)
Definition: ASTContext.h:3208
clang::ento::CallEvent::getReturnValue
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:320
clang::ento::CallEvent::getLocationContext
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:230
clang::ento::ObjCMethodCall::getSelector
Selector getSelector() const
Definition: CallEvent.h:1179
clang::ento::EvalCallOptions
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
ProgramPoint.h
clang::ento::OCM_PropertyAccess
@ OCM_PropertyAccess
Definition: CallEvent.h:1123
clang::CallExpr::getDirectCallee
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return null.
Definition: Expr.h:2981
clang::RecordType
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4816
llvm::DenseMapInfo< PrivateMethodKey >::isEqual
static bool isEqual(const PrivateMethodKey &LHS, const PrivateMethodKey &RHS)
Definition: CallEvent.cpp:1199
clang::ento::CallEvent::getArgSourceRange
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:313
clang::ento::BlockCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:570
clang::ento::CXXMemberOperatorCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:846
clang::ento::AnalysisManager::isInCodeFile
static bool isInCodeFile(SourceLocation SL, const SourceManager &SM)
Definition: AnalysisManager.h:125
clang::BlockDecl
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4311
clang::CFGConstructor
Represents C++ constructor call.
Definition: CFG.h:156
clang::ento::CXXInstanceCall::getCXXThisExpr
virtual const Expr * getCXXThisExpr() const
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.h:675
clang::ento::CallEvent::getSourceRange
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:274
clang::ento::SValBuilder::getContext
ASTContext & getContext()
Definition: SValBuilder.h:136
DeclBase.h
clang::cross_tu::CrossTranslationUnitContext
This class is used for tools that requires cross translation unit capability.
Definition: CrossTranslationUnit.h:127
clang::ento::ObjCMethodCall::isReceiverSelfOrSuper
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to 'self' or 'super'.
Definition: CallEvent.cpp:994
clang::Type::isFunctionPointerType
bool isFunctionPointerType() const
Definition: Type.h:6917
clang::ento::RegionAndSymbolInvalidationTraits::setTrait
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1732
ObjCMessageDataTy
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:1019
clang::ASTContext
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
clang::ento::SValBuilder::getCXXThis
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
Definition: SValBuilder.cpp:308
clang::ento::CXXMemberCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:834
clang::ObjCInterfaceDecl::lookupPrivateMethod
ObjCMethodDecl * lookupPrivateMethod(const Selector &Sel, bool Instance=true) const
Lookup a method in the classes implementation hierarchy.
Definition: DeclObjC.cpp:747
clang::ento::BlockCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:871
clang::ento::SymExpr
Symbolic value.
Definition: SymExpr.h:29
clang::ento::CallEvent::BindingsTy
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:362
clang::ento::BlockCall::getBlockRegion
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:850
clang::Selector::getNumArgs
unsigned getNumArgs() const
Definition: IdentifierTable.cpp:563
clang::CFGBlock::size
unsigned size() const
Definition: CFG.h:919
clang::Type::getAs
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7386
Store.h
clang::CallExpr::getArg
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:3002
clang::CFGAutomaticObjDtor
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:391
clang::ento::SValBuilder::getRegionManager
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:155
clang::CFGStmtMap::getBlock
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:26
processArgument
static SVal processArgument(SVal Value, const Expr *ArgumentExpr, const ParmVarDecl *Parameter, SValBuilder &SVB)
Definition: CallEvent.cpp:398
clang::ento::CXXMemberOperatorCall::getOriginExpr
const CXXOperatorCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:752
clang::PseudoObjectExpr
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:6106
clang::ento::ExprEngine::getBuilderContext
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:224
clang::ento::BlockDataRegion
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:674
IdentifierTable.h
clang::ento::CallEventManager::getCXXInheritedConstructorCall
CallEventRef< CXXInheritedConstructorCall > getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1327
clang::ento::VarRegion
Definition: MemRegion.h:940
clang::ento::CallEventManager::getCXXConstructorCall
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1321
clang::ento::CXXInstanceCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:789
Type.h
clang::ento::CallEvent::invalidateRegions
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:234
Expr.h
isPointerToConst
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection.
Definition: CallEvent.cpp:209
clang::ento::AnyCXXConstructorCall::getCXXThisVal
SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:894
ASTContext.h
clang::ASTContext::getRecordType
QualType getRecordType(const RecordDecl *Decl) const
Definition: ASTContext.cpp:4760
findDefiningRedecl
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1159
clang::VarDecl
Represents a variable declaration or definition.
Definition: Decl.h:906
clang::Type::getPointeeType
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:625
clang::CFGCXXRecordTypedCall
Represents a function call that returns a C++ object by value.
Definition: CFG.h:185
clang::CXXRecordDecl::isDerivedFrom
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Definition: CXXInheritance.cpp:67
clang::Type::getAsCXXRecordDecl
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1760
clang::ento::CallEventManager::getCXXAllocatorCall
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1341
clang::ento::DynamicTypeInfo::isValid
bool isValid() const
Returns true if the dynamic type info is available.
Definition: DynamicTypeInfo.h:31
PathDiagnostic.h
clang::Decl::redecls
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:1014
ExprObjC.h
ExprCXX.h
Base
clang::CFGStmtMap
Definition: CFGStmtMap.h:24
clang::ento::CallEvent::getDecl
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:214
clang::ento::CallEventManager::getCaller
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1398
clang::ObjCMethodDecl::getCanonicalDecl
ObjCMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclObjC.cpp:975
clang::ento::CXXDestructorCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:937
clang::ObjCMessageExpr
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:941
isVoidPointerToNonConst
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:104
clang::AnalysisDeclContextManager::getContext
AnalysisDeclContext * getContext(const Decl *D)
Definition: AnalysisDeclContext.cpp:294
clang::ento::CXXInstanceCall::getCXXThisVal
virtual SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:714
clang::ento::CallEventManager::getSimpleCall
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1377
clang::ento::AnyFunctionCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:593
clang::ento::ObjCMethodCall::getExtraInvalidatedValues
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:953
CFGStmtMap.h
clang::ento::Loc
Definition: SVals.h:282
clang::format::hash_combine
static void hash_combine(std::size_t &seed, const T &v)
Definition: UnwrappedLineParser.cpp:781
clang::ento::CallEvent::hasNonZeroCallbackArg
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:137
clang::AnalysisDeclContext::getManager
AnalysisDeclContextManager * getManager() const
Definition: AnalysisDeclContext.h:108
clang::CFGImplicitDtor
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:366
clang::ento::SValBuilder
Definition: SValBuilder.h:53
getSyntacticFromForPseudoObjectExpr
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:1028
clang::LocationContext::getAnalysisDeclContext
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
Definition: AnalysisDeclContext.h:244
clang::LocationContext::getParent
const LocationContext * getParent() const
It might return null.
Definition: AnalysisDeclContext.h:247
clang::ento::BlockCall::isConversionFromLambda
bool isConversionFromLambda() const
Definition: CallEvent.h:592
clang::ento::CallEvent::getArgExpr
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:283
clang::CXXRecordDecl
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
clang::ParentMap
Definition: ParentMap.h:20
clang::PostStmt
Definition: ProgramPoint.h:310
SourceLocation.h
clang::Type::getAsUnionType
const RecordType * getAsUnionType() const
NOTE: getAs*ArrayType are methods on ASTContext.
Definition: Type.cpp:660
clang::PreStmt
Definition: ProgramPoint.h:294
clang::Type::isDependentType
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2304
clang::ento::SValBuilder::makeLoc
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:356
clang::PseudoObjectExpr::getSyntacticForm
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:6150
clang::Stmt::getStmtClass
StmtClass getStmtClass() const
Definition: Stmt.h:1169
clang::Type::isPointerType
bool isPointerType() const
Definition: Type.h:6883
clang::ento::ObjCMessageKind
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:1122
clang::ento::ProgramStateManager
Definition: ProgramState.h:502
clang::ento::CXXDestructorCall::getCXXThisVal
SVal getCXXThisVal() const override
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:931
clang::ento::SValBuilder::evalCast
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
Definition: SValBuilder.cpp:1092
SValBuilder.h
clang::ento::CallEvent::param_type_iterator
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:461
clang::ObjCObjectType::isObjCClass
bool isObjCClass() const
Definition: Type.h:6083
clang::NamedDecl::getIdentifier
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
clang::CFGElement::getAs
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
getCanonicalDecl
static const Decl * getCanonicalDecl(const Decl *D)
Definition: IndexingContext.cpp:297
clang::ASTContext::getPrintingPolicy
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:686
clang::RecordDecl::fields
field_range fields() const
Definition: Decl.h:4209
clang::QualType::isNull
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:802
llvm::DenseMapInfo< PrivateMethodKey >::InterfaceInfo
DenseMapInfo< const ObjCInterfaceDecl * > InterfaceInfo
Definition: CallEvent.cpp:1180
llvm::ArrayRef
Definition: LLVM.h:34
Value
Value
Definition: UninitializedValues.cpp:103
clang::ento::CallEvent::param_type_begin
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call's formal parameters.
Definition: CallEvent.h:468
clang::Decl
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
PrivateMethodKey::IsClassMethod
bool IsClassMethod
Definition: CallEvent.cpp:1175
clang::ObjCPropertyDecl
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:731
clang::ento::CallEvent::hasNonNullArgumentsWithType
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:114
clang::ento::CallEvent::getExtraInvalidatedValues
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.h:201
clang::StackFrameContext::getCallSite
const Stmt * getCallSite() const
Definition: AnalysisDeclContext.h:325
clang::ento::ObjCMethodCall::canBeOverridenInSubclass
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1105
clang::ento::SimpleFunctionCall::getOriginExpr
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:532
clang::PreImplicitCall
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:582
clang::cross_tu::CrossTranslationUnitContext::hasError
bool hasError(const Decl *ToDecl) const
Returns true if the given Decl is mapped (or created) during an import but there was an unrecoverable...
Definition: CrossTranslationUnit.cpp:809
clang::ento::ObjCMethodCall::getSourceRange
SourceRange getSourceRange() const override
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.cpp:1008
LLVM.h
clang::ento::CallEvent::getAdjustedParameterIndex
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:426
clang::ento::CallEvent::getKindAsString
virtual StringRef getKindAsString() const =0
clang::AnalyzerOptions
Stores options for the analyzer from the command line.
Definition: AnalyzerOptions.h:149
clang::Selector::getIdentifierInfoForSlot
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
Definition: IdentifierTable.cpp:574
State
LineState State
Definition: UnwrappedLineFormatter.cpp:1147
clang::ento::SimpleFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:663
clang::ObjCInterfaceDecl::getSuperClass
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:352
clang::ento::CallEvent::getProgramPoint
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:289
clang::ento::ObjCMethodCall
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1131
clang::ento::AnalysisManager
Definition: AnalysisManager.h:31
clang::ento::CallEvent::getNumArgs
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
clang::ento::CallEvent::Data
const void * Data
Definition: CallEvent.h:160
clang::IdentifierInfo
One of these records is kept for each identifier that is lexed.
Definition: IdentifierTable.h:85
clang::ento::CXXMemberCall::getCXXThisExpr
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:830
clang::ento::ObjCMethodCall::isInstanceMessage
bool isInstanceMessage() const
Definition: CallEvent.h:1171
clang::AnalysisDeclContext::getBody
Stmt * getBody() const
Definition: AnalysisDeclContext.cpp:126
clang::ento::AnyFunctionCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:532
clang::ento::CheckerContext::isCLibraryFunction
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CheckerContext.cpp:48
CheckerContext.h
clang::cross_tu::CrossTranslationUnitContext::getCrossTUDefinition
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName, bool DisplayCTUProgress=false)
This function loads a function or variable definition from an external AST file and merges it into th...
Definition: CrossTranslationUnit.cpp:353
clang::ento::CallEvent::getResultType
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:72
clang::CFGElement
Represents a top-level expression in a basic block.
Definition: CFG.h:55
clang::ento::CE_CXXAllocator
@ CE_CXXAllocator
Definition: CallEvent.h:70
clang::ento::ExprEngine::computeObjectUnderConstruction
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
Definition: ExprEngineCXX.cpp:119
clang::ento::ExprEngine
Definition: ExprEngine.h:123
ProgramState.h
clang::ento::CallEvent::getSVal
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:193
clang::ento::ProgramStateManager::getStoreManager
StoreManager & getStoreManager()
Definition: ProgramState.h:578
clang::ento::MemRegionManager
Definition: MemRegion.h:1353
clang::ento::BlockCall::getDecl
const BlockDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:585
clang::ento::CallEvent::getKind
virtual Kind getKind() const =0
Returns the kind of call this is.
clang::ObjCMethodDecl
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
clang::PointerType
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2769
clang::ento::ObjCMethodCall::parameters
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:946
clang::ObjCMethodDecl::hasBody
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:526
clang::interp::NE
bool NE(InterpState &S, CodePtr OpPC)
Definition: Interp.h:490
clang::ObjCInterfaceDecl::getEndOfDefinitionLoc
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1853
clang::ento::RegionAndSymbolInvalidationTraits::TK_PreserveContents
@ TK_PreserveContents
Tells that a region's contents is not changed.
Definition: MemRegion.h:1585
ParentMap.h
clang::ObjCMethodDecl::findPropertyDecl
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method's selector.
Definition: DeclObjC.cpp:1341
clang::ento::OCM_Message
@ OCM_Message
Definition: CallEvent.h:1125
clang::IdentifierInfo::getName
StringRef getName() const
Return the actual identifier string.
Definition: IdentifierTable.h:196
clang::Expr::IgnoreParens
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:3031
PrivateMethodKey::LookupSelector
Selector LookupSelector
Definition: CallEvent.cpp:1174
clang
Definition: CalledOnceCheck.h:17
clang::Type::isAnyPointerType
bool isAnyPointerType() const
Definition: Type.h:6887
clang::ento::CallEvent::isVariadic
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:378
clang::ento::CallEvent::isInSystemHeader
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:252
clang::CFGDeleteDtor
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:416
clang::Selector
Smart pointer class that efficiently represents Objective-C method names.
Definition: IdentifierTable.h:759
CFG.h
clang::ento::SVal::isUnknownOrUndef
bool isUnknownOrUndef() const
Definition: SVals.h:133
clang::AnalysisDeclContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:106
clang::Stmt
Stmt - This represents one statement.
Definition: Stmt.h:71
clang::ObjCIvarDecl
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1920
llvm::DenseMapInfo< PrivateMethodKey >::getHashValue
static unsigned getHashValue(const PrivateMethodKey &Key)
Definition: CallEvent.cpp:1192
clang::DeclaratorContext::Condition
@ Condition
clang::ento::AnyFunctionCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:602
clang::CFGBaseDtor
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:442
clang::ento::RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion
@ TK_DoNotInvalidateSuperRegion
Definition: MemRegion.h:1591
clang::ento::SVal::isUnknown
bool isUnknown() const
Definition: SVals.h:125
MemRegion.h
clang::Expr::IgnoreParenBaseCasts
Expr * IgnoreParenBaseCasts() LLVM_READONLY
Skip past any parentheses and derived-to-base casts until reaching a fixed point.
Definition: Expr.cpp:3057
clang::Expr::getType
QualType getType() const
Definition: Expr.h:141
clang::SourceLocation::isValid
bool isValid() const
Return true if this is a valid SourceLocation object.
Definition: SourceLocation.h:110
clang::CXXRecordDecl::hasDefinition
bool hasDefinition() const
Definition: DeclCXX.h:550
clang::TypeSourceInfo
A container of type source information.
Definition: Type.h:6593
clang::ObjCMessageExpr::getMethodDecl
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1347
isTransparentUnion
static bool isTransparentUnion(QualType T)
Definition: CallEvent.cpp:391
clang::ento::CallEvent::getArgSVal
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:306
clang::ento::BlockCall::getRegionStoringCapturedLambda
const VarRegion * getRegionStoringCapturedLambda() const
For a block converted from a C++ lambda, returns the block VarRegion for the variable holding the cap...
Definition: CallEvent.h:602
clang::cross_tu::IndexError
Definition: CrossTranslationUnit.h:61
clang::ento::DynamicTypeInfo::canBeASubClass
bool canBeASubClass() const
Returns false if the type information is precise (the type 'DynTy' is the only type in the lattice),...
Definition: DynamicTypeInfo.h:28
clang::ObjCMethodDecl::isPropertyAccessor
bool isPropertyAccessor() const
Definition: DeclObjC.h:440
clang::ento::CXXInstanceCall::getRuntimeDefinition
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:725
clang::RecordType::getDecl
RecordDecl * getDecl() const
Definition: Type.h:4826
clang::ASTContext::getPointerType
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
Definition: ASTContext.cpp:3342
clang::ento::CallEvent::getCalleeAnalysisDeclContext
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:153
clang::ObjCMethodDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:376
clang::ento::SVal
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
clang::ento::ObjCMethodCall::getInitialStackFrameContents
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:1359
Stmt.h
clang::ento::TypedValueRegion
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:531
isCallback
static bool isCallback(QualType T)
Definition: CallEvent.cpp:80
llvm::SmallVectorImpl
Definition: Randstruct.h:18
clang::ento::getDynamicTypeInfo
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
clang::ento::AnyFunctionCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:496
clang::ObjCMessageExpr::getSuperType
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1327
DynamicType.h
clang::ento::MemRegion::getBaseRegion
const LLVM_ATTRIBUTE_RETURNS_NONNULL MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1307
clang::ValueDecl::getType
QualType getType() const
Definition: Decl.h:712
clang::ento::RegionAndSymbolInvalidationTraits
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1570
clang::ento::CXXInstanceCall::getDecl
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:671
clang::Expr
This represents one expression.
Definition: Expr.h:109
CrossTranslationUnit.h
clang::ento::getClassObjectDynamicTypeInfo
DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym)
Get dynamic type information stored in a class object represented by Sym.
clang::cross_tu::CrossTranslationUnitContext::isImportedAsNew
bool isImportedAsNew(const Decl *ToDecl) const
Returns true if the given Decl is newly created during the import.
Definition: CrossTranslationUnit.cpp:803
clang::ento::CallEvent::getParameterLocation
const ParamVarRegion * getParameterLocation(unsigned Index, unsigned BlockCount) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:195
llvm::DenseMapInfo< PrivateMethodKey >::getTombstoneKey
static PrivateMethodKey getTombstoneKey()
Definition: CallEvent.cpp:1187
clang::ento::ObjCMethodCall::argumentsMayEscape
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:1348
castArgToParamTypeIfNeeded
static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx, SVal ArgVal, SValBuilder &SVB)
Cast the argument value to the type of the parameter at the function declaration.
Definition: CallEvent.cpp:433
clang::ento::StoreManager::evalBaseToDerived
Optional< SVal > evalBaseToDerived(SVal Base, QualType DerivedPtrType)
Attempts to do a down cast.
Definition: Store.cpp:317
clang::FunctionDecl::parameters
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2571
clang::Decl::getLocation
SourceLocation getLocation() const
Definition: DeclBase.h:432
clang::ento::CallEvent::dump
void dump() const
Definition: CallEvent.cpp:327
clang::LocationContext::getDecl
const Decl * getDecl() const
Definition: AnalysisDeclContext.h:251
clang::FunctionDecl
Represents a function declaration or definition.
Definition: Decl.h:1904
clang::RecordDecl
Represents a struct/union/class.
Definition: Decl.h:3983
clang::ProgramPoint
Definition: ProgramPoint.h:58
clang::CallExpr
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2811
clang::ento::CallEvent::getCalleeStackFrame
const StackFrameContext * getCalleeStackFrame(unsigned BlockCount) const
Returns the callee stack frame.
Definition: CallEvent.cpp:165
clang::ento::CXXDestructorCall::isBaseDestructor
bool isBaseDestructor() const
Returns true if this is a call to a base class destructor.
Definition: CallEvent.h:831
llvm::IntrusiveRefCntPtr< const ProgramState >
clang::ento::CXXInheritedConstructorCall::getInheritingStackFrame
const StackFrameContext * getInheritingStackFrame() const
Obtain the stack frame of the inheriting constructor.
Definition: CallEvent.cpp:924
clang::ento::ParamVarRegion
ParamVarRegion - Represents a region for paremters.
Definition: MemRegion.h:1024
clang::LocationContext::getParentMap
const ParentMap & getParentMap() const
Definition: AnalysisDeclContext.h:257
clang::CXXMethodDecl::getParent
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined.
Definition: DeclCXX.h:2098
clang::CXXMethodDecl
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1983
clang::NamedDecl::getName
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:274