clang 18.0.0git
CallEvent.cpp
Go to the documentation of this file.
1//===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9/// \file This file defines CallEvent and its subclasses, which represent path-
10/// sensitive instances of different kinds of function and method calls
11/// (C, C++, and Objective-C).
12//
13//===----------------------------------------------------------------------===//
14
17#include "clang/AST/Attr.h"
18#include "clang/AST/Decl.h"
19#include "clang/AST/DeclBase.h"
20#include "clang/AST/DeclCXX.h"
21#include "clang/AST/DeclObjC.h"
22#include "clang/AST/Expr.h"
23#include "clang/AST/ExprCXX.h"
24#include "clang/AST/ExprObjC.h"
25#include "clang/AST/ParentMap.h"
26#include "clang/AST/Stmt.h"
27#include "clang/AST/Type.h"
29#include "clang/Analysis/CFG.h"
34#include "clang/Basic/LLVM.h"
49#include "llvm/ADT/ArrayRef.h"
50#include "llvm/ADT/DenseMap.h"
51#include "llvm/ADT/ImmutableList.h"
52#include "llvm/ADT/PointerIntPair.h"
53#include "llvm/ADT/SmallSet.h"
54#include "llvm/ADT/SmallVector.h"
55#include "llvm/ADT/StringExtras.h"
56#include "llvm/ADT/StringRef.h"
57#include "llvm/Support/Casting.h"
58#include "llvm/Support/Compiler.h"
59#include "llvm/Support/Debug.h"
60#include "llvm/Support/ErrorHandling.h"
61#include "llvm/Support/raw_ostream.h"
62#include <cassert>
63#include <optional>
64#include <utility>
65
66#define DEBUG_TYPE "static-analyzer-call-event"
67
68using namespace clang;
69using namespace ento;
70
72 ASTContext &Ctx = getState()->getStateManager().getContext();
73 const Expr *E = getOriginExpr();
74 if (!E)
75 return Ctx.VoidTy;
76 return Ctx.getReferenceQualifiedType(E);
77}
78
79static bool isCallback(QualType T) {
80 // If a parameter is a block or a callback, assume it can modify pointer.
81 if (T->isBlockPointerType() ||
83 T->isObjCSelType())
84 return true;
85
86 // Check if a callback is passed inside a struct (for both, struct passed by
87 // reference and by value). Dig just one level into the struct for now.
88
89 if (T->isAnyPointerType() || T->isReferenceType())
90 T = T->getPointeeType();
91
92 if (const RecordType *RT = T->getAsStructureType()) {
93 const RecordDecl *RD = RT->getDecl();
94 for (const auto *I : RD->fields()) {
95 QualType FieldT = I->getType();
96 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
97 return true;
98 }
99 }
100 return false;
101}
102
104 if (const auto *PT = T->getAs<PointerType>()) {
105 QualType PointeeTy = PT->getPointeeType();
106 if (PointeeTy.isConstQualified())
107 return false;
108 return PointeeTy->isVoidType();
109 } else
110 return false;
111}
112
114 unsigned NumOfArgs = getNumArgs();
115
116 // If calling using a function pointer, assume the function does not
117 // satisfy the callback.
118 // TODO: We could check the types of the arguments here.
119 if (!getDecl())
120 return false;
121
122 unsigned Idx = 0;
124 E = param_type_end();
125 I != E && Idx < NumOfArgs; ++I, ++Idx) {
126 // If the parameter is 0, it's harmless.
127 if (getArgSVal(Idx).isZeroConstant())
128 continue;
129
130 if (Condition(*I))
131 return true;
132 }
133 return false;
134}
135
138}
139
142}
143
144bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
145 const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
146 if (!FD)
147 return false;
148
149 return CheckerContext::isCLibraryFunction(FD, FunctionName);
150}
151
153 const Decl *D = getDecl();
154 if (!D)
155 return nullptr;
156
159
160 return ADC;
161}
162
163const StackFrameContext *
164CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
166 if (!ADC)
167 return nullptr;
168
169 const Expr *E = getOriginExpr();
170 if (!E)
171 return nullptr;
172
173 // Recover CFG block via reverse lookup.
174 // TODO: If we were to keep CFG element information as part of the CallEvent
175 // instead of doing this reverse lookup, we would be able to build the stack
176 // frame for non-expression-based calls, and also we wouldn't need the reverse
177 // lookup.
179 const CFGBlock *B = Map->getBlock(E);
180 assert(B);
181
182 // Also recover CFG index by scanning the CFG block.
183 unsigned Idx = 0, Sz = B->size();
184 for (; Idx < Sz; ++Idx)
185 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
186 if (StmtElem->getStmt() == E)
187 break;
188 assert(Idx < Sz);
189
190 return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
191}
192
193const ParamVarRegion
194*CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
195 const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
196 // We cannot construct a VarRegion without a stack frame.
197 if (!SFC)
198 return nullptr;
199
200 const ParamVarRegion *PVR =
201 State->getStateManager().getRegionManager().getParamVarRegion(
202 getOriginExpr(), Index, SFC);
203 return PVR;
204}
205
206/// Returns true if a type is a pointer-to-const or reference-to-const
207/// with no further indirection.
208static bool isPointerToConst(QualType Ty) {
209 QualType PointeeTy = Ty->getPointeeType();
210 if (PointeeTy == QualType())
211 return false;
212 if (!PointeeTy.isConstQualified())
213 return false;
214 if (PointeeTy->isAnyPointerType())
215 return false;
216 return true;
217}
218
219// Try to retrieve the function declaration and find the function parameter
220// types which are pointers/references to a non-pointer const.
221// We will not invalidate the corresponding argument regions.
222static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
223 const CallEvent &Call) {
224 unsigned Idx = 0;
225 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
226 E = Call.param_type_end();
227 I != E; ++I, ++Idx) {
228 if (isPointerToConst(*I))
229 PreserveArgs.insert(Idx);
230 }
231}
232
234 ProgramStateRef Orig) const {
235 ProgramStateRef Result = (Orig ? Orig : getState());
236
237 // Don't invalidate anything if the callee is marked pure/const.
238 if (const Decl *callee = getDecl())
239 if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
240 return Result;
241
242 SmallVector<SVal, 8> ValuesToInvalidate;
244
245 getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
246
247 // Indexes of arguments whose values will be preserved by the call.
248 llvm::SmallSet<unsigned, 4> PreserveArgs;
249 if (!argumentsMayEscape())
250 findPtrToConstParams(PreserveArgs, *this);
251
252 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
253 // Mark this region for invalidation. We batch invalidate regions
254 // below for efficiency.
255 if (PreserveArgs.count(Idx))
256 if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
257 ETraits.setTrait(MR->getBaseRegion(),
259 // TODO: Factor this out + handle the lower level const pointers.
260
261 ValuesToInvalidate.push_back(getArgSVal(Idx));
262
263 // If a function accepts an object by argument (which would of course be a
264 // temporary that isn't lifetime-extended), invalidate the object itself,
265 // not only other objects reachable from it. This is necessary because the
266 // destructor has access to the temporary object after the call.
267 // TODO: Support placement arguments once we start
268 // constructing them directly.
269 // TODO: This is unnecessary when there's no destructor, but that's
270 // currently hard to figure out.
271 if (getKind() != CE_CXXAllocator)
273 if (auto AdjIdx = getAdjustedParameterIndex(Idx))
274 if (const TypedValueRegion *TVR =
275 getParameterLocation(*AdjIdx, BlockCount))
276 ValuesToInvalidate.push_back(loc::MemRegionVal(TVR));
277 }
278
279 // Invalidate designated regions using the batch invalidation API.
280 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
281 // global variables.
282 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
283 BlockCount, getLocationContext(),
284 /*CausedByPointerEscape*/ true,
285 /*Symbols=*/nullptr, this, &ETraits);
286}
287
289 const ProgramPointTag *Tag) const {
290
291 if (const Expr *E = getOriginExpr()) {
292 if (IsPreVisit)
293 return PreStmt(E, getLocationContext(), Tag);
294 return PostStmt(E, getLocationContext(), Tag);
295 }
296
297 const Decl *D = getDecl();
298 assert(D && "Cannot get a program point without a statement or decl");
299 assert(ElemRef.getParent() &&
300 "Cannot get a program point without a CFGElementRef");
301
303 if (IsPreVisit)
304 return PreImplicitCall(D, Loc, getLocationContext(), ElemRef, Tag);
305 return PostImplicitCall(D, Loc, getLocationContext(), ElemRef, Tag);
306}
307
308SVal CallEvent::getArgSVal(unsigned Index) const {
309 const Expr *ArgE = getArgExpr(Index);
310 if (!ArgE)
311 return UnknownVal();
312 return getSVal(ArgE);
313}
314
316 const Expr *ArgE = getArgExpr(Index);
317 if (!ArgE)
318 return {};
319 return ArgE->getSourceRange();
320}
321
323 const Expr *E = getOriginExpr();
324 if (!E)
325 return UndefinedVal();
326 return getSVal(E);
327}
328
329LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
330
331void CallEvent::dump(raw_ostream &Out) const {
332 ASTContext &Ctx = getState()->getStateManager().getContext();
333 if (const Expr *E = getOriginExpr()) {
334 E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
335 return;
336 }
337
338 if (const Decl *D = getDecl()) {
339 Out << "Call to ";
340 D->print(Out, Ctx.getPrintingPolicy());
341 return;
342 }
343
344 Out << "Unknown call (type " << getKindAsString() << ")";
345}
346
348 return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(S);
349}
350
352 assert(D);
353 if (const auto *FD = dyn_cast<FunctionDecl>(D))
354 return FD->getReturnType();
355 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
356 return MD->getReturnType();
357 if (const auto *BD = dyn_cast<BlockDecl>(D)) {
358 // Blocks are difficult because the return type may not be stored in the
359 // BlockDecl itself. The AST should probably be enhanced, but for now we
360 // just do what we can.
361 // If the block is declared without an explicit argument list, the
362 // signature-as-written just includes the return type, not the entire
363 // function type.
364 // FIXME: All blocks should have signatures-as-written, even if the return
365 // type is inferred. (That's signified with a dependent result type.)
366 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
367 QualType Ty = TSI->getType();
368 if (const FunctionType *FT = Ty->getAs<FunctionType>())
369 Ty = FT->getReturnType();
370 if (!Ty->isDependentType())
371 return Ty;
372 }
373
374 return {};
375 }
376
377 llvm_unreachable("unknown callable kind");
378}
379
381 assert(D);
382
383 if (const auto *FD = dyn_cast<FunctionDecl>(D))
384 return FD->isVariadic();
385 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
386 return MD->isVariadic();
387 if (const auto *BD = dyn_cast<BlockDecl>(D))
388 return BD->isVariadic();
389
390 llvm_unreachable("unknown callable kind");
391}
392
394 const RecordType *UT = T->getAsUnionType();
395 return UT && UT->getDecl()->hasAttr<TransparentUnionAttr>();
396}
397
398// In some cases, symbolic cases should be transformed before we associate
399// them with parameters. This function incapsulates such cases.
400static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
401 const ParmVarDecl *Parameter, SValBuilder &SVB) {
402 QualType ParamType = Parameter->getType();
403 QualType ArgumentType = ArgumentExpr->getType();
404
405 // Transparent unions allow users to easily convert values of union field
406 // types into union-typed objects.
407 //
408 // Also, more importantly, they allow users to define functions with different
409 // different parameter types, substituting types matching transparent union
410 // field types with the union type itself.
411 //
412 // Here, we check specifically for latter cases and prevent binding
413 // field-typed values to union-typed regions.
414 if (isTransparentUnion(ParamType) &&
415 // Let's check that we indeed trying to bind different types.
416 !isTransparentUnion(ArgumentType)) {
418
419 llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
420 CompoundSVals = BVF.prependSVal(Value, CompoundSVals);
421
422 // Wrap it with compound value.
423 return SVB.makeCompoundVal(ParamType, CompoundSVals);
424 }
425
426 return Value;
427}
428
429/// Cast the argument value to the type of the parameter at the function
430/// declaration.
431/// Returns the argument value if it didn't need a cast.
432/// Or returns the cast argument if it needed a cast.
433/// Or returns 'Unknown' if it would need a cast but the callsite and the
434/// runtime definition don't match in terms of argument and parameter count.
435static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx,
436 SVal ArgVal, SValBuilder &SVB) {
437 const FunctionDecl *RTDecl =
438 Call.getRuntimeDefinition().getDecl()->getAsFunction();
439 const auto *CallExprDecl = dyn_cast_or_null<FunctionDecl>(Call.getDecl());
440
441 if (!RTDecl || !CallExprDecl)
442 return ArgVal;
443
444 // The function decl of the Call (in the AST) will not have any parameter
445 // declarations, if it was 'only' declared without a prototype. However, the
446 // engine will find the appropriate runtime definition - basically a
447 // redeclaration, which has a function body (and a function prototype).
448 if (CallExprDecl->hasPrototype() || !RTDecl->hasPrototype())
449 return ArgVal;
450
451 // Only do this cast if the number arguments at the callsite matches with
452 // the parameters at the runtime definition.
453 if (Call.getNumArgs() != RTDecl->getNumParams())
454 return UnknownVal();
455
456 const Expr *ArgExpr = Call.getArgExpr(ArgIdx);
457 const ParmVarDecl *Param = RTDecl->getParamDecl(ArgIdx);
458 return SVB.evalCast(ArgVal, Param->getType(), ArgExpr->getType());
459}
460
463 SValBuilder &SVB,
464 const CallEvent &Call,
465 ArrayRef<ParmVarDecl*> parameters) {
466 MemRegionManager &MRMgr = SVB.getRegionManager();
467
468 // If the function has fewer parameters than the call has arguments, we simply
469 // do not bind any values to them.
470 unsigned NumArgs = Call.getNumArgs();
471 unsigned Idx = 0;
472 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
473 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
474 assert(*I && "Formal parameter has no decl?");
475
476 // TODO: Support allocator calls.
477 if (Call.getKind() != CE_CXXAllocator)
478 if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx)))
479 continue;
480
481 // TODO: Allocators should receive the correct size and possibly alignment,
482 // determined in compile-time but not represented as arg-expressions,
483 // which makes getArgSVal() fail and return UnknownVal.
484 SVal ArgVal = Call.getArgSVal(Idx);
485 const Expr *ArgExpr = Call.getArgExpr(Idx);
486
487 if (ArgVal.isUnknown())
488 continue;
489
490 // Cast the argument value to match the type of the parameter in some
491 // edge-cases.
492 ArgVal = castArgToParamTypeIfNeeded(Call, Idx, ArgVal, SVB);
493
494 Loc ParamLoc = SVB.makeLoc(
495 MRMgr.getParamVarRegion(Call.getOriginExpr(), Idx, CalleeCtx));
496 Bindings.push_back(
497 std::make_pair(ParamLoc, processArgument(ArgVal, ArgExpr, *I, SVB)));
498 }
499
500 // FIXME: Variadic arguments are not handled at all right now.
501}
502
504 const StackFrameContext *StackFrame = getCalleeStackFrame(0);
505 if (!StackFrame)
506 return nullptr;
507
508 const CFGElement Element = StackFrame->getCallSiteCFGElement();
509 if (const auto Ctor = Element.getAs<CFGConstructor>()) {
510 return Ctor->getConstructionContext();
511 }
512
513 if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
514 return RecCall->getConstructionContext();
515 }
516
517 return nullptr;
518}
519
521 const auto *CC = getConstructionContext();
522 if (!CC)
523 return std::nullopt;
524
525 EvalCallOptions CallOpts;
526 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
527 SVal RetVal = Engine.computeObjectUnderConstruction(
529 getLocationContext(), CC, CallOpts);
530 return RetVal;
531}
532
534 const FunctionDecl *D = getDecl();
535 if (!D)
536 return std::nullopt;
537 return D->parameters();
538}
539
541 const FunctionDecl *FD = getDecl();
542 if (!FD)
543 return {};
544
545 // Note that the AnalysisDeclContext will have the FunctionDecl with
546 // the definition (if one exists).
549 getManager()->getContext(FD);
550 bool IsAutosynthesized;
551 Stmt* Body = AD->getBody(IsAutosynthesized);
552 LLVM_DEBUG({
553 if (IsAutosynthesized)
554 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
555 << "\n";
556 });
557
558 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
560 *Engine.getCrossTranslationUnitContext();
561
562 AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
563
564 if (Body) {
565 const Decl* Decl = AD->getDecl();
566 if (Opts.IsNaiveCTUEnabled && CTUCtx.isImportedAsNew(Decl)) {
567 // A newly created definition, but we had error(s) during the import.
568 if (CTUCtx.hasError(Decl))
569 return {};
570 return RuntimeDefinition(Decl, /*Foreign=*/true);
571 }
572 return RuntimeDefinition(Decl, /*Foreign=*/false);
573 }
574
575 // Try to get CTU definition only if CTUDir is provided.
576 if (!Opts.IsNaiveCTUEnabled)
577 return {};
578
580 CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
581 Opts.DisplayCTUProgress);
582
583 if (!CTUDeclOrError) {
584 handleAllErrors(CTUDeclOrError.takeError(),
585 [&](const cross_tu::IndexError &IE) {
586 CTUCtx.emitCrossTUDiagnostics(IE);
587 });
588 return {};
589 }
590
591 return RuntimeDefinition(*CTUDeclOrError, /*Foreign=*/true);
592}
593
595 const StackFrameContext *CalleeCtx,
596 BindingsTy &Bindings) const {
597 const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
598 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
599 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
600 D->parameters());
601}
602
605 return true;
606
607 const FunctionDecl *D = getDecl();
608 if (!D)
609 return true;
610
611 const IdentifierInfo *II = D->getIdentifier();
612 if (!II)
613 return false;
614
615 // This set of "escaping" APIs is
616
617 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
618 // value into thread local storage. The value can later be retrieved with
619 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
620 // parameter is 'const void *', the region escapes through the call.
621 if (II->isStr("pthread_setspecific"))
622 return true;
623
624 // - xpc_connection_set_context stores a value which can be retrieved later
625 // with xpc_connection_get_context.
626 if (II->isStr("xpc_connection_set_context"))
627 return true;
628
629 // - funopen - sets a buffer for future IO calls.
630 if (II->isStr("funopen"))
631 return true;
632
633 // - __cxa_demangle - can reallocate memory and can return the pointer to
634 // the input buffer.
635 if (II->isStr("__cxa_demangle"))
636 return true;
637
638 StringRef FName = II->getName();
639
640 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
641 // buffer even if it is const.
642 if (FName.endswith("NoCopy"))
643 return true;
644
645 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
646 // be deallocated by NSMapRemove.
647 if (FName.startswith("NS") && FName.contains("Insert"))
648 return true;
649
650 // - Many CF containers allow objects to escape through custom
651 // allocators/deallocators upon container construction. (PR12101)
652 if (FName.startswith("CF") || FName.startswith("CG")) {
653 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
654 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
655 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
656 StrInStrNoCase(FName, "WithData") != StringRef::npos ||
657 StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
658 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
659 }
660
661 return false;
662}
663
666 if (D)
667 return D;
668
669 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
670}
671
673 const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
674 if (!CE)
676
677 const FunctionDecl *D = CE->getDirectCallee();
678 if (D)
679 return D;
680
681 return getSVal(CE->getCallee()).getAsFunctionDecl();
682}
683
685 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
686 SVal ThisVal = getCXXThisVal();
687 Values.push_back(ThisVal);
688
689 // Don't invalidate if the method is const and there are no mutable fields.
690 if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
691 if (!D->isConst())
692 return;
693 // Get the record decl for the class of 'This'. D->getParent() may return a
694 // base class decl, rather than the class of the instance which needs to be
695 // checked for mutable fields.
696 // TODO: We might as well look at the dynamic type of the object.
698 QualType T = Ex->getType();
699 if (T->isPointerType()) // Arrow or implicit-this syntax?
700 T = T->getPointeeType();
701 const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
702 assert(ParentRecord);
703 if (ParentRecord->hasMutableFields())
704 return;
705 // Preserve CXXThis.
706 const MemRegion *ThisRegion = ThisVal.getAsRegion();
707 if (!ThisRegion)
708 return;
709
710 ETraits->setTrait(ThisRegion->getBaseRegion(),
712 }
713}
714
716 const Expr *Base = getCXXThisExpr();
717 // FIXME: This doesn't handle an overloaded ->* operator.
718 if (!Base)
719 return UnknownVal();
720
721 SVal ThisVal = getSVal(Base);
722 assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal));
723 return ThisVal;
724}
725
727 // Do we have a decl at all?
728 const Decl *D = getDecl();
729 if (!D)
730 return {};
731
732 // If the method is non-virtual, we know we can inline it.
733 const auto *MD = cast<CXXMethodDecl>(D);
734 if (!MD->isVirtual())
736
737 // Do we know the implicit 'this' object being called?
738 const MemRegion *R = getCXXThisVal().getAsRegion();
739 if (!R)
740 return {};
741
742 // Do we know anything about the type of 'this'?
744 if (!DynType.isValid())
745 return {};
746
747 // Is the type a C++ class? (This is mostly a defensive check.)
748 QualType RegionType = DynType.getType()->getPointeeType();
749 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
750
751 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
752 if (!RD || !RD->hasDefinition())
753 return {};
754
755 // Find the decl for this method in that class.
756 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
757 if (!Result) {
758 // We might not even get the original statically-resolved method due to
759 // some particularly nasty casting (e.g. casts to sister classes).
760 // However, we should at least be able to search up and down our own class
761 // hierarchy, and some real bugs have been caught by checking this.
762 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
763
764 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
765 // the static type. However, because we currently don't update
766 // DynamicTypeInfo when an object is cast, we can't actually be sure the
767 // DynamicTypeInfo is up to date. This assert should be re-enabled once
768 // this is fixed.
769 //
770 // assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
771
772 return {};
773 }
774
775 // Does the decl that we found have an implementation?
777 if (!Result->hasBody(Definition)) {
778 if (!DynType.canBeASubClass())
780 return {};
781 }
782
783 // We found a definition. If we're not sure that this devirtualization is
784 // actually what will happen at runtime, make sure to provide the region so
785 // that ExprEngine can decide what to do with it.
786 if (DynType.canBeASubClass())
788 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
789}
790
792 const StackFrameContext *CalleeCtx,
793 BindingsTy &Bindings) const {
795
796 // Handle the binding of 'this' in the new stack frame.
797 SVal ThisVal = getCXXThisVal();
798 if (!ThisVal.isUnknown()) {
799 ProgramStateManager &StateMgr = getState()->getStateManager();
800 SValBuilder &SVB = StateMgr.getSValBuilder();
801
802 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
803 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
804
805 // If we devirtualized to a different member function, we need to make sure
806 // we have the proper layering of CXXBaseObjectRegions.
807 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
808 ASTContext &Ctx = SVB.getContext();
809 const CXXRecordDecl *Class = MD->getParent();
810 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
811
812 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
813 std::optional<SVal> V =
814 StateMgr.getStoreManager().evalBaseToDerived(ThisVal, Ty);
815 if (!V) {
816 // We might have suffered some sort of placement new earlier, so
817 // we're constructing in a completely unexpected storage.
818 // Fall back to a generic pointer cast for this-value.
819 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
820 const CXXRecordDecl *StaticClass = StaticMD->getParent();
821 QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
822 ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
823 } else
824 ThisVal = *V;
825 }
826
827 if (!ThisVal.isUnknown())
828 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
829 }
830}
831
834}
835
837 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
838 // id-expression in the class member access expression is a qualified-id,
839 // that function is called. Otherwise, its final overrider in the dynamic type
840 // of the object expression is called.
841 if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
842 if (ME->hasQualifier())
844
846}
847
849 return getOriginExpr()->getArg(0);
850}
851
853 const Expr *Callee = getOriginExpr()->getCallee();
854 const MemRegion *DataReg = getSVal(Callee).getAsRegion();
855
856 return dyn_cast_or_null<BlockDataRegion>(DataReg);
857}
858
860 const BlockDecl *D = getDecl();
861 if (!D)
862 return std::nullopt;
863 return D->parameters();
864}
865
867 RegionAndSymbolInvalidationTraits *ETraits) const {
868 // FIXME: This also needs to invalidate captured globals.
869 if (const MemRegion *R = getBlockRegion())
870 Values.push_back(loc::MemRegionVal(R));
871}
872
874 BindingsTy &Bindings) const {
875 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
878 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
879 Params = LambdaOperatorDecl->parameters();
880
881 // For blocks converted from a C++ lambda, the callee declaration is the
882 // operator() method on the lambda so we bind "this" to
883 // the lambda captured by the block.
884 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
885 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
886 Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
887 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
888 } else {
889 Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
890 }
891
892 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
893 Params);
894}
895
897 if (Data)
898 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
899 return UnknownVal();
900}
901
903 RegionAndSymbolInvalidationTraits *ETraits) const {
904 SVal V = getCXXThisVal();
905 if (SymbolRef Sym = V.getAsSymbol(true))
906 ETraits->setTrait(Sym,
908 Values.push_back(V);
909}
910
912 const StackFrameContext *CalleeCtx,
913 BindingsTy &Bindings) const {
915
916 SVal ThisVal = getCXXThisVal();
917 if (!ThisVal.isUnknown()) {
918 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
919 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
920 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
921 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
922 }
923}
924
925const StackFrameContext *
928 while (isa<CXXInheritedCtorInitExpr>(SFC->getCallSite()))
929 SFC = SFC->getParent()->getStackFrame();
930 return SFC;
931}
932
934 if (Data)
935 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
936 return UnknownVal();
937}
938
940 // Base destructors are always called non-virtually.
941 // Skip CXXInstanceCall's devirtualization logic in this case.
942 if (isBaseDestructor())
944
946}
947
949 const ObjCMethodDecl *D = getDecl();
950 if (!D)
951 return std::nullopt;
952 return D->parameters();
953}
954
956 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
957
958 // If the method call is a setter for property known to be backed by
959 // an instance variable, don't invalidate the entire receiver, just
960 // the storage for that instance variable.
961 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
962 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
963 SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
964 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
965 ETraits->setTrait(
966 IvarRegion,
968 ETraits->setTrait(
969 IvarRegion,
971 Values.push_back(IvarLVal);
972 }
973 return;
974 }
975 }
976
977 Values.push_back(getReceiverSVal());
978}
979
981 // FIXME: Is this the best way to handle class receivers?
982 if (!isInstanceMessage())
983 return UnknownVal();
984
985 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
986 return getSVal(RecE);
987
988 // An instance message with no expression means we are sending to super.
989 // In this case the object reference is the same as 'self'.
990 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
991 SVal SelfVal = getState()->getSelfSVal(getLocationContext());
992 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
993 return SelfVal;
994}
995
997 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
998 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
999 return true;
1000
1001 if (!isInstanceMessage())
1002 return false;
1003
1004 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
1005 SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1006
1007 return (RecVal == SelfVal);
1008}
1009
1011 switch (getMessageKind()) {
1012 case OCM_Message:
1013 return getOriginExpr()->getSourceRange();
1014 case OCM_PropertyAccess:
1015 case OCM_Subscript:
1016 return getContainingPseudoObjectExpr()->getSourceRange();
1017 }
1018 llvm_unreachable("unknown message kind");
1019}
1020
1021using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1022
1023const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1024 assert(Data && "Lazy lookup not yet performed.");
1025 assert(getMessageKind() != OCM_Message && "Explicit message send.");
1026 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
1027}
1028
1029static const Expr *
1031 const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
1032
1033 // This handles the funny case of assigning to the result of a getter.
1034 // This can happen if the getter returns a non-const reference.
1035 if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1036 Syntactic = BO->getLHS()->IgnoreParens();
1037
1038 return Syntactic;
1039}
1040
1042 if (!Data) {
1043 // Find the parent, ignoring implicit casts.
1044 const ParentMap &PM = getLocationContext()->getParentMap();
1046
1047 // Check if parent is a PseudoObjectExpr.
1048 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1049 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1050
1052 switch (Syntactic->getStmtClass()) {
1053 case Stmt::ObjCPropertyRefExprClass:
1055 break;
1056 case Stmt::ObjCSubscriptRefExprClass:
1057 K = OCM_Subscript;
1058 break;
1059 default:
1060 // FIXME: Can this ever happen?
1061 K = OCM_Message;
1062 break;
1063 }
1064
1065 if (K != OCM_Message) {
1066 const_cast<ObjCMethodCall *>(this)->Data
1067 = ObjCMessageDataTy(POE, K).getOpaqueValue();
1068 assert(getMessageKind() == K);
1069 return K;
1070 }
1071 }
1072
1073 const_cast<ObjCMethodCall *>(this)->Data
1074 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1075 assert(getMessageKind() == OCM_Message);
1076 return OCM_Message;
1077 }
1078
1079 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1080 if (!Info.getPointer())
1081 return OCM_Message;
1082 return static_cast<ObjCMessageKind>(Info.getInt());
1083}
1084
1086 // Look for properties accessed with property syntax (foo.bar = ...)
1088 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1089 assert(POE && "Property access without PseudoObjectExpr?");
1090
1091 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1092 auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1093
1094 if (RefExpr->isExplicitProperty())
1095 return RefExpr->getExplicitProperty();
1096 }
1097
1098 // Look for properties accessed with method syntax ([foo setBar:...]).
1099 const ObjCMethodDecl *MD = getDecl();
1100 if (!MD || !MD->isPropertyAccessor())
1101 return nullptr;
1102
1103 // Note: This is potentially quite slow.
1104 return MD->findPropertyDecl();
1105}
1106
1108 Selector Sel) const {
1109 assert(IDecl);
1110 AnalysisManager &AMgr =
1111 getState()->getStateManager().getOwningEngine().getAnalysisManager();
1112 // If the class interface is declared inside the main file, assume it is not
1113 // subcassed.
1114 // TODO: It could actually be subclassed if the subclass is private as well.
1115 // This is probably very rare.
1116 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1117 if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1118 return false;
1119
1120 // Assume that property accessors are not overridden.
1122 return false;
1123
1124 // We assume that if the method is public (declared outside of main file) or
1125 // has a parent which publicly declares the method, the method could be
1126 // overridden in a subclass.
1127
1128 // Find the first declaration in the class hierarchy that declares
1129 // the selector.
1130 ObjCMethodDecl *D = nullptr;
1131 while (true) {
1132 D = IDecl->lookupMethod(Sel, true);
1133
1134 // Cannot find a public definition.
1135 if (!D)
1136 return false;
1137
1138 // If outside the main file,
1139 if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1140 return true;
1141
1142 if (D->isOverriding()) {
1143 // Search in the superclass on the next iteration.
1144 IDecl = D->getClassInterface();
1145 if (!IDecl)
1146 return false;
1147
1148 IDecl = IDecl->getSuperClass();
1149 if (!IDecl)
1150 return false;
1151
1152 continue;
1153 }
1154
1155 return false;
1156 };
1157
1158 llvm_unreachable("The while loop should always terminate.");
1159}
1160
1162 if (!MD)
1163 return MD;
1164
1165 // Find the redeclaration that defines the method.
1166 if (!MD->hasBody()) {
1167 for (auto *I : MD->redecls())
1168 if (I->hasBody())
1169 MD = cast<ObjCMethodDecl>(I);
1170 }
1171 return MD;
1172}
1173
1178};
1179
1180namespace llvm {
1181template <> struct DenseMapInfo<PrivateMethodKey> {
1182 using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1183 using SelectorInfo = DenseMapInfo<Selector>;
1184
1186 return {InterfaceInfo::getEmptyKey(), SelectorInfo::getEmptyKey(), false};
1187 }
1188
1190 return {InterfaceInfo::getTombstoneKey(), SelectorInfo::getTombstoneKey(),
1191 true};
1192 }
1193
1194 static unsigned getHashValue(const PrivateMethodKey &Key) {
1195 return llvm::hash_combine(
1196 llvm::hash_code(InterfaceInfo::getHashValue(Key.Interface)),
1197 llvm::hash_code(SelectorInfo::getHashValue(Key.LookupSelector)),
1198 Key.IsClassMethod);
1199 }
1200
1201 static bool isEqual(const PrivateMethodKey &LHS,
1202 const PrivateMethodKey &RHS) {
1203 return InterfaceInfo::isEqual(LHS.Interface, RHS.Interface) &&
1204 SelectorInfo::isEqual(LHS.LookupSelector, RHS.LookupSelector) &&
1205 LHS.IsClassMethod == RHS.IsClassMethod;
1206 }
1207};
1208} // end namespace llvm
1209
1210static const ObjCMethodDecl *
1212 Selector LookupSelector, bool InstanceMethod) {
1213 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1214 // when in many cases it returns null. We cache the results so
1215 // that repeated queries on the same ObjCIntefaceDecl and Selector
1216 // don't incur the same cost. On some test cases, we can see the
1217 // same query being issued thousands of times.
1218 //
1219 // NOTE: This cache is essentially a "global" variable, but it
1220 // only gets lazily created when we get here. The value of the
1221 // cache probably comes from it being global across ExprEngines,
1222 // where the same queries may get issued. If we are worried about
1223 // concurrency, or possibly loading/unloading ASTs, etc., we may
1224 // need to revisit this someday. In terms of memory, this table
1225 // stays around until clang quits, which also may be bad if we
1226 // need to release memory.
1227 using PrivateMethodCache =
1228 llvm::DenseMap<PrivateMethodKey, std::optional<const ObjCMethodDecl *>>;
1229
1230 static PrivateMethodCache PMC;
1231 std::optional<const ObjCMethodDecl *> &Val =
1232 PMC[{Interface, LookupSelector, InstanceMethod}];
1233
1234 // Query lookupPrivateMethod() if the cache does not hit.
1235 if (!Val) {
1236 Val = Interface->lookupPrivateMethod(LookupSelector, InstanceMethod);
1237
1238 if (!*Val) {
1239 // Query 'lookupMethod' as a backup.
1240 Val = Interface->lookupMethod(LookupSelector, InstanceMethod);
1241 }
1242 }
1243
1244 return *Val;
1245}
1246
1248 const ObjCMessageExpr *E = getOriginExpr();
1249 assert(E);
1250 Selector Sel = E->getSelector();
1251
1252 if (E->isInstanceMessage()) {
1253 // Find the receiver type.
1254 const ObjCObjectType *ReceiverT = nullptr;
1255 bool CanBeSubClassed = false;
1256 bool LookingForInstanceMethod = true;
1257 QualType SupersType = E->getSuperType();
1258 const MemRegion *Receiver = nullptr;
1259
1260 if (!SupersType.isNull()) {
1261 // The receiver is guaranteed to be 'super' in this case.
1262 // Super always means the type of immediate predecessor to the method
1263 // where the call occurs.
1264 ReceiverT = cast<ObjCObjectPointerType>(SupersType)->getObjectType();
1265 } else {
1266 Receiver = getReceiverSVal().getAsRegion();
1267 if (!Receiver)
1268 return {};
1269
1270 DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1271 if (!DTI.isValid()) {
1272 assert(isa<AllocaRegion>(Receiver) &&
1273 "Unhandled untyped region class!");
1274 return {};
1275 }
1276
1277 QualType DynType = DTI.getType();
1278 CanBeSubClassed = DTI.canBeASubClass();
1279
1280 const auto *ReceiverDynT =
1281 dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1282
1283 if (ReceiverDynT) {
1284 ReceiverT = ReceiverDynT->getObjectType();
1285
1286 // It can be actually class methods called with Class object as a
1287 // receiver. This type of messages is treated by the compiler as
1288 // instance (not class).
1289 if (ReceiverT->isObjCClass()) {
1290
1291 SVal SelfVal = getState()->getSelfSVal(getLocationContext());
1292 // For [self classMethod], return compiler visible declaration.
1293 if (Receiver == SelfVal.getAsRegion()) {
1295 }
1296
1297 // Otherwise, let's check if we know something about the type
1298 // inside of this class object.
1299 if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1300 DynamicTypeInfo DTI =
1302 if (DTI.isValid()) {
1303 // Let's use this type for lookup.
1304 ReceiverT =
1305 cast<ObjCObjectType>(DTI.getType().getCanonicalType());
1306
1307 CanBeSubClassed = DTI.canBeASubClass();
1308 // And it should be a class method instead.
1309 LookingForInstanceMethod = false;
1310 }
1311 }
1312 }
1313
1314 if (CanBeSubClassed)
1315 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1316 // Even if `DynamicTypeInfo` told us that it can be
1317 // not necessarily this type, but its descendants, we still want
1318 // to check again if this selector can be actually overridden.
1319 CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1320 }
1321 }
1322
1323 // Lookup the instance method implementation.
1324 if (ReceiverT)
1325 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1326 const ObjCMethodDecl *MD =
1327 lookupRuntimeDefinition(IDecl, Sel, LookingForInstanceMethod);
1328
1329 if (MD && !MD->hasBody())
1330 MD = MD->getCanonicalDecl();
1331
1332 if (CanBeSubClassed)
1333 return RuntimeDefinition(MD, Receiver);
1334 else
1335 return RuntimeDefinition(MD, nullptr);
1336 }
1337 } else {
1338 // This is a class method.
1339 // If we have type info for the receiver class, we are calling via
1340 // class name.
1341 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1342 // Find/Return the method implementation.
1343 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1344 }
1345 }
1346
1347 return {};
1348}
1349
1351 if (isInSystemHeader() && !isInstanceMessage()) {
1352 Selector Sel = getSelector();
1353 if (Sel.getNumArgs() == 1 &&
1354 Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1355 return true;
1356 }
1357
1359}
1360
1362 const StackFrameContext *CalleeCtx,
1363 BindingsTy &Bindings) const {
1364 const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1365 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1366 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1367 D->parameters());
1368
1369 SVal SelfVal = getReceiverSVal();
1370 if (!SelfVal.isUnknown()) {
1371 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1372 MemRegionManager &MRMgr = SVB.getRegionManager();
1373 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1374 Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1375 }
1376}
1377
1380 const LocationContext *LCtx,
1382 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1383 return create<CXXMemberCall>(MCE, State, LCtx, ElemRef);
1384
1385 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1386 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1387 if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1388 if (MD->isInstance())
1389 return create<CXXMemberOperatorCall>(OpCE, State, LCtx, ElemRef);
1390
1391 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1392 return create<BlockCall>(CE, State, LCtx, ElemRef);
1393 }
1394
1395 // Otherwise, it's a normal function call, static member function call, or
1396 // something we can't reason about.
1397 return create<SimpleFunctionCall>(CE, State, LCtx, ElemRef);
1398}
1399
1402 ProgramStateRef State) {
1403 const LocationContext *ParentCtx = CalleeCtx->getParent();
1404 const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1405 CFGBlock::ConstCFGElementRef ElemRef = {CalleeCtx->getCallSiteBlock(),
1406 CalleeCtx->getIndex()};
1407 assert(CallerCtx && "This should not be used for top-level stack frames");
1408
1409 const Stmt *CallSite = CalleeCtx->getCallSite();
1410
1411 if (CallSite) {
1412 if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx, ElemRef))
1413 return Out;
1414
1415 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1416 const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1417 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1418 SVal ThisVal = State->getSVal(ThisPtr);
1419
1420 if (const auto *CE = dyn_cast<CXXConstructExpr>(CallSite))
1421 return getCXXConstructorCall(CE, ThisVal.getAsRegion(), State, CallerCtx,
1422 ElemRef);
1423 else if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(CallSite))
1424 return getCXXInheritedConstructorCall(CIE, ThisVal.getAsRegion(), State,
1425 CallerCtx, ElemRef);
1426 else {
1427 // All other cases are handled by getCall.
1428 llvm_unreachable("This is not an inlineable statement");
1429 }
1430 }
1431
1432 // Fall back to the CFG. The only thing we haven't handled yet is
1433 // destructors, though this could change in the future.
1434 const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1435 CFGElement E = (*B)[CalleeCtx->getIndex()];
1436 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1437 "All other CFG elements should have exprs");
1438
1439 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1440 const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1441 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1442 SVal ThisVal = State->getSVal(ThisPtr);
1443
1444 const Stmt *Trigger;
1445 if (std::optional<CFGAutomaticObjDtor> AutoDtor =
1447 Trigger = AutoDtor->getTriggerStmt();
1448 else if (std::optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1449 Trigger = DeleteDtor->getDeleteExpr();
1450 else
1451 Trigger = Dtor->getBody();
1452
1453 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1454 E.getAs<CFGBaseDtor>().has_value(), State,
1455 CallerCtx, ElemRef);
1456}
1457
1459 const LocationContext *LC,
1461 if (const auto *CE = dyn_cast<CallExpr>(S)) {
1462 return getSimpleCall(CE, State, LC, ElemRef);
1463 } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1464 return getCXXAllocatorCall(NE, State, LC, ElemRef);
1465 } else if (const auto *DE = dyn_cast<CXXDeleteExpr>(S)) {
1466 return getCXXDeallocatorCall(DE, State, LC, ElemRef);
1467 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1468 return getObjCMethodCall(ME, State, LC, ElemRef);
1469 } else {
1470 return nullptr;
1471 }
1472}
Defines the clang::ASTContext interface.
#define V(N, I)
Definition: ASTContext.h:3233
This file defines AnalysisDeclContext, a class that manages the analysis context data for context sen...
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:103
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1161
static const ObjCMethodDecl * lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface, Selector LookupSelector, bool InstanceMethod)
Definition: CallEvent.cpp:1211
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl * > parameters)
Definition: CallEvent.cpp:461
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:1030
static bool isTransparentUnion(QualType T)
Definition: CallEvent.cpp:393
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:1021
static bool isCallback(QualType T)
Definition: CallEvent.cpp:79
static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx, SVal ArgVal, SValBuilder &SVB)
Cast the argument value to the type of the parameter at the function declaration.
Definition: CallEvent.cpp:435
static SVal processArgument(SVal Value, const Expr *ArgumentExpr, const ParmVarDecl *Parameter, SValBuilder &SVB)
Definition: CallEvent.cpp:400
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:222
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
Defines the clang::Expr interface and subclasses for C++ expressions.
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
static const Decl * getCanonicalDecl(const Decl *D)
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified.
Defines the clang::SourceLocation class and associated facilities.
Defines the SourceManager interface.
Defines various enumerations that describe declaration and type specifiers.
C Language Family Type Representation.
static bool isPointerToConst(const QualType &QT)
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
QualType getRecordType(const RecordDecl *Decl) const
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
QualType getReferenceQualifiedType(const Expr *e) const
getReferenceQualifiedType - Given an expr, will return the type for that expression,...
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:683
CanQualType VoidTy
Definition: ASTContext.h:1077
AnalysisDeclContext * getContext(const Decl *D)
const StackFrameContext * getStackFrame(const Decl *D)
Obtain the beginning context of the analysis.
AnalysisDeclContext contains the context data for the function, method or block under analysis.
const Decl * getDecl() const
const ImplicitParamDecl * getSelfDecl() const
AnalysisDeclContextManager * getManager() const
Stores options for the analyzer from the command line.
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:4379
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:4465
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:417
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:468
Represents a single basic block in a source-level CFG.
Definition: CFG.h:604
unsigned size() const
Definition: CFG.h:945
ElementRefImpl< true > ConstCFGElementRef
Definition: CFG.h:914
Represents a function call that returns a C++ object by value.
Definition: CFG.h:185
Represents C++ constructor call.
Definition: CFG.h:156
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:442
Represents a top-level expression in a basic block.
Definition: CFG.h:55
std::optional< T > getAs() const
Convert to the specified CFGElement type, returning std::nullopt if this CFGElement is not of the des...
Definition: CFG.h:109
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:366
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:27
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:510
Expr * getImplicitObjectArgument() const
Retrieve the implicit object argument for the member call.
Definition: ExprCXX.cpp:653
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2035
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined.
Definition: DeclCXX.h:2150
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1215
bool hasDefinition() const
Definition: DeclCXX.h:559
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2832
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: Expr.h:3023
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return null.
Definition: Expr.h:3002
Expr * getCallee()
Definition: Expr.h:2982
ConstructionContext's subclasses describe different ways of constructing an object in C++.
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
SourceLocation getLocation() const
Definition: DeclBase.h:432
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:1017
bool hasAttr() const
Definition: DeclBase.h:560
This represents one expression.
Definition: Expr.h:110
Expr * IgnoreParens() LLVM_READONLY
Skip past any parentheses which might surround this expression until reaching a fixed point.
Definition: Expr.cpp:3068
Expr * IgnoreParenBaseCasts() LLVM_READONLY
Skip past any parentheses and derived-to-base casts until reaching a fixed point.
Definition: Expr.cpp:3094
QualType getType() const
Definition: Expr.h:142
Represents a function declaration or definition.
Definition: Decl.h:1919
const ParmVarDecl * getParamDecl(unsigned i) const
Definition: Decl.h:2626
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2603
bool hasPrototype() const
Whether this function has a prototype, either because one was explicitly written or because it was "i...
Definition: Decl.h:2340
unsigned getNumParams() const
Return the number of parameters this function must have based on its FunctionType.
Definition: Decl.cpp:3616
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3751
One of these records is kept for each identifier that is lexed.
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
StringRef getName() const
Return the actual identifier string.
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
const ParentMap & getParentMap() const
LLVM_ATTRIBUTE_RETURNS_NONNULL AnalysisDeclContext * getAnalysisDeclContext() const
const LocationContext * getParent() const
It might return null.
const StackFrameContext * getStackFrame() const
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:274
Represents an ObjC class declaration.
Definition: DeclObjC.h:1147
ObjCMethodDecl * lookupPrivateMethod(const Selector &Sel, bool Instance=true) const
Lookup a method in the classes implementation hierarchy.
Definition: DeclObjC.cpp:757
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class,...
Definition: DeclObjC.cpp:700
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1865
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:351
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1939
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:942
Selector getSelector() const
Definition: ExprObjC.cpp:293
@ SuperInstance
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1097
@ SuperClass
The receiver is a superclass.
Definition: ExprObjC.h:1094
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1238
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:314
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1326
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1346
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:138
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:524
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:464
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:375
bool isPropertyAccessor() const
Definition: DeclObjC.h:438
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method's selector.
Definition: DeclObjC.cpp:1378
ObjCMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclObjC.cpp:1012
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1211
Represents a class type in Objective C.
Definition: Type.h:6141
bool isObjCClass() const
Definition: Type.h:6209
ObjCInterfaceDecl * getInterface() const
Gets the interface declaration for this object type, if the base type really is an interface.
Definition: Type.h:6374
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:729
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:146
Represents a parameter to a function.
Definition: Decl.h:1724
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2840
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:597
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:579
ProgramPoints can be "tagged" as representing points specific to a given analysis entity.
Definition: ProgramPoint.h:38
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:6299
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:6341
A (possibly-)qualified type.
Definition: Type.h:736
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:803
QualType getCanonicalType() const
Definition: Type.h:6799
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6819
Represents a struct/union/class.
Definition: Decl.h:4036
field_range fields() const
Definition: Decl.h:4263
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4933
RecordDecl * getDecl() const
Definition: Type.h:4943
Smart pointer class that efficiently represents Objective-C method names.
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
unsigned getNumArgs() const
Encodes a location in the source.
bool isValid() const
Return true if this is a valid SourceLocation object.
A trivial tuple used to represent a source range.
SourceLocation getBegin() const
It represents a stack frame of the call stack (based on CallEvent).
CFGElement getCallSiteCFGElement() const
const Stmt * getCallSite() const
const CFGBlock * getCallSiteBlock() const
Stmt - This represents one statement.
Definition: Stmt.h:72
StmtClass getStmtClass() const
Definition: Stmt.h:1181
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:325
A container of type source information.
Definition: Type.h:6718
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1823
bool isBlockPointerType() const
Definition: Type.h:7007
bool isVoidType() const
Definition: Type.h:7317
const RecordType * getAsUnionType() const
NOTE: getAs*ArrayType are methods on ASTContext.
Definition: Type.cpp:690
bool isFunctionPointerType() const
Definition: Type.h:7033
bool isPointerType() const
Definition: Type.h:6999
bool isObjCSelType() const
Definition: Type.h:7172
bool isReferenceType() const
Definition: Type.h:7011
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee.
Definition: Type.cpp:655
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2365
const RecordType * getAsStructureType() const
Definition: Type.cpp:671
bool isAnyPointerType() const
Definition: Type.h:7003
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7523
QualType getType() const
Definition: Decl.h:714
Represents a variable declaration or definition.
Definition: Decl.h:915
This class is used for tools that requires cross translation unit capability.
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName, bool DisplayCTUProgress=false)
This function loads a function or variable definition from an external AST file and merges it into th...
bool hasError(const Decl *ToDecl) const
Returns true if the given Decl is mapped (or created) during an import but there was an unrecoverable...
bool isImportedAsNew(const Decl *ToDecl) const
Returns true if the given Decl is newly created during the import.
static bool isInCodeFile(SourceLocation SL, const SourceManager &SM)
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:911
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:902
SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:896
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:511
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:533
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:594
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:603
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:540
llvm::ImmutableList< SVal > getEmptySValList()
llvm::ImmutableList< SVal > prependSVal(SVal X, llvm::ImmutableList< SVal > L)
const BlockDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:601
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:852
bool isConversionFromLambda() const
Definition: CallEvent.h:608
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:859
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:866
const VarRegion * getRegionStoringCapturedLambda() const
For a block converted from a C++ lambda, returns the block VarRegion for the variable holding the cap...
Definition: CallEvent.h:618
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:873
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:586
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:673
SVal getCXXThisVal() const override
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:933
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:939
bool isBaseDestructor() const
Returns true if this is a call to a base class destructor.
Definition: CallEvent.h:858
const StackFrameContext * getInheritingStackFrame() const
Obtain the stack frame of the inheriting constructor.
Definition: CallEvent.cpp:926
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:684
virtual SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:715
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:726
virtual const Expr * getCXXThisExpr() const
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.h:692
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:672
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:791
const CXXMemberCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:726
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:832
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:836
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:848
const CXXOperatorCallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:771
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1375
CallEventRef getCall(const Stmt *S, ProgramStateRef State, const LocationContext *LC, CFGBlock::ConstCFGElementRef ElemRef)
Gets a call event for a function call, Objective-C method call, a 'new', or a 'delete' call.
Definition: CallEvent.cpp:1458
CallEventRef< CXXDeallocatorCall > getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1391
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.cpp:1379
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1353
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1384
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1360
CallEventRef< CXXInheritedConstructorCall > getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef)
Definition: CallEvent.h:1367
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1401
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:153
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:315
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.h:210
virtual StringRef getKindAsString() const =0
virtual const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:253
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:347
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:474
const ConstructionContext * getConstructionContext() const
Returns the construction context of the call, if it is a C++ constructor call or a call of a function...
Definition: CallEvent.cpp:503
param_type_iterator param_type_end() const
Definition: CallEvent.h:485
const ParamVarRegion * getParameterLocation(unsigned Index, unsigned BlockCount) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:194
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:152
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:233
virtual std::optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:439
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:234
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:71
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:265
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace,...
Definition: CallEvent.cpp:144
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:327
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call's formal parameters.
Definition: CallEvent.h:481
const void * Data
Definition: CallEvent.h:166
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:288
const StackFrameContext * getCalleeStackFrame(unsigned BlockCount) const
Returns the callee stack frame.
Definition: CallEvent.cpp:164
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:351
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:202
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:380
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:308
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:113
std::optional< SVal > getReturnValueUnderConstruction() const
If the call returns a C++ record type then the region of its return value can be retrieved from its c...
Definition: CallEvent.cpp:520
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:296
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:140
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:427
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:322
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:223
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:239
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:136
virtual Kind getKind() const =0
Returns the kind of call this is.
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:287
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace,...
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
bool canBeASubClass() const
Returns false if the type information is precise (the type 'DynTy' is the only type in the lattice),...
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
bool isValid() const
Returns true if the dynamic type info is available.
SVal computeObjectUnderConstruction(const Expr *E, ProgramStateRef State, const NodeBuilderContext *BldrCtx, const LocationContext *LCtx, const ConstructionContext *CC, EvalCallOptions &CallOpts, unsigned Idx=0)
Find location of the object that is being constructed by a given constructor.
const NodeBuilderContext & getBuilderContext()
Definition: ExprEngine.h:225
const VarRegion * getVarRegion(const VarDecl *VD, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:983
const ParamVarRegion * getParamVarRegion(const Expr *OriginExpr, unsigned Index, const LocationContext *LC)
getParamVarRegion - Retrieve or create the memory region associated with a specified CallExpr,...
Definition: MemRegion.cpp:1094
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:96
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1370
LLVM_ATTRIBUTE_RETURNS_NONNULL const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1335
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1166
const ObjCMethodDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:1195
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Used to specify non-argument regions that will be invalidated as a result of this call.
Definition: CallEvent.cpp:955
bool isInstanceMessage() const
Definition: CallEvent.h:1207
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1041
const ObjCMessageExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:1191
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:948
SourceRange getSourceRange() const override
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.cpp:1010
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1107
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:1350
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:980
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:1247
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to 'self' or 'super'.
Definition: CallEvent.cpp:996
Selector getSelector() const
Definition: CallEvent.h:1215
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1085
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:1361
ParamVarRegion - Represents a region for paremters.
Definition: MemRegion.h:1029
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1624
@ TK_PreserveContents
Tells that a region's contents is not changed.
Definition: MemRegion.h:1639
@ TK_SuppressEscape
Suppress pointer-escaping of a region.
Definition: MemRegion.h:1642
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1762
Defines the runtime definition of the called function.
Definition: CallEvent.h:110
BasicValueFactory & getBasicValueFactory()
Definition: SValBuilder.h:149
NonLoc makeCompoundVal(QualType type, llvm::ImmutableList< SVal > vals)
Definition: SValBuilder.h:241
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:155
ASTContext & getContext()
Definition: SValBuilder.h:136
loc::MemRegionVal makeLoc(SymbolRef sym)
Definition: SValBuilder.h:356
SVal evalCast(SVal V, QualType CastTy, QualType OriginalTy)
Cast a given SVal to another SVal using given QualType's.
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:73
bool isUnknownOrUndef() const
Definition: SVals.h:133
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:46
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
bool isValid() const
Definition: SVals.h:137
bool isUnknown() const
Definition: SVals.h:125
const CallExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:548
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:664
std::optional< SVal > evalBaseToDerived(SVal Base, QualType DerivedPtrType)
Attempts to do a down cast.
Definition: Store.cpp:316
Symbolic value.
Definition: SymExpr.h:30
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:530
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
@ CE_CXXAllocator
Definition: CallEvent.h:71
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:1157
@ OCM_PropertyAccess
Definition: CallEvent.h:1158
DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym)
Get dynamic type information stored in a class object represented by Sym.
@ Parameter
The parameter type of a method or function.
@ Result
The result type of a method or function.
YAML serialization mapping.
Definition: Dominators.h:30
Selector LookupSelector
Definition: CallEvent.cpp:1176
const ObjCInterfaceDecl * Interface
Definition: CallEvent.cpp:1175
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:97
DenseMapInfo< Selector > SelectorInfo
Definition: CallEvent.cpp:1183
static unsigned getHashValue(const PrivateMethodKey &Key)
Definition: CallEvent.cpp:1194
static PrivateMethodKey getEmptyKey()
Definition: CallEvent.cpp:1185
DenseMapInfo< const ObjCInterfaceDecl * > InterfaceInfo
Definition: CallEvent.cpp:1182
static bool isEqual(const PrivateMethodKey &LHS, const PrivateMethodKey &RHS)
Definition: CallEvent.cpp:1201
static PrivateMethodKey getTombstoneKey()
Definition: CallEvent.cpp:1189