clang  8.0.0svn
CallEvent.cpp
Go to the documentation of this file.
1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "clang/AST/ASTContext.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
29 #include "clang/Analysis/CFG.h"
34 #include "clang/Basic/LLVM.h"
37 #include "clang/Basic/Specifiers.h"
48 #include "llvm/ADT/ArrayRef.h"
49 #include "llvm/ADT/DenseMap.h"
50 #include "llvm/ADT/None.h"
51 #include "llvm/ADT/Optional.h"
52 #include "llvm/ADT/PointerIntPair.h"
53 #include "llvm/ADT/SmallSet.h"
54 #include "llvm/ADT/SmallVector.h"
55 #include "llvm/ADT/StringExtras.h"
56 #include "llvm/ADT/StringRef.h"
57 #include "llvm/Support/Casting.h"
58 #include "llvm/Support/Compiler.h"
59 #include "llvm/Support/Debug.h"
60 #include "llvm/Support/ErrorHandling.h"
61 #include "llvm/Support/raw_ostream.h"
62 #include <cassert>
63 #include <utility>
64 
65 #define DEBUG_TYPE "static-analyzer-call-event"
66 
67 using namespace clang;
68 using namespace ento;
69 
71  ASTContext &Ctx = getState()->getStateManager().getContext();
72  const Expr *E = getOriginExpr();
73  if (!E)
74  return Ctx.VoidTy;
75  assert(E);
76 
77  QualType ResultTy = E->getType();
78 
79  // A function that returns a reference to 'int' will have a result type
80  // of simply 'int'. Check the origin expr's value kind to recover the
81  // proper type.
82  switch (E->getValueKind()) {
83  case VK_LValue:
84  ResultTy = Ctx.getLValueReferenceType(ResultTy);
85  break;
86  case VK_XValue:
87  ResultTy = Ctx.getRValueReferenceType(ResultTy);
88  break;
89  case VK_RValue:
90  // No adjustment is necessary.
91  break;
92  }
93 
94  return ResultTy;
95 }
96 
97 static bool isCallback(QualType T) {
98  // If a parameter is a block or a callback, assume it can modify pointer.
99  if (T->isBlockPointerType() ||
100  T->isFunctionPointerType() ||
101  T->isObjCSelType())
102  return true;
103 
104  // Check if a callback is passed inside a struct (for both, struct passed by
105  // reference and by value). Dig just one level into the struct for now.
106 
107  if (T->isAnyPointerType() || T->isReferenceType())
108  T = T->getPointeeType();
109 
110  if (const RecordType *RT = T->getAsStructureType()) {
111  const RecordDecl *RD = RT->getDecl();
112  for (const auto *I : RD->fields()) {
113  QualType FieldT = I->getType();
114  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
115  return true;
116  }
117  }
118  return false;
119 }
120 
122  if (const auto *PT = T->getAs<PointerType>()) {
123  QualType PointeeTy = PT->getPointeeType();
124  if (PointeeTy.isConstQualified())
125  return false;
126  return PointeeTy->isVoidType();
127  } else
128  return false;
129 }
130 
131 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
132  unsigned NumOfArgs = getNumArgs();
133 
134  // If calling using a function pointer, assume the function does not
135  // satisfy the callback.
136  // TODO: We could check the types of the arguments here.
137  if (!getDecl())
138  return false;
139 
140  unsigned Idx = 0;
142  E = param_type_end();
143  I != E && Idx < NumOfArgs; ++I, ++Idx) {
144  // If the parameter is 0, it's harmless.
145  if (getArgSVal(Idx).isZeroConstant())
146  continue;
147 
148  if (Condition(*I))
149  return true;
150  }
151  return false;
152 }
153 
156 }
157 
160 }
161 
162 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
163  const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
164  if (!FD)
165  return false;
166 
167  return CheckerContext::isCLibraryFunction(FD, FunctionName);
168 }
169 
171  const Decl *D = getDecl();
172  if (!D)
173  return nullptr;
174 
175  // TODO: For now we skip functions without definitions, even if we have
176  // our own getDecl(), because it's hard to find out which re-declaration
177  // is going to be used, and usually clients don't really care about this
178  // situation because there's a loss of precision anyway because we cannot
179  // inline the call.
181  if (!RD.getDecl())
182  return nullptr;
183 
184  AnalysisDeclContext *ADC =
186 
187  // TODO: For now we skip virtual functions, because this also rises
188  // the problem of which decl to use, but now it's across different classes.
189  if (RD.mayHaveOtherDefinitions() || RD.getDecl() != ADC->getDecl())
190  return nullptr;
191 
192  return ADC;
193 }
194 
197  if (!ADC)
198  return nullptr;
199 
200  const Expr *E = getOriginExpr();
201  if (!E)
202  return nullptr;
203 
204  // Recover CFG block via reverse lookup.
205  // TODO: If we were to keep CFG element information as part of the CallEvent
206  // instead of doing this reverse lookup, we would be able to build the stack
207  // frame for non-expression-based calls, and also we wouldn't need the reverse
208  // lookup.
210  const CFGBlock *B = Map->getBlock(E);
211  assert(B);
212 
213  // Also recover CFG index by scanning the CFG block.
214  unsigned Idx = 0, Sz = B->size();
215  for (; Idx < Sz; ++Idx)
216  if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
217  if (StmtElem->getStmt() == E)
218  break;
219  assert(Idx < Sz);
220 
221  return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, Idx);
222 }
223 
224 const VarRegion *CallEvent::getParameterLocation(unsigned Index) const {
225  const StackFrameContext *SFC = getCalleeStackFrame();
226  // We cannot construct a VarRegion without a stack frame.
227  if (!SFC)
228  return nullptr;
229 
230  // Retrieve parameters of the definition, which are different from
231  // CallEvent's parameters() because getDecl() isn't necessarily
232  // the definition. SFC contains the definition that would be used
233  // during analysis.
234  const Decl *D = SFC->getDecl();
235 
236  // TODO: Refactor into a virtual method of CallEvent, like parameters().
237  const ParmVarDecl *PVD = nullptr;
238  if (const auto *FD = dyn_cast<FunctionDecl>(D))
239  PVD = FD->parameters()[Index];
240  else if (const auto *BD = dyn_cast<BlockDecl>(D))
241  PVD = BD->parameters()[Index];
242  else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
243  PVD = MD->parameters()[Index];
244  else if (const auto *CD = dyn_cast<CXXConstructorDecl>(D))
245  PVD = CD->parameters()[Index];
246  assert(PVD && "Unexpected Decl kind!");
247 
248  const VarRegion *VR =
249  State->getStateManager().getRegionManager().getVarRegion(PVD, SFC);
250 
251  // This sanity check would fail if our parameter declaration doesn't
252  // correspond to the stack frame's function declaration.
253  assert(VR->getStackFrame() == SFC);
254 
255  return VR;
256 }
257 
258 /// Returns true if a type is a pointer-to-const or reference-to-const
259 /// with no further indirection.
260 static bool isPointerToConst(QualType Ty) {
261  QualType PointeeTy = Ty->getPointeeType();
262  if (PointeeTy == QualType())
263  return false;
264  if (!PointeeTy.isConstQualified())
265  return false;
266  if (PointeeTy->isAnyPointerType())
267  return false;
268  return true;
269 }
270 
271 // Try to retrieve the function declaration and find the function parameter
272 // types which are pointers/references to a non-pointer const.
273 // We will not invalidate the corresponding argument regions.
274 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
275  const CallEvent &Call) {
276  unsigned Idx = 0;
277  for (CallEvent::param_type_iterator I = Call.param_type_begin(),
278  E = Call.param_type_end();
279  I != E; ++I, ++Idx) {
280  if (isPointerToConst(*I))
281  PreserveArgs.insert(Idx);
282  }
283 }
284 
286  ProgramStateRef Orig) const {
287  ProgramStateRef Result = (Orig ? Orig : getState());
288 
289  // Don't invalidate anything if the callee is marked pure/const.
290  if (const Decl *callee = getDecl())
291  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
292  return Result;
293 
294  SmallVector<SVal, 8> ValuesToInvalidate;
296 
297  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
298 
299  // Indexes of arguments whose values will be preserved by the call.
300  llvm::SmallSet<unsigned, 4> PreserveArgs;
301  if (!argumentsMayEscape())
302  findPtrToConstParams(PreserveArgs, *this);
303 
304  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
305  // Mark this region for invalidation. We batch invalidate regions
306  // below for efficiency.
307  if (PreserveArgs.count(Idx))
308  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
309  ETraits.setTrait(MR->getBaseRegion(),
311  // TODO: Factor this out + handle the lower level const pointers.
312 
313  ValuesToInvalidate.push_back(getArgSVal(Idx));
314 
315  // If a function accepts an object by argument (which would of course be a
316  // temporary that isn't lifetime-extended), invalidate the object itself,
317  // not only other objects reachable from it. This is necessary because the
318  // destructor has access to the temporary object after the call.
319  // TODO: Support placement arguments once we start
320  // constructing them directly.
321  // TODO: This is unnecessary when there's no destructor, but that's
322  // currently hard to figure out.
323  if (getKind() != CE_CXXAllocator)
325  if (auto AdjIdx = getAdjustedParameterIndex(Idx))
326  if (const VarRegion *VR = getParameterLocation(*AdjIdx))
327  ValuesToInvalidate.push_back(loc::MemRegionVal(VR));
328  }
329 
330  // Invalidate designated regions using the batch invalidation API.
331  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
332  // global variables.
333  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
334  BlockCount, getLocationContext(),
335  /*CausedByPointerEscape*/ true,
336  /*Symbols=*/nullptr, this, &ETraits);
337 }
338 
340  const ProgramPointTag *Tag) const {
341  if (const Expr *E = getOriginExpr()) {
342  if (IsPreVisit)
343  return PreStmt(E, getLocationContext(), Tag);
344  return PostStmt(E, getLocationContext(), Tag);
345  }
346 
347  const Decl *D = getDecl();
348  assert(D && "Cannot get a program point without a statement or decl");
349 
351  if (IsPreVisit)
352  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
353  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
354 }
355 
356 bool CallEvent::isCalled(const CallDescription &CD) const {
357  // FIXME: Add ObjC Message support.
358  if (getKind() == CE_ObjCMessage)
359  return false;
360  if (!CD.IsLookupDone) {
361  CD.IsLookupDone = true;
362  CD.II = &getState()->getStateManager().getContext().Idents.get(
363  CD.getFunctionName());
364  }
365  const IdentifierInfo *II = getCalleeIdentifier();
366  if (!II || II != CD.II)
367  return false;
368 
369  const Decl *D = getDecl();
370  // If CallDescription provides prefix names, use them to improve matching
371  // accuracy.
372  if (CD.QualifiedName.size() > 1 && D) {
373  const DeclContext *Ctx = D->getDeclContext();
374  std::vector<StringRef> QualifiedName = CD.QualifiedName;
375  QualifiedName.pop_back();
376  for (; Ctx && isa<NamedDecl>(Ctx); Ctx = Ctx->getParent()) {
377  if (const auto *ND = dyn_cast<NamespaceDecl>(Ctx)) {
378  if (!QualifiedName.empty() && ND->getName() == QualifiedName.back())
379  QualifiedName.pop_back();
380  continue;
381  }
382 
383  if (const auto *RD = dyn_cast<RecordDecl>(Ctx)) {
384  if (!QualifiedName.empty() && RD->getName() == QualifiedName.back())
385  QualifiedName.pop_back();
386  continue;
387  }
388  }
389 
390  if (!QualifiedName.empty())
391  return false;
392  }
393 
394  return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
395  CD.RequiredArgs == getNumArgs());
396 }
397 
398 SVal CallEvent::getArgSVal(unsigned Index) const {
399  const Expr *ArgE = getArgExpr(Index);
400  if (!ArgE)
401  return UnknownVal();
402  return getSVal(ArgE);
403 }
404 
406  const Expr *ArgE = getArgExpr(Index);
407  if (!ArgE)
408  return {};
409  return ArgE->getSourceRange();
410 }
411 
413  const Expr *E = getOriginExpr();
414  if (!E)
415  return UndefinedVal();
416  return getSVal(E);
417 }
418 
419 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
420 
421 void CallEvent::dump(raw_ostream &Out) const {
422  ASTContext &Ctx = getState()->getStateManager().getContext();
423  if (const Expr *E = getOriginExpr()) {
424  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
425  Out << "\n";
426  return;
427  }
428 
429  if (const Decl *D = getDecl()) {
430  Out << "Call to ";
431  D->print(Out, Ctx.getPrintingPolicy());
432  return;
433  }
434 
435  // FIXME: a string representation of the kind would be nice.
436  Out << "Unknown call (type " << getKind() << ")";
437 }
438 
439 bool CallEvent::isCallStmt(const Stmt *S) {
440  return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
441  || isa<CXXConstructExpr>(S)
442  || isa<CXXNewExpr>(S);
443 }
444 
446  assert(D);
447  if (const auto *FD = dyn_cast<FunctionDecl>(D))
448  return FD->getReturnType();
449  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
450  return MD->getReturnType();
451  if (const auto *BD = dyn_cast<BlockDecl>(D)) {
452  // Blocks are difficult because the return type may not be stored in the
453  // BlockDecl itself. The AST should probably be enhanced, but for now we
454  // just do what we can.
455  // If the block is declared without an explicit argument list, the
456  // signature-as-written just includes the return type, not the entire
457  // function type.
458  // FIXME: All blocks should have signatures-as-written, even if the return
459  // type is inferred. (That's signified with a dependent result type.)
460  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
461  QualType Ty = TSI->getType();
462  if (const FunctionType *FT = Ty->getAs<FunctionType>())
463  Ty = FT->getReturnType();
464  if (!Ty->isDependentType())
465  return Ty;
466  }
467 
468  return {};
469  }
470 
471  llvm_unreachable("unknown callable kind");
472 }
473 
474 bool CallEvent::isVariadic(const Decl *D) {
475  assert(D);
476 
477  if (const auto *FD = dyn_cast<FunctionDecl>(D))
478  return FD->isVariadic();
479  if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
480  return MD->isVariadic();
481  if (const auto *BD = dyn_cast<BlockDecl>(D))
482  return BD->isVariadic();
483 
484  llvm_unreachable("unknown callable kind");
485 }
486 
487 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
488  CallEvent::BindingsTy &Bindings,
489  SValBuilder &SVB,
490  const CallEvent &Call,
492  MemRegionManager &MRMgr = SVB.getRegionManager();
493 
494  // If the function has fewer parameters than the call has arguments, we simply
495  // do not bind any values to them.
496  unsigned NumArgs = Call.getNumArgs();
497  unsigned Idx = 0;
498  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
499  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
500  const ParmVarDecl *ParamDecl = *I;
501  assert(ParamDecl && "Formal parameter has no decl?");
502 
503  if (Call.getKind() != CE_CXXAllocator)
504  if (Call.isArgumentConstructedDirectly(Idx))
505  continue;
506 
507  SVal ArgVal = Call.getArgSVal(Idx);
508  if (!ArgVal.isUnknown()) {
509  Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
510  Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
511  }
512  }
513 
514  // FIXME: Variadic arguments are not handled at all right now.
515 }
516 
518  const FunctionDecl *D = getDecl();
519  if (!D)
520  return None;
521  return D->parameters();
522 }
523 
525  const FunctionDecl *FD = getDecl();
526  if (!FD)
527  return {};
528 
529  // Note that the AnalysisDeclContext will have the FunctionDecl with
530  // the definition (if one exists).
531  AnalysisDeclContext *AD =
533  getManager()->getContext(FD);
534  bool IsAutosynthesized;
535  Stmt* Body = AD->getBody(IsAutosynthesized);
536  LLVM_DEBUG({
537  if (IsAutosynthesized)
538  llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
539  << "\n";
540  });
541  if (Body) {
542  const Decl* Decl = AD->getDecl();
543  return RuntimeDefinition(Decl);
544  }
545 
546  SubEngine *Engine = getState()->getStateManager().getOwningEngine();
547  AnalyzerOptions &Opts = Engine->getAnalysisManager().options;
548 
549  // Try to get CTU definition only if CTUDir is provided.
550  if (!Opts.naiveCTUEnabled())
551  return {};
552 
555  llvm::Expected<const FunctionDecl *> CTUDeclOrError =
556  CTUCtx.getCrossTUDefinition(FD, Opts.getCTUDir(), Opts.getCTUIndexName());
557 
558  if (!CTUDeclOrError) {
559  handleAllErrors(CTUDeclOrError.takeError(),
560  [&](const cross_tu::IndexError &IE) {
561  CTUCtx.emitCrossTUDiagnostics(IE);
562  });
563  return {};
564  }
565 
566  return RuntimeDefinition(*CTUDeclOrError);
567 }
568 
570  const StackFrameContext *CalleeCtx,
571  BindingsTy &Bindings) const {
572  const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
573  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
574  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
575  D->parameters());
576 }
577 
580  return true;
581 
582  const FunctionDecl *D = getDecl();
583  if (!D)
584  return true;
585 
586  const IdentifierInfo *II = D->getIdentifier();
587  if (!II)
588  return false;
589 
590  // This set of "escaping" APIs is
591 
592  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
593  // value into thread local storage. The value can later be retrieved with
594  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
595  // parameter is 'const void *', the region escapes through the call.
596  if (II->isStr("pthread_setspecific"))
597  return true;
598 
599  // - xpc_connection_set_context stores a value which can be retrieved later
600  // with xpc_connection_get_context.
601  if (II->isStr("xpc_connection_set_context"))
602  return true;
603 
604  // - funopen - sets a buffer for future IO calls.
605  if (II->isStr("funopen"))
606  return true;
607 
608  // - __cxa_demangle - can reallocate memory and can return the pointer to
609  // the input buffer.
610  if (II->isStr("__cxa_demangle"))
611  return true;
612 
613  StringRef FName = II->getName();
614 
615  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
616  // buffer even if it is const.
617  if (FName.endswith("NoCopy"))
618  return true;
619 
620  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
621  // be deallocated by NSMapRemove.
622  if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
623  return true;
624 
625  // - Many CF containers allow objects to escape through custom
626  // allocators/deallocators upon container construction. (PR12101)
627  if (FName.startswith("CF") || FName.startswith("CG")) {
628  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
629  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
630  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
631  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
632  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
633  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
634  }
635 
636  return false;
637 }
638 
640  const FunctionDecl *D = getOriginExpr()->getDirectCallee();
641  if (D)
642  return D;
643 
644  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
645 }
646 
648  const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
649  if (!CE)
650  return AnyFunctionCall::getDecl();
651 
652  const FunctionDecl *D = CE->getDirectCallee();
653  if (D)
654  return D;
655 
656  return getSVal(CE->getCallee()).getAsFunctionDecl();
657 }
658 
660  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
661  SVal ThisVal = getCXXThisVal();
662  Values.push_back(ThisVal);
663 
664  // Don't invalidate if the method is const and there are no mutable fields.
665  if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
666  if (!D->isConst())
667  return;
668  // Get the record decl for the class of 'This'. D->getParent() may return a
669  // base class decl, rather than the class of the instance which needs to be
670  // checked for mutable fields.
671  // TODO: We might as well look at the dynamic type of the object.
672  const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
673  QualType T = Ex->getType();
674  if (T->isPointerType()) // Arrow or implicit-this syntax?
675  T = T->getPointeeType();
676  const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
677  assert(ParentRecord);
678  if (ParentRecord->hasMutableFields())
679  return;
680  // Preserve CXXThis.
681  const MemRegion *ThisRegion = ThisVal.getAsRegion();
682  if (!ThisRegion)
683  return;
684 
685  ETraits->setTrait(ThisRegion->getBaseRegion(),
687  }
688 }
689 
691  const Expr *Base = getCXXThisExpr();
692  // FIXME: This doesn't handle an overloaded ->* operator.
693  if (!Base)
694  return UnknownVal();
695 
696  SVal ThisVal = getSVal(Base);
697  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
698  return ThisVal;
699 }
700 
701 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
702  // Do we have a decl at all?
703  const Decl *D = getDecl();
704  if (!D)
705  return {};
706 
707  // If the method is non-virtual, we know we can inline it.
708  const auto *MD = cast<CXXMethodDecl>(D);
709  if (!MD->isVirtual())
711 
712  // Do we know the implicit 'this' object being called?
713  const MemRegion *R = getCXXThisVal().getAsRegion();
714  if (!R)
715  return {};
716 
717  // Do we know anything about the type of 'this'?
718  DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
719  if (!DynType.isValid())
720  return {};
721 
722  // Is the type a C++ class? (This is mostly a defensive check.)
723  QualType RegionType = DynType.getType()->getPointeeType();
724  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
725 
726  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
727  if (!RD || !RD->hasDefinition())
728  return {};
729 
730  // Find the decl for this method in that class.
731  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
732  if (!Result) {
733  // We might not even get the original statically-resolved method due to
734  // some particularly nasty casting (e.g. casts to sister classes).
735  // However, we should at least be able to search up and down our own class
736  // hierarchy, and some real bugs have been caught by checking this.
737  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
738 
739  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
740  // the static type. However, because we currently don't update
741  // DynamicTypeInfo when an object is cast, we can't actually be sure the
742  // DynamicTypeInfo is up to date. This assert should be re-enabled once
743  // this is fixed. <rdar://problem/12287087>
744  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
745 
746  return {};
747  }
748 
749  // Does the decl that we found have an implementation?
750  const FunctionDecl *Definition;
751  if (!Result->hasBody(Definition))
752  return {};
753 
754  // We found a definition. If we're not sure that this devirtualization is
755  // actually what will happen at runtime, make sure to provide the region so
756  // that ExprEngine can decide what to do with it.
757  if (DynType.canBeASubClass())
758  return RuntimeDefinition(Definition, R->StripCasts());
759  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
760 }
761 
763  const StackFrameContext *CalleeCtx,
764  BindingsTy &Bindings) const {
766 
767  // Handle the binding of 'this' in the new stack frame.
768  SVal ThisVal = getCXXThisVal();
769  if (!ThisVal.isUnknown()) {
770  ProgramStateManager &StateMgr = getState()->getStateManager();
771  SValBuilder &SVB = StateMgr.getSValBuilder();
772 
773  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
774  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
775 
776  // If we devirtualized to a different member function, we need to make sure
777  // we have the proper layering of CXXBaseObjectRegions.
778  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
779  ASTContext &Ctx = SVB.getContext();
780  const CXXRecordDecl *Class = MD->getParent();
781  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
782 
783  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
784  bool Failed;
785  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
786  if (Failed) {
787  // We might have suffered some sort of placement new earlier, so
788  // we're constructing in a completely unexpected storage.
789  // Fall back to a generic pointer cast for this-value.
790  const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
791  const CXXRecordDecl *StaticClass = StaticMD->getParent();
792  QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
793  ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
794  }
795  }
796 
797  if (!ThisVal.isUnknown())
798  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
799  }
800 }
801 
803  return getOriginExpr()->getImplicitObjectArgument();
804 }
805 
806 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
807  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
808  // id-expression in the class member access expression is a qualified-id,
809  // that function is called. Otherwise, its final overrider in the dynamic type
810  // of the object expression is called.
811  if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
812  if (ME->hasQualifier())
814 
816 }
817 
819  return getOriginExpr()->getArg(0);
820 }
821 
822 const BlockDataRegion *BlockCall::getBlockRegion() const {
823  const Expr *Callee = getOriginExpr()->getCallee();
824  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
825 
826  return dyn_cast_or_null<BlockDataRegion>(DataReg);
827 }
828 
830  const BlockDecl *D = getDecl();
831  if (!D)
832  return nullptr;
833  return D->parameters();
834 }
835 
837  RegionAndSymbolInvalidationTraits *ETraits) const {
838  // FIXME: This also needs to invalidate captured globals.
839  if (const MemRegion *R = getBlockRegion())
840  Values.push_back(loc::MemRegionVal(R));
841 }
842 
844  BindingsTy &Bindings) const {
845  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
846  ArrayRef<ParmVarDecl*> Params;
847  if (isConversionFromLambda()) {
848  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
849  Params = LambdaOperatorDecl->parameters();
850 
851  // For blocks converted from a C++ lambda, the callee declaration is the
852  // operator() method on the lambda so we bind "this" to
853  // the lambda captured by the block.
854  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
855  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
856  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
857  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
858  } else {
859  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
860  }
861 
862  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
863  Params);
864 }
865 
867  if (Data)
868  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
869  return UnknownVal();
870 }
871 
873  RegionAndSymbolInvalidationTraits *ETraits) const {
874  if (Data) {
875  loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
876  if (SymbolRef Sym = MV.getAsSymbol(true))
877  ETraits->setTrait(Sym,
879  Values.push_back(MV);
880  }
881 }
882 
884  const StackFrameContext *CalleeCtx,
885  BindingsTy &Bindings) const {
887 
888  SVal ThisVal = getCXXThisVal();
889  if (!ThisVal.isUnknown()) {
890  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
891  const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
892  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
893  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
894  }
895 }
896 
898  if (Data)
899  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
900  return UnknownVal();
901 }
902 
903 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
904  // Base destructors are always called non-virtually.
905  // Skip CXXInstanceCall's devirtualization logic in this case.
906  if (isBaseDestructor())
908 
910 }
911 
913  const ObjCMethodDecl *D = getDecl();
914  if (!D)
915  return None;
916  return D->parameters();
917 }
918 
920  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
921 
922  // If the method call is a setter for property known to be backed by
923  // an instance variable, don't invalidate the entire receiver, just
924  // the storage for that instance variable.
925  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
926  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
927  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
928  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
929  ETraits->setTrait(
930  IvarRegion,
932  ETraits->setTrait(
933  IvarRegion,
935  Values.push_back(IvarLVal);
936  }
937  return;
938  }
939  }
940 
941  Values.push_back(getReceiverSVal());
942 }
943 
945  const LocationContext *LCtx = getLocationContext();
946  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
947  if (!SelfDecl)
948  return SVal();
949  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
950 }
951 
953  // FIXME: Is this the best way to handle class receivers?
954  if (!isInstanceMessage())
955  return UnknownVal();
956 
957  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
958  return getSVal(RecE);
959 
960  // An instance message with no expression means we are sending to super.
961  // In this case the object reference is the same as 'self'.
962  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
963  SVal SelfVal = getSelfSVal();
964  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
965  return SelfVal;
966 }
967 
969  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
970  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
971  return true;
972 
973  if (!isInstanceMessage())
974  return false;
975 
976  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
977 
978  return (RecVal == getSelfSVal());
979 }
980 
982  switch (getMessageKind()) {
983  case OCM_Message:
984  return getOriginExpr()->getSourceRange();
985  case OCM_PropertyAccess:
986  case OCM_Subscript:
987  return getContainingPseudoObjectExpr()->getSourceRange();
988  }
989  llvm_unreachable("unknown message kind");
990 }
991 
992 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
993 
994 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
995  assert(Data && "Lazy lookup not yet performed.");
996  assert(getMessageKind() != OCM_Message && "Explicit message send.");
997  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
998 }
999 
1000 static const Expr *
1002  const Expr *Syntactic = POE->getSyntacticForm();
1003 
1004  // This handles the funny case of assigning to the result of a getter.
1005  // This can happen if the getter returns a non-const reference.
1006  if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1007  Syntactic = BO->getLHS();
1008 
1009  return Syntactic;
1010 }
1011 
1013  if (!Data) {
1014  // Find the parent, ignoring implicit casts.
1016  const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1017 
1018  // Check if parent is a PseudoObjectExpr.
1019  if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1020  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1021 
1022  ObjCMessageKind K;
1023  switch (Syntactic->getStmtClass()) {
1024  case Stmt::ObjCPropertyRefExprClass:
1025  K = OCM_PropertyAccess;
1026  break;
1027  case Stmt::ObjCSubscriptRefExprClass:
1028  K = OCM_Subscript;
1029  break;
1030  default:
1031  // FIXME: Can this ever happen?
1032  K = OCM_Message;
1033  break;
1034  }
1035 
1036  if (K != OCM_Message) {
1037  const_cast<ObjCMethodCall *>(this)->Data
1038  = ObjCMessageDataTy(POE, K).getOpaqueValue();
1039  assert(getMessageKind() == K);
1040  return K;
1041  }
1042  }
1043 
1044  const_cast<ObjCMethodCall *>(this)->Data
1045  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1046  assert(getMessageKind() == OCM_Message);
1047  return OCM_Message;
1048  }
1049 
1050  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1051  if (!Info.getPointer())
1052  return OCM_Message;
1053  return static_cast<ObjCMessageKind>(Info.getInt());
1054 }
1055 
1057  // Look for properties accessed with property syntax (foo.bar = ...)
1058  if ( getMessageKind() == OCM_PropertyAccess) {
1059  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1060  assert(POE && "Property access without PseudoObjectExpr?");
1061 
1062  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1063  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1064 
1065  if (RefExpr->isExplicitProperty())
1066  return RefExpr->getExplicitProperty();
1067  }
1068 
1069  // Look for properties accessed with method syntax ([foo setBar:...]).
1070  const ObjCMethodDecl *MD = getDecl();
1071  if (!MD || !MD->isPropertyAccessor())
1072  return nullptr;
1073 
1074  // Note: This is potentially quite slow.
1075  return MD->findPropertyDecl();
1076 }
1077 
1079  Selector Sel) const {
1080  assert(IDecl);
1081  AnalysisManager &AMgr =
1082  getState()->getStateManager().getOwningEngine()->getAnalysisManager();
1083  // If the class interface is declared inside the main file, assume it is not
1084  // subcassed.
1085  // TODO: It could actually be subclassed if the subclass is private as well.
1086  // This is probably very rare.
1087  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1088  if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1089  return false;
1090 
1091  // Assume that property accessors are not overridden.
1092  if (getMessageKind() == OCM_PropertyAccess)
1093  return false;
1094 
1095  // We assume that if the method is public (declared outside of main file) or
1096  // has a parent which publicly declares the method, the method could be
1097  // overridden in a subclass.
1098 
1099  // Find the first declaration in the class hierarchy that declares
1100  // the selector.
1101  ObjCMethodDecl *D = nullptr;
1102  while (true) {
1103  D = IDecl->lookupMethod(Sel, true);
1104 
1105  // Cannot find a public definition.
1106  if (!D)
1107  return false;
1108 
1109  // If outside the main file,
1110  if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1111  return true;
1112 
1113  if (D->isOverriding()) {
1114  // Search in the superclass on the next iteration.
1115  IDecl = D->getClassInterface();
1116  if (!IDecl)
1117  return false;
1118 
1119  IDecl = IDecl->getSuperClass();
1120  if (!IDecl)
1121  return false;
1122 
1123  continue;
1124  }
1125 
1126  return false;
1127  };
1128 
1129  llvm_unreachable("The while loop should always terminate.");
1130 }
1131 
1133  if (!MD)
1134  return MD;
1135 
1136  // Find the redeclaration that defines the method.
1137  if (!MD->hasBody()) {
1138  for (auto I : MD->redecls())
1139  if (I->hasBody())
1140  MD = cast<ObjCMethodDecl>(I);
1141  }
1142  return MD;
1143 }
1144 
1145 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1146  const Expr* InstRec = ME->getInstanceReceiver();
1147  if (!InstRec)
1148  return false;
1149  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1150 
1151  // Check that receiver is called 'self'.
1152  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1153  !InstRecIg->getFoundDecl()->getName().equals("self"))
1154  return false;
1155 
1156  // Check that the method name is 'class'.
1157  if (ME->getSelector().getNumArgs() != 0 ||
1158  !ME->getSelector().getNameForSlot(0).equals("class"))
1159  return false;
1160 
1161  return true;
1162 }
1163 
1164 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1165  const ObjCMessageExpr *E = getOriginExpr();
1166  assert(E);
1167  Selector Sel = E->getSelector();
1168 
1169  if (E->isInstanceMessage()) {
1170  // Find the receiver type.
1171  const ObjCObjectPointerType *ReceiverT = nullptr;
1172  bool CanBeSubClassed = false;
1173  QualType SupersType = E->getSuperType();
1174  const MemRegion *Receiver = nullptr;
1175 
1176  if (!SupersType.isNull()) {
1177  // The receiver is guaranteed to be 'super' in this case.
1178  // Super always means the type of immediate predecessor to the method
1179  // where the call occurs.
1180  ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1181  } else {
1182  Receiver = getReceiverSVal().getAsRegion();
1183  if (!Receiver)
1184  return {};
1185 
1186  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1187  if (!DTI.isValid()) {
1188  assert(isa<AllocaRegion>(Receiver) &&
1189  "Unhandled untyped region class!");
1190  return {};
1191  }
1192 
1193  QualType DynType = DTI.getType();
1194  CanBeSubClassed = DTI.canBeASubClass();
1195  ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1196 
1197  if (ReceiverT && CanBeSubClassed)
1198  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1199  if (!canBeOverridenInSubclass(IDecl, Sel))
1200  CanBeSubClassed = false;
1201  }
1202 
1203  // Handle special cases of '[self classMethod]' and
1204  // '[[self class] classMethod]', which are treated by the compiler as
1205  // instance (not class) messages. We will statically dispatch to those.
1206  if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1207  // For [self classMethod], return the compiler visible declaration.
1208  if (PT->getObjectType()->isObjCClass() &&
1209  Receiver == getSelfSVal().getAsRegion())
1210  return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1211 
1212  // Similarly, handle [[self class] classMethod].
1213  // TODO: We are currently doing a syntactic match for this pattern with is
1214  // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1215  // shows. A better way would be to associate the meta type with the symbol
1216  // using the dynamic type info tracking and use it here. We can add a new
1217  // SVal for ObjC 'Class' values that know what interface declaration they
1218  // come from. Then 'self' in a class method would be filled in with
1219  // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1220  // do proper dynamic dispatch for class methods just like we do for
1221  // instance methods now.
1222  if (E->getInstanceReceiver())
1223  if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1224  if (isCallToSelfClass(M))
1225  return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1226  }
1227 
1228  // Lookup the instance method implementation.
1229  if (ReceiverT)
1230  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1231  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1232  // when in many cases it returns null. We cache the results so
1233  // that repeated queries on the same ObjCIntefaceDecl and Selector
1234  // don't incur the same cost. On some test cases, we can see the
1235  // same query being issued thousands of times.
1236  //
1237  // NOTE: This cache is essentially a "global" variable, but it
1238  // only gets lazily created when we get here. The value of the
1239  // cache probably comes from it being global across ExprEngines,
1240  // where the same queries may get issued. If we are worried about
1241  // concurrency, or possibly loading/unloading ASTs, etc., we may
1242  // need to revisit this someday. In terms of memory, this table
1243  // stays around until clang quits, which also may be bad if we
1244  // need to release memory.
1245  using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1246  using PrivateMethodCache =
1247  llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1248 
1249  static PrivateMethodCache PMC;
1250  Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1251 
1252  // Query lookupPrivateMethod() if the cache does not hit.
1253  if (!Val.hasValue()) {
1254  Val = IDecl->lookupPrivateMethod(Sel);
1255 
1256  // If the method is a property accessor, we should try to "inline" it
1257  // even if we don't actually have an implementation.
1258  if (!*Val)
1259  if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1260  if (CompileTimeMD->isPropertyAccessor()) {
1261  if (!CompileTimeMD->getSelfDecl() &&
1262  isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1263  // If the method is an accessor in a category, and it doesn't
1264  // have a self declaration, first
1265  // try to find the method in a class extension. This
1266  // works around a bug in Sema where multiple accessors
1267  // are synthesized for properties in class
1268  // extensions that are redeclared in a category and the
1269  // the implicit parameters are not filled in for
1270  // the method on the category.
1271  // This ensures we find the accessor in the extension, which
1272  // has the implicit parameters filled in.
1273  auto *ID = CompileTimeMD->getClassInterface();
1274  for (auto *CatDecl : ID->visible_extensions()) {
1275  Val = CatDecl->getMethod(Sel,
1276  CompileTimeMD->isInstanceMethod());
1277  if (*Val)
1278  break;
1279  }
1280  }
1281  if (!*Val)
1282  Val = IDecl->lookupInstanceMethod(Sel);
1283  }
1284  }
1285 
1286  const ObjCMethodDecl *MD = Val.getValue();
1287  if (CanBeSubClassed)
1288  return RuntimeDefinition(MD, Receiver);
1289  else
1290  return RuntimeDefinition(MD, nullptr);
1291  }
1292  } else {
1293  // This is a class method.
1294  // If we have type info for the receiver class, we are calling via
1295  // class name.
1296  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1297  // Find/Return the method implementation.
1298  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1299  }
1300  }
1301 
1302  return {};
1303 }
1304 
1306  if (isInSystemHeader() && !isInstanceMessage()) {
1307  Selector Sel = getSelector();
1308  if (Sel.getNumArgs() == 1 &&
1309  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1310  return true;
1311  }
1312 
1314 }
1315 
1317  const StackFrameContext *CalleeCtx,
1318  BindingsTy &Bindings) const {
1319  const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1320  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1321  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1322  D->parameters());
1323 
1324  SVal SelfVal = getReceiverSVal();
1325  if (!SelfVal.isUnknown()) {
1326  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1327  MemRegionManager &MRMgr = SVB.getRegionManager();
1328  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1329  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1330  }
1331 }
1332 
1333 CallEventRef<>
1335  const LocationContext *LCtx) {
1336  if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1337  return create<CXXMemberCall>(MCE, State, LCtx);
1338 
1339  if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1340  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1341  if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1342  if (MD->isInstance())
1343  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1344 
1345  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1346  return create<BlockCall>(CE, State, LCtx);
1347  }
1348 
1349  // Otherwise, it's a normal function call, static member function call, or
1350  // something we can't reason about.
1351  return create<SimpleFunctionCall>(CE, State, LCtx);
1352 }
1353 
1354 CallEventRef<>
1356  ProgramStateRef State) {
1357  const LocationContext *ParentCtx = CalleeCtx->getParent();
1358  const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1359  assert(CallerCtx && "This should not be used for top-level stack frames");
1360 
1361  const Stmt *CallSite = CalleeCtx->getCallSite();
1362 
1363  if (CallSite) {
1364  if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
1365  return getSimpleCall(CE, State, CallerCtx);
1366 
1367  switch (CallSite->getStmtClass()) {
1368  case Stmt::CXXConstructExprClass:
1369  case Stmt::CXXTemporaryObjectExprClass: {
1370  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1371  const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1372  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1373  SVal ThisVal = State->getSVal(ThisPtr);
1374 
1375  return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1376  ThisVal.getAsRegion(), State, CallerCtx);
1377  }
1378  case Stmt::CXXNewExprClass:
1379  return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
1380  case Stmt::ObjCMessageExprClass:
1381  return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
1382  State, CallerCtx);
1383  default:
1384  llvm_unreachable("This is not an inlineable statement.");
1385  }
1386  }
1387 
1388  // Fall back to the CFG. The only thing we haven't handled yet is
1389  // destructors, though this could change in the future.
1390  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1391  CFGElement E = (*B)[CalleeCtx->getIndex()];
1392  assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1393  "All other CFG elements should have exprs");
1394 
1395  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1396  const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1397  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1398  SVal ThisVal = State->getSVal(ThisPtr);
1399 
1400  const Stmt *Trigger;
1402  Trigger = AutoDtor->getTriggerStmt();
1403  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1404  Trigger = DeleteDtor->getDeleteExpr();
1405  else
1406  Trigger = Dtor->getBody();
1407 
1408  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1409  E.getAs<CFGBaseDtor>().hasValue(), State,
1410  CallerCtx);
1411 }
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1061
Defines the clang::ASTContext interface.
SVal getSelfSVal() const
Return the value of &#39;self&#39; if available.
Definition: CallEvent.cpp:944
const VarRegion * getParameterLocation(unsigned Index) const
Returns memory location for a parameter variable within the callee stack frame.
Definition: CallEvent.cpp:224
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:952
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:872
Represents a function declaration or definition.
Definition: Decl.h:1717
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:5140
Smart pointer class that efficiently represents Objective-C method names.
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2511
A (possibly-)qualified type.
Definition: Type.h:642
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6185
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:578
Selector getSelector() const
Definition: ExprObjC.cpp:312
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1144
Stmt * getBody() const
Get the body of the Declaration.
const SymExpr * SymbolRef
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:1001
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1438
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:339
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:3329
static bool isCallToSelfClass(const ObjCMessageExpr *ME)
Definition: CallEvent.cpp:1145
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:497
C Language Family Type Representation.
Defines the SourceManager interface.
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:333
AnalysisDeclContext * getCalleeAnalysisDeclContext() const
Returns AnalysisDeclContext for the callee stack frame.
Definition: CallEvent.cpp:170
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:86
const RecordType * getAsStructureType() const
Definition: Type.cpp:513
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
Represents C++ object destructor generated from a call to delete.
Definition: CFG.h:409
SourceRange getSourceRange() const override
Definition: CallEvent.cpp:981
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:557
A container of type source information.
Definition: Decl.h:86
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1334
virtual RuntimeDefinition getRuntimeDefinition() const =0
Returns the definition of the function or method that will be called.
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:762
Expr * ignoreParenBaseCasts() LLVM_READONLY
Ignore parentheses and derived-to-base casts.
Definition: Expr.cpp:2614
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:442
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:266
Represents a variable declaration or definition.
Definition: Decl.h:812
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6590
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1574
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:226
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:139
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:121
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:818
ArrayRef< ParmVarDecl * > parameters() const override
Return call&#39;s formal parameters.
Definition: CallEvent.cpp:517
Represents a parameter to a function.
Definition: Decl.h:1536
Defines the clang::Expr interface and subclasses for C++ expressions.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:836
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:269
Represents a struct/union/class.
Definition: Decl.h:3570
One of these records is kept for each identifier that is lexed.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:806
param_type_iterator param_type_end() const
Definition: CallEvent.h:493
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
field_range fields() const
Definition: Decl.h:3761
AnalysisDeclContext contains the context data for the function or method under analysis.
StringRef getCTUDir()
Returns the directory containing the CTU related files.
Represents C++ object destructor implicitly generated for automatic object or temporary bound to cons...
Definition: CFG.h:384
bool isReferenceType() const
Definition: Type.h:6189
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:316
bool isObjCSelType() const
Definition: Type.h:6315
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:110
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2231
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl *> parameters)
Definition: CallEvent.cpp:487
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:966
virtual Kind getKind() const =0
Returns the kind of call this is.
const ImplicitParamDecl * getSelfDecl() const
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:154
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
An x-value expression is a reference to an object with independent storage but which can be "moved"...
Definition: Specifiers.h:119
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:404
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:274
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:663
const LocationContext * getParent() const
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection...
Definition: CallEvent.cpp:260
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:1132
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:412
unsigned size() const
Definition: CFG.h:713
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:517
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call&#39;s formal parameters.
Definition: CallEvent.h:489
Represents an ObjC class declaration.
Definition: DeclObjC.h:1164
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:474
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:875
virtual ArrayRef< ParmVarDecl * > parameters() const =0
Return call&#39;s formal parameters.
const CFGBlock * getCallSiteBlock() const
SmallVectorImpl< FrameBindingTy > BindingsTy
Definition: CallEvent.h:395
const StackFrameContext * getStackFrame(AnalysisDeclContext *Ctx, LocationContext const *Parent, const Stmt *S, const CFGBlock *Blk, unsigned Idx)
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:802
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:957
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to &#39;self&#39; or &#39;super&#39;.
Definition: CallEvent.cpp:968
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1605
const Stmt * getCallSite() const
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:912
Represents a single basic block in a source-level CFG.
Definition: CFG.h:552
bool argumentsMayEscape() const override
Definition: CallEvent.cpp:1305
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:829
AnalysisDeclContext * getContext(const Decl *D)
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:256
static bool isCallback(QualType T)
Definition: CallEvent.cpp:97
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3835
This represents one expression.
Definition: Expr.h:105
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:1316
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:639
CFGBlock * getBlock(Stmt *S)
Returns the CFGBlock the specified Stmt* appears in.
Definition: CFGStmtMap.cpp:27
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Definition: CallEvent.cpp:1355
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:482
const Expr * getCallee() const
Definition: Expr.h:2325
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:278
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
DeclContext * getDeclContext()
Definition: DeclBase.h:426
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:338
virtual SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:690
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:376
StringRef getFunctionName() const
Get the name of the function that this object matches.
Definition: CallEvent.h:117
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:843
bool hasBody(const FunctionDecl *&Definition) const
Returns true if the function has a body.
Definition: Decl.cpp:2674
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
QualType getType() const
Definition: Expr.h:127
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:246
DeclContext * getParent()
getParent - Returns the containing DeclContext.
Definition: DeclBase.h:1764
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:904
virtual cross_tu::CrossTranslationUnitContext * getCrossTranslationUnitContext()=0
QualType getRecordType(const RecordDecl *Decl) const
unsigned getNumArgs() const
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:919
Represents C++ object destructor implicitly generated for base object in destructor.
Definition: CFG.h:435
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:707
ParentMap & getParentMap() const
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:347
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:701
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:6012
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:307
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee&#39;s stack frame at the start of this ca...
Definition: CallEvent.cpp:569
const ImplicitParamDecl * getSelfDecl() const
Return the ImplicitParamDecl* associated with &#39;self&#39; if this AnalysisDeclContext wraps an ObjCMethodD...
Defines the runtime definition of the called function.
Definition: CallEvent.h:145
QualType getCanonicalType() const
Definition: Type.h:5992
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:5096
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:78
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:659
Encodes a location in the source.
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:647
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:439
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
const MemRegion * getAsRegion() const
Definition: SVals.cpp:151
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:445
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2043
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
CanQualType VoidTy
Definition: ASTContext.h:1025
const StackFrameContext * getStackFrame() const
Definition: MemRegion.cpp:158
const Decl * getDecl() const
bool isAnyPointerType() const
Definition: Type.h:6181
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:456
bool naiveCTUEnabled()
Returns true when naive cross translation unit analysis is enabled.
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:721
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:903
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1303
Tells that a region&#39;s contents is not changed.
Definition: MemRegion.h:1453
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:234
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:110
Defines various enumerations that describe declaration and type specifiers.
StringRef getName() const
Return the actual identifier string.
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1207
static const unsigned NoArgRequirement
Definition: CallEvent.h:89
llvm::Expected< const FunctionDecl * > getCrossTUDefinition(const FunctionDecl *FD, StringRef CrossTUDir, StringRef IndexName)
This function loads a function definition from an external AST file and merge it into the original AS...
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:946
SVal getCXXThisVal() const
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:866
Dataflow Directional Tag Classes.
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:1078
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:822
AnalysisDeclContextManager * getManager() const
Return the AnalysisDeclContextManager (if any) that created this AnalysisDeclContext.
bool isValid() const
Return true if this is a valid SourceLocation object.
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:405
DeclContext - This is used only as base class of specific decl types that can act as declaration cont...
Definition: DeclBase.h:1267
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:574
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg)
Get dynamic type information for a region.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:1164
QualType getSuperType() const
Retrieve the type referred to by &#39;super&#39;.
Definition: ExprObjC.h:1283
StmtClass getStmtClass() const
Definition: Stmt.h:391
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:158
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2163
bool mayHaveOtherDefinitions()
Check if the definition we have is precise.
Definition: CallEvent.h:166
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:1012
This class is used for tools that requires cross translation unit capability.
const Decl * getDecl() const
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
Definition: Expr.cpp:2631
Represents a pointer to an Objective C object.
Definition: Type.h:5675
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:63
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4253
StringRef getCTUIndexName()
Returns the name of the file containing the CTU index of functions.
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5731
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:496
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:445
const StackFrameContext * getStackFrame() const
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:162
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class, its categories, and its super classes (using a linear search).
Definition: DeclObjC.cpp:683
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:70
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1358
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method&#39;s selector.
Definition: DeclObjC.cpp:1302
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:131
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:251
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
bool isVoidType() const
Definition: Type.h:6404
SVal getCXXThisVal() const override
Returns the value of the implicit &#39;this&#39; object.
Definition: CallEvent.cpp:897
Represents C++ object destructor implicitly generated by compiler on various occasions.
Definition: CFG.h:359
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:356
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1937
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
Represents a top-level expression in a basic block.
Definition: CFG.h:56
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:992
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:268
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2285
void emitCrossTUDiagnostics(const IndexError &IE)
Emit diagnostics for the user for potential configuration errors.
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:275
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:1056
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:134
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:285
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:2056
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:971
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:3913
bool isPointerType() const
Definition: Type.h:6177
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:398
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:114
const void * Data
Definition: CallEvent.h:193
A trivial tuple used to represent a source range.
bool isPropertyAccessor() const
Definition: DeclObjC.h:424
AnalysisDeclContext * getAnalysisDeclContext() const
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1870
bool isFunctionPointerType() const
Definition: Type.h:6201
The receiver is a superclass.
Definition: ExprObjC.h:1058
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1195
SourceLocation getBegin() const
Represents C++ object destructor implicitly generated at the end of full expression for temporary obj...
Definition: CFG.h:477
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.cpp:524
SourceLocation getLocation() const
Definition: DeclBase.h:417
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:367
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:883
const StackFrameContext * getCalleeStackFrame() const
Returns the callee stack frame.
Definition: CallEvent.cpp:195
virtual AnalysisManager & getAnalysisManager()=0