clang  9.0.0svn
CallEvent.h
Go to the documentation of this file.
1 //===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
17 
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/Stmt.h"
26 #include "clang/AST/Type.h"
28 #include "clang/Basic/LLVM.h"
35 #include "llvm/ADT/ArrayRef.h"
36 #include "llvm/ADT/IntrusiveRefCntPtr.h"
37 #include "llvm/ADT/PointerIntPair.h"
38 #include "llvm/ADT/PointerUnion.h"
39 #include "llvm/ADT/STLExtras.h"
40 #include "llvm/ADT/SmallVector.h"
41 #include "llvm/ADT/StringRef.h"
42 #include "llvm/Support/Allocator.h"
43 #include "llvm/Support/Casting.h"
44 #include "llvm/Support/ErrorHandling.h"
45 #include <cassert>
46 #include <limits>
47 #include <utility>
48 
49 namespace clang {
50 
51 class LocationContext;
52 class ProgramPoint;
53 class ProgramPointTag;
54 class StackFrameContext;
55 
56 namespace ento {
57 
71 };
72 
73 class CallEvent;
74 class CallDescription;
75 
76 template<typename T = CallEvent>
77 class CallEventRef : public IntrusiveRefCntPtr<const T> {
78 public:
79  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
80  CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
81 
83  return this->get()->template cloneWithState<T>(State);
84  }
85 
86  // Allow implicit conversions to a superclass type, since CallEventRef
87  // behaves like a pointer-to-const.
88  template <typename SuperT>
89  operator CallEventRef<SuperT> () const {
90  return this->get();
91  }
92 };
93 
94 /// \class RuntimeDefinition
95 /// Defines the runtime definition of the called function.
96 ///
97 /// Encapsulates the information we have about which Decl will be used
98 /// when the call is executed on the given path. When dealing with dynamic
99 /// dispatch, the information is based on DynamicTypeInfo and might not be
100 /// precise.
102  /// The Declaration of the function which could be called at runtime.
103  /// NULL if not available.
104  const Decl *D = nullptr;
105 
106  /// The region representing an object (ObjC/C++) on which the method is
107  /// called. With dynamic dispatch, the method definition depends on the
108  /// runtime type of this object. NULL when the DynamicTypeInfo is
109  /// precise.
110  const MemRegion *R = nullptr;
111 
112 public:
113  RuntimeDefinition() = default;
114  RuntimeDefinition(const Decl *InD): D(InD) {}
115  RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
116 
117  const Decl *getDecl() { return D; }
118 
119  /// Check if the definition we have is precise.
120  /// If not, it is possible that the call dispatches to another definition at
121  /// execution time.
122  bool mayHaveOtherDefinitions() { return R != nullptr; }
123 
124  /// When other definitions are possible, returns the region whose runtime type
125  /// determines the method definition.
126  const MemRegion *getDispatchRegion() { return R; }
127 };
128 
129 /// Represents an abstract call to a function or method along a
130 /// particular path.
131 ///
132 /// CallEvents are created through the factory methods of CallEventManager.
133 ///
134 /// CallEvents should always be cheap to create and destroy. In order for
135 /// CallEventManager to be able to re-use CallEvent-sized memory blocks,
136 /// subclasses of CallEvent may not add any data members to the base class.
137 /// Use the "Data" and "Location" fields instead.
138 class CallEvent {
139 public:
141 
142 private:
144  const LocationContext *LCtx;
145  llvm::PointerUnion<const Expr *, const Decl *> Origin;
146 
147 protected:
148  // This is user data for subclasses.
149  const void *Data;
150 
151  // This is user data for subclasses.
152  // This should come right before RefCount, so that the two fields can be
153  // packed together on LP64 platforms.
155 
156 private:
157  template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
158 
159  mutable unsigned RefCount = 0;
160 
161  void Retain() const { ++RefCount; }
162  void Release() const;
163 
164 protected:
165  friend class CallEventManager;
166 
168  : State(std::move(state)), LCtx(lctx), Origin(E) {}
169 
171  : State(std::move(state)), LCtx(lctx), Origin(D) {}
172 
173  // DO NOT MAKE PUBLIC
174  CallEvent(const CallEvent &Original)
175  : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
176  Data(Original.Data), Location(Original.Location) {}
177 
178  /// Copies this CallEvent, with vtable intact, into a new block of memory.
179  virtual void cloneTo(void *Dest) const = 0;
180 
181  /// Get the value of arbitrary expressions at this point in the path.
182  SVal getSVal(const Stmt *S) const {
183  return getState()->getSVal(S, getLocationContext());
184  }
185 
187 
188  /// Used to specify non-argument regions that will be invalidated as a
189  /// result of this call.
190  virtual void getExtraInvalidatedValues(ValueList &Values,
191  RegionAndSymbolInvalidationTraits *ETraits) const {}
192 
193 public:
194  CallEvent &operator=(const CallEvent &) = delete;
195  virtual ~CallEvent() = default;
196 
197  /// Returns the kind of call this is.
198  virtual Kind getKind() const = 0;
199 
200  /// Returns the declaration of the function or method that will be
201  /// called. May be null.
202  virtual const Decl *getDecl() const {
203  return Origin.dyn_cast<const Decl *>();
204  }
205 
206  /// The state in which the call is being evaluated.
207  const ProgramStateRef &getState() const {
208  return State;
209  }
210 
211  /// The context in which the call is being evaluated.
213  return LCtx;
214  }
215 
216  /// Returns the definition of the function or method that will be
217  /// called.
218  virtual RuntimeDefinition getRuntimeDefinition() const = 0;
219 
220  /// Returns the expression whose value will be the result of this call.
221  /// May be null.
222  const Expr *getOriginExpr() const {
223  return Origin.dyn_cast<const Expr *>();
224  }
225 
226  /// Returns the number of arguments (explicit and implicit).
227  ///
228  /// Note that this may be greater than the number of parameters in the
229  /// callee's declaration, and that it may include arguments not written in
230  /// the source.
231  virtual unsigned getNumArgs() const = 0;
232 
233  /// Returns true if the callee is known to be from a system header.
234  bool isInSystemHeader() const {
235  const Decl *D = getDecl();
236  if (!D)
237  return false;
238 
240  if (Loc.isValid()) {
241  const SourceManager &SM =
242  getState()->getStateManager().getContext().getSourceManager();
243  return SM.isInSystemHeader(D->getLocation());
244  }
245 
246  // Special case for implicitly-declared global operator new/delete.
247  // These should be considered system functions.
248  if (const auto *FD = dyn_cast<FunctionDecl>(D))
249  return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal();
250 
251  return false;
252  }
253 
254  /// Returns true if the CallEvent is a call to a function that matches
255  /// the CallDescription.
256  ///
257  /// Note that this function is not intended to be used to match Obj-C method
258  /// calls.
259  bool isCalled(const CallDescription &CD) const;
260 
261  /// Returns a source range for the entire call, suitable for
262  /// outputting in diagnostics.
263  virtual SourceRange getSourceRange() const {
264  return getOriginExpr()->getSourceRange();
265  }
266 
267  /// Returns the value of a given argument at the time of the call.
268  virtual SVal getArgSVal(unsigned Index) const;
269 
270  /// Returns the expression associated with a given argument.
271  /// May be null if this expression does not appear in the source.
272  virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }
273 
274  /// Returns the source range for errors associated with this argument.
275  ///
276  /// May be invalid if the argument is not written in the source.
277  virtual SourceRange getArgSourceRange(unsigned Index) const;
278 
279  /// Returns the result type, adjusted for references.
280  QualType getResultType() const;
281 
282  /// Returns the return value of the call.
283  ///
284  /// This should only be called if the CallEvent was created using a state in
285  /// which the return value has already been bound to the origin expression.
286  SVal getReturnValue() const;
287 
288  /// Returns true if the type of any of the non-null arguments satisfies
289  /// the condition.
290  bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;
291 
292  /// Returns true if any of the arguments appear to represent callbacks.
293  bool hasNonZeroCallbackArg() const;
294 
295  /// Returns true if any of the arguments is void*.
296  bool hasVoidPointerToNonConstArg() const;
297 
298  /// Returns true if any of the arguments are known to escape to long-
299  /// term storage, even if this method will not modify them.
300  // NOTE: The exact semantics of this are still being defined!
301  // We don't really want a list of hardcoded exceptions in the long run,
302  // but we don't want duplicated lists of known APIs in the short term either.
303  virtual bool argumentsMayEscape() const {
304  return hasNonZeroCallbackArg();
305  }
306 
307  /// Returns true if the callee is an externally-visible function in the
308  /// top-level namespace, such as \c malloc.
309  ///
310  /// You can use this call to determine that a particular function really is
311  /// a library function and not, say, a C++ member function with the same name.
312  ///
313  /// If a name is provided, the function must additionally match the given
314  /// name.
315  ///
316  /// Note that this deliberately excludes C++ library functions in the \c std
317  /// namespace, but will include C library functions accessed through the
318  /// \c std namespace. This also does not check if the function is declared
319  /// as 'extern "C"', or if it uses C++ name mangling.
320  // FIXME: Add a helper for checking namespaces.
321  // FIXME: Move this down to AnyFunctionCall once checkers have more
322  // precise callbacks.
323  bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
324 
325  /// Returns the name of the callee, if its name is a simple identifier.
326  ///
327  /// Note that this will fail for Objective-C methods, blocks, and C++
328  /// overloaded operators. The former is named by a Selector rather than a
329  /// simple identifier, and the latter two do not have names.
330  // FIXME: Move this down to AnyFunctionCall once checkers have more
331  // precise callbacks.
333  const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
334  if (!ND)
335  return nullptr;
336  return ND->getIdentifier();
337  }
338 
339  /// Returns an appropriate ProgramPoint for this call.
340  ProgramPoint getProgramPoint(bool IsPreVisit = false,
341  const ProgramPointTag *Tag = nullptr) const;
342 
343  /// Returns a new state with all argument regions invalidated.
344  ///
345  /// This accepts an alternate state in case some processing has already
346  /// occurred.
347  ProgramStateRef invalidateRegions(unsigned BlockCount,
348  ProgramStateRef Orig = nullptr) const;
349 
350  using FrameBindingTy = std::pair<Loc, SVal>;
352 
353  /// Populates the given SmallVector with the bindings in the callee's stack
354  /// frame at the start of this call.
355  virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
356  BindingsTy &Bindings) const = 0;
357 
358  /// Returns a copy of this CallEvent, but using the given state.
359  template <typename T>
361 
362  /// Returns a copy of this CallEvent, but using the given state.
364  return cloneWithState<CallEvent>(NewState);
365  }
366 
367  /// Returns true if this is a statement is a function or method call
368  /// of some kind.
369  static bool isCallStmt(const Stmt *S);
370 
371  /// Returns the result type of a function or method declaration.
372  ///
373  /// This will return a null QualType if the result type cannot be determined.
374  static QualType getDeclaredResultType(const Decl *D);
375 
376  /// Returns true if the given decl is known to be variadic.
377  ///
378  /// \p D must not be null.
379  static bool isVariadic(const Decl *D);
380 
381  /// Returns AnalysisDeclContext for the callee stack frame.
382  /// Currently may fail; returns null on failure.
383  AnalysisDeclContext *getCalleeAnalysisDeclContext() const;
384 
385  /// Returns the callee stack frame. That stack frame will only be entered
386  /// during analysis if the call is inlined, but it may still be useful
387  /// in intermediate calculations even if the call isn't inlined.
388  /// May fail; returns null on failure.
389  const StackFrameContext *getCalleeStackFrame() const;
390 
391  /// Returns memory location for a parameter variable within the callee stack
392  /// frame. May fail; returns null on failure.
393  const VarRegion *getParameterLocation(unsigned Index) const;
394 
395  /// Returns true if on the current path, the argument was constructed by
396  /// calling a C++ constructor over it. This is an internal detail of the
397  /// analysis which doesn't necessarily represent the program semantics:
398  /// if we are supposed to construct an argument directly, we may still
399  /// not do that because we don't know how (i.e., construction context is
400  /// unavailable in the CFG or not supported by the analyzer).
401  bool isArgumentConstructedDirectly(unsigned Index) const {
402  // This assumes that the object was not yet removed from the state.
404  getState(), {getOriginExpr(), Index}, getLocationContext()).hasValue();
405  }
406 
407  /// Some calls have parameter numbering mismatched from argument numbering.
408  /// This function converts an argument index to the corresponding
409  /// parameter index. Returns None is the argument doesn't correspond
410  /// to any parameter variable.
411  virtual Optional<unsigned>
412  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const {
413  return ASTArgumentIndex;
414  }
415 
416  /// Some call event sub-classes conveniently adjust mismatching AST indices
417  /// to match parameter indices. This function converts an argument index
418  /// as understood by CallEvent to the argument index as understood by the AST.
419  virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const {
420  return CallArgumentIndex;
421  }
422 
423  // Iterator access to formal parameters and their types.
424 private:
425  struct GetTypeFn {
426  QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
427  };
428 
429 public:
430  /// Return call's formal parameters.
431  ///
432  /// Remember that the number of formal parameters may not match the number
433  /// of arguments for all calls. However, the first parameter will always
434  /// correspond with the argument value returned by \c getArgSVal(0).
435  virtual ArrayRef<ParmVarDecl *> parameters() const = 0;
436 
437  using param_type_iterator =
438  llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;
439 
440  /// Returns an iterator over the types of the call's formal parameters.
441  ///
442  /// This uses the callee decl found by default name lookup rather than the
443  /// definition because it represents a public interface, and probably has
444  /// more annotations.
446  return llvm::map_iterator(parameters().begin(), GetTypeFn());
447  }
448  /// \sa param_type_begin()
450  return llvm::map_iterator(parameters().end(), GetTypeFn());
451  }
452 
453  // For debugging purposes only
454  void dump(raw_ostream &Out) const;
455  void dump() const;
456 };
457 
458 /// Represents a call to any sort of function that might have a
459 /// FunctionDecl.
460 class AnyFunctionCall : public CallEvent {
461 protected:
463  const LocationContext *LCtx)
464  : CallEvent(E, St, LCtx) {}
466  const LocationContext *LCtx)
467  : CallEvent(D, St, LCtx) {}
468  AnyFunctionCall(const AnyFunctionCall &Other) = default;
469 
470 public:
471  // This function is overridden by subclasses, but they must return
472  // a FunctionDecl.
473  const FunctionDecl *getDecl() const override {
474  return cast<FunctionDecl>(CallEvent::getDecl());
475  }
476 
477  RuntimeDefinition getRuntimeDefinition() const override;
478 
479  bool argumentsMayEscape() const override;
480 
481  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
482  BindingsTy &Bindings) const override;
483 
484  ArrayRef<ParmVarDecl *> parameters() const override;
485 
486  static bool classof(const CallEvent *CA) {
487  return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
489  }
490 };
491 
492 /// Represents a C function or static C++ member function call.
493 ///
494 /// Example: \c fun()
496  friend class CallEventManager;
497 
498 protected:
500  const LocationContext *LCtx)
501  : AnyFunctionCall(CE, St, LCtx) {}
502  SimpleFunctionCall(const SimpleFunctionCall &Other) = default;
503 
504  void cloneTo(void *Dest) const override {
505  new (Dest) SimpleFunctionCall(*this);
506  }
507 
508 public:
509  virtual const CallExpr *getOriginExpr() const {
510  return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
511  }
512 
513  const FunctionDecl *getDecl() const override;
514 
515  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
516 
517  const Expr *getArgExpr(unsigned Index) const override {
518  return getOriginExpr()->getArg(Index);
519  }
520 
521  Kind getKind() const override { return CE_Function; }
522 
523  static bool classof(const CallEvent *CA) {
524  return CA->getKind() == CE_Function;
525  }
526 };
527 
528 /// Represents a call to a block.
529 ///
530 /// Example: <tt>^{ /* ... */ }()</tt>
531 class BlockCall : public CallEvent {
532  friend class CallEventManager;
533 
534 protected:
536  const LocationContext *LCtx)
537  : CallEvent(CE, St, LCtx) {}
538  BlockCall(const BlockCall &Other) = default;
539 
540  void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }
541 
542  void getExtraInvalidatedValues(ValueList &Values,
543  RegionAndSymbolInvalidationTraits *ETraits) const override;
544 
545 public:
546  virtual const CallExpr *getOriginExpr() const {
547  return cast<CallExpr>(CallEvent::getOriginExpr());
548  }
549 
550  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
551 
552  const Expr *getArgExpr(unsigned Index) const override {
553  return getOriginExpr()->getArg(Index);
554  }
555 
556  /// Returns the region associated with this instance of the block.
557  ///
558  /// This may be NULL if the block's origin is unknown.
559  const BlockDataRegion *getBlockRegion() const;
560 
561  const BlockDecl *getDecl() const override {
562  const BlockDataRegion *BR = getBlockRegion();
563  if (!BR)
564  return nullptr;
565  return BR->getDecl();
566  }
567 
568  bool isConversionFromLambda() const {
569  const BlockDecl *BD = getDecl();
570  if (!BD)
571  return false;
572 
573  return BD->isConversionFromLambda();
574  }
575 
576  /// For a block converted from a C++ lambda, returns the block
577  /// VarRegion for the variable holding the captured C++ lambda record.
578  const VarRegion *getRegionStoringCapturedLambda() const {
579  assert(isConversionFromLambda());
580  const BlockDataRegion *BR = getBlockRegion();
581  assert(BR && "Block converted from lambda must have a block region");
582 
583  auto I = BR->referenced_vars_begin();
584  assert(I != BR->referenced_vars_end());
585 
586  return I.getCapturedRegion();
587  }
588 
589  RuntimeDefinition getRuntimeDefinition() const override {
590  if (!isConversionFromLambda())
591  return RuntimeDefinition(getDecl());
592 
593  // Clang converts lambdas to blocks with an implicit user-defined
594  // conversion operator method on the lambda record that looks (roughly)
595  // like:
596  //
597  // typedef R(^block_type)(P1, P2, ...);
598  // operator block_type() const {
599  // auto Lambda = *this;
600  // return ^(P1 p1, P2 p2, ...){
601  // /* return Lambda(p1, p2, ...); */
602  // };
603  // }
604  //
605  // Here R is the return type of the lambda and P1, P2, ... are
606  // its parameter types. 'Lambda' is a fake VarDecl captured by the block
607  // that is initialized to a copy of the lambda.
608  //
609  // Sema leaves the body of a lambda-converted block empty (it is
610  // produced by CodeGen), so we can't analyze it directly. Instead, we skip
611  // the block body and analyze the operator() method on the captured lambda.
612  const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
613  const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
614  CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();
615 
616  return RuntimeDefinition(LambdaCallOperator);
617  }
618 
619  bool argumentsMayEscape() const override {
620  return true;
621  }
622 
623  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
624  BindingsTy &Bindings) const override;
625 
626  ArrayRef<ParmVarDecl*> parameters() const override;
627 
628  Kind getKind() const override { return CE_Block; }
629 
630  static bool classof(const CallEvent *CA) {
631  return CA->getKind() == CE_Block;
632  }
633 };
634 
635 /// Represents a non-static C++ member function call, no matter how
636 /// it is written.
638 protected:
640  const LocationContext *LCtx)
641  : AnyFunctionCall(CE, St, LCtx) {}
643  const LocationContext *LCtx)
644  : AnyFunctionCall(D, St, LCtx) {}
645  CXXInstanceCall(const CXXInstanceCall &Other) = default;
646 
647  void getExtraInvalidatedValues(ValueList &Values,
648  RegionAndSymbolInvalidationTraits *ETraits) const override;
649 
650 public:
651  /// Returns the expression representing the implicit 'this' object.
652  virtual const Expr *getCXXThisExpr() const { return nullptr; }
653 
654  /// Returns the value of the implicit 'this' object.
655  virtual SVal getCXXThisVal() const;
656 
657  const FunctionDecl *getDecl() const override;
658 
659  RuntimeDefinition getRuntimeDefinition() const override;
660 
661  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
662  BindingsTy &Bindings) const override;
663 
664  static bool classof(const CallEvent *CA) {
665  return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
666  CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
667  }
668 };
669 
670 /// Represents a non-static C++ member function call.
671 ///
672 /// Example: \c obj.fun()
674  friend class CallEventManager;
675 
676 protected:
678  const LocationContext *LCtx)
679  : CXXInstanceCall(CE, St, LCtx) {}
680  CXXMemberCall(const CXXMemberCall &Other) = default;
681 
682  void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }
683 
684 public:
685  virtual const CXXMemberCallExpr *getOriginExpr() const {
686  return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
687  }
688 
689  unsigned getNumArgs() const override {
690  if (const CallExpr *CE = getOriginExpr())
691  return CE->getNumArgs();
692  return 0;
693  }
694 
695  const Expr *getArgExpr(unsigned Index) const override {
696  return getOriginExpr()->getArg(Index);
697  }
698 
699  const Expr *getCXXThisExpr() const override;
700 
701  RuntimeDefinition getRuntimeDefinition() const override;
702 
703  Kind getKind() const override { return CE_CXXMember; }
704 
705  static bool classof(const CallEvent *CA) {
706  return CA->getKind() == CE_CXXMember;
707  }
708 };
709 
710 /// Represents a C++ overloaded operator call where the operator is
711 /// implemented as a non-static member function.
712 ///
713 /// Example: <tt>iter + 1</tt>
715  friend class CallEventManager;
716 
717 protected:
719  const LocationContext *LCtx)
720  : CXXInstanceCall(CE, St, LCtx) {}
721  CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;
722 
723  void cloneTo(void *Dest) const override {
724  new (Dest) CXXMemberOperatorCall(*this);
725  }
726 
727 public:
728  virtual const CXXOperatorCallExpr *getOriginExpr() const {
729  return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
730  }
731 
732  unsigned getNumArgs() const override {
733  return getOriginExpr()->getNumArgs() - 1;
734  }
735 
736  const Expr *getArgExpr(unsigned Index) const override {
737  return getOriginExpr()->getArg(Index + 1);
738  }
739 
740  const Expr *getCXXThisExpr() const override;
741 
742  Kind getKind() const override { return CE_CXXMemberOperator; }
743 
744  static bool classof(const CallEvent *CA) {
745  return CA->getKind() == CE_CXXMemberOperator;
746  }
747 
749  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override {
750  // For member operator calls argument 0 on the expression corresponds
751  // to implicit this-parameter on the declaration.
752  return (ASTArgumentIndex > 0) ? Optional<unsigned>(ASTArgumentIndex - 1)
753  : None;
754  }
755 
756  unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override {
757  // For member operator calls argument 0 on the expression corresponds
758  // to implicit this-parameter on the declaration.
759  return CallArgumentIndex + 1;
760  }
761 };
762 
763 /// Represents an implicit call to a C++ destructor.
764 ///
765 /// This can occur at the end of a scope (for automatic objects), at the end
766 /// of a full-expression (for temporaries), or as part of a delete.
768  friend class CallEventManager;
769 
770 protected:
771  using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;
772 
773  /// Creates an implicit destructor.
774  ///
775  /// \param DD The destructor that will be called.
776  /// \param Trigger The statement whose completion causes this destructor call.
777  /// \param Target The object region to be destructed.
778  /// \param St The path-sensitive state at this point in the program.
779  /// \param LCtx The location context at this point in the program.
780  CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
781  const MemRegion *Target, bool IsBaseDestructor,
782  ProgramStateRef St, const LocationContext *LCtx)
783  : CXXInstanceCall(DD, St, LCtx) {
784  Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
785  Location = Trigger->getEndLoc();
786  }
787 
788  CXXDestructorCall(const CXXDestructorCall &Other) = default;
789 
790  void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}
791 
792 public:
793  SourceRange getSourceRange() const override { return Location; }
794  unsigned getNumArgs() const override { return 0; }
795 
796  RuntimeDefinition getRuntimeDefinition() const override;
797 
798  /// Returns the value of the implicit 'this' object.
799  SVal getCXXThisVal() const override;
800 
801  /// Returns true if this is a call to a base class destructor.
802  bool isBaseDestructor() const {
803  return DtorDataTy::getFromOpaqueValue(Data).getInt();
804  }
805 
806  Kind getKind() const override { return CE_CXXDestructor; }
807 
808  static bool classof(const CallEvent *CA) {
809  return CA->getKind() == CE_CXXDestructor;
810  }
811 };
812 
813 /// Represents a call to a C++ constructor.
814 ///
815 /// Example: \c T(1)
817  friend class CallEventManager;
818 
819 protected:
820  /// Creates a constructor call.
821  ///
822  /// \param CE The constructor expression as written in the source.
823  /// \param Target The region where the object should be constructed. If NULL,
824  /// a new symbolic region will be used.
825  /// \param St The path-sensitive state at this point in the program.
826  /// \param LCtx The location context at this point in the program.
827  CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
828  ProgramStateRef St, const LocationContext *LCtx)
829  : AnyFunctionCall(CE, St, LCtx) {
830  Data = Target;
831  }
832 
833  CXXConstructorCall(const CXXConstructorCall &Other) = default;
834 
835  void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }
836 
837  void getExtraInvalidatedValues(ValueList &Values,
838  RegionAndSymbolInvalidationTraits *ETraits) const override;
839 
840 public:
841  virtual const CXXConstructExpr *getOriginExpr() const {
842  return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
843  }
844 
845  const CXXConstructorDecl *getDecl() const override {
846  return getOriginExpr()->getConstructor();
847  }
848 
849  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
850 
851  const Expr *getArgExpr(unsigned Index) const override {
852  return getOriginExpr()->getArg(Index);
853  }
854 
855  /// Returns the value of the implicit 'this' object.
856  SVal getCXXThisVal() const;
857 
858  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
859  BindingsTy &Bindings) const override;
860 
861  Kind getKind() const override { return CE_CXXConstructor; }
862 
863  static bool classof(const CallEvent *CA) {
864  return CA->getKind() == CE_CXXConstructor;
865  }
866 };
867 
868 /// Represents the memory allocation call in a C++ new-expression.
869 ///
870 /// This is a call to "operator new".
872  friend class CallEventManager;
873 
874 protected:
876  const LocationContext *LCtx)
877  : AnyFunctionCall(E, St, LCtx) {}
878  CXXAllocatorCall(const CXXAllocatorCall &Other) = default;
879 
880  void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }
881 
882 public:
883  virtual const CXXNewExpr *getOriginExpr() const {
884  return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
885  }
886 
887  const FunctionDecl *getDecl() const override {
888  return getOriginExpr()->getOperatorNew();
889  }
890 
891  /// Number of non-placement arguments to the call. It is equal to 2 for
892  /// C++17 aligned operator new() calls that have alignment implicitly
893  /// passed as the second argument, and to 1 for other operator new() calls.
894  unsigned getNumImplicitArgs() const {
895  return getOriginExpr()->passAlignment() ? 2 : 1;
896  }
897 
898  unsigned getNumArgs() const override {
899  return getOriginExpr()->getNumPlacementArgs() + getNumImplicitArgs();
900  }
901 
902  const Expr *getArgExpr(unsigned Index) const override {
903  // The first argument of an allocator call is the size of the allocation.
904  if (Index < getNumImplicitArgs())
905  return nullptr;
906  return getOriginExpr()->getPlacementArg(Index - getNumImplicitArgs());
907  }
908 
909  /// Number of placement arguments to the operator new() call. For example,
910  /// standard std::nothrow operator new and standard placement new both have
911  /// 1 implicit argument (size) and 1 placement argument, while regular
912  /// operator new() has 1 implicit argument and 0 placement arguments.
913  const Expr *getPlacementArgExpr(unsigned Index) const {
914  return getOriginExpr()->getPlacementArg(Index);
915  }
916 
917  Kind getKind() const override { return CE_CXXAllocator; }
918 
919  static bool classof(const CallEvent *CE) {
920  return CE->getKind() == CE_CXXAllocator;
921  }
922 };
923 
924 /// Represents the ways an Objective-C message send can occur.
925 //
926 // Note to maintainers: OCM_Message should always be last, since it does not
927 // need to fit in the Data field's low bits.
932 };
933 
934 /// Represents any expression that calls an Objective-C method.
935 ///
936 /// This includes all of the kinds listed in ObjCMessageKind.
937 class ObjCMethodCall : public CallEvent {
938  friend class CallEventManager;
939 
940  const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
941 
942 protected:
944  const LocationContext *LCtx)
945  : CallEvent(Msg, St, LCtx) {
946  Data = nullptr;
947  }
948 
949  ObjCMethodCall(const ObjCMethodCall &Other) = default;
950 
951  void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }
952 
953  void getExtraInvalidatedValues(ValueList &Values,
954  RegionAndSymbolInvalidationTraits *ETraits) const override;
955 
956  /// Check if the selector may have multiple definitions (may have overrides).
957  virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
958  Selector Sel) const;
959 
960 public:
961  virtual const ObjCMessageExpr *getOriginExpr() const {
962  return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
963  }
964 
965  const ObjCMethodDecl *getDecl() const override {
966  return getOriginExpr()->getMethodDecl();
967  }
968 
969  unsigned getNumArgs() const override {
970  return getOriginExpr()->getNumArgs();
971  }
972 
973  const Expr *getArgExpr(unsigned Index) const override {
974  return getOriginExpr()->getArg(Index);
975  }
976 
977  bool isInstanceMessage() const {
978  return getOriginExpr()->isInstanceMessage();
979  }
980 
982  return getOriginExpr()->getMethodFamily();
983  }
984 
986  return getOriginExpr()->getSelector();
987  }
988 
989  SourceRange getSourceRange() const override;
990 
991  /// Returns the value of the receiver at the time of this call.
992  SVal getReceiverSVal() const;
993 
994  /// Return the value of 'self' if available.
995  SVal getSelfSVal() const;
996 
997  /// Get the interface for the receiver.
998  ///
999  /// This works whether this is an instance message or a class message.
1000  /// However, it currently just uses the static type of the receiver.
1002  return getOriginExpr()->getReceiverInterface();
1003  }
1004 
1005  /// Checks if the receiver refers to 'self' or 'super'.
1006  bool isReceiverSelfOrSuper() const;
1007 
1008  /// Returns how the message was written in the source (property access,
1009  /// subscript, or explicit message send).
1010  ObjCMessageKind getMessageKind() const;
1011 
1012  /// Returns true if this property access or subscript is a setter (has the
1013  /// form of an assignment).
1014  bool isSetter() const {
1015  switch (getMessageKind()) {
1016  case OCM_Message:
1017  llvm_unreachable("This is not a pseudo-object access!");
1018  case OCM_PropertyAccess:
1019  return getNumArgs() > 0;
1020  case OCM_Subscript:
1021  return getNumArgs() > 1;
1022  }
1023  llvm_unreachable("Unknown message kind");
1024  }
1025 
1026  // Returns the property accessed by this method, either explicitly via
1027  // property syntax or implicitly via a getter or setter method. Returns
1028  // nullptr if the call is not a prooperty access.
1029  const ObjCPropertyDecl *getAccessedProperty() const;
1030 
1031  RuntimeDefinition getRuntimeDefinition() const override;
1032 
1033  bool argumentsMayEscape() const override;
1034 
1035  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
1036  BindingsTy &Bindings) const override;
1037 
1038  ArrayRef<ParmVarDecl*> parameters() const override;
1039 
1040  Kind getKind() const override { return CE_ObjCMessage; }
1041 
1042  static bool classof(const CallEvent *CA) {
1043  return CA->getKind() == CE_ObjCMessage;
1044  }
1045 };
1046 
1048  /// Describes a C standard function that is sometimes implemented as a macro
1049  /// that expands to a compiler builtin with some __builtin prefix.
1050  /// The builtin may as well have a few extra arguments on top of the requested
1051  /// number of arguments.
1053 };
1054 
1055 /// This class represents a description of a function call using the number of
1056 /// arguments and the name of the function.
1058  friend CallEvent;
1059 
1060  mutable IdentifierInfo *II = nullptr;
1061  mutable bool IsLookupDone = false;
1062  // The list of the qualified names used to identify the specified CallEvent,
1063  // e.g. "{a, b}" represent the qualified names, like "a::b".
1064  std::vector<const char *> QualifiedName;
1065  Optional<unsigned> RequiredArgs;
1066  int Flags;
1067 
1068 public:
1069  /// Constructs a CallDescription object.
1070  ///
1071  /// @param QualifiedName The list of the name qualifiers of the function that
1072  /// will be matched. The user is allowed to skip any of the qualifiers.
1073  /// For example, {"std", "basic_string", "c_str"} would match both
1074  /// std::basic_string<...>::c_str() and std::__1::basic_string<...>::c_str().
1075  ///
1076  /// @param RequiredArgs The number of arguments that is expected to match a
1077  /// call. Omit this parameter to match every occurrence of call with a given
1078  /// name regardless the number of arguments.
1079  CallDescription(int Flags, ArrayRef<const char *> QualifiedName,
1080  Optional<unsigned> RequiredArgs = None)
1081  : QualifiedName(QualifiedName), RequiredArgs(RequiredArgs),
1082  Flags(Flags) {}
1083 
1084  /// Construct a CallDescription with default flags.
1086  Optional<unsigned> RequiredArgs = None)
1087  : CallDescription(0, QualifiedName, RequiredArgs) {}
1088 
1089  /// Get the name of the function that this object matches.
1090  StringRef getFunctionName() const { return QualifiedName.back(); }
1091 };
1092 
1093 /// An immutable map from CallDescriptions to arbitrary data. Provides a unified
1094 /// way for checkers to react on function calls.
1095 template <typename T> class CallDescriptionMap {
1096  // Some call descriptions aren't easily hashable (eg., the ones with qualified
1097  // names in which some sections are omitted), so let's put them
1098  // in a simple vector and use linear lookup.
1099  // TODO: Implement an actual map for fast lookup for "hashable" call
1100  // descriptions (eg., the ones for C functions that just match the name).
1101  std::vector<std::pair<CallDescription, T>> LinearMap;
1102 
1103 public:
1105  std::initializer_list<std::pair<CallDescription, T>> &&List)
1106  : LinearMap(List) {}
1107 
1108  ~CallDescriptionMap() = default;
1109 
1110  // These maps are usually stored once per checker, so let's make sure
1111  // we don't do redundant copies.
1112  CallDescriptionMap(const CallDescriptionMap &) = delete;
1113  CallDescriptionMap &operator=(const CallDescription &) = delete;
1114 
1115  const T *lookup(const CallEvent &Call) const {
1116  // Slow path: linear lookup.
1117  // TODO: Implement some sort of fast path.
1118  for (const std::pair<CallDescription, T> &I : LinearMap)
1119  if (Call.isCalled(I.first))
1120  return &I.second;
1121 
1122  return nullptr;
1123  }
1124 };
1125 
1126 /// Manages the lifetime of CallEvent objects.
1127 ///
1128 /// CallEventManager provides a way to create arbitrary CallEvents "on the
1129 /// stack" as if they were value objects by keeping a cache of CallEvent-sized
1130 /// memory blocks. The CallEvents created by CallEventManager are only valid
1131 /// for the lifetime of the OwnedCallEvent that holds them; right now these
1132 /// objects cannot be copied and ownership cannot be transferred.
1134  friend class CallEvent;
1135 
1136  llvm::BumpPtrAllocator &Alloc;
1138 
1139  using CallEventTemplateTy = SimpleFunctionCall;
1140 
1141  void reclaim(const void *Memory) {
1142  Cache.push_back(const_cast<void *>(Memory));
1143  }
1144 
1145  /// Returns memory that can be initialized as a CallEvent.
1146  void *allocate() {
1147  if (Cache.empty())
1148  return Alloc.Allocate<CallEventTemplateTy>();
1149  else
1150  return Cache.pop_back_val();
1151  }
1152 
1153  template <typename T, typename Arg>
1154  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1155  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1156  "CallEvent subclasses are not all the same size");
1157  return new (allocate()) T(A, St, LCtx);
1158  }
1159 
1160  template <typename T, typename Arg1, typename Arg2>
1161  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1162  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1163  "CallEvent subclasses are not all the same size");
1164  return new (allocate()) T(A1, A2, St, LCtx);
1165  }
1166 
1167  template <typename T, typename Arg1, typename Arg2, typename Arg3>
1168  T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
1169  const LocationContext *LCtx) {
1170  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171  "CallEvent subclasses are not all the same size");
1172  return new (allocate()) T(A1, A2, A3, St, LCtx);
1173  }
1174 
1175  template <typename T, typename Arg1, typename Arg2, typename Arg3,
1176  typename Arg4>
1177  T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
1178  const LocationContext *LCtx) {
1179  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1180  "CallEvent subclasses are not all the same size");
1181  return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
1182  }
1183 
1184 public:
1185  CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
1186 
1187  /// Gets an outside caller given a callee context.
1188  CallEventRef<>
1189  getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
1190 
1191  /// Gets a call event for a function call, Objective-C method call,
1192  /// or a 'new' call.
1193  CallEventRef<>
1194  getCall(const Stmt *S, ProgramStateRef State,
1195  const LocationContext *LC);
1196 
1197  CallEventRef<>
1198  getSimpleCall(const CallExpr *E, ProgramStateRef State,
1199  const LocationContext *LCtx);
1200 
1201  CallEventRef<ObjCMethodCall>
1203  const LocationContext *LCtx) {
1204  return create<ObjCMethodCall>(E, State, LCtx);
1205  }
1206 
1207  CallEventRef<CXXConstructorCall>
1208  getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
1209  ProgramStateRef State, const LocationContext *LCtx) {
1210  return create<CXXConstructorCall>(E, Target, State, LCtx);
1211  }
1212 
1213  CallEventRef<CXXDestructorCall>
1214  getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
1215  const MemRegion *Target, bool IsBase,
1216  ProgramStateRef State, const LocationContext *LCtx) {
1217  return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
1218  }
1219 
1220  CallEventRef<CXXAllocatorCall>
1222  const LocationContext *LCtx) {
1223  return create<CXXAllocatorCall>(E, State, LCtx);
1224  }
1225 };
1226 
1227 template <typename T>
1229  assert(isa<T>(*this) && "Cloning to unrelated type");
1230  static_assert(sizeof(T) == sizeof(CallEvent),
1231  "Subclasses may not add fields");
1232 
1233  if (NewState == State)
1234  return cast<T>(this);
1235 
1236  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1237  T *Copy = static_cast<T *>(Mgr.allocate());
1238  cloneTo(Copy);
1239  assert(Copy->getKind() == this->getKind() && "Bad copy");
1240 
1241  Copy->State = NewState;
1242  return Copy;
1243 }
1244 
1245 inline void CallEvent::Release() const {
1246  assert(RefCount > 0 && "Reference count is already zero.");
1247  --RefCount;
1248 
1249  if (RefCount > 0)
1250  return;
1251 
1252  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1253  Mgr.reclaim(this);
1254 
1255  this->~CallEvent();
1256 }
1257 
1258 } // namespace ento
1259 
1260 } // namespace clang
1261 
1262 namespace llvm {
1263 
1264 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1265 template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
1266  using SimpleType = const T *;
1267 
1268  static SimpleType
1270  return Val.get();
1271  }
1272 };
1273 
1274 } // namespace llvm
1275 
1276 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
A call to an overloaded operator written using operator syntax.
Definition: ExprCXX.h:77
CallEvent(const CallEvent &Original)
Definition: CallEvent.h:174
Kind getKind() const override
Definition: CallEvent.h:1040
Represents a function declaration or definition.
Definition: Decl.h:1748
RuntimeDefinition(const Decl *InD, const MemRegion *InR)
Definition: CallEvent.h:115
Smart pointer class that efficiently represents Objective-C method names.
A (possibly-)qualified type.
Definition: Type.h:643
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
CallEventRef< T > cloneWithState(ProgramStateRef NewState) const
Returns a copy of this CallEvent, but using the given state.
const CXXConstructorDecl * getDecl() const override
Definition: CallEvent.h:845
Specialize PointerLikeTypeTraits to allow LazyGenerationalUpdatePtr to be placed into a PointerUnion...
Definition: Dominators.h:30
CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:642
static SimpleType getSimplifiedValue(clang::ento::CallEventRef< T > Val)
Definition: CallEvent.h:1269
TypePropertyCache< Private > Cache
Definition: Type.cpp:3553
void cloneTo(void *Dest) const override
Definition: CallEvent.h:880
Stmt - This represents one statement.
Definition: Stmt.h:66
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1439
SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:499
AnyFunctionCall(const Decl *D, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:465
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:1042
C Language Family Type Representation.
Defines the SourceManager interface.
void cloneTo(void *Dest) const override
Definition: CallEvent.h:790
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:718
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1133
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:705
CallDescription(int Flags, ArrayRef< const char *> QualifiedName, Optional< unsigned > RequiredArgs=None)
Constructs a CallDescription object.
Definition: CallEvent.h:1079
StringRef getFunctionName() const
Get the name of the function that this object matches.
Definition: CallEvent.h:1090
ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:943
CallEventRef< CXXDestructorCall > getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBase, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1214
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1326
CallDescription(ArrayRef< const char *> QualifiedName, Optional< unsigned > RequiredArgs=None)
Construct a CallDescription with default flags.
Definition: CallEvent.h:1085
Represents a C++ constructor within a class.
Definition: DeclCXX.h:2566
bool isBaseDestructor() const
Returns true if this is a call to a base class destructor.
Definition: CallEvent.h:802
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:222
llvm::PointerIntPair< const MemRegion *, 1, bool > DtorDataTy
Definition: CallEvent.h:771
Represents a variable declaration or definition.
Definition: Decl.h:812
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:486
const T * lookup(const CallEvent &Call) const
Definition: CallEvent.h:1115
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:182
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object&#39;s ConstructionContext, retrieve such object&#39;s location.
Definition: ExprEngine.cpp:474
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:138
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:863
Represents a C++ overloaded operator call where the operator is implemented as a non-static member fu...
Definition: CallEvent.h:714
CharSourceRange getSourceRange(const SourceRange &Range)
Returns the token CharSourceRange corresponding to Range.
Definition: FixIt.h:32
Represents a parameter to a function.
Definition: Decl.h:1564
Defines the clang::Expr interface and subclasses for C++ expressions.
unsigned getNumArgs() const override
Returns the number of arguments (explicit and implicit).
Definition: CallEvent.h:515
One of these records is kept for each identifier that is lexed.
unsigned getNumArgs() const override
Definition: CallEvent.h:794
param_type_iterator param_type_end() const
Definition: CallEvent.h:449
LineState State
ObjCMethodFamily
A family of Objective-C methods.
virtual const CallExpr * getOriginExpr() const
Definition: CallEvent.h:509
SourceLocation Location
Definition: CallEvent.h:154
AnalysisDeclContext contains the context data for the function or method under analysis.
Definition: Format.h:2274
const BlockDecl * getDecl() const override
Definition: CallEvent.h:561
const ObjCInterfaceDecl * getReceiverInterface() const
Get the interface for the receiver.
Definition: CallEvent.h:1001
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:272
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
bool argumentsMayEscape() const override
Definition: CallEvent.h:619
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:744
Represents the memory allocation call in a C++ new-expression.
Definition: CallEvent.h:871
Kind getKind() const override
Definition: CallEvent.h:628
virtual const CXXOperatorCallExpr * getOriginExpr() const
Definition: CallEvent.h:728
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:1057
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:937
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:523
virtual Kind getKind() const =0
Returns the kind of call this is.
const FunctionDecl * getDecl() const override
Definition: CallEvent.h:887
static void dump(llvm::raw_ostream &OS, StringRef FunctionName, ArrayRef< CounterExpression > Expressions, ArrayRef< CounterMappingRegion > Regions)
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
bool isSetter() const
Returns true if this property access or subscript is a setter (has the form of an assignment)...
Definition: CallEvent.h:1014
virtual const CXXConstructExpr * getOriginExpr() const
Definition: CallEvent.h:841
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:473
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call&#39;s formal parameters.
Definition: CallEvent.h:445
std::pair< Loc, SVal > FrameBindingTy
Definition: CallEvent.h:350
Represents an ObjC class declaration.
Definition: DeclObjC.h:1171
BlockCall(const CallExpr *CE, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:535
Represents a non-static C++ member function call.
Definition: CallEvent.h:673
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.h:589
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:928
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1636
const Expr * getPlacementArgExpr(unsigned Index) const
Number of placement arguments to the operator new() call.
Definition: CallEvent.h:913
Represents a non-static C++ member function call, no matter how it is written.
Definition: CallEvent.h:637
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:212
CallEventManager(llvm::BumpPtrAllocator &alloc)
Definition: CallEvent.h:1185
Represents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3915
This represents one expression.
Definition: Expr.h:108
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:695
unsigned getNumArgs() const override
Definition: CallEvent.h:550
bool isInSystemHeader(SourceLocation Loc) const
Returns if a SourceLocation is in a system header.
unsigned getNumArgs() const override
Definition: CallEvent.h:849
Represents an implicit call to a C++ destructor.
Definition: CallEvent.h:767
Kind getKind() const override
Definition: CallEvent.h:861
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2830
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:438
virtual const CXXNewExpr * getOriginExpr() const
Definition: CallEvent.h:883
Represents a call to any sort of function that might have a FunctionDecl.
Definition: CallEvent.h:460
bool isInSystemHeader() const
Returns true if the callee is known to be from a system header.
Definition: CallEvent.h:234
Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override
Definition: CallEvent.h:749
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:332
Kind getKind() const override
Returns the kind of call this is.
Definition: CallEvent.h:521
virtual const CallExpr * getOriginExpr() const
Definition: CallEvent.h:546
Defines the clang::IdentifierInfo, clang::IdentifierTable, and clang::Selector interfaces.
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:202
Kind getKind() const override
Definition: CallEvent.h:703
CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
Definition: CallEvent.h:170
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:950
virtual const Expr * getCXXThisExpr() const
Returns the expression representing the implicit &#39;this&#39; object.
Definition: CallEvent.h:652
CallEventRef< ObjCMethodCall > getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1202
Represents a C function or static C++ member function call.
Definition: CallEvent.h:495
const SourceManager & SM
Definition: Format.cpp:1572
const VarRegion * getRegionStoringCapturedLambda() const
For a block converted from a C++ lambda, returns the block VarRegion for the variable holding the cap...
Definition: CallEvent.h:578
unsigned getNumArgs() const override
Definition: CallEvent.h:689
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:303
SourceLocation getEndLoc() const LLVM_READONLY
Definition: Stmt.cpp:276
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:630
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:552
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:263
void cloneTo(void *Dest) const override
Definition: CallEvent.h:540
Defines the runtime definition of the called function.
Definition: CallEvent.h:101
Kind getKind() const override
Definition: CallEvent.h:917
CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:677
Kind
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:5663
CallDescriptionFlags
Definition: CallEvent.h:1047
CallEventRef< CXXAllocatorCall > getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1221
Encodes a location in the source.
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:851
CallEventRef(const T *Call)
Definition: CallEvent.h:79
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:39
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:2000
CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:875
bool isArgumentConstructedDirectly(unsigned Index) const
Returns true if on the current path, the argument was constructed by calling a C++ constructor over i...
Definition: CallEvent.h:401
Represents a call to a member function that may be written either with member call syntax (e...
Definition: ExprCXX.h:170
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2114
const Expr * getArgExpr(unsigned Index) const override
Returns the expression associated with a given argument.
Definition: CallEvent.h:517
bool isConversionFromLambda() const
Definition: Decl.h:4058
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
unsigned getNumImplicitArgs() const
Number of non-placement arguments to the call.
Definition: CallEvent.h:894
virtual Optional< unsigned > getAdjustedParameterIndex(unsigned ASTArgumentIndex) const
Some calls have parameter numbering mismatched from argument numbering.
Definition: CallEvent.h:412
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:728
unsigned getNumArgs() const override
Definition: CallEvent.h:898
void cloneTo(void *Dest) const override
Definition: CallEvent.h:682
void cloneTo(void *Dest) const override
Definition: CallEvent.h:951
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:902
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:190
const MemRegion * getDispatchRegion()
When other definitions are possible, returns the region whose runtime type determines the method defi...
Definition: CallEvent.h:126
const ObjCMethodDecl * getDecl() const override
Definition: CallEvent.h:965
CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target, ProgramStateRef St, const LocationContext *LCtx)
Creates a constructor call.
Definition: CallEvent.h:827
CallDescriptionMap(std::initializer_list< std::pair< CallDescription, T >> &&List)
Definition: CallEvent.h:1104
void cloneTo(void *Dest) const override
Definition: CallEvent.h:835
virtual const ObjCMessageExpr * getOriginExpr() const
Definition: CallEvent.h:961
Selector getSelector() const
Definition: CallEvent.h:985
Dataflow Directional Tag Classes.
bool isValid() const
Return true if this is a valid SourceLocation object.
CXXMethodDecl * getLambdaCallOperator() const
Retrieve the lambda call operator of the closure type if this is a closure type.
Definition: DeclCXX.cpp:1385
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:664
bool isConversionFromLambda() const
Definition: CallEvent.h:568
static bool classof(const CallEvent *CA)
Definition: CallEvent.h:808
virtual const CXXMemberCallExpr * getOriginExpr() const
Definition: CallEvent.h:685
std::unique_ptr< DiagnosticConsumer > create(StringRef OutputFile, DiagnosticOptions *Diags, bool MergeChildRecords=false)
Returns a DiagnosticConsumer that serializes diagnostics to a bitcode file.
Kind getKind() const override
Definition: CallEvent.h:806
Describes a C standard function that is sometimes implemented as a macro that expands to a compiler b...
Definition: CallEvent.h:1052
RuntimeDefinition(const Decl *InD)
Definition: CallEvent.h:114
bool mayHaveOtherDefinitions()
Check if the definition we have is precise.
Definition: CallEvent.h:122
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:138
SourceRange getSourceRange() const override
Definition: CallEvent.h:793
bool isInstanceMessage() const
Definition: CallEvent.h:977
CXXInstanceCall(const CallExpr *CE, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:639
CallEventRef cloneWithState(ProgramStateRef NewState) const
Returns a copy of this CallEvent, but using the given state.
Definition: CallEvent.h:363
virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const
Some call event sub-classes conveniently adjust mismatching AST indices to match parameter indices...
Definition: CallEvent.h:419
ObjCMethodFamily getMethodFamily() const
Definition: CallEvent.h:981
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:736
unsigned getNumArgs() const override
Definition: CallEvent.h:969
unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override
Definition: CallEvent.h:756
void cloneTo(void *Dest) const override
Definition: CallEvent.h:723
static bool classof(const CallEvent *CE)
Definition: CallEvent.h:919
CallEventRef< CXXConstructorCall > getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.h:1208
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:207
const Expr * getArgExpr(unsigned Index) const override
Definition: CallEvent.h:973
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
unsigned getNumArgs() const override
Definition: CallEvent.h:732
CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
Definition: CallEvent.h:167
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2516
static Decl::Kind getKind(const Decl *D)
Definition: DeclBase.cpp:944
An immutable map from CallDescriptions to arbitrary data.
Definition: CallEvent.h:1095
AnyFunctionCall(const Expr *E, ProgramStateRef St, const LocationContext *LCtx)
Definition: CallEvent.h:462
QualType getType() const
Definition: Decl.h:647
const void * Data
Definition: CallEvent.h:149
A trivial tuple used to represent a source range.
CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, const MemRegion *Target, bool IsBaseDestructor, ProgramStateRef St, const LocationContext *LCtx)
Creates an implicit destructor.
Definition: CallEvent.h:780
Represents a call to a C++ constructor.
Definition: CallEvent.h:816
This class handles loading and caching of source files into memory.
void cloneTo(void *Dest) const override
Copies this CallEvent, with vtable intact, into a new block of memory.
Definition: CallEvent.h:504
SourceLocation getLocation() const
Definition: DeclBase.h:429
CallEventRef(const CallEventRef &Orig)
Definition: CallEvent.h:80
Kind getKind() const override
Definition: CallEvent.h:742
CallEventRef< T > cloneWithState(ProgramStateRef State) const
Definition: CallEvent.h:82
ArrayRef< SVal > ValueList