clang 19.0.0git
DynamicTypePropagation.cpp
Go to the documentation of this file.
1//===- DynamicTypePropagation.cpp ------------------------------*- C++ -*--===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This file contains two checkers. One helps the static analyzer core to track
10// types, the other does type inference on Obj-C generics and report type
11// errors.
12//
13// Dynamic Type Propagation:
14// This checker defines the rules for dynamic type gathering and propagation.
15//
16// Generics Checker for Objective-C:
17// This checker tries to find type errors that the compiler is not able to catch
18// due to the implicit conversions that were introduced for backward
19// compatibility.
20//
21//===----------------------------------------------------------------------===//
22
23#include "clang/AST/ParentMap.h"
34#include "llvm/ADT/STLExtras.h"
35#include <optional>
36
37using namespace clang;
38using namespace ento;
39
40// ProgramState trait - The type inflation is tracked by DynamicTypeMap. This is
41// an auxiliary map that tracks more information about generic types, because in
42// some cases the most derived type is not the most informative one about the
43// type parameters. This types that are stored for each symbol in this map must
44// be specialized.
45// TODO: In some case the type stored in this map is exactly the same that is
46// stored in DynamicTypeMap. We should no store duplicated information in those
47// cases.
48REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef,
50
51namespace {
52class DynamicTypePropagation:
53 public Checker< check::PreCall,
54 check::PostCall,
55 check::DeadSymbols,
56 check::PostStmt<CastExpr>,
57 check::PostStmt<CXXNewExpr>,
58 check::PreObjCMessage,
59 check::PostObjCMessage > {
60
61 /// Return a better dynamic type if one can be derived from the cast.
62 const ObjCObjectPointerType *getBetterObjCType(const Expr *CastE,
63 CheckerContext &C) const;
64
65 ExplodedNode *dynamicTypePropagationOnCasts(const CastExpr *CE,
66 ProgramStateRef &State,
67 CheckerContext &C) const;
68
69 mutable std::unique_ptr<BugType> ObjCGenericsBugType;
70 void initBugType() const {
71 if (!ObjCGenericsBugType)
72 ObjCGenericsBugType.reset(new BugType(
73 GenericCheckName, "Generics", categories::CoreFoundationObjectiveC));
74 }
75
76 class GenericsBugVisitor : public BugReporterVisitor {
77 public:
78 GenericsBugVisitor(SymbolRef S) : Sym(S) {}
79
80 void Profile(llvm::FoldingSetNodeID &ID) const override {
81 static int X = 0;
82 ID.AddPointer(&X);
83 ID.AddPointer(Sym);
84 }
85
86 PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,
88 PathSensitiveBugReport &BR) override;
89
90 private:
91 // The tracked symbol.
92 SymbolRef Sym;
93 };
94
95 void reportGenericsBug(const ObjCObjectPointerType *From,
98 const Stmt *ReportedNode = nullptr) const;
99
100public:
101 void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
102 void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
103 void checkPostStmt(const CastExpr *CastE, CheckerContext &C) const;
104 void checkPostStmt(const CXXNewExpr *NewE, CheckerContext &C) const;
105 void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
106 void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
107 void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
108
109 /// This value is set to true, when the Generics checker is turned on.
110 bool CheckGenerics = false;
111 CheckerNameRef GenericCheckName;
112};
113
114bool isObjCClassType(QualType Type) {
115 if (const auto *PointerType = dyn_cast<ObjCObjectPointerType>(Type)) {
116 return PointerType->getObjectType()->isObjCClass();
117 }
118 return false;
119}
120
121struct RuntimeType {
122 const ObjCObjectType *Type = nullptr;
123 bool Precise = false;
124
125 operator bool() const { return Type != nullptr; }
126};
127
128RuntimeType inferReceiverType(const ObjCMethodCall &Message,
129 CheckerContext &C) {
130 const ObjCMessageExpr *MessageExpr = Message.getOriginExpr();
131
132 // Check if we can statically infer the actual type precisely.
133 //
134 // 1. Class is written directly in the message:
135 // \code
136 // [ActualClass classMethod];
137 // \endcode
138 if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Class) {
139 return {MessageExpr->getClassReceiver()->getAs<ObjCObjectType>(),
140 /*Precise=*/true};
141 }
142
143 // 2. Receiver is 'super' from a class method (a.k.a 'super' is a
144 // class object).
145 // \code
146 // [super classMethod];
147 // \endcode
148 if (MessageExpr->getReceiverKind() == ObjCMessageExpr::SuperClass) {
149 return {MessageExpr->getSuperType()->getAs<ObjCObjectType>(),
150 /*Precise=*/true};
151 }
152
153 // 3. Receiver is 'super' from an instance method (a.k.a 'super' is an
154 // instance of a super class).
155 // \code
156 // [super instanceMethod];
157 // \encode
158 if (MessageExpr->getReceiverKind() == ObjCMessageExpr::SuperInstance) {
159 if (const auto *ObjTy =
160 MessageExpr->getSuperType()->getAs<ObjCObjectPointerType>())
161 return {ObjTy->getObjectType(), /*Precise=*/true};
162 }
163
164 const Expr *RecE = MessageExpr->getInstanceReceiver();
165
166 if (!RecE)
167 return {};
168
169 // Otherwise, let's try to get type information from our estimations of
170 // runtime types.
171 QualType InferredType;
172 SVal ReceiverSVal = C.getSVal(RecE);
173 ProgramStateRef State = C.getState();
174
175 if (const MemRegion *ReceiverRegion = ReceiverSVal.getAsRegion()) {
176 if (DynamicTypeInfo DTI = getDynamicTypeInfo(State, ReceiverRegion)) {
177 InferredType = DTI.getType().getCanonicalType();
178 }
179 }
180
181 if (SymbolRef ReceiverSymbol = ReceiverSVal.getAsSymbol()) {
182 if (InferredType.isNull()) {
183 InferredType = ReceiverSymbol->getType();
184 }
185
186 // If receiver is a Class object, we want to figure out the type it
187 // represents.
188 if (isObjCClassType(InferredType)) {
189 // We actually might have some info on what type is contained in there.
190 if (DynamicTypeInfo DTI =
191 getClassObjectDynamicTypeInfo(State, ReceiverSymbol)) {
192
193 // Types in Class objects can be ONLY Objective-C types
194 return {cast<ObjCObjectType>(DTI.getType()), !DTI.canBeASubClass()};
195 }
196
197 SVal SelfSVal = State->getSelfSVal(C.getLocationContext());
198
199 // Another way we can guess what is in Class object, is when it is a
200 // 'self' variable of the current class method.
201 if (ReceiverSVal == SelfSVal) {
202 // In this case, we should return the type of the enclosing class
203 // declaration.
204 if (const ObjCMethodDecl *MD =
205 dyn_cast<ObjCMethodDecl>(C.getStackFrame()->getDecl()))
206 if (const ObjCObjectType *ObjTy = dyn_cast<ObjCObjectType>(
207 MD->getClassInterface()->getTypeForDecl()))
208 return {ObjTy};
209 }
210 }
211 }
212
213 // Unfortunately, it seems like we have no idea what that type is.
214 if (InferredType.isNull()) {
215 return {};
216 }
217
218 // We can end up here if we got some dynamic type info and the
219 // receiver is not one of the known Class objects.
220 if (const auto *ReceiverInferredType =
221 dyn_cast<ObjCObjectPointerType>(InferredType)) {
222 return {ReceiverInferredType->getObjectType()};
223 }
224
225 // Any other type (like 'Class') is not really useful at this point.
226 return {};
227}
228} // end anonymous namespace
229
230void DynamicTypePropagation::checkDeadSymbols(SymbolReaper &SR,
231 CheckerContext &C) const {
232 ProgramStateRef State = removeDeadTypes(C.getState(), SR);
233 State = removeDeadClassObjectTypes(State, SR);
234
235 MostSpecializedTypeArgsMapTy TyArgMap =
236 State->get<MostSpecializedTypeArgsMap>();
237 for (SymbolRef Sym : llvm::make_first_range(TyArgMap)) {
238 if (SR.isDead(Sym)) {
239 State = State->remove<MostSpecializedTypeArgsMap>(Sym);
240 }
241 }
242
243 C.addTransition(State);
244}
245
246static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD,
247 CheckerContext &C) {
248 assert(Region);
249 assert(MD);
250
251 ASTContext &Ctx = C.getASTContext();
252 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(MD->getParent()));
253
254 ProgramStateRef State = C.getState();
255 State = setDynamicTypeInfo(State, Region, Ty, /*CanBeSubClassed=*/false);
256 C.addTransition(State);
257}
258
259void DynamicTypePropagation::checkPreCall(const CallEvent &Call,
260 CheckerContext &C) const {
261 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
262 // C++11 [class.cdtor]p4: When a virtual function is called directly or
263 // indirectly from a constructor or from a destructor, including during
264 // the construction or destruction of the class's non-static data members,
265 // and the object to which the call applies is the object under
266 // construction or destruction, the function called is the final overrider
267 // in the constructor's or destructor's class and not one overriding it in
268 // a more-derived class.
269
270 switch (Ctor->getOriginExpr()->getConstructionKind()) {
271 case CXXConstructionKind::Complete:
272 case CXXConstructionKind::Delegating:
273 // No additional type info necessary.
274 return;
275 case CXXConstructionKind::NonVirtualBase:
276 case CXXConstructionKind::VirtualBase:
277 if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion())
278 recordFixedType(Target, Ctor->getDecl(), C);
279 return;
280 }
281
282 return;
283 }
284
285 if (const CXXDestructorCall *Dtor = dyn_cast<CXXDestructorCall>(&Call)) {
286 // C++11 [class.cdtor]p4 (see above)
287 if (!Dtor->isBaseDestructor())
288 return;
289
290 const MemRegion *Target = Dtor->getCXXThisVal().getAsRegion();
291 if (!Target)
292 return;
293
294 const Decl *D = Dtor->getDecl();
295 if (!D)
296 return;
297
298 recordFixedType(Target, cast<CXXDestructorDecl>(D), C);
299 return;
300 }
301}
302
303void DynamicTypePropagation::checkPostCall(const CallEvent &Call,
304 CheckerContext &C) const {
305 // We can obtain perfect type info for return values from some calls.
306 if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
307
308 // Get the returned value if it's a region.
309 const MemRegion *RetReg = Call.getReturnValue().getAsRegion();
310 if (!RetReg)
311 return;
312
313 ProgramStateRef State = C.getState();
314 const ObjCMethodDecl *D = Msg->getDecl();
315
316 if (D && D->hasRelatedResultType()) {
317 switch (Msg->getMethodFamily()) {
318 default:
319 break;
320
321 // We assume that the type of the object returned by alloc and new are the
322 // pointer to the object of the class specified in the receiver of the
323 // message.
324 case OMF_alloc:
325 case OMF_new: {
326 // Get the type of object that will get created.
327 RuntimeType ObjTy = inferReceiverType(*Msg, C);
328
329 if (!ObjTy)
330 return;
331
332 QualType DynResTy =
333 C.getASTContext().getObjCObjectPointerType(QualType(ObjTy.Type, 0));
334 // We used to assume that whatever type we got from inferring the
335 // type is actually precise (and it is not exactly correct).
336 // A big portion of the existing behavior depends on that assumption
337 // (e.g. certain inlining won't take place). For this reason, we don't
338 // use ObjTy.Precise flag here.
339 //
340 // TODO: We should mitigate this problem some time in the future
341 // and replace hardcoded 'false' with '!ObjTy.Precise'.
342 C.addTransition(setDynamicTypeInfo(State, RetReg, DynResTy, false));
343 break;
344 }
345 case OMF_init: {
346 // Assume, the result of the init method has the same dynamic type as
347 // the receiver and propagate the dynamic type info.
348 const MemRegion *RecReg = Msg->getReceiverSVal().getAsRegion();
349 if (!RecReg)
350 return;
351 DynamicTypeInfo RecDynType = getDynamicTypeInfo(State, RecReg);
352 C.addTransition(setDynamicTypeInfo(State, RetReg, RecDynType));
353 break;
354 }
355 }
356 }
357 return;
358 }
359
360 if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
361 // We may need to undo the effects of our pre-call check.
362 switch (Ctor->getOriginExpr()->getConstructionKind()) {
363 case CXXConstructionKind::Complete:
364 case CXXConstructionKind::Delegating:
365 // No additional work necessary.
366 // Note: This will leave behind the actual type of the object for
367 // complete constructors, but arguably that's a good thing, since it
368 // means the dynamic type info will be correct even for objects
369 // constructed with operator new.
370 return;
371 case CXXConstructionKind::NonVirtualBase:
372 case CXXConstructionKind::VirtualBase:
373 if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion()) {
374 // We just finished a base constructor. Now we can use the subclass's
375 // type when resolving virtual calls.
376 const LocationContext *LCtx = C.getLocationContext();
377
378 // FIXME: In C++17 classes with non-virtual bases may be treated as
379 // aggregates, and in such case no top-frame constructor will be called.
380 // Figure out if we need to do anything in this case.
381 // FIXME: Instead of relying on the ParentMap, we should have the
382 // trigger-statement (InitListExpr in this case) available in this
383 // callback, ideally as part of CallEvent.
384 if (isa_and_nonnull<InitListExpr>(
385 LCtx->getParentMap().getParent(Ctor->getOriginExpr())))
386 return;
387
388 recordFixedType(Target, cast<CXXConstructorDecl>(LCtx->getDecl()), C);
389 }
390 return;
391 }
392 }
393}
394
395/// TODO: Handle explicit casts.
396/// Handle C++ casts.
397///
398/// Precondition: the cast is between ObjCObjectPointers.
399ExplodedNode *DynamicTypePropagation::dynamicTypePropagationOnCasts(
400 const CastExpr *CE, ProgramStateRef &State, CheckerContext &C) const {
401 // We only track type info for regions.
402 const MemRegion *ToR = C.getSVal(CE).getAsRegion();
403 if (!ToR)
404 return C.getPredecessor();
405
406 if (isa<ExplicitCastExpr>(CE))
407 return C.getPredecessor();
408
409 if (const Type *NewTy = getBetterObjCType(CE, C)) {
410 State = setDynamicTypeInfo(State, ToR, QualType(NewTy, 0));
411 return C.addTransition(State);
412 }
413 return C.getPredecessor();
414}
415
416void DynamicTypePropagation::checkPostStmt(const CXXNewExpr *NewE,
417 CheckerContext &C) const {
418 if (NewE->isArray())
419 return;
420
421 // We only track dynamic type info for regions.
422 const MemRegion *MR = C.getSVal(NewE).getAsRegion();
423 if (!MR)
424 return;
425
426 C.addTransition(setDynamicTypeInfo(C.getState(), MR, NewE->getType(),
427 /*CanBeSubClassed=*/false));
428}
429
430// Return a better dynamic type if one can be derived from the cast.
431// Compare the current dynamic type of the region and the new type to which we
432// are casting. If the new type is lower in the inheritance hierarchy, pick it.
434DynamicTypePropagation::getBetterObjCType(const Expr *CastE,
435 CheckerContext &C) const {
436 const MemRegion *ToR = C.getSVal(CastE).getAsRegion();
437 assert(ToR);
438
439 // Get the old and new types.
440 const ObjCObjectPointerType *NewTy =
442 if (!NewTy)
443 return nullptr;
444 QualType OldDTy = getDynamicTypeInfo(C.getState(), ToR).getType();
445 if (OldDTy.isNull()) {
446 return NewTy;
447 }
448 const ObjCObjectPointerType *OldTy =
449 OldDTy->getAs<ObjCObjectPointerType>();
450 if (!OldTy)
451 return nullptr;
452
453 // Id the old type is 'id', the new one is more precise.
454 if (OldTy->isObjCIdType() && !NewTy->isObjCIdType())
455 return NewTy;
456
457 // Return new if it's a subclass of old.
458 const ObjCInterfaceDecl *ToI = NewTy->getInterfaceDecl();
459 const ObjCInterfaceDecl *FromI = OldTy->getInterfaceDecl();
460 if (ToI && FromI && FromI->isSuperClassOf(ToI))
461 return NewTy;
462
463 return nullptr;
464}
465
467 const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
468 const ObjCObjectPointerType *MostInformativeCandidate, ASTContext &C) {
469 // Checking if from and to are the same classes modulo specialization.
470 if (From->getInterfaceDecl()->getCanonicalDecl() ==
472 if (To->isSpecialized()) {
473 assert(MostInformativeCandidate->isSpecialized());
474 return MostInformativeCandidate;
475 }
476 return From;
477 }
478
479 if (To->getObjectType()->getSuperClassType().isNull()) {
480 // If To has no super class and From and To aren't the same then
481 // To was not actually a descendent of From. In this case the best we can
482 // do is 'From'.
483 return From;
484 }
485
486 const auto *SuperOfTo =
488 assert(SuperOfTo);
489 QualType SuperPtrOfToQual =
490 C.getObjCObjectPointerType(QualType(SuperOfTo, 0));
491 const auto *SuperPtrOfTo = SuperPtrOfToQual->castAs<ObjCObjectPointerType>();
492 if (To->isUnspecialized())
493 return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo, SuperPtrOfTo,
494 C);
495 else
496 return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo,
497 MostInformativeCandidate, C);
498}
499
500/// A downcast may loose specialization information. E. g.:
501/// MutableMap<T, U> : Map
502/// The downcast to MutableMap looses the information about the types of the
503/// Map (due to the type parameters are not being forwarded to Map), and in
504/// general there is no way to recover that information from the
505/// declaration. In order to have to most information, lets find the most
506/// derived type that has all the type parameters forwarded.
507///
508/// Get the a subclass of \p From (which has a lower bound \p To) that do not
509/// loose information about type parameters. \p To has to be a subclass of
510/// \p From. From has to be specialized.
511static const ObjCObjectPointerType *
513 const ObjCObjectPointerType *To, ASTContext &C) {
514 return getMostInformativeDerivedClassImpl(From, To, To, C);
515}
516
517/// Inputs:
518/// \param StaticLowerBound Static lower bound for a symbol. The dynamic lower
519/// bound might be the subclass of this type.
520/// \param StaticUpperBound A static upper bound for a symbol.
521/// \p StaticLowerBound expected to be the subclass of \p StaticUpperBound.
522/// \param Current The type that was inferred for a symbol in a previous
523/// context. Might be null when this is the first time that inference happens.
524/// Precondition:
525/// \p StaticLowerBound or \p StaticUpperBound is specialized. If \p Current
526/// is not null, it is specialized.
527/// Possible cases:
528/// (1) The \p Current is null and \p StaticLowerBound <: \p StaticUpperBound
529/// (2) \p StaticLowerBound <: \p Current <: \p StaticUpperBound
530/// (3) \p Current <: \p StaticLowerBound <: \p StaticUpperBound
531/// (4) \p StaticLowerBound <: \p StaticUpperBound <: \p Current
532/// Effect:
533/// Use getMostInformativeDerivedClass with the upper and lower bound of the
534/// set {\p StaticLowerBound, \p Current, \p StaticUpperBound}. The computed
535/// lower bound must be specialized. If the result differs from \p Current or
536/// \p Current is null, store the result.
537static bool
539 const ObjCObjectPointerType *const *Current,
540 const ObjCObjectPointerType *StaticLowerBound,
541 const ObjCObjectPointerType *StaticUpperBound,
542 ASTContext &C) {
543 // TODO: The above 4 cases are not exhaustive. In particular, it is possible
544 // for Current to be incomparable with StaticLowerBound, StaticUpperBound,
545 // or both.
546 //
547 // For example, suppose Foo<T> and Bar<T> are unrelated types.
548 //
549 // Foo<T> *f = ...
550 // Bar<T> *b = ...
551 //
552 // id t1 = b;
553 // f = t1;
554 // id t2 = f; // StaticLowerBound is Foo<T>, Current is Bar<T>
555 //
556 // We should either constrain the callers of this function so that the stated
557 // preconditions hold (and assert it) or rewrite the function to expicitly
558 // handle the additional cases.
559
560 // Precondition
561 assert(StaticUpperBound->isSpecialized() ||
562 StaticLowerBound->isSpecialized());
563 assert(!Current || (*Current)->isSpecialized());
564
565 // Case (1)
566 if (!Current) {
567 if (StaticUpperBound->isUnspecialized()) {
568 State = State->set<MostSpecializedTypeArgsMap>(Sym, StaticLowerBound);
569 return true;
570 }
571 // Upper bound is specialized.
572 const ObjCObjectPointerType *WithMostInfo =
573 getMostInformativeDerivedClass(StaticUpperBound, StaticLowerBound, C);
574 State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
575 return true;
576 }
577
578 // Case (3)
579 if (C.canAssignObjCInterfaces(StaticLowerBound, *Current)) {
580 return false;
581 }
582
583 // Case (4)
584 if (C.canAssignObjCInterfaces(*Current, StaticUpperBound)) {
585 // The type arguments might not be forwarded at any point of inheritance.
586 const ObjCObjectPointerType *WithMostInfo =
587 getMostInformativeDerivedClass(*Current, StaticUpperBound, C);
588 WithMostInfo =
589 getMostInformativeDerivedClass(WithMostInfo, StaticLowerBound, C);
590 if (WithMostInfo == *Current)
591 return false;
592 State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
593 return true;
594 }
595
596 // Case (2)
597 const ObjCObjectPointerType *WithMostInfo =
598 getMostInformativeDerivedClass(*Current, StaticLowerBound, C);
599 if (WithMostInfo != *Current) {
600 State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
601 return true;
602 }
603
604 return false;
605}
606
607/// Type inference based on static type information that is available for the
608/// cast and the tracked type information for the given symbol. When the tracked
609/// symbol and the destination type of the cast are unrelated, report an error.
610void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
611 CheckerContext &C) const {
612 if (CE->getCastKind() != CK_BitCast)
613 return;
614
615 QualType OriginType = CE->getSubExpr()->getType();
616 QualType DestType = CE->getType();
617
618 const auto *OrigObjectPtrType = OriginType->getAs<ObjCObjectPointerType>();
619 const auto *DestObjectPtrType = DestType->getAs<ObjCObjectPointerType>();
620
621 if (!OrigObjectPtrType || !DestObjectPtrType)
622 return;
623
624 ProgramStateRef State = C.getState();
625 ExplodedNode *AfterTypeProp = dynamicTypePropagationOnCasts(CE, State, C);
626
627 ASTContext &ASTCtxt = C.getASTContext();
628
629 // This checker detects the subtyping relationships using the assignment
630 // rules. In order to be able to do this the kindofness must be stripped
631 // first. The checker treats every type as kindof type anyways: when the
632 // tracked type is the subtype of the static type it tries to look up the
633 // methods in the tracked type first.
634 OrigObjectPtrType = OrigObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
635 DestObjectPtrType = DestObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
636
637 if (OrigObjectPtrType->isUnspecialized() &&
638 DestObjectPtrType->isUnspecialized())
639 return;
640
641 SymbolRef Sym = C.getSVal(CE).getAsSymbol();
642 if (!Sym)
643 return;
644
645 const ObjCObjectPointerType *const *TrackedType =
646 State->get<MostSpecializedTypeArgsMap>(Sym);
647
648 if (isa<ExplicitCastExpr>(CE)) {
649 // Treat explicit casts as an indication from the programmer that the
650 // Objective-C type system is not rich enough to express the needed
651 // invariant. In such cases, forget any existing information inferred
652 // about the type arguments. We don't assume the casted-to specialized
653 // type here because the invariant the programmer specifies in the cast
654 // may only hold at this particular program point and not later ones.
655 // We don't want a suppressing cast to require a cascade of casts down the
656 // line.
657 if (TrackedType) {
658 State = State->remove<MostSpecializedTypeArgsMap>(Sym);
659 C.addTransition(State, AfterTypeProp);
660 }
661 return;
662 }
663
664 // Check which assignments are legal.
665 bool OrigToDest =
666 ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, OrigObjectPtrType);
667 bool DestToOrig =
668 ASTCtxt.canAssignObjCInterfaces(OrigObjectPtrType, DestObjectPtrType);
669
670 // The tracked type should be the sub or super class of the static destination
671 // type. When an (implicit) upcast or a downcast happens according to static
672 // types, and there is no subtyping relationship between the tracked and the
673 // static destination types, it indicates an error.
674 if (TrackedType &&
675 !ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, *TrackedType) &&
676 !ASTCtxt.canAssignObjCInterfaces(*TrackedType, DestObjectPtrType)) {
677 static CheckerProgramPointTag IllegalConv(this, "IllegalConversion");
678 ExplodedNode *N = C.addTransition(State, AfterTypeProp, &IllegalConv);
679 reportGenericsBug(*TrackedType, DestObjectPtrType, N, Sym, C);
680 return;
681 }
682
683 // Handle downcasts and upcasts.
684
685 const ObjCObjectPointerType *LowerBound = DestObjectPtrType;
686 const ObjCObjectPointerType *UpperBound = OrigObjectPtrType;
687 if (OrigToDest && !DestToOrig)
688 std::swap(LowerBound, UpperBound);
689
690 // The id type is not a real bound. Eliminate it.
691 LowerBound = LowerBound->isObjCIdType() ? UpperBound : LowerBound;
692 UpperBound = UpperBound->isObjCIdType() ? LowerBound : UpperBound;
693
694 if (storeWhenMoreInformative(State, Sym, TrackedType, LowerBound, UpperBound,
695 ASTCtxt)) {
696 C.addTransition(State, AfterTypeProp);
697 }
698}
699
700static const Expr *stripCastsAndSugar(const Expr *E) {
701 E = E->IgnoreParenImpCasts();
702 if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(E))
703 E = POE->getSyntacticForm()->IgnoreParenImpCasts();
704 if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E))
705 E = OVE->getSourceExpr()->IgnoreParenImpCasts();
706 return E;
707}
708
710 // It is illegal to typedef parameterized types inside an interface. Therefore
711 // an Objective-C type can only be dependent on a type parameter when the type
712 // parameter structurally present in the type itself.
713 class IsObjCTypeParamDependentTypeVisitor
714 : public RecursiveASTVisitor<IsObjCTypeParamDependentTypeVisitor> {
715 public:
716 IsObjCTypeParamDependentTypeVisitor() = default;
717 bool VisitObjCTypeParamType(const ObjCTypeParamType *Type) {
718 if (isa<ObjCTypeParamDecl>(Type->getDecl())) {
719 Result = true;
720 return false;
721 }
722 return true;
723 }
724
725 bool Result = false;
726 };
727
728 IsObjCTypeParamDependentTypeVisitor Visitor;
729 Visitor.TraverseType(Type);
730 return Visitor.Result;
731}
732
733/// A method might not be available in the interface indicated by the static
734/// type. However it might be available in the tracked type. In order to
735/// properly substitute the type parameters we need the declaration context of
736/// the method. The more specialized the enclosing class of the method is, the
737/// more likely that the parameter substitution will be successful.
738static const ObjCMethodDecl *
740 const ObjCObjectPointerType *TrackedType, ASTContext &ASTCtxt) {
741 const ObjCMethodDecl *Method = nullptr;
742
743 QualType ReceiverType = MessageExpr->getReceiverType();
744
745 // Do this "devirtualization" on instance and class methods only. Trust the
746 // static type on super and super class calls.
747 if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Instance ||
748 MessageExpr->getReceiverKind() == ObjCMessageExpr::Class) {
749 // When the receiver type is id, Class, or some super class of the tracked
750 // type, look up the method in the tracked type, not in the receiver type.
751 // This way we preserve more information.
752 if (ReceiverType->isObjCIdType() || ReceiverType->isObjCClassType() ||
754 ReceiverType->castAs<ObjCObjectPointerType>(), TrackedType)) {
755 const ObjCInterfaceDecl *InterfaceDecl = TrackedType->getInterfaceDecl();
756 // The method might not be found.
757 Selector Sel = MessageExpr->getSelector();
758 Method = InterfaceDecl->lookupInstanceMethod(Sel);
759 if (!Method)
760 Method = InterfaceDecl->lookupClassMethod(Sel);
761 }
762 }
763
764 // Fallback to statick method lookup when the one based on the tracked type
765 // failed.
766 return Method ? Method : MessageExpr->getMethodDecl();
767}
768
769/// Get the returned ObjCObjectPointerType by a method based on the tracked type
770/// information, or null pointer when the returned type is not an
771/// ObjCObjectPointerType.
773 const ObjCMethodDecl *Method, ArrayRef<QualType> TypeArgs,
774 const ObjCObjectPointerType *SelfType, ASTContext &C) {
775 QualType StaticResultType = Method->getReturnType();
776
777 // Is the return type declared as instance type?
778 if (StaticResultType == C.getObjCInstanceType())
779 return QualType(SelfType, 0);
780
781 // Check whether the result type depends on a type parameter.
782 if (!isObjCTypeParamDependent(StaticResultType))
783 return QualType();
784
785 QualType ResultType = StaticResultType.substObjCTypeArgs(
786 C, TypeArgs, ObjCSubstitutionContext::Result);
787
788 return ResultType;
789}
790
791/// When the receiver has a tracked type, use that type to validate the
792/// argumments of the message expression and the return value.
793void DynamicTypePropagation::checkPreObjCMessage(const ObjCMethodCall &M,
794 CheckerContext &C) const {
795 ProgramStateRef State = C.getState();
797 if (!Sym)
798 return;
799
800 const ObjCObjectPointerType *const *TrackedType =
801 State->get<MostSpecializedTypeArgsMap>(Sym);
802 if (!TrackedType)
803 return;
804
805 // Get the type arguments from tracked type and substitute type arguments
806 // before do the semantic check.
807
808 ASTContext &ASTCtxt = C.getASTContext();
809 const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
810 const ObjCMethodDecl *Method =
811 findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
812
813 // It is possible to call non-existent methods in Obj-C.
814 if (!Method)
815 return;
816
817 // If the method is declared on a class that has a non-invariant
818 // type parameter, don't warn about parameter mismatches after performing
819 // substitution. This prevents warning when the programmer has purposely
820 // casted the receiver to a super type or unspecialized type but the analyzer
821 // has a more precise tracked type than the programmer intends at the call
822 // site.
823 //
824 // For example, consider NSArray (which has a covariant type parameter)
825 // and NSMutableArray (a subclass of NSArray where the type parameter is
826 // invariant):
827 // NSMutableArray *a = [[NSMutableArray<NSString *> alloc] init;
828 //
829 // [a containsObject:number]; // Safe: -containsObject is defined on NSArray.
830 // NSArray<NSObject *> *other = [a arrayByAddingObject:number] // Safe
831 //
832 // [a addObject:number] // Unsafe: -addObject: is defined on NSMutableArray
833 //
834
836 if (!Interface)
837 return;
838
839 ObjCTypeParamList *TypeParams = Interface->getTypeParamList();
840 if (!TypeParams)
841 return;
842
843 for (ObjCTypeParamDecl *TypeParam : *TypeParams) {
844 if (TypeParam->getVariance() != ObjCTypeParamVariance::Invariant)
845 return;
846 }
847
848 std::optional<ArrayRef<QualType>> TypeArgs =
849 (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
850 // This case might happen when there is an unspecialized override of a
851 // specialized method.
852 if (!TypeArgs)
853 return;
854
855 for (unsigned i = 0; i < Method->param_size(); i++) {
856 const Expr *Arg = MessageExpr->getArg(i);
857 const ParmVarDecl *Param = Method->parameters()[i];
858
859 QualType OrigParamType = Param->getType();
860 if (!isObjCTypeParamDependent(OrigParamType))
861 continue;
862
863 QualType ParamType = OrigParamType.substObjCTypeArgs(
864 ASTCtxt, *TypeArgs, ObjCSubstitutionContext::Parameter);
865 // Check if it can be assigned
866 const auto *ParamObjectPtrType = ParamType->getAs<ObjCObjectPointerType>();
867 const auto *ArgObjectPtrType =
869 if (!ParamObjectPtrType || !ArgObjectPtrType)
870 continue;
871
872 // Check if we have more concrete tracked type that is not a super type of
873 // the static argument type.
874 SVal ArgSVal = M.getArgSVal(i);
875 SymbolRef ArgSym = ArgSVal.getAsSymbol();
876 if (ArgSym) {
877 const ObjCObjectPointerType *const *TrackedArgType =
878 State->get<MostSpecializedTypeArgsMap>(ArgSym);
879 if (TrackedArgType &&
880 ASTCtxt.canAssignObjCInterfaces(ArgObjectPtrType, *TrackedArgType)) {
881 ArgObjectPtrType = *TrackedArgType;
882 }
883 }
884
885 // Warn when argument is incompatible with the parameter.
886 if (!ASTCtxt.canAssignObjCInterfaces(ParamObjectPtrType,
887 ArgObjectPtrType)) {
888 static CheckerProgramPointTag Tag(this, "ArgTypeMismatch");
889 ExplodedNode *N = C.addTransition(State, &Tag);
890 reportGenericsBug(ArgObjectPtrType, ParamObjectPtrType, N, Sym, C, Arg);
891 return;
892 }
893 }
894}
895
896/// This callback is used to infer the types for Class variables. This info is
897/// used later to validate messages that sent to classes. Class variables are
898/// initialized with by invoking the 'class' method on a class.
899/// This method is also used to infer the type information for the return
900/// types.
901// TODO: right now it only tracks generic types. Extend this to track every
902// type in the DynamicTypeMap and diagnose type errors!
903void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
904 CheckerContext &C) const {
905 const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
906
907 SymbolRef RetSym = M.getReturnValue().getAsSymbol();
908 if (!RetSym)
909 return;
910
911 Selector Sel = MessageExpr->getSelector();
912 ProgramStateRef State = C.getState();
913
914 // Here we try to propagate information on Class objects.
915 if (Sel.getAsString() == "class") {
916 // We try to figure out the type from the receiver of the 'class' message.
917 if (RuntimeType ReceiverRuntimeType = inferReceiverType(M, C)) {
918
919 ReceiverRuntimeType.Type->getSuperClassType();
920 QualType ReceiverClassType(ReceiverRuntimeType.Type, 0);
921
922 // We want to consider only precise information on generics.
923 if (ReceiverRuntimeType.Type->isSpecialized() &&
924 ReceiverRuntimeType.Precise) {
925 QualType ReceiverClassPointerType =
926 C.getASTContext().getObjCObjectPointerType(ReceiverClassType);
927 const auto *InferredType =
928 ReceiverClassPointerType->castAs<ObjCObjectPointerType>();
929 State = State->set<MostSpecializedTypeArgsMap>(RetSym, InferredType);
930 }
931
932 // Constrain the resulting class object to the inferred type.
933 State = setClassObjectDynamicTypeInfo(State, RetSym, ReceiverClassType,
934 !ReceiverRuntimeType.Precise);
935
936 C.addTransition(State);
937 return;
938 }
939 }
940
941 if (Sel.getAsString() == "superclass") {
942 // We try to figure out the type from the receiver of the 'superclass'
943 // message.
944 if (RuntimeType ReceiverRuntimeType = inferReceiverType(M, C)) {
945
946 // Result type would be a super class of the receiver's type.
947 QualType ReceiversSuperClass =
948 ReceiverRuntimeType.Type->getSuperClassType();
949
950 // Check if it really had super class.
951 //
952 // TODO: we can probably pay closer attention to cases when the class
953 // object can be 'nil' as the result of such message.
954 if (!ReceiversSuperClass.isNull()) {
955 // Constrain the resulting class object to the inferred type.
957 State, RetSym, ReceiversSuperClass, !ReceiverRuntimeType.Precise);
958
959 C.addTransition(State);
960 }
961 return;
962 }
963 }
964
965 // Tracking for return types.
967 if (!RecSym)
968 return;
969
970 const ObjCObjectPointerType *const *TrackedType =
971 State->get<MostSpecializedTypeArgsMap>(RecSym);
972 if (!TrackedType)
973 return;
974
975 ASTContext &ASTCtxt = C.getASTContext();
976 const ObjCMethodDecl *Method =
977 findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
978 if (!Method)
979 return;
980
981 std::optional<ArrayRef<QualType>> TypeArgs =
982 (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
983 if (!TypeArgs)
984 return;
985
986 QualType ResultType =
987 getReturnTypeForMethod(Method, *TypeArgs, *TrackedType, ASTCtxt);
988 // The static type is the same as the deduced type.
989 if (ResultType.isNull())
990 return;
991
992 const MemRegion *RetRegion = M.getReturnValue().getAsRegion();
993 ExplodedNode *Pred = C.getPredecessor();
994 // When there is an entry available for the return symbol in DynamicTypeMap,
995 // the call was inlined, and the information in the DynamicTypeMap is should
996 // be precise.
997 if (RetRegion && !getRawDynamicTypeInfo(State, RetRegion)) {
998 // TODO: we have duplicated information in DynamicTypeMap and
999 // MostSpecializedTypeArgsMap. We should only store anything in the later if
1000 // the stored data differs from the one stored in the former.
1001 State = setDynamicTypeInfo(State, RetRegion, ResultType,
1002 /*CanBeSubClassed=*/true);
1003 Pred = C.addTransition(State);
1004 }
1005
1006 const auto *ResultPtrType = ResultType->getAs<ObjCObjectPointerType>();
1007
1008 if (!ResultPtrType || ResultPtrType->isUnspecialized())
1009 return;
1010
1011 // When the result is a specialized type and it is not tracked yet, track it
1012 // for the result symbol.
1013 if (!State->get<MostSpecializedTypeArgsMap>(RetSym)) {
1014 State = State->set<MostSpecializedTypeArgsMap>(RetSym, ResultPtrType);
1015 C.addTransition(State, Pred);
1016 }
1017}
1018
1019void DynamicTypePropagation::reportGenericsBug(
1020 const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
1022 const Stmt *ReportedNode) const {
1023 if (!CheckGenerics)
1024 return;
1025
1026 initBugType();
1027 SmallString<192> Buf;
1028 llvm::raw_svector_ostream OS(Buf);
1029 OS << "Conversion from value of type '";
1030 QualType::print(From, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
1031 OS << "' to incompatible type '";
1032 QualType::print(To, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
1033 OS << "'";
1034 auto R = std::make_unique<PathSensitiveBugReport>(*ObjCGenericsBugType,
1035 OS.str(), N);
1036 R->markInteresting(Sym);
1037 R->addVisitor(std::make_unique<GenericsBugVisitor>(Sym));
1038 if (ReportedNode)
1039 R->addRange(ReportedNode->getSourceRange());
1040 C.emitReport(std::move(R));
1041}
1042
1043PathDiagnosticPieceRef DynamicTypePropagation::GenericsBugVisitor::VisitNode(
1044 const ExplodedNode *N, BugReporterContext &BRC,
1046 ProgramStateRef state = N->getState();
1047 ProgramStateRef statePrev = N->getFirstPred()->getState();
1048
1049 const ObjCObjectPointerType *const *TrackedType =
1050 state->get<MostSpecializedTypeArgsMap>(Sym);
1051 const ObjCObjectPointerType *const *TrackedTypePrev =
1052 statePrev->get<MostSpecializedTypeArgsMap>(Sym);
1053 if (!TrackedType)
1054 return nullptr;
1055
1056 if (TrackedTypePrev && *TrackedTypePrev == *TrackedType)
1057 return nullptr;
1058
1059 // Retrieve the associated statement.
1060 const Stmt *S = N->getStmtForDiagnostics();
1061 if (!S)
1062 return nullptr;
1063
1064 const LangOptions &LangOpts = BRC.getASTContext().getLangOpts();
1065
1066 SmallString<256> Buf;
1067 llvm::raw_svector_ostream OS(Buf);
1068 OS << "Type '";
1069 QualType::print(*TrackedType, Qualifiers(), OS, LangOpts, llvm::Twine());
1070 OS << "' is inferred from ";
1071
1072 if (const auto *ExplicitCast = dyn_cast<ExplicitCastExpr>(S)) {
1073 OS << "explicit cast (from '";
1074 QualType::print(ExplicitCast->getSubExpr()->getType().getTypePtr(),
1075 Qualifiers(), OS, LangOpts, llvm::Twine());
1076 OS << "' to '";
1077 QualType::print(ExplicitCast->getType().getTypePtr(), Qualifiers(), OS,
1078 LangOpts, llvm::Twine());
1079 OS << "')";
1080 } else if (const auto *ImplicitCast = dyn_cast<ImplicitCastExpr>(S)) {
1081 OS << "implicit cast (from '";
1082 QualType::print(ImplicitCast->getSubExpr()->getType().getTypePtr(),
1083 Qualifiers(), OS, LangOpts, llvm::Twine());
1084 OS << "' to '";
1085 QualType::print(ImplicitCast->getType().getTypePtr(), Qualifiers(), OS,
1086 LangOpts, llvm::Twine());
1087 OS << "')";
1088 } else {
1089 OS << "this context";
1090 }
1091
1092 // Generate the extra diagnostic.
1094 N->getLocationContext());
1095 return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true);
1096}
1097
1098/// Register checkers.
1099void ento::registerObjCGenericsChecker(CheckerManager &mgr) {
1100 DynamicTypePropagation *checker = mgr.getChecker<DynamicTypePropagation>();
1101 checker->CheckGenerics = true;
1102 checker->GenericCheckName = mgr.getCurrentCheckerName();
1103}
1104
1105bool ento::shouldRegisterObjCGenericsChecker(const CheckerManager &mgr) {
1106 return true;
1107}
1108
1109void ento::registerDynamicTypePropagation(CheckerManager &mgr) {
1110 mgr.registerChecker<DynamicTypePropagation>();
1111}
1112
1113bool ento::shouldRegisterDynamicTypePropagation(const CheckerManager &mgr) {
1114 return true;
1115}
static char ID
Definition: Arena.cpp:183
Defines enum values for all the target-independent builtin functions.
static QualType getReturnTypeForMethod(const ObjCMethodDecl *Method, ArrayRef< QualType > TypeArgs, const ObjCObjectPointerType *SelfType, ASTContext &C)
Get the returned ObjCObjectPointerType by a method based on the tracked type information,...
static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD, CheckerContext &C)
static const ObjCObjectPointerType * getMostInformativeDerivedClassImpl(const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, const ObjCObjectPointerType *MostInformativeCandidate, ASTContext &C)
static const ObjCMethodDecl * findMethodDecl(const ObjCMessageExpr *MessageExpr, const ObjCObjectPointerType *TrackedType, ASTContext &ASTCtxt)
A method might not be available in the interface indicated by the static type. However it might be av...
static bool isObjCTypeParamDependent(QualType Type)
static const Expr * stripCastsAndSugar(const Expr *E)
static const ObjCObjectPointerType * getMostInformativeDerivedClass(const ObjCObjectPointerType *From, const ObjCObjectPointerType *To, ASTContext &C)
A downcast may loose specialization information. E. g.: MutableMap<T, U> : Map The downcast to Mutabl...
static bool storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym, const ObjCObjectPointerType *const *Current, const ObjCObjectPointerType *StaticLowerBound, const ObjCObjectPointerType *StaticUpperBound, ASTContext &C)
Inputs:
#define X(type, name)
Definition: Value.h:143
llvm::MachO::Target Target
Definition: MachO.h:48
#define REGISTER_MAP_WITH_PROGRAMSTATE(Name, Key, Value)
Declares an immutable map of type NameTy, suitable for placement into the ProgramState.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:182
QualType getRecordType(const RecordDecl *Decl) const
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
bool canAssignObjCInterfaces(const ObjCObjectPointerType *LHSOPT, const ObjCObjectPointerType *RHSOPT)
canAssignObjCInterfaces - Return true if the two interface types are compatible for assignment from R...
const LangOptions & getLangOpts() const
Definition: ASTContext.h:775
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2057
const CXXRecordDecl * getParent() const
Return the parent of this method declaration, which is the class in which this method is defined.
Definition: DeclCXX.h:2183
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)".
Definition: ExprCXX.h:2234
bool isArray() const
Definition: ExprCXX.h:2342
CastExpr - Base class for type casts, including both implicit casts (ImplicitCastExpr) and explicit c...
Definition: Expr.h:3483
CastKind getCastKind() const
Definition: Expr.h:3527
Expr * getSubExpr()
Definition: Expr.h:3533
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:85
DeclContext * getDeclContext()
Definition: DeclBase.h:455
This represents one expression.
Definition: Expr.h:110
Expr * IgnoreParenImpCasts() LLVM_READONLY
Skip past any parentheses and implicit casts which might surround this expression until reaching a fi...
Definition: Expr.cpp:3059
QualType getType() const
Definition: Expr.h:142
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:454
It wraps the AnalysisDeclContext to represent both the call stack with the help of StackFrameContext ...
const Decl * getDecl() const
const ParentMap & getParentMap() const
Represents an ObjC class declaration.
Definition: DeclObjC.h:1152
ObjCMethodDecl * lookupClassMethod(Selector Sel) const
Lookup a class method for a given selector.
Definition: DeclObjC.h:1848
ObjCMethodDecl * lookupInstanceMethod(Selector Sel) const
Lookup an instance method for a given selector.
Definition: DeclObjC.h:1843
ObjCInterfaceDecl * getCanonicalDecl() override
Retrieves the canonical declaration of this Objective-C class.
Definition: DeclObjC.h:1911
bool isSuperClassOf(const ObjCInterfaceDecl *I) const
isSuperClassOf - Return true if this class is the specified class or is a super class of the specifie...
Definition: DeclObjC.h:1806
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:945
Expr * getArg(unsigned Arg)
getArg - Return the specified argument.
Definition: ExprObjC.h:1395
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1260
Selector getSelector() const
Definition: ExprObjC.cpp:293
@ SuperInstance
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:959
@ Instance
The receiver is an object instance.
Definition: ExprObjC.h:953
@ SuperClass
The receiver is a superclass.
Definition: ExprObjC.h:956
@ Class
The receiver is a class.
Definition: ExprObjC.h:950
QualType getClassReceiver() const
Returns the type of a class message send, or NULL if the message is not a class message.
Definition: ExprObjC.h:1279
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1336
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1356
ReceiverKind getReceiverKind() const
Determine the kind of receiver that this message is being sent to.
Definition: ExprObjC.h:1234
QualType getReceiverType() const
Retrieve the receiver type to which this message is being directed.
Definition: ExprObjC.cpp:300
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:140
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:373
unsigned param_size() const
Definition: DeclObjC.h:347
bool hasRelatedResultType() const
Determine whether this method has a result type that is related to the message receiver's type.
Definition: DeclObjC.h:256
QualType getReturnType() const
Definition: DeclObjC.h:329
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1210
Represents a pointer to an Objective C object.
Definition: Type.h:6798
bool isSpecialized() const
Whether this type is specialized, meaning that it has type arguments.
Definition: Type.h:6887
const ObjCObjectPointerType * stripObjCKindOfTypeAndQuals(const ASTContext &ctx) const
Strip off the Objective-C "kindof" type and (with it) any protocol qualifiers.
Definition: Type.cpp:899
const ObjCObjectType * getObjectType() const
Gets the type pointed to by this ObjC pointer.
Definition: Type.h:6835
bool isUnspecialized() const
Whether this type is unspecialized, meaning that is has no type arguments.
Definition: Type.h:6895
bool isObjCIdType() const
True if this is equivalent to the 'id' type, i.e.
Definition: Type.h:6856
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface.
Definition: Type.h:6850
Represents a class type in Objective C.
Definition: Type.h:6544
QualType getSuperClassType() const
Retrieve the type of the superclass of this object type.
Definition: Type.h:6670
Represents the declaration of an Objective-C type parameter.
Definition: DeclObjC.h:578
Stores a list of Objective-C type parameters for a parameterized class or a category/extension thereo...
Definition: DeclObjC.h:658
Represents a type parameter type in Objective C.
Definition: Type.h:6470
OpaqueValueExpr - An expression referring to an opaque object of a fixed type and value class.
Definition: Expr.h:1168
Stmt * getParent(Stmt *) const
Definition: ParentMap.cpp:136
Represents a parameter to a function.
Definition: Decl.h:1761
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2929
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:6305
A (possibly-)qualified type.
Definition: Type.h:738
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:805
void print(raw_ostream &OS, const PrintingPolicy &Policy, const Twine &PlaceHolder=Twine(), unsigned Indentation=0) const
QualType getCanonicalType() const
Definition: Type.h:7201
QualType substObjCTypeArgs(ASTContext &ctx, ArrayRef< QualType > typeArgs, ObjCSubstitutionContext context) const
Substitute type arguments for the Objective-C type parameters used in the subject type.
Definition: Type.cpp:1595
The collection of all-type qualifiers we support.
Definition: Type.h:148
A class that does preorder or postorder depth-first traversal on the entire Clang AST and visits each...
Smart pointer class that efficiently represents Objective-C method names.
std::string getAsString() const
Derive the full selector name (e.g.
Stmt - This represents one statement.
Definition: Stmt.h:84
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:326
The base class of the type hierarchy.
Definition: Type.h:1607
const T * castAs() const
Member-template castAs<specific type>.
Definition: Type.h:7980
bool isObjCIdType() const
Definition: Type.h:7567
bool isObjCClassType() const
Definition: Type.h:7573
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7913
QualType getType() const
Definition: Decl.h:717
ASTContext & getASTContext() const
Definition: BugReporter.h:733
const SourceManager & getSourceManager() const
Definition: BugReporter.h:737
BugReporterVisitors are used to add custom diagnostics along a path.
Represents a call to a C++ constructor.
Definition: CallEvent.h:979
Represents an implicit call to a C++ destructor.
Definition: CallEvent.h:890
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:153
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:308
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:322
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
CheckerNameRef getCurrentCheckerName() const
This wrapper is used to ensure that only StringRefs originating from the CheckerRegistry are used as ...
Tag that can use a checker name as a message provider (see SimpleProgramPointTag).
Definition: Checker.h:505
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
const ProgramStateRef & getState() const
const Stmt * getStmtForDiagnostics() const
If the node's program point corresponds to a statement, retrieve that statement.
const LocationContext * getLocationContext() const
ExplodedNode * getFirstPred()
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:96
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:1243
const ObjCMessageExpr * getOriginExpr() const override
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:1269
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:1004
SVal - This represents a symbolic expression, which can be either an L-value or an R-value.
Definition: SVals.h:55
SymbolRef getAsSymbol(bool IncludeBaseRegions=false) const
If this SVal wraps a symbol return that SymbolRef.
Definition: SVals.cpp:104
const MemRegion * getAsRegion() const
Definition: SVals.cpp:120
Symbolic value.
Definition: SymExpr.h:30
A class responsible for cleaning up unused symbols.
bool isDead(SymbolRef sym)
Returns whether or not a symbol has been confirmed dead.
const char *const CoreFoundationObjectiveC
ProgramStateRef setClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym, DynamicTypeInfo NewTy)
Set constraint on a type contained in a class object; return the new state.
ProgramStateRef removeDeadClassObjectTypes(ProgramStateRef State, SymbolReaper &SR)
Removes the dead Class object type informations from State.
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get dynamic type information for the region MR.
const DynamicTypeInfo * getRawDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR)
Get raw dynamic type information for the region MR.
ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR, DynamicTypeInfo NewTy)
Set dynamic type information of the region; return the new state.
ProgramStateRef removeDeadTypes(ProgramStateRef State, SymbolReaper &SR)
Removes the dead type informations from State.
std::shared_ptr< PathDiagnosticPiece > PathDiagnosticPieceRef
DynamicTypeInfo getClassObjectDynamicTypeInfo(ProgramStateRef State, SymbolRef Sym)
Get dynamic type information stored in a class object represented by Sym.
The JSON file list parser is used to communicate input to InstallAPI.
@ Interface
The "__interface" keyword introduces the elaborated-type-specifier.
#define bool
Definition: stdbool.h:20