clang  9.0.0svn
ExprEngineCallAndReturn.cpp
Go to the documentation of this file.
1 //=-- ExprEngineCallAndReturn.cpp - Support for call/return -----*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This file defines ExprEngine's support for calls and returns.
10 //
11 //===----------------------------------------------------------------------===//
12 
16 #include "clang/AST/DeclCXX.h"
21 #include "llvm/ADT/SmallSet.h"
22 #include "llvm/ADT/Statistic.h"
23 #include "llvm/Support/SaveAndRestore.h"
24 
25 using namespace clang;
26 using namespace ento;
27 
28 #define DEBUG_TYPE "ExprEngine"
29 
30 STATISTIC(NumOfDynamicDispatchPathSplits,
31  "The # of times we split the path due to imprecise dynamic dispatch info");
32 
33 STATISTIC(NumInlinedCalls,
34  "The # of times we inlined a call");
35 
36 STATISTIC(NumReachedInlineCountMax,
37  "The # of times we reached inline count maximum");
38 
40  ExplodedNode *Pred) {
41  // Get the entry block in the CFG of the callee.
42  const StackFrameContext *calleeCtx = CE.getCalleeContext();
43  PrettyStackTraceLocationContext CrashInfo(calleeCtx);
44  const CFGBlock *Entry = CE.getEntry();
45 
46  // Validate the CFG.
47  assert(Entry->empty());
48  assert(Entry->succ_size() == 1);
49 
50  // Get the solitary successor.
51  const CFGBlock *Succ = *(Entry->succ_begin());
52 
53  // Construct an edge representing the starting location in the callee.
54  BlockEdge Loc(Entry, Succ, calleeCtx);
55 
56  ProgramStateRef state = Pred->getState();
57 
58  // Construct a new node, notify checkers that analysis of the function has
59  // begun, and add the resultant nodes to the worklist.
60  bool isNew;
61  ExplodedNode *Node = G.getNode(Loc, state, false, &isNew);
62  Node->addPredecessor(Pred, G);
63  if (isNew) {
64  ExplodedNodeSet DstBegin;
65  processBeginOfFunction(BC, Node, DstBegin, Loc);
66  Engine.enqueue(DstBegin);
67  }
68 }
69 
70 // Find the last statement on the path to the exploded node and the
71 // corresponding Block.
72 static std::pair<const Stmt*,
73  const CFGBlock*> getLastStmt(const ExplodedNode *Node) {
74  const Stmt *S = nullptr;
75  const CFGBlock *Blk = nullptr;
76  const StackFrameContext *SF = Node->getStackFrame();
77 
78  // Back up through the ExplodedGraph until we reach a statement node in this
79  // stack frame.
80  while (Node) {
81  const ProgramPoint &PP = Node->getLocation();
82 
83  if (PP.getStackFrame() == SF) {
84  if (Optional<StmtPoint> SP = PP.getAs<StmtPoint>()) {
85  S = SP->getStmt();
86  break;
87  } else if (Optional<CallExitEnd> CEE = PP.getAs<CallExitEnd>()) {
88  S = CEE->getCalleeContext()->getCallSite();
89  if (S)
90  break;
91 
92  // If there is no statement, this is an implicitly-generated call.
93  // We'll walk backwards over it and then continue the loop to find
94  // an actual statement.
96  do {
97  Node = Node->getFirstPred();
98  CE = Node->getLocationAs<CallEnter>();
99  } while (!CE || CE->getCalleeContext() != CEE->getCalleeContext());
100 
101  // Continue searching the graph.
102  } else if (Optional<BlockEdge> BE = PP.getAs<BlockEdge>()) {
103  Blk = BE->getSrc();
104  }
105  } else if (Optional<CallEnter> CE = PP.getAs<CallEnter>()) {
106  // If we reached the CallEnter for this function, it has no statements.
107  if (CE->getCalleeContext() == SF)
108  break;
109  }
110 
111  if (Node->pred_empty())
112  return std::make_pair(nullptr, nullptr);
113 
114  Node = *Node->pred_begin();
115  }
116 
117  return std::make_pair(S, Blk);
118 }
119 
120 /// Adjusts a return value when the called function's return type does not
121 /// match the caller's expression type. This can happen when a dynamic call
122 /// is devirtualized, and the overriding method has a covariant (more specific)
123 /// return type than the parent's method. For C++ objects, this means we need
124 /// to add base casts.
125 static SVal adjustReturnValue(SVal V, QualType ExpectedTy, QualType ActualTy,
126  StoreManager &StoreMgr) {
127  // For now, the only adjustments we handle apply only to locations.
128  if (!V.getAs<Loc>())
129  return V;
130 
131  // If the types already match, don't do any unnecessary work.
132  ExpectedTy = ExpectedTy.getCanonicalType();
133  ActualTy = ActualTy.getCanonicalType();
134  if (ExpectedTy == ActualTy)
135  return V;
136 
137  // No adjustment is needed between Objective-C pointer types.
138  if (ExpectedTy->isObjCObjectPointerType() &&
139  ActualTy->isObjCObjectPointerType())
140  return V;
141 
142  // C++ object pointers may need "derived-to-base" casts.
143  const CXXRecordDecl *ExpectedClass = ExpectedTy->getPointeeCXXRecordDecl();
144  const CXXRecordDecl *ActualClass = ActualTy->getPointeeCXXRecordDecl();
145  if (ExpectedClass && ActualClass) {
146  CXXBasePaths Paths(/*FindAmbiguities=*/true, /*RecordPaths=*/true,
147  /*DetectVirtual=*/false);
148  if (ActualClass->isDerivedFrom(ExpectedClass, Paths) &&
149  !Paths.isAmbiguous(ActualTy->getCanonicalTypeUnqualified())) {
150  return StoreMgr.evalDerivedToBase(V, Paths.front());
151  }
152  }
153 
154  // Unfortunately, Objective-C does not enforce that overridden methods have
155  // covariant return types, so we can't assert that that never happens.
156  // Be safe and return UnknownVal().
157  return UnknownVal();
158 }
159 
161  ExplodedNode *Pred,
162  ExplodedNodeSet &Dst) {
163  // Find the last statement in the function and the corresponding basic block.
164  const Stmt *LastSt = nullptr;
165  const CFGBlock *Blk = nullptr;
166  std::tie(LastSt, Blk) = getLastStmt(Pred);
167  if (!Blk || !LastSt) {
168  Dst.Add(Pred);
169  return;
170  }
171 
172  // Here, we destroy the current location context. We use the current
173  // function's entire body as a diagnostic statement, with which the program
174  // point will be associated. However, we only want to use LastStmt as a
175  // reference for what to clean up if it's a ReturnStmt; otherwise, everything
176  // is dead.
177  SaveAndRestore<const NodeBuilderContext *> NodeContextRAII(currBldrCtx, &BC);
178  const LocationContext *LCtx = Pred->getLocationContext();
179  removeDead(Pred, Dst, dyn_cast<ReturnStmt>(LastSt), LCtx,
180  LCtx->getAnalysisDeclContext()->getBody(),
182 }
183 
184 static bool wasDifferentDeclUsedForInlining(CallEventRef<> Call,
185  const StackFrameContext *calleeCtx) {
186  const Decl *RuntimeCallee = calleeCtx->getDecl();
187  const Decl *StaticDecl = Call->getDecl();
188  assert(RuntimeCallee);
189  if (!StaticDecl)
190  return true;
191  return RuntimeCallee->getCanonicalDecl() != StaticDecl->getCanonicalDecl();
192 }
193 
194 /// The call exit is simulated with a sequence of nodes, which occur between
195 /// CallExitBegin and CallExitEnd. The following operations occur between the
196 /// two program points:
197 /// 1. CallExitBegin (triggers the start of call exit sequence)
198 /// 2. Bind the return value
199 /// 3. Run Remove dead bindings to clean up the dead symbols from the callee.
200 /// 4. CallExitEnd (switch to the caller context)
201 /// 5. PostStmt<CallExpr>
203  // Step 1 CEBNode was generated before the call.
205  const StackFrameContext *calleeCtx = CEBNode->getStackFrame();
206 
207  // The parent context might not be a stack frame, so make sure we
208  // look up the first enclosing stack frame.
209  const StackFrameContext *callerCtx =
210  calleeCtx->getParent()->getStackFrame();
211 
212  const Stmt *CE = calleeCtx->getCallSite();
213  ProgramStateRef state = CEBNode->getState();
214  // Find the last statement in the function and the corresponding basic block.
215  const Stmt *LastSt = nullptr;
216  const CFGBlock *Blk = nullptr;
217  std::tie(LastSt, Blk) = getLastStmt(CEBNode);
218 
219  // Generate a CallEvent /before/ cleaning the state, so that we can get the
220  // correct value for 'this' (if necessary).
222  CallEventRef<> Call = CEMgr.getCaller(calleeCtx, state);
223 
224  // Step 2: generate node with bound return value: CEBNode -> BindedRetNode.
225 
226  // If the callee returns an expression, bind its value to CallExpr.
227  if (CE) {
228  if (const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) {
229  const LocationContext *LCtx = CEBNode->getLocationContext();
230  SVal V = state->getSVal(RS, LCtx);
231 
232  // Ensure that the return type matches the type of the returned Expr.
233  if (wasDifferentDeclUsedForInlining(Call, calleeCtx)) {
234  QualType ReturnedTy =
235  CallEvent::getDeclaredResultType(calleeCtx->getDecl());
236  if (!ReturnedTy.isNull()) {
237  if (const Expr *Ex = dyn_cast<Expr>(CE)) {
238  V = adjustReturnValue(V, Ex->getType(), ReturnedTy,
239  getStoreManager());
240  }
241  }
242  }
243 
244  state = state->BindExpr(CE, callerCtx, V);
245  }
246 
247  // Bind the constructed object value to CXXConstructExpr.
248  if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) {
249  loc::MemRegionVal This =
250  svalBuilder.getCXXThis(CCE->getConstructor()->getParent(), calleeCtx);
251  SVal ThisV = state->getSVal(This);
252  ThisV = state->getSVal(ThisV.castAs<Loc>());
253  state = state->BindExpr(CCE, callerCtx, ThisV);
254  }
255 
256  if (const auto *CNE = dyn_cast<CXXNewExpr>(CE)) {
257  // We are currently evaluating a CXXNewAllocator CFGElement. It takes a
258  // while to reach the actual CXXNewExpr element from here, so keep the
259  // region for later use.
260  // Additionally cast the return value of the inlined operator new
261  // (which is of type 'void *') to the correct object type.
262  SVal AllocV = state->getSVal(CNE, callerCtx);
263  AllocV = svalBuilder.evalCast(
264  AllocV, CNE->getType(),
265  getContext().getPointerType(getContext().VoidTy));
266 
267  state = addObjectUnderConstruction(state, CNE, calleeCtx->getParent(),
268  AllocV);
269  }
270  }
271 
272  // Step 3: BindedRetNode -> CleanedNodes
273  // If we can find a statement and a block in the inlined function, run remove
274  // dead bindings before returning from the call. This is important to ensure
275  // that we report the issues such as leaks in the stack contexts in which
276  // they occurred.
277  ExplodedNodeSet CleanedNodes;
278  if (LastSt && Blk && AMgr.options.AnalysisPurgeOpt != PurgeNone) {
279  static SimpleProgramPointTag retValBind("ExprEngine", "Bind Return Value");
280  PostStmt Loc(LastSt, calleeCtx, &retValBind);
281  bool isNew;
282  ExplodedNode *BindedRetNode = G.getNode(Loc, state, false, &isNew);
283  BindedRetNode->addPredecessor(CEBNode, G);
284  if (!isNew)
285  return;
286 
287  NodeBuilderContext Ctx(getCoreEngine(), Blk, BindedRetNode);
288  currBldrCtx = &Ctx;
289  // Here, we call the Symbol Reaper with 0 statement and callee location
290  // context, telling it to clean up everything in the callee's context
291  // (and its children). We use the callee's function body as a diagnostic
292  // statement, with which the program point will be associated.
293  removeDead(BindedRetNode, CleanedNodes, nullptr, calleeCtx,
294  calleeCtx->getAnalysisDeclContext()->getBody(),
296  currBldrCtx = nullptr;
297  } else {
298  CleanedNodes.Add(CEBNode);
299  }
300 
301  for (ExplodedNodeSet::iterator I = CleanedNodes.begin(),
302  E = CleanedNodes.end(); I != E; ++I) {
303 
304  // Step 4: Generate the CallExit and leave the callee's context.
305  // CleanedNodes -> CEENode
306  CallExitEnd Loc(calleeCtx, callerCtx);
307  bool isNew;
308  ProgramStateRef CEEState = (*I == CEBNode) ? state : (*I)->getState();
309 
310  ExplodedNode *CEENode = G.getNode(Loc, CEEState, false, &isNew);
311  CEENode->addPredecessor(*I, G);
312  if (!isNew)
313  return;
314 
315  // Step 5: Perform the post-condition check of the CallExpr and enqueue the
316  // result onto the work list.
317  // CEENode -> Dst -> WorkList
318  NodeBuilderContext Ctx(Engine, calleeCtx->getCallSiteBlock(), CEENode);
319  SaveAndRestore<const NodeBuilderContext*> NBCSave(currBldrCtx,
320  &Ctx);
321  SaveAndRestore<unsigned> CBISave(currStmtIdx, calleeCtx->getIndex());
322 
323  CallEventRef<> UpdatedCall = Call.cloneWithState(CEEState);
324 
325  ExplodedNodeSet DstPostCall;
326  if (const CXXNewExpr *CNE = dyn_cast_or_null<CXXNewExpr>(CE)) {
327  ExplodedNodeSet DstPostPostCallCallback;
328  getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
329  CEENode, *UpdatedCall, *this,
330  /*WasInlined=*/true);
331  for (auto I : DstPostPostCallCallback) {
333  CNE,
334  *getObjectUnderConstruction(I->getState(), CNE,
335  calleeCtx->getParent()),
336  DstPostCall, I, *this,
337  /*WasInlined=*/true);
338  }
339  } else {
340  getCheckerManager().runCheckersForPostCall(DstPostCall, CEENode,
341  *UpdatedCall, *this,
342  /*WasInlined=*/true);
343  }
344  ExplodedNodeSet Dst;
345  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(Call)) {
346  getCheckerManager().runCheckersForPostObjCMessage(Dst, DstPostCall, *Msg,
347  *this,
348  /*WasInlined=*/true);
349  } else if (CE &&
350  !(isa<CXXNewExpr>(CE) && // Called when visiting CXXNewExpr.
351  AMgr.getAnalyzerOptions().MayInlineCXXAllocator)) {
352  getCheckerManager().runCheckersForPostStmt(Dst, DstPostCall, CE,
353  *this, /*WasInlined=*/true);
354  } else {
355  Dst.insert(DstPostCall);
356  }
357 
358  // Enqueue the next element in the block.
359  for (ExplodedNodeSet::iterator PSI = Dst.begin(), PSE = Dst.end();
360  PSI != PSE; ++PSI) {
361  Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(),
362  calleeCtx->getIndex()+1);
363  }
364  }
365 }
366 
367 void ExprEngine::examineStackFrames(const Decl *D, const LocationContext *LCtx,
368  bool &IsRecursive, unsigned &StackDepth) {
369  IsRecursive = false;
370  StackDepth = 0;
371 
372  while (LCtx) {
373  if (const StackFrameContext *SFC = dyn_cast<StackFrameContext>(LCtx)) {
374  const Decl *DI = SFC->getDecl();
375 
376  // Mark recursive (and mutually recursive) functions and always count
377  // them when measuring the stack depth.
378  if (DI == D) {
379  IsRecursive = true;
380  ++StackDepth;
381  LCtx = LCtx->getParent();
382  continue;
383  }
384 
385  // Do not count the small functions when determining the stack depth.
386  AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(DI);
387  const CFG *CalleeCFG = CalleeADC->getCFG();
388  if (CalleeCFG->getNumBlockIDs() > AMgr.options.AlwaysInlineSize)
389  ++StackDepth;
390  }
391  LCtx = LCtx->getParent();
392  }
393 }
394 
395 // The GDM component containing the dynamic dispatch bifurcation info. When
396 // the exact type of the receiver is not known, we want to explore both paths -
397 // one on which we do inline it and the other one on which we don't. This is
398 // done to ensure we do not drop coverage.
399 // This is the map from the receiver region to a bool, specifying either we
400 // consider this region's information precise or not along the given path.
401 namespace {
403  DynamicDispatchModeInlined = 1,
404  DynamicDispatchModeConservative
405  };
406 } // end anonymous namespace
407 
408 REGISTER_MAP_WITH_PROGRAMSTATE(DynamicDispatchBifurcationMap,
409  const MemRegion *, unsigned)
410 
411 bool ExprEngine::inlineCall(const CallEvent &Call, const Decl *D,
412  NodeBuilder &Bldr, ExplodedNode *Pred,
414  assert(D);
415 
416  const LocationContext *CurLC = Pred->getLocationContext();
417  const StackFrameContext *CallerSFC = CurLC->getStackFrame();
418  const LocationContext *ParentOfCallee = CallerSFC;
419  if (Call.getKind() == CE_Block &&
420  !cast<BlockCall>(Call).isConversionFromLambda()) {
421  const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion();
422  assert(BR && "If we have the block definition we should have its region");
423  AnalysisDeclContext *BlockCtx = AMgr.getAnalysisDeclContext(D);
424  ParentOfCallee = BlockCtx->getBlockInvocationContext(CallerSFC,
425  cast<BlockDecl>(D),
426  BR);
427  }
428 
429  // This may be NULL, but that's fine.
430  const Expr *CallE = Call.getOriginExpr();
431 
432  // Construct a new stack frame for the callee.
433  AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D);
434  const StackFrameContext *CalleeSFC =
435  CalleeADC->getStackFrame(ParentOfCallee, CallE,
436  currBldrCtx->getBlock(),
437  currStmtIdx);
438 
439  CallEnter Loc(CallE, CalleeSFC, CurLC);
440 
441  // Construct a new state which contains the mapping from actual to
442  // formal arguments.
443  State = State->enterStackFrame(Call, CalleeSFC);
444 
445  bool isNew;
446  if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) {
447  N->addPredecessor(Pred, G);
448  if (isNew)
449  Engine.getWorkList()->enqueue(N);
450  }
451 
452  // If we decided to inline the call, the successor has been manually
453  // added onto the work list so remove it from the node builder.
454  Bldr.takeNodes(Pred);
455 
456  NumInlinedCalls++;
457  Engine.FunctionSummaries->bumpNumTimesInlined(D);
458 
459  // Mark the decl as visited.
460  if (VisitedCallees)
461  VisitedCallees->insert(D);
462 
463  return true;
464 }
465 
467  const Stmt *CallE) {
468  const void *ReplayState = State->get<ReplayWithoutInlining>();
469  if (!ReplayState)
470  return nullptr;
471 
472  assert(ReplayState == CallE && "Backtracked to the wrong call.");
473  (void)CallE;
474 
475  return State->remove<ReplayWithoutInlining>();
476 }
477 
479  ExplodedNodeSet &dst) {
480  // Perform the previsit of the CallExpr.
481  ExplodedNodeSet dstPreVisit;
482  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, CE, *this);
483 
484  // Get the call in its initial state. We use this as a template to perform
485  // all the checks.
487  CallEventRef<> CallTemplate
488  = CEMgr.getSimpleCall(CE, Pred->getState(), Pred->getLocationContext());
489 
490  // Evaluate the function call. We try each of the checkers
491  // to see if the can evaluate the function call.
492  ExplodedNodeSet dstCallEvaluated;
493  for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
494  I != E; ++I) {
495  evalCall(dstCallEvaluated, *I, *CallTemplate);
496  }
497 
498  // Finally, perform the post-condition check of the CallExpr and store
499  // the created nodes in 'Dst'.
500  // Note that if the call was inlined, dstCallEvaluated will be empty.
501  // The post-CallExpr check will occur in processCallExit.
502  getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE,
503  *this);
504 }
505 
506 ProgramStateRef ExprEngine::finishArgumentConstruction(ProgramStateRef State,
507  const CallEvent &Call) {
508  const Expr *E = Call.getOriginExpr();
509  // FIXME: Constructors to placement arguments of operator new
510  // are not supported yet.
511  if (!E || isa<CXXNewExpr>(E))
512  return State;
513 
514  const LocationContext *LC = Call.getLocationContext();
515  for (unsigned CallI = 0, CallN = Call.getNumArgs(); CallI != CallN; ++CallI) {
516  unsigned I = Call.getASTArgumentIndex(CallI);
517  if (Optional<SVal> V =
518  getObjectUnderConstruction(State, {E, I}, LC)) {
519  SVal VV = *V;
520  (void)VV;
521  assert(cast<VarRegion>(VV.castAs<loc::MemRegionVal>().getRegion())
522  ->getStackFrame()->getParent()
523  ->getStackFrame() == LC->getStackFrame());
524  State = finishObjectConstruction(State, {E, I}, LC);
525  }
526  }
527 
528  return State;
529 }
530 
531 void ExprEngine::finishArgumentConstruction(ExplodedNodeSet &Dst,
532  ExplodedNode *Pred,
533  const CallEvent &Call) {
534  ProgramStateRef State = Pred->getState();
535  ProgramStateRef CleanedState = finishArgumentConstruction(State, Call);
536  if (CleanedState == State) {
537  Dst.insert(Pred);
538  return;
539  }
540 
541  const Expr *E = Call.getOriginExpr();
542  const LocationContext *LC = Call.getLocationContext();
543  NodeBuilder B(Pred, Dst, *currBldrCtx);
544  static SimpleProgramPointTag Tag("ExprEngine",
545  "Finish argument construction");
546  PreStmt PP(E, LC, &Tag);
547  B.generateNode(PP, CleanedState, Pred);
548 }
549 
551  const CallEvent &Call) {
552  // WARNING: At this time, the state attached to 'Call' may be older than the
553  // state in 'Pred'. This is a minor optimization since CheckerManager will
554  // use an updated CallEvent instance when calling checkers, but if 'Call' is
555  // ever used directly in this function all callers should be updated to pass
556  // the most recent state. (It is probably not worth doing the work here since
557  // for some callers this will not be necessary.)
558 
559  // Run any pre-call checks using the generic call interface.
560  ExplodedNodeSet dstPreVisit;
561  getCheckerManager().runCheckersForPreCall(dstPreVisit, Pred,
562  Call, *this);
563 
564  // Actually evaluate the function call. We try each of the checkers
565  // to see if the can evaluate the function call, and get a callback at
566  // defaultEvalCall if all of them fail.
567  ExplodedNodeSet dstCallEvaluated;
568  getCheckerManager().runCheckersForEvalCall(dstCallEvaluated, dstPreVisit,
569  Call, *this);
570 
571  // If there were other constructors called for object-type arguments
572  // of this call, clean them up.
573  ExplodedNodeSet dstArgumentCleanup;
574  for (auto I : dstCallEvaluated)
575  finishArgumentConstruction(dstArgumentCleanup, I, Call);
576 
577  // Finally, run any post-call checks.
578  getCheckerManager().runCheckersForPostCall(Dst, dstArgumentCleanup,
579  Call, *this);
580 }
581 
583  const LocationContext *LCtx,
584  ProgramStateRef State) {
585  const Expr *E = Call.getOriginExpr();
586  if (!E)
587  return State;
588 
589  // Some method families have known return values.
590  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
591  switch (Msg->getMethodFamily()) {
592  default:
593  break;
594  case OMF_autorelease:
595  case OMF_retain:
596  case OMF_self: {
597  // These methods return their receivers.
598  return State->BindExpr(E, LCtx, Msg->getReceiverSVal());
599  }
600  }
601  } else if (const CXXConstructorCall *C = dyn_cast<CXXConstructorCall>(&Call)){
602  SVal ThisV = C->getCXXThisVal();
603  ThisV = State->getSVal(ThisV.castAs<Loc>());
604  return State->BindExpr(E, LCtx, ThisV);
605  }
606 
607  SVal R;
608  QualType ResultTy = Call.getResultType();
609  unsigned Count = currBldrCtx->blockCount();
610  if (auto RTC = getCurrentCFGElement().getAs<CFGCXXRecordTypedCall>()) {
611  // Conjure a temporary if the function returns an object by value.
612  SVal Target;
613  assert(RTC->getStmt() == Call.getOriginExpr());
614  EvalCallOptions CallOpts; // FIXME: We won't really need those.
615  std::tie(State, Target) =
616  prepareForObjectConstruction(Call.getOriginExpr(), State, LCtx,
617  RTC->getConstructionContext(), CallOpts);
618  assert(Target.getAsRegion());
619  // Invalidate the region so that it didn't look uninitialized. Don't notify
620  // the checkers.
621  State = State->invalidateRegions(Target.getAsRegion(), E, Count, LCtx,
622  /* CausedByPointerEscape=*/false, nullptr,
623  &Call, nullptr);
624 
625  R = State->getSVal(Target.castAs<Loc>(), E->getType());
626  } else {
627  // Conjure a symbol if the return value is unknown.
628 
629  // See if we need to conjure a heap pointer instead of
630  // a regular unknown pointer.
631  bool IsHeapPointer = false;
632  if (const auto *CNE = dyn_cast<CXXNewExpr>(E))
633  if (CNE->getOperatorNew()->isReplaceableGlobalAllocationFunction()) {
634  // FIXME: Delegate this to evalCall in MallocChecker?
635  IsHeapPointer = true;
636  }
637 
638  R = IsHeapPointer ? svalBuilder.getConjuredHeapSymbolVal(E, LCtx, Count)
639  : svalBuilder.conjureSymbolVal(nullptr, E, LCtx, ResultTy,
640  Count);
641  }
642  return State->BindExpr(E, LCtx, R);
643 }
644 
645 // Conservatively evaluate call by invalidating regions and binding
646 // a conjured return value.
647 void ExprEngine::conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
648  ExplodedNode *Pred,
649  ProgramStateRef State) {
650  State = Call.invalidateRegions(currBldrCtx->blockCount(), State);
651  State = bindReturnValue(Call, Pred->getLocationContext(), State);
652 
653  // And make the result node.
654  Bldr.generateNode(Call.getProgramPoint(), State, Pred);
655 }
656 
657 ExprEngine::CallInlinePolicy
658 ExprEngine::mayInlineCallKind(const CallEvent &Call, const ExplodedNode *Pred,
659  AnalyzerOptions &Opts,
660  const ExprEngine::EvalCallOptions &CallOpts) {
661  const LocationContext *CurLC = Pred->getLocationContext();
662  const StackFrameContext *CallerSFC = CurLC->getStackFrame();
663  switch (Call.getKind()) {
664  case CE_Function:
665  case CE_Block:
666  break;
667  case CE_CXXMember:
670  return CIP_DisallowedAlways;
671  break;
672  case CE_CXXConstructor: {
674  return CIP_DisallowedAlways;
675 
676  const CXXConstructorCall &Ctor = cast<CXXConstructorCall>(Call);
677 
678  const CXXConstructExpr *CtorExpr = Ctor.getOriginExpr();
679 
680  auto CCE = getCurrentCFGElement().getAs<CFGConstructor>();
681  const ConstructionContext *CC = CCE ? CCE->getConstructionContext()
682  : nullptr;
683 
684  if (CC && isa<NewAllocatedObjectConstructionContext>(CC) &&
685  !Opts.MayInlineCXXAllocator)
686  return CIP_DisallowedOnce;
687 
688  // FIXME: We don't handle constructors or destructors for arrays properly.
689  // Even once we do, we still need to be careful about implicitly-generated
690  // initializers for array fields in default move/copy constructors.
691  // We still allow construction into ElementRegion targets when they don't
692  // represent array elements.
693  if (CallOpts.IsArrayCtorOrDtor)
694  return CIP_DisallowedOnce;
695 
696  // Inlining constructors requires including initializers in the CFG.
697  const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
698  assert(ADC->getCFGBuildOptions().AddInitializers && "No CFG initializers");
699  (void)ADC;
700 
701  // If the destructor is trivial, it's always safe to inline the constructor.
702  if (Ctor.getDecl()->getParent()->hasTrivialDestructor())
703  break;
704 
705  // For other types, only inline constructors if destructor inlining is
706  // also enabled.
708  return CIP_DisallowedAlways;
709 
710  if (CtorExpr->getConstructionKind() == CXXConstructExpr::CK_Complete) {
711  // If we don't handle temporary destructors, we shouldn't inline
712  // their constructors.
713  if (CallOpts.IsTemporaryCtorOrDtor &&
714  !Opts.ShouldIncludeTemporaryDtorsInCFG)
715  return CIP_DisallowedOnce;
716 
717  // If we did not find the correct this-region, it would be pointless
718  // to inline the constructor. Instead we will simply invalidate
719  // the fake temporary target.
721  return CIP_DisallowedOnce;
722 
723  // If the temporary is lifetime-extended by binding it to a reference-type
724  // field within an aggregate, automatic destructors don't work properly.
726  return CIP_DisallowedOnce;
727  }
728 
729  break;
730  }
731  case CE_CXXDestructor: {
733  return CIP_DisallowedAlways;
734 
735  // Inlining destructors requires building the CFG correctly.
736  const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
737  assert(ADC->getCFGBuildOptions().AddImplicitDtors && "No CFG destructors");
738  (void)ADC;
739 
740  // FIXME: We don't handle constructors or destructors for arrays properly.
741  if (CallOpts.IsArrayCtorOrDtor)
742  return CIP_DisallowedOnce;
743 
744  // Allow disabling temporary destructor inlining with a separate option.
745  if (CallOpts.IsTemporaryCtorOrDtor &&
746  !Opts.MayInlineCXXTemporaryDtors)
747  return CIP_DisallowedOnce;
748 
749  // If we did not find the correct this-region, it would be pointless
750  // to inline the destructor. Instead we will simply invalidate
751  // the fake temporary target.
753  return CIP_DisallowedOnce;
754  break;
755  }
756  case CE_CXXAllocator:
757  if (Opts.MayInlineCXXAllocator)
758  break;
759  // Do not inline allocators until we model deallocators.
760  // This is unfortunate, but basically necessary for smart pointers and such.
761  return CIP_DisallowedAlways;
762  case CE_ObjCMessage:
763  if (!Opts.MayInlineObjCMethod)
764  return CIP_DisallowedAlways;
765  if (!(Opts.getIPAMode() == IPAK_DynamicDispatch ||
767  return CIP_DisallowedAlways;
768  break;
769  }
770 
771  return CIP_Allowed;
772 }
773 
774 /// Returns true if the given C++ class contains a member with the given name.
775 static bool hasMember(const ASTContext &Ctx, const CXXRecordDecl *RD,
776  StringRef Name) {
777  const IdentifierInfo &II = Ctx.Idents.get(Name);
778  DeclarationName DeclName = Ctx.DeclarationNames.getIdentifier(&II);
779  if (!RD->lookup(DeclName).empty())
780  return true;
781 
782  CXXBasePaths Paths(false, false, false);
783  if (RD->lookupInBases(
784  [DeclName](const CXXBaseSpecifier *Specifier, CXXBasePath &Path) {
785  return CXXRecordDecl::FindOrdinaryMember(Specifier, Path, DeclName);
786  },
787  Paths))
788  return true;
789 
790  return false;
791 }
792 
793 /// Returns true if the given C++ class is a container or iterator.
794 ///
795 /// Our heuristic for this is whether it contains a method named 'begin()' or a
796 /// nested type named 'iterator' or 'iterator_category'.
797 static bool isContainerClass(const ASTContext &Ctx, const CXXRecordDecl *RD) {
798  return hasMember(Ctx, RD, "begin") ||
799  hasMember(Ctx, RD, "iterator") ||
800  hasMember(Ctx, RD, "iterator_category");
801 }
802 
803 /// Returns true if the given function refers to a method of a C++ container
804 /// or iterator.
805 ///
806 /// We generally do a poor job modeling most containers right now, and might
807 /// prefer not to inline their methods.
808 static bool isContainerMethod(const ASTContext &Ctx,
809  const FunctionDecl *FD) {
810  if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(FD))
811  return isContainerClass(Ctx, MD->getParent());
812  return false;
813 }
814 
815 /// Returns true if the given function is the destructor of a class named
816 /// "shared_ptr".
817 static bool isCXXSharedPtrDtor(const FunctionDecl *FD) {
818  const CXXDestructorDecl *Dtor = dyn_cast<CXXDestructorDecl>(FD);
819  if (!Dtor)
820  return false;
821 
822  const CXXRecordDecl *RD = Dtor->getParent();
823  if (const IdentifierInfo *II = RD->getDeclName().getAsIdentifierInfo())
824  if (II->isStr("shared_ptr"))
825  return true;
826 
827  return false;
828 }
829 
830 /// Returns true if the function in \p CalleeADC may be inlined in general.
831 ///
832 /// This checks static properties of the function, such as its signature and
833 /// CFG, to determine whether the analyzer should ever consider inlining it,
834 /// in any context.
835 static bool mayInlineDecl(AnalysisManager &AMgr,
836  AnalysisDeclContext *CalleeADC) {
837  AnalyzerOptions &Opts = AMgr.getAnalyzerOptions();
838  // FIXME: Do not inline variadic calls.
839  if (CallEvent::isVariadic(CalleeADC->getDecl()))
840  return false;
841 
842  // Check certain C++-related inlining policies.
843  ASTContext &Ctx = CalleeADC->getASTContext();
844  if (Ctx.getLangOpts().CPlusPlus) {
845  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CalleeADC->getDecl())) {
846  // Conditionally control the inlining of template functions.
847  if (!Opts.MayInlineTemplateFunctions)
848  if (FD->getTemplatedKind() != FunctionDecl::TK_NonTemplate)
849  return false;
850 
851  // Conditionally control the inlining of C++ standard library functions.
852  if (!Opts.MayInlineCXXStandardLibrary)
853  if (Ctx.getSourceManager().isInSystemHeader(FD->getLocation()))
855  return false;
856 
857  // Conditionally control the inlining of methods on objects that look
858  // like C++ containers.
859  if (!Opts.MayInlineCXXContainerMethods)
860  if (!AMgr.isInCodeFile(FD->getLocation()))
861  if (isContainerMethod(Ctx, FD))
862  return false;
863 
864  // Conditionally control the inlining of the destructor of C++ shared_ptr.
865  // We don't currently do a good job modeling shared_ptr because we can't
866  // see the reference count, so treating as opaque is probably the best
867  // idea.
868  if (!Opts.MayInlineCXXSharedPtrDtor)
869  if (isCXXSharedPtrDtor(FD))
870  return false;
871  }
872  }
873 
874  // It is possible that the CFG cannot be constructed.
875  // Be safe, and check if the CalleeCFG is valid.
876  const CFG *CalleeCFG = CalleeADC->getCFG();
877  if (!CalleeCFG)
878  return false;
879 
880  // Do not inline large functions.
881  if (CalleeCFG->getNumBlockIDs() > Opts.MaxInlinableSize)
882  return false;
883 
884  // It is possible that the live variables analysis cannot be
885  // run. If so, bail out.
886  if (!CalleeADC->getAnalysis<RelaxedLiveVariables>())
887  return false;
888 
889  return true;
890 }
891 
892 bool ExprEngine::shouldInlineCall(const CallEvent &Call, const Decl *D,
893  const ExplodedNode *Pred,
894  const EvalCallOptions &CallOpts) {
895  if (!D)
896  return false;
897 
898  AnalysisManager &AMgr = getAnalysisManager();
899  AnalyzerOptions &Opts = AMgr.options;
900  AnalysisDeclContextManager &ADCMgr = AMgr.getAnalysisDeclContextManager();
901  AnalysisDeclContext *CalleeADC = ADCMgr.getContext(D);
902 
903  // The auto-synthesized bodies are essential to inline as they are
904  // usually small and commonly used. Note: we should do this check early on to
905  // ensure we always inline these calls.
906  if (CalleeADC->isBodyAutosynthesized())
907  return true;
908 
909  if (!AMgr.shouldInlineCall())
910  return false;
911 
912  // Check if this function has been marked as non-inlinable.
913  Optional<bool> MayInline = Engine.FunctionSummaries->mayInline(D);
914  if (MayInline.hasValue()) {
915  if (!MayInline.getValue())
916  return false;
917 
918  } else {
919  // We haven't actually checked the static properties of this function yet.
920  // Do that now, and record our decision in the function summaries.
921  if (mayInlineDecl(getAnalysisManager(), CalleeADC)) {
922  Engine.FunctionSummaries->markMayInline(D);
923  } else {
924  Engine.FunctionSummaries->markShouldNotInline(D);
925  return false;
926  }
927  }
928 
929  // Check if we should inline a call based on its kind.
930  // FIXME: this checks both static and dynamic properties of the call, which
931  // means we're redoing a bit of work that could be cached in the function
932  // summary.
933  CallInlinePolicy CIP = mayInlineCallKind(Call, Pred, Opts, CallOpts);
934  if (CIP != CIP_Allowed) {
935  if (CIP == CIP_DisallowedAlways) {
936  assert(!MayInline.hasValue() || MayInline.getValue());
937  Engine.FunctionSummaries->markShouldNotInline(D);
938  }
939  return false;
940  }
941 
942  const CFG *CalleeCFG = CalleeADC->getCFG();
943 
944  // Do not inline if recursive or we've reached max stack frame count.
945  bool IsRecursive = false;
946  unsigned StackDepth = 0;
947  examineStackFrames(D, Pred->getLocationContext(), IsRecursive, StackDepth);
948  if ((StackDepth >= Opts.InlineMaxStackDepth) &&
949  ((CalleeCFG->getNumBlockIDs() > Opts.AlwaysInlineSize)
950  || IsRecursive))
951  return false;
952 
953  // Do not inline large functions too many times.
954  if ((Engine.FunctionSummaries->getNumTimesInlined(D) >
955  Opts.MaxTimesInlineLarge) &&
956  CalleeCFG->getNumBlockIDs() >=
957  Opts.MinCFGSizeTreatFunctionsAsLarge) {
958  NumReachedInlineCountMax++;
959  return false;
960  }
961 
962  if (HowToInline == Inline_Minimal &&
963  (CalleeCFG->getNumBlockIDs() > Opts.AlwaysInlineSize
964  || IsRecursive))
965  return false;
966 
967  return true;
968 }
969 
970 static bool isTrivialObjectAssignment(const CallEvent &Call) {
971  const CXXInstanceCall *ICall = dyn_cast<CXXInstanceCall>(&Call);
972  if (!ICall)
973  return false;
974 
975  const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(ICall->getDecl());
976  if (!MD)
977  return false;
979  return false;
980 
981  return MD->isTrivial();
982 }
983 
985  const CallEvent &CallTemplate,
986  const EvalCallOptions &CallOpts) {
987  // Make sure we have the most recent state attached to the call.
988  ProgramStateRef State = Pred->getState();
989  CallEventRef<> Call = CallTemplate.cloneWithState(State);
990 
991  // Special-case trivial assignment operators.
992  if (isTrivialObjectAssignment(*Call)) {
993  performTrivialCopy(Bldr, Pred, *Call);
994  return;
995  }
996 
997  // Try to inline the call.
998  // The origin expression here is just used as a kind of checksum;
999  // this should still be safe even for CallEvents that don't come from exprs.
1000  const Expr *E = Call->getOriginExpr();
1001 
1002  ProgramStateRef InlinedFailedState = getInlineFailedState(State, E);
1003  if (InlinedFailedState) {
1004  // If we already tried once and failed, make sure we don't retry later.
1005  State = InlinedFailedState;
1006  } else {
1007  RuntimeDefinition RD = Call->getRuntimeDefinition();
1008  const Decl *D = RD.getDecl();
1009  if (shouldInlineCall(*Call, D, Pred, CallOpts)) {
1010  if (RD.mayHaveOtherDefinitions()) {
1012 
1013  // Explore with and without inlining the call.
1014  if (Options.getIPAMode() == IPAK_DynamicDispatchBifurcate) {
1015  BifurcateCall(RD.getDispatchRegion(), *Call, D, Bldr, Pred);
1016  return;
1017  }
1018 
1019  // Don't inline if we're not in any dynamic dispatch mode.
1020  if (Options.getIPAMode() != IPAK_DynamicDispatch) {
1021  conservativeEvalCall(*Call, Bldr, Pred, State);
1022  return;
1023  }
1024  }
1025 
1026  // We are not bifurcating and we do have a Decl, so just inline.
1027  if (inlineCall(*Call, D, Bldr, Pred, State))
1028  return;
1029  }
1030  }
1031 
1032  // If we can't inline it, handle the return value and invalidate the regions.
1033  conservativeEvalCall(*Call, Bldr, Pred, State);
1034 }
1035 
1036 void ExprEngine::BifurcateCall(const MemRegion *BifurReg,
1037  const CallEvent &Call, const Decl *D,
1038  NodeBuilder &Bldr, ExplodedNode *Pred) {
1039  assert(BifurReg);
1040  BifurReg = BifurReg->StripCasts();
1041 
1042  // Check if we've performed the split already - note, we only want
1043  // to split the path once per memory region.
1044  ProgramStateRef State = Pred->getState();
1045  const unsigned *BState =
1046  State->get<DynamicDispatchBifurcationMap>(BifurReg);
1047  if (BState) {
1048  // If we are on "inline path", keep inlining if possible.
1049  if (*BState == DynamicDispatchModeInlined)
1050  if (inlineCall(Call, D, Bldr, Pred, State))
1051  return;
1052  // If inline failed, or we are on the path where we assume we
1053  // don't have enough info about the receiver to inline, conjure the
1054  // return value and invalidate the regions.
1055  conservativeEvalCall(Call, Bldr, Pred, State);
1056  return;
1057  }
1058 
1059  // If we got here, this is the first time we process a message to this
1060  // region, so split the path.
1061  ProgramStateRef IState =
1062  State->set<DynamicDispatchBifurcationMap>(BifurReg,
1063  DynamicDispatchModeInlined);
1064  inlineCall(Call, D, Bldr, Pred, IState);
1065 
1066  ProgramStateRef NoIState =
1067  State->set<DynamicDispatchBifurcationMap>(BifurReg,
1068  DynamicDispatchModeConservative);
1069  conservativeEvalCall(Call, Bldr, Pred, NoIState);
1070 
1071  NumOfDynamicDispatchPathSplits++;
1072 }
1073 
1075  ExplodedNodeSet &Dst) {
1076  ExplodedNodeSet dstPreVisit;
1077  getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, RS, *this);
1078 
1079  StmtNodeBuilder B(dstPreVisit, Dst, *currBldrCtx);
1080 
1081  if (RS->getRetValue()) {
1082  for (ExplodedNodeSet::iterator it = dstPreVisit.begin(),
1083  ei = dstPreVisit.end(); it != ei; ++it) {
1084  B.generateNode(RS, *it, (*it)->getState());
1085  }
1086  }
1087 }
Represents a function declaration or definition.
Definition: Decl.h:1737
unsigned InlineMaxStackDepth
The inlining stack depth limit.
bool empty() const
Definition: CFG.h:713
A (possibly-)qualified type.
Definition: Type.h:639
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
CallEventRef< T > cloneWithState(ProgramStateRef NewState) const
Returns a copy of this CallEvent, but using the given state.
const CXXConstructorDecl * getDecl() const override
Definition: CallEvent.h:877
bool IsTemporaryCtorOrDtor
This call is a constructor or a destructor of a temporary value.
Definition: ExprEngine.h:106
Stmt * getBody() const
Get the body of the Declaration.
succ_iterator succ_begin()
Definition: CFG.h:750
void VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitCall - Transfer function for function calls.
void processCallExit(ExplodedNode *Pred) override
Generate the sequence of nodes that simulate the call exit and the post visit for CallExpr...
Stmt - This represents one statement.
Definition: Stmt.h:65
This builder class is useful for generating nodes that resulted from visiting a statement.
Definition: CoreEngine.h:369
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:338
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
Represents a point when we begin processing an inlined call.
Definition: ProgramPoint.h:630
Manages the lifetime of CallEvent objects.
Definition: CallEvent.h:1086
static bool isContainerMethod(const ASTContext &Ctx, const FunctionDecl *FD)
Returns true if the given function refers to a method of a C++ container or iterator.
IntrusiveRefCntPtr< const ProgramState > ProgramStateRef
bool isDerivedFrom(const CXXRecordDecl *Base) const
Determine whether this class is derived from the class Base.
Hints for figuring out of a call should be inlined during evalCall().
Definition: ExprEngine.h:96
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1319
bool IsArrayCtorOrDtor
This call is a constructor or a destructor for a single element within an array, a part of array cons...
Definition: ExprEngine.h:103
const NestedNameSpecifier * Specifier
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1341
const ProgramStateRef & getState() const
SVal evalCast(SVal val, QualType castTy, QualType originalType)
Represents a path from a specific derived class (which is not represented as part of the path) to a p...
static bool wasDifferentDeclUsedForInlining(CallEventRef<> Call, const StackFrameContext *calleeCtx)
static std::pair< const Stmt *, const CFGBlock * > getLastStmt(const ExplodedNode *Node)
unsigned succ_size() const
Definition: CFG.h:768
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:254
ASTContext & getASTContext() const
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the &#39;this&#39; object reference.
static Optional< SVal > getObjectUnderConstruction(ProgramStateRef State, const ConstructionContextItem &Item, const LocationContext *LC)
By looking at a certain item that may be potentially part of an object&#39;s ConstructionContext, retrieve such object&#39;s location.
Definition: ExprEngine.cpp:464
static bool hasMember(const ASTContext &Ctx, const CXXRecordDecl *RD, StringRef Name)
Returns true if the given C++ class contains a member with the given name.
void enqueue(ExplodedNodeSet &Set)
Enqueue the given set of nodes onto the work list.
Definition: CoreEngine.cpp:525
void removeDead(ExplodedNode *Node, ExplodedNodeSet &Out, const Stmt *ReferenceStmt, const LocationContext *LC, const Stmt *DiagnosticStmt=nullptr, ProgramPoint::Kind K=ProgramPoint::PreStmtPurgeDeadSymbolsKind)
Run the analyzer&#39;s garbage collection - remove dead symbols and bindings from the state...
Definition: ExprEngine.cpp:642
bool isMoveAssignmentOperator() const
Determine whether this is a move assignment operator.
Definition: DeclCXX.cpp:2139
const CFGBlock * getEntry() const
Returns the entry block in the CFG for the entered function.
Definition: ProgramPoint.h:645
DeclarationName getDeclName() const
Get the actual, stored name of the declaration, which may be a special name.
Definition: Decl.h:297
One of these records is kept for each identifier that is lexed.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
LineState State
AnalysisDeclContext contains the context data for the function or method under analysis.
void addPredecessor(ExplodedNode *V, ExplodedGraph &G)
addPredeccessor - Adds a predecessor to the current node, and in tandem add this node as a successor ...
void runCheckersForPostObjCMessage(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const ObjCMethodCall &msg, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
i32 captured_struct **param SharedsTy A type which contains references the shared variables *param Shareds Context with the list of shared variables from the p *TaskFunction *param Data Additional data for task generation like final * state
const StackFrameContext * getStackFrame() const
Definition: ProgramPoint.h:183
IdentifierTable & Idents
Definition: ASTContext.h:565
STATISTIC(NumOfDynamicDispatchPathSplits, "The # of times we split the path due to imprecise dynamic dispatch info")
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:969
virtual Kind getKind() const =0
Returns the kind of call this is.
static bool isInStdNamespace(const Decl *D)
Returns true if the root namespace of the given declaration is the &#39;std&#39; C++ namespace.
WorkList * getWorkList() const
Definition: CoreEngine.h:164
void runCheckersForPreCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng)
Run checkers for pre-visiting obj-c messages.
CFGElement getCurrentCFGElement()
Return the CFG element corresponding to the worklist element that is currently being processed by Exp...
Definition: ExprEngine.h:661
T * getAnalysis()
Return the specified analysis object, lazily running the analysis if necessary.
const LocationContext * getLocationContext() const
const LocationContext * getParent() const
virtual const CXXConstructExpr * getOriginExpr() const
Definition: CallEvent.h:873
void VisitReturnStmt(const ReturnStmt *R, ExplodedNode *Pred, ExplodedNodeSet &Dst)
VisitReturnStmt - Transfer function logic for return statements.
const CoreEngine & getCoreEngine() const
Definition: ExprEngine.h:410
bool hasTrivialDestructor() const
Determine whether this class has a trivial destructor (C++ [class.dtor]p3)
Definition: DeclCXX.h:1477
void runCheckersForPostCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &Call, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting obj-c messages.
static bool isCXXSharedPtrDtor(const FunctionDecl *FD)
Returns true if the given function is the destructor of a class named "shared_ptr".
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:476
virtual Decl * getCanonicalDecl()
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclBase.h:869
lookup_result lookup(DeclarationName Name) const
lookup - Find the declarations (if any) with the given Name in this context.
Definition: DeclBase.cpp:1597
AnalysisDeclContext * getAnalysisDeclContext(const Decl *D)
CheckerManager & getCheckerManager() const
Definition: ExprEngine.h:192
void removeDeadOnEndOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst)
Remove dead bindings/symbols before exiting a function.
static bool isTrivialObjectAssignment(const CallEvent &Call)
ProgramStateRef bindReturnValue(const CallEvent &Call, const LocationContext *LCtx, ProgramStateRef State)
Create a new state in which the call return value is binded to the call origin expression.
Represents a non-static C++ member function call, no matter how it is written.
Definition: CallEvent.h:669
static SVal adjustReturnValue(SVal V, QualType ExpectedTy, QualType ActualTy, StoreManager &StoreMgr)
Adjusts a return value when the called function&#39;s return type does not match the caller&#39;s expression ...
DeclarationNameTable DeclarationNames
Definition: ASTContext.h:568
Represents a single basic block in a source-level CFG.
Definition: CFG.h:551
Represents a point when we finish the call exit sequence (for inlined call).
Definition: ProgramPoint.h:688
AnalysisDeclContext * getContext(const Decl *D)
void runCheckersForPostStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng, bool wasInlined=false)
Run checkers for post-visiting Stmts.
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:244
void processBeginOfFunction(NodeBuilderContext &BC, ExplodedNode *Pred, ExplodedNodeSet &Dst, const BlockEdge &L) override
Called by CoreEngine.
This represents one expression.
Definition: Expr.h:108
Represents a source-level, intra-procedural CFG that represents the control-flow of a Stmt...
Definition: CFG.h:1002
bool isInSystemHeader(SourceLocation Loc) const
Returns if a SourceLocation is in a system header.
const CXXRecordDecl * getPointeeCXXRecordDecl() const
If this is a pointer or reference to a RecordType, return the CXXRecordDecl that the type refers to...
Definition: Type.cpp:1620
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Gets an outside caller given a callee context.
Definition: CallEvent.cpp:1362
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2713
AnalyzerOptions & getAnalyzerOptions() override
This is the simplest builder which generates nodes in the ExplodedGraph.
Definition: CoreEngine.h:227
Represents C++ constructor call.
Definition: CFG.h:150
void Add(ExplodedNode *N)
Refers to regular member function and operator calls.
IdentifierInfo * getAsIdentifierInfo() const
Retrieve the IdentifierInfo * stored in this declaration name, or null if this declaration name isn&#39;t...
Refers to constructors (implicit or explicit).
QualType getType() const
Definition: Expr.h:130
void runCheckersForEvalCall(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const CallEvent &CE, ExprEngine &Eng)
Run checkers for evaluating a call.
ASTContext & getContext() const
getContext - Return the ASTContext associated with this analysis.
Definition: ExprEngine.h:184
ReturnStmt - This represents a return, optionally of an expression: return; return 4;...
Definition: Stmt.h:2550
bool isBodyAutosynthesized() const
Checks if the body of the Decl is generated by the BodyFarm.
ExplodedNode * getNode(const ProgramPoint &L, ProgramStateRef State, bool IsSink=false, bool *IsNew=nullptr)
Retrieve the node associated with a (Location,State) pair, where the &#39;Location&#39; is a ProgramPoint in ...
const StackFrameContext * getStackFrame(LocationContext const *Parent, const Stmt *S, const CFGBlock *Blk, unsigned Idx)
bool isTrivial() const
Whether this function is "trivial" in some specialized C++ senses.
Definition: Decl.h:2025
Enable inlining of dynamically dispatched methods.
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:704
IPAKind getIPAMode() const
Returns the inter-procedural analysis mode.
const MemRegion * getRegion() const
Get the underlining region.
Definition: SVals.h:602
While alive, includes the current analysis stack in a crash trace.
CanQualType getCanonicalTypeUnqualified() const
void runCheckersForNewAllocator(const CXXNewExpr *NE, SVal Target, ExplodedNodeSet &Dst, ExplodedNode *Pred, ExprEngine &Eng, bool wasInlined=false)
Run checkers between C++ operator new and constructor calls.
Defines the runtime definition of the called function.
Definition: CallEvent.h:133
QualType getCanonicalType() const
Definition: Type.h:6123
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:654
IdentifierInfo & get(StringRef Name)
Return the identifier token info for the specified named identifier.
Expr * getRetValue()
Definition: Stmt.h:2583
AnalysisManager & getAnalysisManager() override
Definition: ExprEngine.h:186
const MemRegion * getAsRegion() const
Definition: SVals.cpp:150
Represents a new-expression for memory allocation and constructor calls, e.g: "new CXXNewExpr(foo)"...
Definition: ExprCXX.h:1989
CallEventManager & getCallEventManager()
Definition: ProgramState.h:524
REGISTER_MAP_WITH_PROGRAMSTATE(DynamicDispatchBifurcationMap, const MemRegion *, unsigned) bool ExprEngine
void evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred, const CallEvent &Call)
Evaluate a call, running pre- and post-call checks and allowing checkers to be responsible for handli...
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:2048
bool IsCtorOrDtorWithImproperlyModeledTargetRegion
This call is a constructor or a destructor for which we do not currently compute the this-region corr...
Definition: ExprEngine.h:99
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:75
DeclarationName getIdentifier(const IdentifierInfo *ID)
Create a declaration name that is a simple identifier.
const Decl * getDecl() const
bool isObjCObjectPointerType() const
Definition: Type.h:6405
Do minimal inlining of callees.
Definition: ExprEngine.h:92
unsigned getNumBlockIDs() const
Returns the total number of BlockIDs allocated (which start at 0).
Definition: CFG.h:1168
Refers to destructors (implicit or explicit).
void runCheckersForPreStmt(ExplodedNodeSet &Dst, const ExplodedNodeSet &Src, const Stmt *S, ExprEngine &Eng)
Run checkers for pre-visiting Stmts.
static bool isContainerClass(const ASTContext &Ctx, const CXXRecordDecl *RD)
Returns true if the given C++ class is a container or iterator.
const MemRegion * getDispatchRegion()
When other definitions are possible, returns the region whose runtime type determines the method defi...
Definition: CallEvent.h:158
void insert(const ExplodedNodeSet &S)
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:109
static bool mayInlineDecl(AnalysisManager &AMgr, AnalysisDeclContext *CalleeADC)
Returns true if the function in CalleeADC may be inlined in general.
ast_type_traits::DynTypedNode Node
pred_iterator pred_begin()
Definition: CFG.h:732
static ProgramStateRef getInlineFailedState(ProgramStateRef State, const Stmt *CallE)
Dataflow Directional Tag Classes.
CFG::BuildOptions & getCFGBuildOptions()
Return the build options used to construct the CFG.
StoreManager & getStoreManager()
Definition: ExprEngine.h:388
const StackFrameContext * getCalleeContext() const
Definition: ProgramPoint.h:640
The name of a declaration.
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2173
const MemRegion * StripCasts(bool StripBaseAndDerivedCasts=true) const
Definition: MemRegion.cpp:1196
bool isAmbiguous(CanQualType BaseType)
Determine whether the path from the most-derived type to the given base type is ambiguous (i...
bool isCopyAssignmentOperator() const
Determine whether this is a copy-assignment operator, regardless of whether it was declared implicitl...
Definition: DeclCXX.cpp:2118
bool mayHaveOtherDefinitions()
Check if the definition we have is precise.
Definition: CallEvent.h:154
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:170
ProgramStateManager & getStateManager() override
Definition: ExprEngine.h:386
const Decl * getDecl() const
void defaultEvalCall(NodeBuilder &B, ExplodedNode *Pred, const CallEvent &Call, const EvalCallOptions &CallOpts={})
Default implementation of call evaluation.
bool lookupInBases(BaseMatchesCallback BaseMatches, CXXBasePaths &Paths, bool LookupInDependent=false) const
Look for entities within the base classes of this C++ class, transitively searching all base class su...
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:103
virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const
Some call event sub-classes conveniently adjust mismatching AST indices to match parameter indices...
Definition: CallEvent.h:451
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:447
bool mayInlineCXXMemberFunction(CXXInlineableMemberKind K) const
Returns the option controlling which C++ member functions will be considered for inlining.
CXXBasePath & front()
const StackFrameContext * getStackFrame() const
Represents a base class of a C++ class.
Definition: DeclCXX.h:191
Stores options for the analyzer from the command line.
SourceManager & getSourceManager()
Definition: ASTContext.h:661
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:69
ExplodedNode * generateNode(const ProgramPoint &PP, ProgramStateRef State, ExplodedNode *Pred)
Generates a node in the ExplodedGraph.
Definition: CoreEngine.h:280
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate.h) and friends (in DeclFriend.h).
ConstructionContext&#39;s subclasses describe different ways of constructing an object in C++...
Represents a C++ struct/union/class.
Definition: DeclCXX.h:299
bool IsTemporaryLifetimeExtendedViaAggregate
This call is a constructor for a temporary that is lifetime-extended by binding it to a reference-typ...
Definition: ExprEngine.h:111
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2434
ExplodedNode * generateNode(const Stmt *S, ExplodedNode *Pred, ProgramStateRef St, const ProgramPointTag *tag=nullptr, ProgramPoint::Kind K=ProgramPoint::PostStmtKind)
Definition: CoreEngine.h:398
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:284
virtual void enqueue(const WorkListUnit &U)=0
const BlockInvocationContext * getBlockInvocationContext(const LocationContext *parent, const BlockDecl *BD, const void *ContextData)
BasePaths - Represents the set of paths from a derived class to one of its (direct or indirect) bases...
const StackFrameContext * getStackFrame() const
AnalysisPurgeMode AnalysisPurgeOpt
Enable inlining of dynamically dispatched methods, bifurcate paths when exact type info is unavailabl...
Optional< T > getAs() const
Convert to the specified ProgramPoint type, returning None if this ProgramPoint is not of the desired...
Definition: ProgramPoint.h:151
AnalysisDeclContext * getAnalysisDeclContext() const
Represents a call to a C++ constructor.
Definition: CallEvent.h:848
const LangOptions & getLangOpts() const
Definition: ASTContext.h:706
void processCallEnter(NodeBuilderContext &BC, CallEnter CE, ExplodedNode *Pred) override
Generate the entry node of the callee.
CallEventRef< T > cloneWithState(ProgramStateRef State) const
Definition: CallEvent.h:114