clang  8.0.0svn
MemRegion.h
Go to the documentation of this file.
1 //==- MemRegion.h - Abstract memory regions for static analysis -*- C++ -*--==//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This file defines MemRegion and its subclasses. MemRegion defines a
11 // partially-typed abstraction of memory useful for path-sensitive dataflow
12 // analyses.
13 //
14 //===----------------------------------------------------------------------===//
15 
16 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
17 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
18 
19 #include "clang/AST/ASTContext.h"
20 #include "clang/AST/CharUnits.h"
21 #include "clang/AST/Decl.h"
22 #include "clang/AST/DeclObjC.h"
24 #include "clang/AST/Expr.h"
25 #include "clang/AST/ExprObjC.h"
26 #include "clang/AST/Type.h"
27 #include "clang/Basic/LLVM.h"
31 #include "llvm/ADT/DenseMap.h"
32 #include "llvm/ADT/FoldingSet.h"
33 #include "llvm/ADT/Optional.h"
34 #include "llvm/ADT/PointerIntPair.h"
35 #include "llvm/Support/Allocator.h"
36 #include "llvm/Support/Casting.h"
37 #include <cassert>
38 #include <cstdint>
39 #include <limits>
40 #include <string>
41 #include <utility>
42 
43 namespace clang {
44 
45 class AnalysisDeclContext;
46 class CXXRecordDecl;
47 class Decl;
48 class LocationContext;
49 class StackFrameContext;
50 
51 namespace ento {
52 
53 class CodeTextRegion;
54 class MemRegion;
55 class MemRegionManager;
56 class MemSpaceRegion;
57 class SValBuilder;
58 class SymbolicRegion;
59 class VarRegion;
60 
61 /// Represent a region's offset within the top level base region.
62 class RegionOffset {
63  /// The base region.
64  const MemRegion *R = nullptr;
65 
66  /// The bit offset within the base region. Can be negative.
67  int64_t Offset;
68 
69 public:
70  // We're using a const instead of an enumeration due to the size required;
71  // Visual Studio will only create enumerations of size int, not long long.
72  static const int64_t Symbolic = std::numeric_limits<int64_t>::max();
73 
74  RegionOffset() = default;
75  RegionOffset(const MemRegion *r, int64_t off) : R(r), Offset(off) {}
76 
77  const MemRegion *getRegion() const { return R; }
78 
79  bool hasSymbolicOffset() const { return Offset == Symbolic; }
80 
81  int64_t getOffset() const {
82  assert(!hasSymbolicOffset());
83  return Offset;
84  }
85 
86  bool isValid() const { return R; }
87 };
88 
89 //===----------------------------------------------------------------------===//
90 // Base region classes.
91 //===----------------------------------------------------------------------===//
92 
93 /// MemRegion - The root abstract class for all memory regions.
94 class MemRegion : public llvm::FoldingSetNode {
95 public:
96  enum Kind {
97 #define REGION(Id, Parent) Id ## Kind,
98 #define REGION_RANGE(Id, First, Last) BEGIN_##Id = First, END_##Id = Last,
99 #include "clang/StaticAnalyzer/Core/PathSensitive/Regions.def"
100  };
101 
102 private:
103  const Kind kind;
104  mutable Optional<RegionOffset> cachedOffset;
105 
106 protected:
107  MemRegion(Kind k) : kind(k) {}
108  virtual ~MemRegion();
109 
110 public:
111  ASTContext &getContext() const;
112 
113  virtual void Profile(llvm::FoldingSetNodeID& ID) const = 0;
114 
115  virtual MemRegionManager* getMemRegionManager() const = 0;
116 
117  const MemSpaceRegion *getMemorySpace() const;
118 
119  const MemRegion *getBaseRegion() const;
120 
121  /// Check if the region is a subregion of the given region.
122  /// Each region is a subregion of itself.
123  virtual bool isSubRegionOf(const MemRegion *R) const;
124 
125  const MemRegion *StripCasts(bool StripBaseAndDerivedCasts = true) const;
126 
127  /// If this is a symbolic region, returns the region. Otherwise,
128  /// goes up the base chain looking for the first symbolic base region.
129  const SymbolicRegion *getSymbolicBase() const;
130 
131  bool hasGlobalsOrParametersStorage() const;
132 
133  bool hasStackStorage() const;
134 
135  bool hasStackNonParametersStorage() const;
136 
137  bool hasStackParametersStorage() const;
138 
139  /// Compute the offset within the top level memory object.
140  RegionOffset getAsOffset() const;
141 
142  /// Get a string representation of a region for debug use.
143  std::string getString() const;
144 
145  virtual void dumpToStream(raw_ostream &os) const;
146 
147  void dump() const;
148 
149  /// Returns true if this region can be printed in a user-friendly way.
150  virtual bool canPrintPretty() const;
151 
152  /// Print the region for use in diagnostics.
153  virtual void printPretty(raw_ostream &os) const;
154 
155  /// Returns true if this region's textual representation can be used
156  /// as part of a larger expression.
157  virtual bool canPrintPrettyAsExpr() const;
158 
159  /// Print the region as expression.
160  ///
161  /// When this region represents a subexpression, the method is for printing
162  /// an expression containing it.
163  virtual void printPrettyAsExpr(raw_ostream &os) const;
164 
165  Kind getKind() const { return kind; }
166 
167  template<typename RegionTy> const RegionTy* getAs() const;
168 
169  virtual bool isBoundable() const { return false; }
170 
171  /// Get descriptive name for memory region. The name is obtained from
172  /// the variable/field declaration retrieved from the memory region.
173  /// Regions that point to an element of an array are returned as: "arr[0]".
174  /// Regions that point to a struct are returned as: "st.var".
175  //
176  /// \param UseQuotes Set if the name should be quoted.
177  ///
178  /// \returns variable name for memory region
179  std::string getDescriptiveName(bool UseQuotes = true) const;
180 
181  /// Retrieve source range from memory region. The range retrieval
182  /// is based on the decl obtained from the memory region.
183  /// For a VarRegion the range of the base region is returned.
184  /// For a FieldRegion the range of the field is returned.
185  /// If no declaration is found, an empty source range is returned.
186  /// The client is responsible for checking if the returned range is valid.
187  ///
188  /// \returns source range for declaration retrieved from memory region
189  SourceRange sourceRange() const;
190 };
191 
192 /// MemSpaceRegion - A memory region that represents a "memory space";
193 /// for example, the set of global variables, the stack frame, etc.
194 class MemSpaceRegion : public MemRegion {
195 protected:
197 
198  MemSpaceRegion(MemRegionManager *mgr, Kind k) : MemRegion(k), Mgr(mgr) {
199  assert(classof(this));
200  assert(mgr);
201  }
202 
203  MemRegionManager* getMemRegionManager() const override { return Mgr; }
204 
205 public:
206  bool isBoundable() const override { return false; }
207 
208  void Profile(llvm::FoldingSetNodeID &ID) const override;
209 
210  static bool classof(const MemRegion *R) {
211  Kind k = R->getKind();
212  return k >= BEGIN_MEMSPACES && k <= END_MEMSPACES;
213  }
214 };
215 
216 /// CodeSpaceRegion - The memory space that holds the executable code of
217 /// functions and blocks.
219  friend class MemRegionManager;
220 
222  : MemSpaceRegion(mgr, CodeSpaceRegionKind) {}
223 
224 public:
225  void dumpToStream(raw_ostream &os) const override;
226 
227  static bool classof(const MemRegion *R) {
228  return R->getKind() == CodeSpaceRegionKind;
229  }
230 };
231 
233  virtual void anchor();
234 
235 protected:
237  assert(classof(this));
238  }
239 
240 public:
241  static bool classof(const MemRegion *R) {
242  Kind k = R->getKind();
243  return k >= BEGIN_GLOBAL_MEMSPACES && k <= END_GLOBAL_MEMSPACES;
244  }
245 };
246 
247 /// The region of the static variables within the current CodeTextRegion
248 /// scope.
249 ///
250 /// Currently, only the static locals are placed there, so we know that these
251 /// variables do not get invalidated by calls to other functions.
253  friend class MemRegionManager;
254 
255  const CodeTextRegion *CR;
256 
258  : GlobalsSpaceRegion(mgr, StaticGlobalSpaceRegionKind), CR(cr) {
259  assert(cr);
260  }
261 
262 public:
263  void Profile(llvm::FoldingSetNodeID &ID) const override;
264 
265  void dumpToStream(raw_ostream &os) const override;
266 
267  const CodeTextRegion *getCodeRegion() const { return CR; }
268 
269  static bool classof(const MemRegion *R) {
270  return R->getKind() == StaticGlobalSpaceRegionKind;
271  }
272 };
273 
274 /// The region for all the non-static global variables.
275 ///
276 /// This class is further split into subclasses for efficient implementation of
277 /// invalidating a set of related global values as is done in
278 /// RegionStoreManager::invalidateRegions (instead of finding all the dependent
279 /// globals, we invalidate the whole parent region).
281  void anchor() override;
282 
283 protected:
285  : GlobalsSpaceRegion(mgr, k) {
286  assert(classof(this));
287  }
288 
289 public:
290  static bool classof(const MemRegion *R) {
291  Kind k = R->getKind();
292  return k >= BEGIN_NON_STATIC_GLOBAL_MEMSPACES &&
293  k <= END_NON_STATIC_GLOBAL_MEMSPACES;
294  }
295 };
296 
297 /// The region containing globals which are defined in system/external
298 /// headers and are considered modifiable by system calls (ex: errno).
300  friend class MemRegionManager;
301 
303  : NonStaticGlobalSpaceRegion(mgr, GlobalSystemSpaceRegionKind) {}
304 
305 public:
306  void dumpToStream(raw_ostream &os) const override;
307 
308  static bool classof(const MemRegion *R) {
309  return R->getKind() == GlobalSystemSpaceRegionKind;
310  }
311 };
312 
313 /// The region containing globals which are considered not to be modified
314 /// or point to data which could be modified as a result of a function call
315 /// (system or internal). Ex: Const global scalars would be modeled as part of
316 /// this region. This region also includes most system globals since they have
317 /// low chance of being modified.
319  friend class MemRegionManager;
320 
322  : NonStaticGlobalSpaceRegion(mgr, GlobalImmutableSpaceRegionKind) {}
323 
324 public:
325  void dumpToStream(raw_ostream &os) const override;
326 
327  static bool classof(const MemRegion *R) {
328  return R->getKind() == GlobalImmutableSpaceRegionKind;
329  }
330 };
331 
332 /// The region containing globals which can be modified by calls to
333 /// "internally" defined functions - (for now just) functions other then system
334 /// calls.
336  friend class MemRegionManager;
337 
339  : NonStaticGlobalSpaceRegion(mgr, GlobalInternalSpaceRegionKind) {}
340 
341 public:
342  void dumpToStream(raw_ostream &os) const override;
343 
344  static bool classof(const MemRegion *R) {
345  return R->getKind() == GlobalInternalSpaceRegionKind;
346  }
347 };
348 
350  friend class MemRegionManager;
351 
353  : MemSpaceRegion(mgr, HeapSpaceRegionKind) {}
354 
355 public:
356  void dumpToStream(raw_ostream &os) const override;
357 
358  static bool classof(const MemRegion *R) {
359  return R->getKind() == HeapSpaceRegionKind;
360  }
361 };
362 
364  friend class MemRegionManager;
365 
367  : MemSpaceRegion(mgr, UnknownSpaceRegionKind) {}
368 
369 public:
370  void dumpToStream(raw_ostream &os) const override;
371 
372  static bool classof(const MemRegion *R) {
373  return R->getKind() == UnknownSpaceRegionKind;
374  }
375 };
376 
378  virtual void anchor();
379 
380  const StackFrameContext *SFC;
381 
382 protected:
384  : MemSpaceRegion(mgr, k), SFC(sfc) {
385  assert(classof(this));
386  assert(sfc);
387  }
388 
389 public:
390  const StackFrameContext *getStackFrame() const { return SFC; }
391 
392  void Profile(llvm::FoldingSetNodeID &ID) const override;
393 
394  static bool classof(const MemRegion *R) {
395  Kind k = R->getKind();
396  return k >= BEGIN_STACK_MEMSPACES && k <= END_STACK_MEMSPACES;
397  }
398 };
399 
401  friend class MemRegionManager;
402 
404  : StackSpaceRegion(mgr, StackLocalsSpaceRegionKind, sfc) {}
405 
406 public:
407  void dumpToStream(raw_ostream &os) const override;
408 
409  static bool classof(const MemRegion *R) {
410  return R->getKind() == StackLocalsSpaceRegionKind;
411  }
412 };
413 
415 private:
416  friend class MemRegionManager;
417 
419  : StackSpaceRegion(mgr, StackArgumentsSpaceRegionKind, sfc) {}
420 
421 public:
422  void dumpToStream(raw_ostream &os) const override;
423 
424  static bool classof(const MemRegion *R) {
425  return R->getKind() == StackArgumentsSpaceRegionKind;
426  }
427 };
428 
429 /// SubRegion - A region that subsets another larger region. Most regions
430 /// are subclasses of SubRegion.
431 class SubRegion : public MemRegion {
432  virtual void anchor();
433 
434 protected:
436 
437  SubRegion(const MemRegion *sReg, Kind k) : MemRegion(k), superRegion(sReg) {
438  assert(classof(this));
439  assert(sReg);
440  }
441 
442 public:
443  const MemRegion* getSuperRegion() const {
444  return superRegion;
445  }
446 
447  /// getExtent - Returns the size of the region in bytes.
448  virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const {
449  return UnknownVal();
450  }
451 
452  MemRegionManager* getMemRegionManager() const override;
453 
454  bool isSubRegionOf(const MemRegion* R) const override;
455 
456  static bool classof(const MemRegion* R) {
457  return R->getKind() > END_MEMSPACES;
458  }
459 };
460 
461 //===----------------------------------------------------------------------===//
462 // MemRegion subclasses.
463 //===----------------------------------------------------------------------===//
464 
465 /// AllocaRegion - A region that represents an untyped blob of bytes created
466 /// by a call to 'alloca'.
467 class AllocaRegion : public SubRegion {
468  friend class MemRegionManager;
469 
470  // Block counter. Used to distinguish different pieces of memory allocated by
471  // alloca at the same call site.
472  unsigned Cnt;
473 
474  const Expr *Ex;
475 
476  AllocaRegion(const Expr *ex, unsigned cnt, const MemSpaceRegion *superRegion)
477  : SubRegion(superRegion, AllocaRegionKind), Cnt(cnt), Ex(ex) {
478  assert(Ex);
479  }
480 
481  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Expr *Ex,
482  unsigned Cnt, const MemRegion *superRegion);
483 
484 public:
485  const Expr *getExpr() const { return Ex; }
486 
487  bool isBoundable() const override { return true; }
488 
489  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
490 
491  void Profile(llvm::FoldingSetNodeID& ID) const override;
492 
493  void dumpToStream(raw_ostream &os) const override;
494 
495  static bool classof(const MemRegion* R) {
496  return R->getKind() == AllocaRegionKind;
497  }
498 };
499 
500 /// TypedRegion - An abstract class representing regions that are typed.
501 class TypedRegion : public SubRegion {
502  void anchor() override;
503 
504 protected:
505  TypedRegion(const MemRegion *sReg, Kind k) : SubRegion(sReg, k) {
506  assert(classof(this));
507  }
508 
509 public:
510  virtual QualType getLocationType() const = 0;
511 
513  return getLocationType().getDesugaredType(Context);
514  }
515 
516  bool isBoundable() const override { return true; }
517 
518  static bool classof(const MemRegion* R) {
519  unsigned k = R->getKind();
520  return k >= BEGIN_TYPED_REGIONS && k <= END_TYPED_REGIONS;
521  }
522 };
523 
524 /// TypedValueRegion - An abstract class representing regions having a typed value.
526  void anchor() override;
527 
528 protected:
529  TypedValueRegion(const MemRegion* sReg, Kind k) : TypedRegion(sReg, k) {
530  assert(classof(this));
531  }
532 
533 public:
534  virtual QualType getValueType() const = 0;
535 
536  QualType getLocationType() const override {
537  // FIXME: We can possibly optimize this later to cache this value.
538  QualType T = getValueType();
539  ASTContext &ctx = getContext();
540  if (T->getAs<ObjCObjectType>())
541  return ctx.getObjCObjectPointerType(T);
542  return ctx.getPointerType(getValueType());
543  }
544 
546  QualType T = getValueType();
547  return T.getTypePtrOrNull() ? T.getDesugaredType(Context) : T;
548  }
549 
550  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
551 
552  static bool classof(const MemRegion* R) {
553  unsigned k = R->getKind();
554  return k >= BEGIN_TYPED_VALUE_REGIONS && k <= END_TYPED_VALUE_REGIONS;
555  }
556 };
557 
558 class CodeTextRegion : public TypedRegion {
559  void anchor() override;
560 
561 protected:
562  CodeTextRegion(const MemSpaceRegion *sreg, Kind k) : TypedRegion(sreg, k) {
563  assert(classof(this));
564  }
565 
566 public:
567  bool isBoundable() const override { return false; }
568 
569  static bool classof(const MemRegion* R) {
570  Kind k = R->getKind();
571  return k >= BEGIN_CODE_TEXT_REGIONS && k <= END_CODE_TEXT_REGIONS;
572  }
573 };
574 
575 /// FunctionCodeRegion - A region that represents code texts of function.
577  friend class MemRegionManager;
578 
579  const NamedDecl *FD;
580 
581  FunctionCodeRegion(const NamedDecl *fd, const CodeSpaceRegion* sreg)
582  : CodeTextRegion(sreg, FunctionCodeRegionKind), FD(fd) {
583  assert(isa<ObjCMethodDecl>(fd) || isa<FunctionDecl>(fd));
584  }
585 
586  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const NamedDecl *FD,
587  const MemRegion*);
588 
589 public:
590  QualType getLocationType() const override {
591  const ASTContext &Ctx = getContext();
592  if (const auto *D = dyn_cast<FunctionDecl>(FD)) {
593  return Ctx.getPointerType(D->getType());
594  }
595 
596  assert(isa<ObjCMethodDecl>(FD));
597  assert(false && "Getting the type of ObjCMethod is not supported yet");
598 
599  // TODO: We might want to return a different type here (ex: id (*ty)(...))
600  // depending on how it is used.
601  return {};
602  }
603 
604  const NamedDecl *getDecl() const {
605  return FD;
606  }
607 
608  void dumpToStream(raw_ostream &os) const override;
609 
610  void Profile(llvm::FoldingSetNodeID& ID) const override;
611 
612  static bool classof(const MemRegion* R) {
613  return R->getKind() == FunctionCodeRegionKind;
614  }
615 };
616 
617 /// BlockCodeRegion - A region that represents code texts of blocks (closures).
618 /// Blocks are represented with two kinds of regions. BlockCodeRegions
619 /// represent the "code", while BlockDataRegions represent instances of blocks,
620 /// which correspond to "code+data". The distinction is important, because
621 /// like a closure a block captures the values of externally referenced
622 /// variables.
624  friend class MemRegionManager;
625 
626  const BlockDecl *BD;
628  CanQualType locTy;
629 
630  BlockCodeRegion(const BlockDecl *bd, CanQualType lTy,
631  AnalysisDeclContext *ac, const CodeSpaceRegion* sreg)
632  : CodeTextRegion(sreg, BlockCodeRegionKind), BD(bd), AC(ac), locTy(lTy) {
633  assert(bd);
634  assert(ac);
635  assert(lTy->getTypePtr()->isBlockPointerType());
636  }
637 
638  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const BlockDecl *BD,
640  const MemRegion*);
641 
642 public:
643  QualType getLocationType() const override {
644  return locTy;
645  }
646 
647  const BlockDecl *getDecl() const {
648  return BD;
649  }
650 
652 
653  void dumpToStream(raw_ostream &os) const override;
654 
655  void Profile(llvm::FoldingSetNodeID& ID) const override;
656 
657  static bool classof(const MemRegion* R) {
658  return R->getKind() == BlockCodeRegionKind;
659  }
660 };
661 
662 /// BlockDataRegion - A region that represents a block instance.
663 /// Blocks are represented with two kinds of regions. BlockCodeRegions
664 /// represent the "code", while BlockDataRegions represent instances of blocks,
665 /// which correspond to "code+data". The distinction is important, because
666 /// like a closure a block captures the values of externally referenced
667 /// variables.
668 class BlockDataRegion : public TypedRegion {
669  friend class MemRegionManager;
670 
671  const BlockCodeRegion *BC;
672  const LocationContext *LC; // Can be null
673  unsigned BlockCount;
674  void *ReferencedVars = nullptr;
675  void *OriginalVars = nullptr;
676 
677  BlockDataRegion(const BlockCodeRegion *bc, const LocationContext *lc,
678  unsigned count, const MemSpaceRegion *sreg)
679  : TypedRegion(sreg, BlockDataRegionKind), BC(bc), LC(lc),
680  BlockCount(count) {
681  assert(bc);
682  assert(lc);
683  assert(isa<GlobalImmutableSpaceRegion>(sreg) ||
684  isa<StackLocalsSpaceRegion>(sreg) ||
685  isa<UnknownSpaceRegion>(sreg));
686  }
687 
688  static void ProfileRegion(llvm::FoldingSetNodeID&, const BlockCodeRegion *,
689  const LocationContext *, unsigned,
690  const MemRegion *);
691 
692 public:
693  const BlockCodeRegion *getCodeRegion() const { return BC; }
694 
695  const BlockDecl *getDecl() const { return BC->getDecl(); }
696 
697  QualType getLocationType() const override { return BC->getLocationType(); }
698 
700  const MemRegion * const *R;
701  const MemRegion * const *OriginalR;
702 
703  public:
704  explicit referenced_vars_iterator(const MemRegion * const *r,
705  const MemRegion * const *originalR)
706  : R(r), OriginalR(originalR) {}
707 
708  const VarRegion *getCapturedRegion() const {
709  return cast<VarRegion>(*R);
710  }
711 
712  const VarRegion *getOriginalRegion() const {
713  return cast<VarRegion>(*OriginalR);
714  }
715 
716  bool operator==(const referenced_vars_iterator &I) const {
717  assert((R == nullptr) == (I.R == nullptr));
718  return I.R == R;
719  }
720 
721  bool operator!=(const referenced_vars_iterator &I) const {
722  assert((R == nullptr) == (I.R == nullptr));
723  return I.R != R;
724  }
725 
727  ++R;
728  ++OriginalR;
729  return *this;
730  }
731  };
732 
733  /// Return the original region for a captured region, if
734  /// one exists.
735  const VarRegion *getOriginalRegion(const VarRegion *VR) const;
736 
737  referenced_vars_iterator referenced_vars_begin() const;
738  referenced_vars_iterator referenced_vars_end() const;
739 
740  void dumpToStream(raw_ostream &os) const override;
741 
742  void Profile(llvm::FoldingSetNodeID& ID) const override;
743 
744  static bool classof(const MemRegion* R) {
745  return R->getKind() == BlockDataRegionKind;
746  }
747 
748 private:
749  void LazyInitializeReferencedVars();
750  std::pair<const VarRegion *, const VarRegion *>
751  getCaptureRegions(const VarDecl *VD);
752 };
753 
754 /// SymbolicRegion - A special, "non-concrete" region. Unlike other region
755 /// classes, SymbolicRegion represents a region that serves as an alias for
756 /// either a real region, a NULL pointer, etc. It essentially is used to
757 /// map the concept of symbolic values into the domain of regions. Symbolic
758 /// regions do not need to be typed.
759 class SymbolicRegion : public SubRegion {
760  friend class MemRegionManager;
761 
762  const SymbolRef sym;
763 
764  SymbolicRegion(const SymbolRef s, const MemSpaceRegion *sreg)
765  : SubRegion(sreg, SymbolicRegionKind), sym(s) {
766  // Because pointer arithmetic is represented by ElementRegion layers,
767  // the base symbol here should not contain any arithmetic.
768  assert(s && isa<SymbolData>(s));
769  assert(s->getType()->isAnyPointerType() ||
770  s->getType()->isReferenceType() ||
771  s->getType()->isBlockPointerType());
772 
773  // populateWorklistFromSymbol() relies on this assertion, and needs to be
774  // updated if more cases are introduced.
775  assert(isa<UnknownSpaceRegion>(sreg) || isa<HeapSpaceRegion>(sreg));
776  }
777 
778 public:
779  SymbolRef getSymbol() const { return sym; }
780 
781  bool isBoundable() const override { return true; }
782 
783  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
784 
785  void Profile(llvm::FoldingSetNodeID& ID) const override;
786 
787  static void ProfileRegion(llvm::FoldingSetNodeID& ID,
788  SymbolRef sym,
789  const MemRegion* superRegion);
790 
791  void dumpToStream(raw_ostream &os) const override;
792 
793  static bool classof(const MemRegion* R) {
794  return R->getKind() == SymbolicRegionKind;
795  }
796 };
797 
798 /// StringRegion - Region associated with a StringLiteral.
800  friend class MemRegionManager;
801 
802  const StringLiteral *Str;
803 
804  StringRegion(const StringLiteral *str, const GlobalInternalSpaceRegion *sreg)
805  : TypedValueRegion(sreg, StringRegionKind), Str(str) {
806  assert(str);
807  }
808 
809  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
810  const StringLiteral *Str,
811  const MemRegion *superRegion);
812 
813 public:
814  const StringLiteral *getStringLiteral() const { return Str; }
815 
816  QualType getValueType() const override { return Str->getType(); }
817 
818  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
819 
820  bool isBoundable() const override { return false; }
821 
822  void Profile(llvm::FoldingSetNodeID& ID) const override {
823  ProfileRegion(ID, Str, superRegion);
824  }
825 
826  void dumpToStream(raw_ostream &os) const override;
827 
828  static bool classof(const MemRegion* R) {
829  return R->getKind() == StringRegionKind;
830  }
831 };
832 
833 /// The region associated with an ObjCStringLiteral.
835  friend class MemRegionManager;
836 
837  const ObjCStringLiteral *Str;
838 
840  const GlobalInternalSpaceRegion *sreg)
841  : TypedValueRegion(sreg, ObjCStringRegionKind), Str(str) {
842  assert(str);
843  }
844 
845  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
846  const ObjCStringLiteral *Str,
847  const MemRegion *superRegion);
848 
849 public:
850  const ObjCStringLiteral *getObjCStringLiteral() const { return Str; }
851 
852  QualType getValueType() const override { return Str->getType(); }
853 
854  bool isBoundable() const override { return false; }
855 
856  void Profile(llvm::FoldingSetNodeID& ID) const override {
857  ProfileRegion(ID, Str, superRegion);
858  }
859 
860  void dumpToStream(raw_ostream &os) const override;
861 
862  static bool classof(const MemRegion* R) {
863  return R->getKind() == ObjCStringRegionKind;
864  }
865 };
866 
867 /// CompoundLiteralRegion - A memory region representing a compound literal.
868 /// Compound literals are essentially temporaries that are stack allocated
869 /// or in the global constant pool.
871  friend class MemRegionManager;
872 
873  const CompoundLiteralExpr *CL;
874 
876  const MemSpaceRegion *sReg)
877  : TypedValueRegion(sReg, CompoundLiteralRegionKind), CL(cl) {
878  assert(cl);
879  assert(isa<GlobalInternalSpaceRegion>(sReg) ||
880  isa<StackLocalsSpaceRegion>(sReg));
881  }
882 
883  static void ProfileRegion(llvm::FoldingSetNodeID& ID,
884  const CompoundLiteralExpr *CL,
885  const MemRegion* superRegion);
886 
887 public:
888  QualType getValueType() const override { return CL->getType(); }
889 
890  bool isBoundable() const override { return !CL->isFileScope(); }
891 
892  void Profile(llvm::FoldingSetNodeID& ID) const override;
893 
894  void dumpToStream(raw_ostream &os) const override;
895 
896  const CompoundLiteralExpr *getLiteralExpr() const { return CL; }
897 
898  static bool classof(const MemRegion* R) {
899  return R->getKind() == CompoundLiteralRegionKind;
900  }
901 };
902 
903 class DeclRegion : public TypedValueRegion {
904 protected:
905  const ValueDecl *D;
906 
907  DeclRegion(const ValueDecl *d, const MemRegion *sReg, Kind k)
908  : TypedValueRegion(sReg, k), D(d) {
909  assert(classof(this));
910  assert(d);
911  }
912 
913  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl *D,
914  const MemRegion* superRegion, Kind k);
915 
916 public:
917  const ValueDecl *getDecl() const { return D; }
918  void Profile(llvm::FoldingSetNodeID& ID) const override;
919 
920  static bool classof(const MemRegion* R) {
921  unsigned k = R->getKind();
922  return k >= BEGIN_DECL_REGIONS && k <= END_DECL_REGIONS;
923  }
924 };
925 
926 class VarRegion : public DeclRegion {
927  friend class MemRegionManager;
928 
929  // Constructors and private methods.
930  VarRegion(const VarDecl *vd, const MemRegion *sReg)
931  : DeclRegion(vd, sReg, VarRegionKind) {
932  // VarRegion appears in unknown space when it's a block variable as seen
933  // from a block using it, when this block is analyzed at top-level.
934  // Other block variables appear within block data regions,
935  // which, unlike everything else on this list, are not memory spaces.
936  assert(isa<GlobalsSpaceRegion>(sReg) || isa<StackSpaceRegion>(sReg) ||
937  isa<BlockDataRegion>(sReg) || isa<UnknownSpaceRegion>(sReg));
938  }
939 
940  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const VarDecl *VD,
941  const MemRegion *superRegion) {
942  DeclRegion::ProfileRegion(ID, VD, superRegion, VarRegionKind);
943  }
944 
945 public:
946  void Profile(llvm::FoldingSetNodeID& ID) const override;
947 
948  const VarDecl *getDecl() const { return cast<VarDecl>(D); }
949 
950  const StackFrameContext *getStackFrame() const;
951 
952  QualType getValueType() const override {
953  // FIXME: We can cache this if needed.
954  return getDecl()->getType();
955  }
956 
957  void dumpToStream(raw_ostream &os) const override;
958 
959  bool canPrintPrettyAsExpr() const override;
960 
961  void printPrettyAsExpr(raw_ostream &os) const override;
962 
963  static bool classof(const MemRegion* R) {
964  return R->getKind() == VarRegionKind;
965  }
966 };
967 
968 /// CXXThisRegion - Represents the region for the implicit 'this' parameter
969 /// in a call to a C++ method. This region doesn't represent the object
970 /// referred to by 'this', but rather 'this' itself.
972  friend class MemRegionManager;
973 
974  CXXThisRegion(const PointerType *thisPointerTy,
975  const StackArgumentsSpaceRegion *sReg)
976  : TypedValueRegion(sReg, CXXThisRegionKind),
977  ThisPointerTy(thisPointerTy) {
978  assert(ThisPointerTy->getPointeeType()->getAsCXXRecordDecl() &&
979  "Invalid region type!");
980  }
981 
982  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
983  const PointerType *PT,
984  const MemRegion *sReg);
985 
986 public:
987  void Profile(llvm::FoldingSetNodeID &ID) const override;
988 
989  QualType getValueType() const override {
990  return QualType(ThisPointerTy, 0);
991  }
992 
993  void dumpToStream(raw_ostream &os) const override;
994 
995  static bool classof(const MemRegion* R) {
996  return R->getKind() == CXXThisRegionKind;
997  }
998 
999 private:
1000  const PointerType *ThisPointerTy;
1001 };
1002 
1003 class FieldRegion : public DeclRegion {
1004  friend class MemRegionManager;
1005 
1006  FieldRegion(const FieldDecl *fd, const SubRegion* sReg)
1007  : DeclRegion(fd, sReg, FieldRegionKind) {}
1008 
1009  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const FieldDecl *FD,
1010  const MemRegion* superRegion) {
1011  DeclRegion::ProfileRegion(ID, FD, superRegion, FieldRegionKind);
1012  }
1013 
1014 public:
1015  const FieldDecl *getDecl() const { return cast<FieldDecl>(D); }
1016 
1017  QualType getValueType() const override {
1018  // FIXME: We can cache this if needed.
1019  return getDecl()->getType();
1020  }
1021 
1022  DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const override;
1023 
1024  void dumpToStream(raw_ostream &os) const override;
1025 
1026  bool canPrintPretty() const override;
1027  void printPretty(raw_ostream &os) const override;
1028  bool canPrintPrettyAsExpr() const override;
1029  void printPrettyAsExpr(raw_ostream &os) const override;
1030 
1031  static bool classof(const MemRegion* R) {
1032  return R->getKind() == FieldRegionKind;
1033  }
1034 };
1035 
1036 class ObjCIvarRegion : public DeclRegion {
1037  friend class MemRegionManager;
1038 
1039  ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg);
1040 
1041  static void ProfileRegion(llvm::FoldingSetNodeID& ID, const ObjCIvarDecl *ivd,
1042  const MemRegion* superRegion);
1043 
1044 public:
1045  const ObjCIvarDecl *getDecl() const;
1046  QualType getValueType() const override;
1047 
1048  bool canPrintPrettyAsExpr() const override;
1049  void printPrettyAsExpr(raw_ostream &os) const override;
1050 
1051  void dumpToStream(raw_ostream &os) const override;
1052 
1053  static bool classof(const MemRegion* R) {
1054  return R->getKind() == ObjCIvarRegionKind;
1055  }
1056 };
1057 
1058 //===----------------------------------------------------------------------===//
1059 // Auxiliary data classes for use with MemRegions.
1060 //===----------------------------------------------------------------------===//
1061 
1063  friend class ElementRegion;
1064 
1065  const MemRegion *Region;
1066  CharUnits Offset;
1067 
1068  RegionRawOffset(const MemRegion* reg, CharUnits offset = CharUnits::Zero())
1069  : Region(reg), Offset(offset) {}
1070 
1071 public:
1072  // FIXME: Eventually support symbolic offsets.
1073  CharUnits getOffset() const { return Offset; }
1074  const MemRegion *getRegion() const { return Region; }
1075 
1076  void dumpToStream(raw_ostream &os) const;
1077  void dump() const;
1078 };
1079 
1080 /// ElementRegin is used to represent both array elements and casts.
1082  friend class MemRegionManager;
1083 
1084  QualType ElementType;
1085  NonLoc Index;
1086 
1087  ElementRegion(QualType elementType, NonLoc Idx, const SubRegion *sReg)
1088  : TypedValueRegion(sReg, ElementRegionKind), ElementType(elementType),
1089  Index(Idx) {
1090  assert((!Idx.getAs<nonloc::ConcreteInt>() ||
1091  Idx.castAs<nonloc::ConcreteInt>().getValue().isSigned()) &&
1092  "The index must be signed");
1093  assert(!elementType.isNull() && !elementType->isVoidType() &&
1094  "Invalid region type!");
1095  }
1096 
1097  static void ProfileRegion(llvm::FoldingSetNodeID& ID, QualType elementType,
1098  SVal Idx, const MemRegion* superRegion);
1099 
1100 public:
1101  NonLoc getIndex() const { return Index; }
1102 
1103  QualType getValueType() const override { return ElementType; }
1104 
1105  QualType getElementType() const { return ElementType; }
1106 
1107  /// Compute the offset within the array. The array might also be a subobject.
1108  RegionRawOffset getAsArrayOffset() const;
1109 
1110  void dumpToStream(raw_ostream &os) const override;
1111 
1112  void Profile(llvm::FoldingSetNodeID& ID) const override;
1113 
1114  static bool classof(const MemRegion* R) {
1115  return R->getKind() == ElementRegionKind;
1116  }
1117 };
1118 
1119 // C++ temporary object associated with an expression.
1121  friend class MemRegionManager;
1122 
1123  Expr const *Ex;
1124 
1125  CXXTempObjectRegion(Expr const *E, MemSpaceRegion const *sReg)
1126  : TypedValueRegion(sReg, CXXTempObjectRegionKind), Ex(E) {
1127  assert(E);
1128  assert(isa<StackLocalsSpaceRegion>(sReg) ||
1129  isa<GlobalInternalSpaceRegion>(sReg));
1130  }
1131 
1132  static void ProfileRegion(llvm::FoldingSetNodeID &ID,
1133  Expr const *E, const MemRegion *sReg);
1134 
1135 public:
1136  const Expr *getExpr() const { return Ex; }
1137 
1138  QualType getValueType() const override { return Ex->getType(); }
1139 
1140  void dumpToStream(raw_ostream &os) const override;
1141 
1142  void Profile(llvm::FoldingSetNodeID &ID) const override;
1143 
1144  static bool classof(const MemRegion* R) {
1145  return R->getKind() == CXXTempObjectRegionKind;
1146  }
1147 };
1148 
1149 // CXXBaseObjectRegion represents a base object within a C++ object. It is
1150 // identified by the base class declaration and the region of its parent object.
1152  friend class MemRegionManager;
1153 
1154  llvm::PointerIntPair<const CXXRecordDecl *, 1, bool> Data;
1155 
1156  CXXBaseObjectRegion(const CXXRecordDecl *RD, bool IsVirtual,
1157  const SubRegion *SReg)
1158  : TypedValueRegion(SReg, CXXBaseObjectRegionKind), Data(RD, IsVirtual) {
1159  assert(RD);
1160  }
1161 
1162  static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
1163  bool IsVirtual, const MemRegion *SReg);
1164 
1165 public:
1166  const CXXRecordDecl *getDecl() const { return Data.getPointer(); }
1167  bool isVirtual() const { return Data.getInt(); }
1168 
1169  QualType getValueType() const override;
1170 
1171  void dumpToStream(raw_ostream &os) const override;
1172 
1173  void Profile(llvm::FoldingSetNodeID &ID) const override;
1174 
1175  bool canPrintPrettyAsExpr() const override;
1176 
1177  void printPrettyAsExpr(raw_ostream &os) const override;
1178 
1179  static bool classof(const MemRegion *region) {
1180  return region->getKind() == CXXBaseObjectRegionKind;
1181  }
1182 };
1183 
1184 // CXXDerivedObjectRegion represents a derived-class object that surrounds
1185 // a C++ object. It is identified by the derived class declaration and the
1186 // region of its parent object. It is a bit counter-intuitive (but not otherwise
1187 // unseen) that this region represents a larger segment of memory that its
1188 // super-region.
1190  friend class MemRegionManager;
1191 
1192  const CXXRecordDecl *DerivedD;
1193 
1194  CXXDerivedObjectRegion(const CXXRecordDecl *DerivedD, const SubRegion *SReg)
1195  : TypedValueRegion(SReg, CXXDerivedObjectRegionKind), DerivedD(DerivedD) {
1196  assert(DerivedD);
1197  // In case of a concrete region, it should always be possible to model
1198  // the base-to-derived cast by undoing a previous derived-to-base cast,
1199  // otherwise the cast is most likely ill-formed.
1200  assert(SReg->getSymbolicBase() &&
1201  "Should have unwrapped a base region instead!");
1202  }
1203 
1204  static void ProfileRegion(llvm::FoldingSetNodeID &ID, const CXXRecordDecl *RD,
1205  const MemRegion *SReg);
1206 
1207 public:
1208  const CXXRecordDecl *getDecl() const { return DerivedD; }
1209 
1210  QualType getValueType() const override;
1211 
1212  void dumpToStream(raw_ostream &os) const override;
1213 
1214  void Profile(llvm::FoldingSetNodeID &ID) const override;
1215 
1216  bool canPrintPrettyAsExpr() const override;
1217 
1218  void printPrettyAsExpr(raw_ostream &os) const override;
1219 
1220  static bool classof(const MemRegion *region) {
1221  return region->getKind() == CXXDerivedObjectRegionKind;
1222  }
1223 };
1224 
1225 template<typename RegionTy>
1226 const RegionTy* MemRegion::getAs() const {
1227  if (const auto *RT = dyn_cast<RegionTy>(this))
1228  return RT;
1229 
1230  return nullptr;
1231 }
1232 
1233 //===----------------------------------------------------------------------===//
1234 // MemRegionManager - Factory object for creating regions.
1235 //===----------------------------------------------------------------------===//
1236 
1238  ASTContext &C;
1239  llvm::BumpPtrAllocator& A;
1240  llvm::FoldingSet<MemRegion> Regions;
1241 
1242  GlobalInternalSpaceRegion *InternalGlobals = nullptr;
1243  GlobalSystemSpaceRegion *SystemGlobals = nullptr;
1244  GlobalImmutableSpaceRegion *ImmutableGlobals = nullptr;
1245 
1246  llvm::DenseMap<const StackFrameContext *, StackLocalsSpaceRegion *>
1247  StackLocalsSpaceRegions;
1248  llvm::DenseMap<const StackFrameContext *, StackArgumentsSpaceRegion *>
1249  StackArgumentsSpaceRegions;
1250  llvm::DenseMap<const CodeTextRegion *, StaticGlobalSpaceRegion *>
1251  StaticsGlobalSpaceRegions;
1252 
1253  HeapSpaceRegion *heap = nullptr;
1254  UnknownSpaceRegion *unknown = nullptr;
1255  CodeSpaceRegion *code = nullptr;
1256 
1257 public:
1258  MemRegionManager(ASTContext &c, llvm::BumpPtrAllocator &a) : C(c), A(a) {}
1259  ~MemRegionManager();
1260 
1261  ASTContext &getContext() { return C; }
1262 
1263  llvm::BumpPtrAllocator &getAllocator() { return A; }
1264 
1265  /// getStackLocalsRegion - Retrieve the memory region associated with the
1266  /// specified stack frame.
1267  const StackLocalsSpaceRegion *
1268  getStackLocalsRegion(const StackFrameContext *STC);
1269 
1270  /// getStackArgumentsRegion - Retrieve the memory region associated with
1271  /// function/method arguments of the specified stack frame.
1273  getStackArgumentsRegion(const StackFrameContext *STC);
1274 
1275  /// getGlobalsRegion - Retrieve the memory region associated with
1276  /// global variables.
1277  const GlobalsSpaceRegion *getGlobalsRegion(
1278  MemRegion::Kind K = MemRegion::GlobalInternalSpaceRegionKind,
1279  const CodeTextRegion *R = nullptr);
1280 
1281  /// getHeapRegion - Retrieve the memory region associated with the
1282  /// generic "heap".
1283  const HeapSpaceRegion *getHeapRegion();
1284 
1285  /// getUnknownRegion - Retrieve the memory region associated with unknown
1286  /// memory space.
1287  const UnknownSpaceRegion *getUnknownRegion();
1288 
1289  const CodeSpaceRegion *getCodeRegion();
1290 
1291  /// getAllocaRegion - Retrieve a region associated with a call to alloca().
1292  const AllocaRegion *getAllocaRegion(const Expr *Ex, unsigned Cnt,
1293  const LocationContext *LC);
1294 
1295  /// getCompoundLiteralRegion - Retrieve the region associated with a
1296  /// given CompoundLiteral.
1297  const CompoundLiteralRegion*
1298  getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
1299  const LocationContext *LC);
1300 
1301  /// getCXXThisRegion - Retrieve the [artificial] region associated with the
1302  /// parameter 'this'.
1303  const CXXThisRegion *getCXXThisRegion(QualType thisPointerTy,
1304  const LocationContext *LC);
1305 
1306  /// Retrieve or create a "symbolic" memory region.
1307  const SymbolicRegion* getSymbolicRegion(SymbolRef Sym);
1308 
1309  /// Return a unique symbolic region belonging to heap memory space.
1310  const SymbolicRegion *getSymbolicHeapRegion(SymbolRef sym);
1311 
1312  const StringRegion *getStringRegion(const StringLiteral *Str);
1313 
1314  const ObjCStringRegion *getObjCStringRegion(const ObjCStringLiteral *Str);
1315 
1316  /// getVarRegion - Retrieve or create the memory region associated with
1317  /// a specified VarDecl and LocationContext.
1318  const VarRegion* getVarRegion(const VarDecl *D, const LocationContext *LC);
1319 
1320  /// getVarRegion - Retrieve or create the memory region associated with
1321  /// a specified VarDecl and super region.
1322  const VarRegion *getVarRegion(const VarDecl *D, const MemRegion *superR);
1323 
1324  /// getElementRegion - Retrieve the memory region associated with the
1325  /// associated element type, index, and super region.
1326  const ElementRegion *getElementRegion(QualType elementType, NonLoc Idx,
1327  const SubRegion *superRegion,
1328  ASTContext &Ctx);
1329 
1331  const SubRegion *superRegion) {
1332  return getElementRegion(ER->getElementType(), ER->getIndex(),
1333  superRegion, ER->getContext());
1334  }
1335 
1336  /// getFieldRegion - Retrieve or create the memory region associated with
1337  /// a specified FieldDecl. 'superRegion' corresponds to the containing
1338  /// memory region (which typically represents the memory representing
1339  /// a structure or class).
1340  const FieldRegion *getFieldRegion(const FieldDecl *fd,
1341  const SubRegion* superRegion);
1342 
1344  const SubRegion *superRegion) {
1345  return getFieldRegion(FR->getDecl(), superRegion);
1346  }
1347 
1348  /// getObjCIvarRegion - Retrieve or create the memory region associated with
1349  /// a specified Objective-c instance variable. 'superRegion' corresponds
1350  /// to the containing region (which typically represents the Objective-C
1351  /// object).
1352  const ObjCIvarRegion *getObjCIvarRegion(const ObjCIvarDecl *ivd,
1353  const SubRegion* superRegion);
1354 
1355  const CXXTempObjectRegion *getCXXTempObjectRegion(Expr const *Ex,
1356  LocationContext const *LC);
1357 
1358  /// Create a CXXBaseObjectRegion with the given base class for region
1359  /// \p Super.
1360  ///
1361  /// The type of \p Super is assumed be a class deriving from \p BaseClass.
1362  const CXXBaseObjectRegion *
1363  getCXXBaseObjectRegion(const CXXRecordDecl *BaseClass, const SubRegion *Super,
1364  bool IsVirtual);
1365 
1366  /// Create a CXXBaseObjectRegion with the same CXXRecordDecl but a different
1367  /// super region.
1368  const CXXBaseObjectRegion *
1370  const SubRegion *superRegion) {
1371  return getCXXBaseObjectRegion(baseReg->getDecl(), superRegion,
1372  baseReg->isVirtual());
1373  }
1374 
1375  /// Create a CXXDerivedObjectRegion with the given derived class for region
1376  /// \p Super. This should not be used for casting an existing
1377  /// CXXBaseObjectRegion back to the derived type; instead, CXXBaseObjectRegion
1378  /// should be removed.
1379  const CXXDerivedObjectRegion *
1380  getCXXDerivedObjectRegion(const CXXRecordDecl *BaseClass,
1381  const SubRegion *Super);
1382 
1383  const FunctionCodeRegion *getFunctionCodeRegion(const NamedDecl *FD);
1384  const BlockCodeRegion *getBlockCodeRegion(const BlockDecl *BD,
1385  CanQualType locTy,
1386  AnalysisDeclContext *AC);
1387 
1388  /// getBlockDataRegion - Get the memory region associated with an instance
1389  /// of a block. Unlike many other MemRegions, the LocationContext*
1390  /// argument is allowed to be NULL for cases where we have no known
1391  /// context.
1392  const BlockDataRegion *getBlockDataRegion(const BlockCodeRegion *bc,
1393  const LocationContext *lc,
1394  unsigned blockCount);
1395 
1396  /// Create a CXXTempObjectRegion for temporaries which are lifetime-extended
1397  /// by static references. This differs from getCXXTempObjectRegion in the
1398  /// super-region used.
1399  const CXXTempObjectRegion *getCXXStaticTempObjectRegion(const Expr *Ex);
1400 
1401 private:
1402  template <typename RegionTy, typename SuperTy,
1403  typename Arg1Ty>
1404  RegionTy* getSubRegion(const Arg1Ty arg1,
1405  const SuperTy* superRegion);
1406 
1407  template <typename RegionTy, typename SuperTy,
1408  typename Arg1Ty, typename Arg2Ty>
1409  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
1410  const SuperTy* superRegion);
1411 
1412  template <typename RegionTy, typename SuperTy,
1413  typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
1414  RegionTy* getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
1415  const Arg3Ty arg3,
1416  const SuperTy* superRegion);
1417 
1418  template <typename REG>
1419  const REG* LazyAllocate(REG*& region);
1420 
1421  template <typename REG, typename ARG>
1422  const REG* LazyAllocate(REG*& region, ARG a);
1423 };
1424 
1425 //===----------------------------------------------------------------------===//
1426 // Out-of-line member definitions.
1427 //===----------------------------------------------------------------------===//
1428 
1430  return getMemRegionManager()->getContext();
1431 }
1432 
1433 //===----------------------------------------------------------------------===//
1434 // Means for storing region/symbol handling traits.
1435 //===----------------------------------------------------------------------===//
1436 
1437 /// Information about invalidation for a particular region/symbol.
1439  using StorageTypeForKinds = unsigned char;
1440 
1441  llvm::DenseMap<const MemRegion *, StorageTypeForKinds> MRTraitsMap;
1442  llvm::DenseMap<SymbolRef, StorageTypeForKinds> SymTraitsMap;
1443 
1444  using const_region_iterator =
1445  llvm::DenseMap<const MemRegion *, StorageTypeForKinds>::const_iterator;
1446  using const_symbol_iterator =
1447  llvm::DenseMap<SymbolRef, StorageTypeForKinds>::const_iterator;
1448 
1449 public:
1450  /// Describes different invalidation traits.
1452  /// Tells that a region's contents is not changed.
1453  TK_PreserveContents = 0x1,
1454 
1455  /// Suppress pointer-escaping of a region.
1456  TK_SuppressEscape = 0x2,
1457 
1458  // Do not invalidate super region.
1459  TK_DoNotInvalidateSuperRegion = 0x4,
1460 
1461  /// When applied to a MemSpaceRegion, indicates the entire memory space
1462  /// should be invalidated.
1463  TK_EntireMemSpace = 0x8
1464 
1465  // Do not forget to extend StorageTypeForKinds if number of traits exceed
1466  // the number of bits StorageTypeForKinds can store.
1467  };
1468 
1469  void setTrait(SymbolRef Sym, InvalidationKinds IK);
1470  void setTrait(const MemRegion *MR, InvalidationKinds IK);
1471  bool hasTrait(SymbolRef Sym, InvalidationKinds IK) const;
1472  bool hasTrait(const MemRegion *MR, InvalidationKinds IK) const;
1473 };
1474 
1475 //===----------------------------------------------------------------------===//
1476 // Pretty-printing regions.
1477 //===----------------------------------------------------------------------===//
1478 inline raw_ostream &operator<<(raw_ostream &os, const MemRegion *R) {
1479  R->dumpToStream(os);
1480  return os;
1481 }
1482 
1483 } // namespace ento
1484 
1485 } // namespace clang
1486 
1487 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_MEMREGION_H
RegionOffset(const MemRegion *r, int64_t off)
Definition: MemRegion.h:75
const ElementRegion * getElementRegionWithSuper(const ElementRegion *ER, const SubRegion *superRegion)
Definition: MemRegion.h:1330
bool isBoundable() const override
Definition: MemRegion.h:890
Defines the clang::ASTContext interface.
CodeTextRegion(const MemSpaceRegion *sreg, Kind k)
Definition: MemRegion.h:562
TypedValueRegion - An abstract class representing regions having a typed value.
Definition: MemRegion.h:525
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1031
CompoundLiteralRegion - A memory region representing a compound literal.
Definition: MemRegion.h:870
QualType getValueType() const override
Definition: MemRegion.h:989
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2511
A (possibly-)qualified type.
Definition: Type.h:642
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:94
bool isBlockPointerType() const
Definition: Type.h:6185
const CXXRecordDecl * getDecl() const
Definition: MemRegion.h:1208
QualType getDesugaredType(const ASTContext &Context) const
Return the specified type with any "sugar" removed from the type.
Definition: Type.h:942
SubRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:437
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1438
NonLoc getIndex() const
Definition: MemRegion.h:1101
MemRegionManager * getMemRegionManager() const override
Definition: MemRegion.h:203
C Language Family Type Representation.
virtual void dumpToStream(raw_ostream &os) const
Definition: MemRegion.cpp:455
BlockCodeRegion - A region that represents code texts of blocks (closures).
Definition: MemRegion.h:623
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:87
const ValueDecl * D
Definition: MemRegion.h:905
static bool classof(const MemRegion *R)
Definition: MemRegion.h:898
static bool classof(const MemRegion *R)
Definition: MemRegion.h:995
const ValueDecl * getDecl() const
Definition: MemRegion.h:917
QualType getLocationType() const override
Definition: MemRegion.h:697
const NamedDecl * getDecl() const
Definition: MemRegion.h:604
const MemRegion * getRegion() const
Definition: MemRegion.h:77
The l-value was an access to a declared entity or something equivalently strong, like the address of ...
MemSpaceRegion - A memory region that represents a "memory space"; for example, the set of global var...
Definition: MemRegion.h:194
static bool classof(const MemRegion *region)
Definition: MemRegion.h:1179
const ObjCStringLiteral * getObjCStringLiteral() const
Definition: MemRegion.h:850
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1114
Value representing integer constant.
Definition: SVals.h:377
const CXXBaseObjectRegion * getCXXBaseObjectRegionWithSuper(const CXXBaseObjectRegion *baseReg, const SubRegion *superRegion)
Create a CXXBaseObjectRegion with the same CXXRecordDecl but a different super region.
Definition: MemRegion.h:1369
AllocaRegion - A region that represents an untyped blob of bytes created by a call to &#39;alloca&#39;...
Definition: MemRegion.h:467
static bool classof(const MemRegion *R)
Definition: MemRegion.h:552
bool operator==(const referenced_vars_iterator &I) const
Definition: MemRegion.h:716
CodeSpaceRegion - The memory space that holds the executable code of functions and blocks...
Definition: MemRegion.h:218
CharUnits getOffset() const
Definition: MemRegion.h:1073
Represents a variable declaration or definition.
Definition: Decl.h:812
CompoundLiteralExpr - [C99 6.5.2.5].
Definition: Expr.h:2717
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6590
DeclRegion(const ValueDecl *d, const MemRegion *sReg, Kind k)
Definition: MemRegion.h:907
QualType getElementType() const
Definition: MemRegion.h:1105
AnalysisDeclContext * getAnalysisDeclContext() const
Definition: MemRegion.h:651
Symbolic value.
Definition: SymExpr.h:30
CXXThisRegion - Represents the region for the implicit &#39;this&#39; parameter in a call to a C++ method...
Definition: MemRegion.h:971
const MemRegion * getSuperRegion() const
Definition: MemRegion.h:443
const SymbolicRegion * getSymbolicBase() const
If this is a symbolic region, returns the region.
Definition: MemRegion.cpp:1209
GlobalsSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:236
The region containing globals which can be modified by calls to "internally" defined functions - (for...
Definition: MemRegion.h:335
The region associated with an ObjCStringLiteral.
Definition: MemRegion.h:834
Represents a class type in Objective C.
Definition: Type.h:5419
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:154
bool isFileScope() const
Definition: Expr.h:2747
bool isValid() const
Definition: MemRegion.h:86
const FieldDecl * getDecl() const
Definition: MemRegion.h:1015
Represents a member of a struct/union/class.
Definition: Decl.h:2556
ASTContext & getContext() const
Definition: MemRegion.h:1429
AnalysisDeclContext contains the context data for the function or method under analysis.
QualType getLocationType() const override
Definition: MemRegion.h:590
bool isReferenceType() const
Definition: Type.h:6189
static CharUnits Zero()
Zero - Construct a CharUnits quantity of zero.
Definition: CharUnits.h:53
virtual DefinedOrUnknownSVal getExtent(SValBuilder &svalBuilder) const
getExtent - Returns the size of the region in bytes.
Definition: MemRegion.h:448
QualType getValueType() const override
Definition: MemRegion.h:888
bool isBoundable() const override
Definition: MemRegion.h:854
The region containing globals which are considered not to be modified or point to data which could be...
Definition: MemRegion.h:318
static bool classof(const MemRegion *R)
Definition: MemRegion.h:241
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:668
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1053
static bool classof(const MemRegion *region)
Definition: MemRegion.h:1220
CharUnits - This is an opaque type for sizes expressed in character units.
Definition: CharUnits.h:38
uint32_t Offset
Definition: CacheTokens.cpp:43
static void dump(llvm::raw_ostream &OS, StringRef FunctionName, ArrayRef< CounterExpression > Expressions, ArrayRef< CounterMappingRegion > Regions)
const CXXRecordDecl * getDecl() const
Definition: MemRegion.h:1166
Forward-declares and imports various common LLVM datatypes that clang wants to use unqualified...
referenced_vars_iterator(const MemRegion *const *r, const MemRegion *const *originalR)
Definition: MemRegion.h:704
static bool classof(const MemRegion *R)
Definition: MemRegion.h:409
static bool classof(const MemRegion *R)
Definition: MemRegion.h:1144
ObjCStringLiteral, used for Objective-C string literals i.e.
Definition: ExprObjC.h:51
static bool classof(const MemRegion *R)
Definition: MemRegion.h:269
const StringLiteral * getStringLiteral() const
Definition: MemRegion.h:814
QualType getValueType() const override
Definition: MemRegion.h:952
Represent a region&#39;s offset within the top level base region.
Definition: MemRegion.h:62
const T * getTypePtr() const
Retrieve the underlying type pointer, which refers to a canonical type.
Definition: CanonicalType.h:84
static void ProfileRegion(llvm::FoldingSetNodeID &ID, const Decl *D, const MemRegion *superRegion, Kind k)
Definition: MemRegion.cpp:309
virtual QualType getType() const =0
static bool classof(const MemRegion *R)
Definition: MemRegion.h:828
QualType getValueType() const override
Definition: MemRegion.h:816
bool operator!=(const referenced_vars_iterator &I) const
Definition: MemRegion.h:721
static bool classof(const MemRegion *R)
Definition: MemRegion.h:372
const RegionTy * getAs() const
Definition: MemRegion.h:1226
SymbolicRegion - A special, "non-concrete" region.
Definition: MemRegion.h:759
Pepresents a block literal declaration, which is like an unnamed FunctionDecl.
Definition: Decl.h:3835
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition: Decl.h:636
This represents one expression.
Definition: Expr.h:105
TypedValueRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:529
static const int64_t Symbolic
Definition: MemRegion.h:72
llvm::BumpPtrAllocator & getAllocator()
Definition: MemRegion.h:1263
static bool classof(const MemRegion *R)
Definition: MemRegion.h:744
QualType getType() const
Definition: Expr.h:127
QualType getDesugaredValueType(ASTContext &Context) const
Definition: MemRegion.h:545
const BlockCodeRegion * getCodeRegion() const
Definition: MemRegion.h:693
static bool classof(const MemRegion *R)
Definition: MemRegion.h:920
static bool classof(const MemRegion *R)
Definition: MemRegion.h:569
static bool classof(const MemRegion *R)
Definition: MemRegion.h:657
bool isNull() const
Return true if this QualType doesn&#39;t point to a type yet.
Definition: Type.h:707
static bool classof(const MemRegion *R)
Definition: MemRegion.h:495
TypedRegion(const MemRegion *sReg, Kind k)
Definition: MemRegion.h:505
const StackFrameContext * getStackFrame() const
Definition: MemRegion.h:390
The region of the static variables within the current CodeTextRegion scope.
Definition: MemRegion.h:252
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:112
const VarDecl * getDecl() const
Definition: MemRegion.h:948
virtual bool isBoundable() const
Definition: MemRegion.h:169
The region for all the non-static global variables.
Definition: MemRegion.h:280
Kind getKind() const
Definition: MemRegion.h:165
static bool classof(const MemRegion *R)
Definition: MemRegion.h:862
const BlockDecl * getDecl() const
Definition: MemRegion.h:647
QualType getValueType() const override
Definition: MemRegion.h:1138
Kind
static bool classof(const MemRegion *R)
Definition: MemRegion.h:793
FunctionCodeRegion - A region that represents code texts of function.
Definition: MemRegion.h:576
SymbolRef getSymbol() const
Definition: MemRegion.h:779
const CompoundLiteralExpr * getLiteralExpr() const
Definition: MemRegion.h:896
bool isBoundable() const override
Definition: MemRegion.h:516
static bool classof(const MemRegion *R)
Definition: MemRegion.h:394
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:76
bool isBoundable() const override
Definition: MemRegion.h:781
bool isAnyPointerType() const
Definition: Type.h:6181
QualType getLocationType() const override
Definition: MemRegion.h:536
static bool classof(const MemRegion *R)
Definition: MemRegion.h:327
static bool classof(const MemRegion *R)
Definition: MemRegion.h:456
bool isBoundable() const override
Definition: MemRegion.h:487
static bool classof(const MemRegion *R)
Definition: MemRegion.h:290
Dataflow Directional Tag Classes.
raw_ostream & operator<<(raw_ostream &Out, const CheckerBase &Checker)
Dump checker name to stream.
Definition: Checker.cpp:34
QualType getValueType() const override
Definition: MemRegion.h:852
InvalidationKinds
Describes different invalidation traits.
Definition: MemRegion.h:1451
const MemRegion * getRegion() const
Definition: MemRegion.h:1074
bool isBoundable() const override
Definition: MemRegion.h:206
QualType getLocationType() const override
Definition: MemRegion.h:643
static bool classof(const MemRegion *R)
Definition: MemRegion.h:612
static bool classof(const MemRegion *R)
Definition: MemRegion.h:344
const Expr * getExpr() const
Definition: MemRegion.h:1136
static bool classof(const MemRegion *R)
Definition: MemRegion.h:358
static bool classof(const OMPClause *T)
bool isBoundable() const override
Definition: MemRegion.h:820
T castAs() const
Convert to the specified SVal type, asserting that this SVal is of the desired type.
Definition: SVals.h:104
SubRegion - A region that subsets another larger region.
Definition: MemRegion.h:431
The region containing globals which are defined in system/external headers and are considered modifia...
Definition: MemRegion.h:299
StackSpaceRegion(MemRegionManager *mgr, Kind k, const StackFrameContext *sfc)
Definition: MemRegion.h:383
int64_t getOffset() const
Definition: MemRegion.h:81
const Type * getTypePtrOrNull() const
Definition: Type.h:5957
const CodeTextRegion * getCodeRegion() const
Definition: MemRegion.h:267
const BlockDecl * getDecl() const
Definition: MemRegion.h:695
MemSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:198
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: MemRegion.h:856
const Expr * getExpr() const
Definition: MemRegion.h:485
Defines the clang::SourceLocation class and associated facilities.
Represents a C++ struct/union/class.
Definition: DeclCXX.h:300
bool isVoidType() const
Definition: Type.h:6404
static bool classof(const MemRegion *R)
Definition: MemRegion.h:227
void Profile(llvm::FoldingSetNodeID &ID) const override
Definition: MemRegion.h:822
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1937
QualType getValueType() const override
Definition: MemRegion.h:1103
static bool classof(const MemRegion *R)
Definition: MemRegion.h:963
static bool classof(const MemRegion *R)
Definition: MemRegion.h:518
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
unsigned kind
All of the diagnostics that can be emitted by the frontend.
Definition: DiagnosticIDs.h:61
StringLiteral - This represents a string literal expression, e.g.
Definition: Expr.h:1568
QualType getDesugaredLocationType(ASTContext &Context) const
Definition: MemRegion.h:512
StringRegion - Region associated with a StringLiteral.
Definition: MemRegion.h:799
const FieldRegion * getFieldRegionWithSuper(const FieldRegion *FR, const SubRegion *superRegion)
Definition: MemRegion.h:1343
ElementRegin is used to represent both array elements and casts.
Definition: MemRegion.h:1081
__DEVICE__ int max(int __a, int __b)
QualType getValueType() const override
Definition: MemRegion.h:1017
MemRegionManager(ASTContext &c, llvm::BumpPtrAllocator &a)
Definition: MemRegion.h:1258
const llvm::APSInt & getValue() const
Definition: SVals.h:381
A trivial tuple used to represent a source range.
This represents a decl that may have a name.
Definition: Decl.h:248
QualType getObjCObjectPointerType(QualType OIT) const
Return a ObjCObjectPointerType type for the given ObjCObjectType.
static bool classof(const MemRegion *R)
Definition: MemRegion.h:308
const MemRegion * superRegion
Definition: MemRegion.h:435
static bool classof(const MemRegion *R)
Definition: MemRegion.h:424
bool isBoundable() const override
Definition: MemRegion.h:567
MemRegionManager * Mgr
Definition: MemRegion.h:196
bool hasSymbolicOffset() const
Definition: MemRegion.h:79
NonStaticGlobalSpaceRegion(MemRegionManager *mgr, Kind k)
Definition: MemRegion.h:284
TypedRegion - An abstract class representing regions that are typed.
Definition: MemRegion.h:501
static bool classof(const MemRegion *R)
Definition: MemRegion.h:210