clang  5.0.0
CallEvent.cpp
Go to the documentation of this file.
1 //===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15 
17 #include "clang/AST/ParentMap.h"
21 #include "llvm/ADT/SmallSet.h"
22 #include "llvm/ADT/StringExtras.h"
23 #include "llvm/Support/raw_ostream.h"
24 
25 using namespace clang;
26 using namespace ento;
27 
29  const Expr *E = getOriginExpr();
30  assert(E && "Calls without origin expressions do not have results");
31  QualType ResultTy = E->getType();
32 
33  ASTContext &Ctx = getState()->getStateManager().getContext();
34 
35  // A function that returns a reference to 'int' will have a result type
36  // of simply 'int'. Check the origin expr's value kind to recover the
37  // proper type.
38  switch (E->getValueKind()) {
39  case VK_LValue:
40  ResultTy = Ctx.getLValueReferenceType(ResultTy);
41  break;
42  case VK_XValue:
43  ResultTy = Ctx.getRValueReferenceType(ResultTy);
44  break;
45  case VK_RValue:
46  // No adjustment is necessary.
47  break;
48  }
49 
50  return ResultTy;
51 }
52 
53 static bool isCallback(QualType T) {
54  // If a parameter is a block or a callback, assume it can modify pointer.
55  if (T->isBlockPointerType() ||
56  T->isFunctionPointerType() ||
57  T->isObjCSelType())
58  return true;
59 
60  // Check if a callback is passed inside a struct (for both, struct passed by
61  // reference and by value). Dig just one level into the struct for now.
62 
63  if (T->isAnyPointerType() || T->isReferenceType())
64  T = T->getPointeeType();
65 
66  if (const RecordType *RT = T->getAsStructureType()) {
67  const RecordDecl *RD = RT->getDecl();
68  for (const auto *I : RD->fields()) {
69  QualType FieldT = I->getType();
70  if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
71  return true;
72  }
73  }
74  return false;
75 }
76 
78  if (const PointerType *PT = T->getAs<PointerType>()) {
79  QualType PointeeTy = PT->getPointeeType();
80  if (PointeeTy.isConstQualified())
81  return false;
82  return PointeeTy->isVoidType();
83  } else
84  return false;
85 }
86 
87 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
88  unsigned NumOfArgs = getNumArgs();
89 
90  // If calling using a function pointer, assume the function does not
91  // satisfy the callback.
92  // TODO: We could check the types of the arguments here.
93  if (!getDecl())
94  return false;
95 
96  unsigned Idx = 0;
98  E = param_type_end();
99  I != E && Idx < NumOfArgs; ++I, ++Idx) {
100  if (NumOfArgs <= Idx)
101  break;
102 
103  // If the parameter is 0, it's harmless.
104  if (getArgSVal(Idx).isZeroConstant())
105  continue;
106 
107  if (Condition(*I))
108  return true;
109  }
110  return false;
111 }
112 
115 }
116 
119 }
120 
121 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
122  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
123  if (!FD)
124  return false;
125 
126  return CheckerContext::isCLibraryFunction(FD, FunctionName);
127 }
128 
129 /// \brief Returns true if a type is a pointer-to-const or reference-to-const
130 /// with no further indirection.
131 static bool isPointerToConst(QualType Ty) {
132  QualType PointeeTy = Ty->getPointeeType();
133  if (PointeeTy == QualType())
134  return false;
135  if (!PointeeTy.isConstQualified())
136  return false;
137  if (PointeeTy->isAnyPointerType())
138  return false;
139  return true;
140 }
141 
142 // Try to retrieve the function declaration and find the function parameter
143 // types which are pointers/references to a non-pointer const.
144 // We will not invalidate the corresponding argument regions.
145 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
146  const CallEvent &Call) {
147  unsigned Idx = 0;
149  E = Call.param_type_end();
150  I != E; ++I, ++Idx) {
151  if (isPointerToConst(*I))
152  PreserveArgs.insert(Idx);
153  }
154 }
155 
157  ProgramStateRef Orig) const {
158  ProgramStateRef Result = (Orig ? Orig : getState());
159 
160  // Don't invalidate anything if the callee is marked pure/const.
161  if (const Decl *callee = getDecl())
162  if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
163  return Result;
164 
165  SmallVector<SVal, 8> ValuesToInvalidate;
167 
168  getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
169 
170  // Indexes of arguments whose values will be preserved by the call.
171  llvm::SmallSet<unsigned, 4> PreserveArgs;
172  if (!argumentsMayEscape())
173  findPtrToConstParams(PreserveArgs, *this);
174 
175  for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
176  // Mark this region for invalidation. We batch invalidate regions
177  // below for efficiency.
178  if (PreserveArgs.count(Idx))
179  if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
180  ETraits.setTrait(MR->getBaseRegion(),
182  // TODO: Factor this out + handle the lower level const pointers.
183 
184  ValuesToInvalidate.push_back(getArgSVal(Idx));
185  }
186 
187  // Invalidate designated regions using the batch invalidation API.
188  // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
189  // global variables.
190  return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
191  BlockCount, getLocationContext(),
192  /*CausedByPointerEscape*/ true,
193  /*Symbols=*/nullptr, this, &ETraits);
194 }
195 
197  const ProgramPointTag *Tag) const {
198  if (const Expr *E = getOriginExpr()) {
199  if (IsPreVisit)
200  return PreStmt(E, getLocationContext(), Tag);
201  return PostStmt(E, getLocationContext(), Tag);
202  }
203 
204  const Decl *D = getDecl();
205  assert(D && "Cannot get a program point without a statement or decl");
206 
208  if (IsPreVisit)
209  return PreImplicitCall(D, Loc, getLocationContext(), Tag);
210  return PostImplicitCall(D, Loc, getLocationContext(), Tag);
211 }
212 
213 bool CallEvent::isCalled(const CallDescription &CD) const {
214  assert(getKind() != CE_ObjCMessage && "Obj-C methods are not supported");
215  if (!CD.IsLookupDone) {
216  CD.IsLookupDone = true;
217  CD.II = &getState()->getStateManager().getContext().Idents.get(CD.FuncName);
218  }
219  const IdentifierInfo *II = getCalleeIdentifier();
220  if (!II || II != CD.II)
221  return false;
222  return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
223  CD.RequiredArgs == getNumArgs());
224 }
225 
226 SVal CallEvent::getArgSVal(unsigned Index) const {
227  const Expr *ArgE = getArgExpr(Index);
228  if (!ArgE)
229  return UnknownVal();
230  return getSVal(ArgE);
231 }
232 
234  const Expr *ArgE = getArgExpr(Index);
235  if (!ArgE)
236  return SourceRange();
237  return ArgE->getSourceRange();
238 }
239 
241  const Expr *E = getOriginExpr();
242  if (!E)
243  return UndefinedVal();
244  return getSVal(E);
245 }
246 
247 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
248 
249 void CallEvent::dump(raw_ostream &Out) const {
250  ASTContext &Ctx = getState()->getStateManager().getContext();
251  if (const Expr *E = getOriginExpr()) {
252  E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
253  Out << "\n";
254  return;
255  }
256 
257  if (const Decl *D = getDecl()) {
258  Out << "Call to ";
259  D->print(Out, Ctx.getPrintingPolicy());
260  return;
261  }
262 
263  // FIXME: a string representation of the kind would be nice.
264  Out << "Unknown call (type " << getKind() << ")";
265 }
266 
267 
269  return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
270  || isa<CXXConstructExpr>(S)
271  || isa<CXXNewExpr>(S);
272 }
273 
275  assert(D);
276  if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D))
277  return FD->getReturnType();
278  if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D))
279  return MD->getReturnType();
280  if (const BlockDecl *BD = dyn_cast<BlockDecl>(D)) {
281  // Blocks are difficult because the return type may not be stored in the
282  // BlockDecl itself. The AST should probably be enhanced, but for now we
283  // just do what we can.
284  // If the block is declared without an explicit argument list, the
285  // signature-as-written just includes the return type, not the entire
286  // function type.
287  // FIXME: All blocks should have signatures-as-written, even if the return
288  // type is inferred. (That's signified with a dependent result type.)
289  if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
290  QualType Ty = TSI->getType();
291  if (const FunctionType *FT = Ty->getAs<FunctionType>())
292  Ty = FT->getReturnType();
293  if (!Ty->isDependentType())
294  return Ty;
295  }
296 
297  return QualType();
298  }
299 
300  llvm_unreachable("unknown callable kind");
301 }
302 
303 bool CallEvent::isVariadic(const Decl *D) {
304  assert(D);
305 
306  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
307  return FD->isVariadic();
308  if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D))
309  return MD->isVariadic();
310  if (const BlockDecl *BD = dyn_cast<BlockDecl>(D))
311  return BD->isVariadic();
312 
313  llvm_unreachable("unknown callable kind");
314 }
315 
316 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
317  CallEvent::BindingsTy &Bindings,
318  SValBuilder &SVB,
319  const CallEvent &Call,
320  ArrayRef<ParmVarDecl*> parameters) {
321  MemRegionManager &MRMgr = SVB.getRegionManager();
322 
323  // If the function has fewer parameters than the call has arguments, we simply
324  // do not bind any values to them.
325  unsigned NumArgs = Call.getNumArgs();
326  unsigned Idx = 0;
327  ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
328  for (; I != E && Idx < NumArgs; ++I, ++Idx) {
329  const ParmVarDecl *ParamDecl = *I;
330  assert(ParamDecl && "Formal parameter has no decl?");
331 
332  SVal ArgVal = Call.getArgSVal(Idx);
333  if (!ArgVal.isUnknown()) {
334  Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
335  Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
336  }
337  }
338 
339  // FIXME: Variadic arguments are not handled at all right now.
340 }
341 
343  const FunctionDecl *D = getDecl();
344  if (!D)
345  return None;
346  return D->parameters();
347 }
348 
350  const StackFrameContext *CalleeCtx,
351  BindingsTy &Bindings) const {
352  const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl());
353  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
354  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
355  D->parameters());
356 }
357 
360  return true;
361 
362  const FunctionDecl *D = getDecl();
363  if (!D)
364  return true;
365 
366  const IdentifierInfo *II = D->getIdentifier();
367  if (!II)
368  return false;
369 
370  // This set of "escaping" APIs is
371 
372  // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
373  // value into thread local storage. The value can later be retrieved with
374  // 'void *ptheread_getspecific(pthread_key)'. So even thought the
375  // parameter is 'const void *', the region escapes through the call.
376  if (II->isStr("pthread_setspecific"))
377  return true;
378 
379  // - xpc_connection_set_context stores a value which can be retrieved later
380  // with xpc_connection_get_context.
381  if (II->isStr("xpc_connection_set_context"))
382  return true;
383 
384  // - funopen - sets a buffer for future IO calls.
385  if (II->isStr("funopen"))
386  return true;
387 
388  // - __cxa_demangle - can reallocate memory and can return the pointer to
389  // the input buffer.
390  if (II->isStr("__cxa_demangle"))
391  return true;
392 
393  StringRef FName = II->getName();
394 
395  // - CoreFoundation functions that end with "NoCopy" can free a passed-in
396  // buffer even if it is const.
397  if (FName.endswith("NoCopy"))
398  return true;
399 
400  // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
401  // be deallocated by NSMapRemove.
402  if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
403  return true;
404 
405  // - Many CF containers allow objects to escape through custom
406  // allocators/deallocators upon container construction. (PR12101)
407  if (FName.startswith("CF") || FName.startswith("CG")) {
408  return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
409  StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
410  StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
411  StrInStrNoCase(FName, "WithData") != StringRef::npos ||
412  StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
413  StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
414  }
415 
416  return false;
417 }
418 
419 
422  if (D)
423  return D;
424 
425  return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
426 }
427 
428 
430  const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr());
431  if (!CE)
432  return AnyFunctionCall::getDecl();
433 
434  const FunctionDecl *D = CE->getDirectCallee();
435  if (D)
436  return D;
437 
438  return getSVal(CE->getCallee()).getAsFunctionDecl();
439 }
440 
442  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
443  SVal ThisVal = getCXXThisVal();
444  Values.push_back(ThisVal);
445 
446  // Don't invalidate if the method is const and there are no mutable fields.
447  if (const CXXMethodDecl *D = cast_or_null<CXXMethodDecl>(getDecl())) {
448  if (!D->isConst())
449  return;
450  // Get the record decl for the class of 'This'. D->getParent() may return a
451  // base class decl, rather than the class of the instance which needs to be
452  // checked for mutable fields.
453  const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
454  const CXXRecordDecl *ParentRecord = Ex->getType()->getAsCXXRecordDecl();
455  if (!ParentRecord || ParentRecord->hasMutableFields())
456  return;
457  // Preserve CXXThis.
458  const MemRegion *ThisRegion = ThisVal.getAsRegion();
459  if (!ThisRegion)
460  return;
461 
462  ETraits->setTrait(ThisRegion->getBaseRegion(),
464  }
465 }
466 
468  const Expr *Base = getCXXThisExpr();
469  // FIXME: This doesn't handle an overloaded ->* operator.
470  if (!Base)
471  return UnknownVal();
472 
473  SVal ThisVal = getSVal(Base);
474  assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
475  return ThisVal;
476 }
477 
478 
480  // Do we have a decl at all?
481  const Decl *D = getDecl();
482  if (!D)
483  return RuntimeDefinition();
484 
485  // If the method is non-virtual, we know we can inline it.
486  const CXXMethodDecl *MD = cast<CXXMethodDecl>(D);
487  if (!MD->isVirtual())
489 
490  // Do we know the implicit 'this' object being called?
491  const MemRegion *R = getCXXThisVal().getAsRegion();
492  if (!R)
493  return RuntimeDefinition();
494 
495  // Do we know anything about the type of 'this'?
496  DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
497  if (!DynType.isValid())
498  return RuntimeDefinition();
499 
500  // Is the type a C++ class? (This is mostly a defensive check.)
501  QualType RegionType = DynType.getType()->getPointeeType();
502  assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
503 
504  const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
505  if (!RD || !RD->hasDefinition())
506  return RuntimeDefinition();
507 
508  // Find the decl for this method in that class.
509  const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
510  if (!Result) {
511  // We might not even get the original statically-resolved method due to
512  // some particularly nasty casting (e.g. casts to sister classes).
513  // However, we should at least be able to search up and down our own class
514  // hierarchy, and some real bugs have been caught by checking this.
515  assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
516 
517  // FIXME: This is checking that our DynamicTypeInfo is at least as good as
518  // the static type. However, because we currently don't update
519  // DynamicTypeInfo when an object is cast, we can't actually be sure the
520  // DynamicTypeInfo is up to date. This assert should be re-enabled once
521  // this is fixed. <rdar://problem/12287087>
522  //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
523 
524  return RuntimeDefinition();
525  }
526 
527  // Does the decl that we found have an implementation?
528  const FunctionDecl *Definition;
529  if (!Result->hasBody(Definition))
530  return RuntimeDefinition();
531 
532  // We found a definition. If we're not sure that this devirtualization is
533  // actually what will happen at runtime, make sure to provide the region so
534  // that ExprEngine can decide what to do with it.
535  if (DynType.canBeASubClass())
536  return RuntimeDefinition(Definition, R->StripCasts());
537  return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
538 }
539 
541  const StackFrameContext *CalleeCtx,
542  BindingsTy &Bindings) const {
544 
545  // Handle the binding of 'this' in the new stack frame.
546  SVal ThisVal = getCXXThisVal();
547  if (!ThisVal.isUnknown()) {
548  ProgramStateManager &StateMgr = getState()->getStateManager();
549  SValBuilder &SVB = StateMgr.getSValBuilder();
550 
551  const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
552  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
553 
554  // If we devirtualized to a different member function, we need to make sure
555  // we have the proper layering of CXXBaseObjectRegions.
556  if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
557  ASTContext &Ctx = SVB.getContext();
558  const CXXRecordDecl *Class = MD->getParent();
559  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
560 
561  // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
562  bool Failed;
563  ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
564  assert(!Failed && "Calling an incorrectly devirtualized method");
565  }
566 
567  if (!ThisVal.isUnknown())
568  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
569  }
570 }
571 
572 
573 
575  return getOriginExpr()->getImplicitObjectArgument();
576 }
577 
579  // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
580  // id-expression in the class member access expression is a qualified-id,
581  // that function is called. Otherwise, its final overrider in the dynamic type
582  // of the object expression is called.
583  if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
584  if (ME->hasQualifier())
586 
588 }
589 
590 
592  return getOriginExpr()->getArg(0);
593 }
594 
595 
597  const Expr *Callee = getOriginExpr()->getCallee();
598  const MemRegion *DataReg = getSVal(Callee).getAsRegion();
599 
600  return dyn_cast_or_null<BlockDataRegion>(DataReg);
601 }
602 
604  const BlockDecl *D = getDecl();
605  if (!D)
606  return nullptr;
607  return D->parameters();
608 }
609 
611  RegionAndSymbolInvalidationTraits *ETraits) const {
612  // FIXME: This also needs to invalidate captured globals.
613  if (const MemRegion *R = getBlockRegion())
614  Values.push_back(loc::MemRegionVal(R));
615 }
616 
618  BindingsTy &Bindings) const {
619  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
620  ArrayRef<ParmVarDecl*> Params;
621  if (isConversionFromLambda()) {
622  auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
623  Params = LambdaOperatorDecl->parameters();
624 
625  // For blocks converted from a C++ lambda, the callee declaration is the
626  // operator() method on the lambda so we bind "this" to
627  // the lambda captured by the block.
628  const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
629  SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
630  Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
631  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
632  } else {
633  Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
634  }
635 
636  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
637  Params);
638 }
639 
640 
642  if (Data)
643  return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
644  return UnknownVal();
645 }
646 
648  RegionAndSymbolInvalidationTraits *ETraits) const {
649  if (Data)
650  Values.push_back(loc::MemRegionVal(static_cast<const MemRegion *>(Data)));
651 }
652 
654  const StackFrameContext *CalleeCtx,
655  BindingsTy &Bindings) const {
657 
658  SVal ThisVal = getCXXThisVal();
659  if (!ThisVal.isUnknown()) {
660  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
661  const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
662  Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
663  Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
664  }
665 }
666 
668  if (Data)
669  return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
670  return UnknownVal();
671 }
672 
674  // Base destructors are always called non-virtually.
675  // Skip CXXInstanceCall's devirtualization logic in this case.
676  if (isBaseDestructor())
678 
680 }
681 
683  const ObjCMethodDecl *D = getDecl();
684  if (!D)
685  return None;
686  return D->parameters();
687 }
688 
690  ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
691 
692  // If the method call is a setter for property known to be backed by
693  // an instance variable, don't invalidate the entire receiver, just
694  // the storage for that instance variable.
695  if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
696  if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
697  SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
698  if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
699  ETraits->setTrait(
700  IvarRegion,
702  ETraits->setTrait(
703  IvarRegion,
705  Values.push_back(IvarLVal);
706  }
707  return;
708  }
709  }
710 
711  Values.push_back(getReceiverSVal());
712 }
713 
715  const LocationContext *LCtx = getLocationContext();
716  const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
717  if (!SelfDecl)
718  return SVal();
719  return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
720 }
721 
723  // FIXME: Is this the best way to handle class receivers?
724  if (!isInstanceMessage())
725  return UnknownVal();
726 
727  if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
728  return getSVal(RecE);
729 
730  // An instance message with no expression means we are sending to super.
731  // In this case the object reference is the same as 'self'.
732  assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
733  SVal SelfVal = getSelfSVal();
734  assert(SelfVal.isValid() && "Calling super but not in ObjC method");
735  return SelfVal;
736 }
737 
739  if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
740  getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
741  return true;
742 
743  if (!isInstanceMessage())
744  return false;
745 
746  SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
747 
748  return (RecVal == getSelfSVal());
749 }
750 
752  switch (getMessageKind()) {
753  case OCM_Message:
754  return getOriginExpr()->getSourceRange();
755  case OCM_PropertyAccess:
756  case OCM_Subscript:
757  return getContainingPseudoObjectExpr()->getSourceRange();
758  }
759  llvm_unreachable("unknown message kind");
760 }
761 
762 typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
763 
764 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
765  assert(Data && "Lazy lookup not yet performed.");
766  assert(getMessageKind() != OCM_Message && "Explicit message send.");
767  return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
768 }
769 
770 static const Expr *
772  const Expr *Syntactic = POE->getSyntacticForm();
773 
774  // This handles the funny case of assigning to the result of a getter.
775  // This can happen if the getter returns a non-const reference.
776  if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic))
777  Syntactic = BO->getLHS();
778 
779  return Syntactic;
780 }
781 
783  if (!Data) {
784 
785  // Find the parent, ignoring implicit casts.
786  ParentMap &PM = getLocationContext()->getParentMap();
787  const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
788 
789  // Check if parent is a PseudoObjectExpr.
790  if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
791  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
792 
793  ObjCMessageKind K;
794  switch (Syntactic->getStmtClass()) {
795  case Stmt::ObjCPropertyRefExprClass:
796  K = OCM_PropertyAccess;
797  break;
798  case Stmt::ObjCSubscriptRefExprClass:
799  K = OCM_Subscript;
800  break;
801  default:
802  // FIXME: Can this ever happen?
803  K = OCM_Message;
804  break;
805  }
806 
807  if (K != OCM_Message) {
808  const_cast<ObjCMethodCall *>(this)->Data
809  = ObjCMessageDataTy(POE, K).getOpaqueValue();
810  assert(getMessageKind() == K);
811  return K;
812  }
813  }
814 
815  const_cast<ObjCMethodCall *>(this)->Data
816  = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
817  assert(getMessageKind() == OCM_Message);
818  return OCM_Message;
819  }
820 
821  ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
822  if (!Info.getPointer())
823  return OCM_Message;
824  return static_cast<ObjCMessageKind>(Info.getInt());
825 }
826 
828  // Look for properties accessed with property syntax (foo.bar = ...)
829  if ( getMessageKind() == OCM_PropertyAccess) {
830  const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
831  assert(POE && "Property access without PseudoObjectExpr?");
832 
833  const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
834  auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
835 
836  if (RefExpr->isExplicitProperty())
837  return RefExpr->getExplicitProperty();
838  }
839 
840  // Look for properties accessed with method syntax ([foo setBar:...]).
841  const ObjCMethodDecl *MD = getDecl();
842  if (!MD || !MD->isPropertyAccessor())
843  return nullptr;
844 
845  // Note: This is potentially quite slow.
846  return MD->findPropertyDecl();
847 }
848 
850  Selector Sel) const {
851  assert(IDecl);
852  const SourceManager &SM =
853  getState()->getStateManager().getContext().getSourceManager();
854 
855  // If the class interface is declared inside the main file, assume it is not
856  // subcassed.
857  // TODO: It could actually be subclassed if the subclass is private as well.
858  // This is probably very rare.
859  SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
860  if (InterfLoc.isValid() && SM.isInMainFile(InterfLoc))
861  return false;
862 
863  // Assume that property accessors are not overridden.
864  if (getMessageKind() == OCM_PropertyAccess)
865  return false;
866 
867  // We assume that if the method is public (declared outside of main file) or
868  // has a parent which publicly declares the method, the method could be
869  // overridden in a subclass.
870 
871  // Find the first declaration in the class hierarchy that declares
872  // the selector.
873  ObjCMethodDecl *D = nullptr;
874  while (true) {
875  D = IDecl->lookupMethod(Sel, true);
876 
877  // Cannot find a public definition.
878  if (!D)
879  return false;
880 
881  // If outside the main file,
882  if (D->getLocation().isValid() && !SM.isInMainFile(D->getLocation()))
883  return true;
884 
885  if (D->isOverriding()) {
886  // Search in the superclass on the next iteration.
887  IDecl = D->getClassInterface();
888  if (!IDecl)
889  return false;
890 
891  IDecl = IDecl->getSuperClass();
892  if (!IDecl)
893  return false;
894 
895  continue;
896  }
897 
898  return false;
899  };
900 
901  llvm_unreachable("The while loop should always terminate.");
902 }
903 
905  if (!MD)
906  return MD;
907 
908  // Find the redeclaration that defines the method.
909  if (!MD->hasBody()) {
910  for (auto I : MD->redecls())
911  if (I->hasBody())
912  MD = cast<ObjCMethodDecl>(I);
913  }
914  return MD;
915 }
916 
917 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
918  const Expr* InstRec = ME->getInstanceReceiver();
919  if (!InstRec)
920  return false;
921  const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
922 
923  // Check that receiver is called 'self'.
924  if (!InstRecIg || !InstRecIg->getFoundDecl() ||
925  !InstRecIg->getFoundDecl()->getName().equals("self"))
926  return false;
927 
928  // Check that the method name is 'class'.
929  if (ME->getSelector().getNumArgs() != 0 ||
930  !ME->getSelector().getNameForSlot(0).equals("class"))
931  return false;
932 
933  return true;
934 }
935 
937  const ObjCMessageExpr *E = getOriginExpr();
938  assert(E);
939  Selector Sel = E->getSelector();
940 
941  if (E->isInstanceMessage()) {
942 
943  // Find the receiver type.
944  const ObjCObjectPointerType *ReceiverT = nullptr;
945  bool CanBeSubClassed = false;
946  QualType SupersType = E->getSuperType();
947  const MemRegion *Receiver = nullptr;
948 
949  if (!SupersType.isNull()) {
950  // The receiver is guaranteed to be 'super' in this case.
951  // Super always means the type of immediate predecessor to the method
952  // where the call occurs.
953  ReceiverT = cast<ObjCObjectPointerType>(SupersType);
954  } else {
955  Receiver = getReceiverSVal().getAsRegion();
956  if (!Receiver)
957  return RuntimeDefinition();
958 
959  DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
960  if (!DTI.isValid()) {
961  assert(isa<AllocaRegion>(Receiver) &&
962  "Unhandled untyped region class!");
963  return RuntimeDefinition();
964  }
965 
966  QualType DynType = DTI.getType();
967  CanBeSubClassed = DTI.canBeASubClass();
968  ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
969 
970  if (ReceiverT && CanBeSubClassed)
971  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
972  if (!canBeOverridenInSubclass(IDecl, Sel))
973  CanBeSubClassed = false;
974  }
975 
976  // Handle special cases of '[self classMethod]' and
977  // '[[self class] classMethod]', which are treated by the compiler as
978  // instance (not class) messages. We will statically dispatch to those.
979  if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
980  // For [self classMethod], return the compiler visible declaration.
981  if (PT->getObjectType()->isObjCClass() &&
982  Receiver == getSelfSVal().getAsRegion())
984 
985  // Similarly, handle [[self class] classMethod].
986  // TODO: We are currently doing a syntactic match for this pattern with is
987  // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
988  // shows. A better way would be to associate the meta type with the symbol
989  // using the dynamic type info tracking and use it here. We can add a new
990  // SVal for ObjC 'Class' values that know what interface declaration they
991  // come from. Then 'self' in a class method would be filled in with
992  // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
993  // do proper dynamic dispatch for class methods just like we do for
994  // instance methods now.
995  if (E->getInstanceReceiver())
996  if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
997  if (isCallToSelfClass(M))
999  }
1000 
1001  // Lookup the instance method implementation.
1002  if (ReceiverT)
1003  if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1004  // Repeatedly calling lookupPrivateMethod() is expensive, especially
1005  // when in many cases it returns null. We cache the results so
1006  // that repeated queries on the same ObjCIntefaceDecl and Selector
1007  // don't incur the same cost. On some test cases, we can see the
1008  // same query being issued thousands of times.
1009  //
1010  // NOTE: This cache is essentially a "global" variable, but it
1011  // only gets lazily created when we get here. The value of the
1012  // cache probably comes from it being global across ExprEngines,
1013  // where the same queries may get issued. If we are worried about
1014  // concurrency, or possibly loading/unloading ASTs, etc., we may
1015  // need to revisit this someday. In terms of memory, this table
1016  // stays around until clang quits, which also may be bad if we
1017  // need to release memory.
1018  typedef std::pair<const ObjCInterfaceDecl*, Selector>
1019  PrivateMethodKey;
1020  typedef llvm::DenseMap<PrivateMethodKey,
1022  PrivateMethodCache;
1023 
1024  static PrivateMethodCache PMC;
1025  Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1026 
1027  // Query lookupPrivateMethod() if the cache does not hit.
1028  if (!Val.hasValue()) {
1029  Val = IDecl->lookupPrivateMethod(Sel);
1030 
1031  // If the method is a property accessor, we should try to "inline" it
1032  // even if we don't actually have an implementation.
1033  if (!*Val)
1034  if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1035  if (CompileTimeMD->isPropertyAccessor()) {
1036  if (!CompileTimeMD->getSelfDecl() &&
1037  isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1038  // If the method is an accessor in a category, and it doesn't
1039  // have a self declaration, first
1040  // try to find the method in a class extension. This
1041  // works around a bug in Sema where multiple accessors
1042  // are synthesized for properties in class
1043  // extensions that are redeclared in a category and the
1044  // the implicit parameters are not filled in for
1045  // the method on the category.
1046  // This ensures we find the accessor in the extension, which
1047  // has the implicit parameters filled in.
1048  auto *ID = CompileTimeMD->getClassInterface();
1049  for (auto *CatDecl : ID->visible_extensions()) {
1050  Val = CatDecl->getMethod(Sel,
1051  CompileTimeMD->isInstanceMethod());
1052  if (*Val)
1053  break;
1054  }
1055  }
1056  if (!*Val)
1057  Val = IDecl->lookupInstanceMethod(Sel);
1058  }
1059  }
1060 
1061  const ObjCMethodDecl *MD = Val.getValue();
1062  if (CanBeSubClassed)
1063  return RuntimeDefinition(MD, Receiver);
1064  else
1065  return RuntimeDefinition(MD, nullptr);
1066  }
1067 
1068  } else {
1069  // This is a class method.
1070  // If we have type info for the receiver class, we are calling via
1071  // class name.
1072  if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1073  // Find/Return the method implementation.
1074  return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1075  }
1076  }
1077 
1078  return RuntimeDefinition();
1079 }
1080 
1082  if (isInSystemHeader() && !isInstanceMessage()) {
1083  Selector Sel = getSelector();
1084  if (Sel.getNumArgs() == 1 &&
1085  Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1086  return true;
1087  }
1088 
1090 }
1091 
1093  const StackFrameContext *CalleeCtx,
1094  BindingsTy &Bindings) const {
1095  const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1096  SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1097  addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1098  D->parameters());
1099 
1100  SVal SelfVal = getReceiverSVal();
1101  if (!SelfVal.isUnknown()) {
1102  const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1103  MemRegionManager &MRMgr = SVB.getRegionManager();
1104  Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1105  Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1106  }
1107 }
1108 
1111  const LocationContext *LCtx) {
1112  if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1113  return create<CXXMemberCall>(MCE, State, LCtx);
1114 
1115  if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1116  const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1117  if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1118  if (MD->isInstance())
1119  return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1120 
1121  } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1122  return create<BlockCall>(CE, State, LCtx);
1123  }
1124 
1125  // Otherwise, it's a normal function call, static member function call, or
1126  // something we can't reason about.
1127  return create<SimpleFunctionCall>(CE, State, LCtx);
1128 }
1129 
1130 
1134  const LocationContext *ParentCtx = CalleeCtx->getParent();
1135  const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame();
1136  assert(CallerCtx && "This should not be used for top-level stack frames");
1137 
1138  const Stmt *CallSite = CalleeCtx->getCallSite();
1139 
1140  if (CallSite) {
1141  if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
1142  return getSimpleCall(CE, State, CallerCtx);
1143 
1144  switch (CallSite->getStmtClass()) {
1145  case Stmt::CXXConstructExprClass:
1146  case Stmt::CXXTemporaryObjectExprClass: {
1147  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1148  const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1149  Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1150  SVal ThisVal = State->getSVal(ThisPtr);
1151 
1152  return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1153  ThisVal.getAsRegion(), State, CallerCtx);
1154  }
1155  case Stmt::CXXNewExprClass:
1156  return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
1157  case Stmt::ObjCMessageExprClass:
1158  return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
1159  State, CallerCtx);
1160  default:
1161  llvm_unreachable("This is not an inlineable statement.");
1162  }
1163  }
1164 
1165  // Fall back to the CFG. The only thing we haven't handled yet is
1166  // destructors, though this could change in the future.
1167  const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1168  CFGElement E = (*B)[CalleeCtx->getIndex()];
1169  assert(E.getAs<CFGImplicitDtor>() &&
1170  "All other CFG elements should have exprs");
1171  assert(!E.getAs<CFGTemporaryDtor>() && "We don't handle temporaries yet");
1172 
1173  SValBuilder &SVB = State->getStateManager().getSValBuilder();
1174  const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1175  Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1176  SVal ThisVal = State->getSVal(ThisPtr);
1177 
1178  const Stmt *Trigger;
1180  Trigger = AutoDtor->getTriggerStmt();
1181  else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1182  Trigger = cast<Stmt>(DeleteDtor->getDeleteExpr());
1183  else
1184  Trigger = Dtor->getBody();
1185 
1186  return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1187  E.getAs<CFGBaseDtor>().hasValue(), State,
1188  CallerCtx);
1189 }
llvm::PointerIntPair< const PseudoObjectExpr *, 2 > ObjCMessageDataTy
Definition: CallEvent.cpp:762
bool isObjCSelType() const
Definition: Type.h:5818
virtual SVal getArgSVal(unsigned Index) const
Returns the value of a given argument at the time of the call.
Definition: CallEvent.cpp:226
A call to an overloaded operator written using operator syntax.
Definition: ExprCXX.h:52
The receiver is the instance of the superclass object.
Definition: ExprObjC.h:1009
SVal attemptDownCast(SVal Base, QualType DerivedPtrType, bool &Failed)
Attempts to do a down cast.
Definition: Store.cpp:296
StmtClass getStmtClass() const
Definition: Stmt.h:361
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:647
FunctionDecl - An instance of this class is created to represent a function declaration or definition...
Definition: Decl.h:1618
Expr * getSyntacticForm()
Return the syntactic form of this expression, i.e.
Definition: Expr.h:4982
Smart pointer class that efficiently represents Objective-C method names.
PointerType - C99 6.7.5.1 - Pointer Declarators.
Definition: Type.h:2224
A (possibly-)qualified type.
Definition: Type.h:616
MemRegion - The root abstract class for all memory regions.
Definition: MemRegion.h:79
bool canBeASubClass() const
Returns false if the type information is precise (the type T is the only type in the lattice)...
bool argumentsMayEscape() const override
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.cpp:358
ObjCInterfaceDecl * getClassInterface()
Definition: DeclObjC.cpp:1089
IdentifierInfo * getIdentifier() const
getIdentifier - Get the identifier that names this declaration, if there is one.
Definition: Decl.h:232
bool hasVoidPointerToNonConstArg() const
Returns true if any of the arguments is void*.
Definition: CallEvent.cpp:117
static const Expr * getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE)
Definition: CallEvent.cpp:771
Stmt - This represents one statement.
Definition: Stmt.h:60
Information about invalidation for a particular region/symbol.
Definition: MemRegion.h:1383
FunctionType - C99 6.7.5.3 - Function Declarators.
Definition: Type.h:2923
static bool isCallToSelfClass(const ObjCMessageExpr *ME)
Definition: CallEvent.cpp:917
QualType getRValueReferenceType(QualType T) const
Return the uniqued reference to the type for an rvalue reference to the specified type...
virtual bool argumentsMayEscape() const
Returns true if any of the arguments are known to escape to long- term storage, even if this method w...
Definition: CallEvent.h:306
const ProgramStateRef & getState() const
The state in which the call is being evaluated.
Definition: CallEvent.h:210
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:81
QualType getLValueReferenceType(QualType T, bool SpelledAsLValue=true) const
Return the uniqued reference to the type for an lvalue reference to the specified type...
CFGDeleteDtor - Represents C++ object destructor generated from a call to delete. ...
Definition: CFG.h:242
QualType getRecordType(const RecordDecl *Decl) const
SourceRange getSourceRange() const override
Definition: CallEvent.cpp:751
Represents a program point just before an implicit call event.
Definition: ProgramPoint.h:551
A container of type source information.
Definition: Decl.h:62
bool isBlockPointerType() const
Definition: Type.h:5718
CallEventRef getSimpleCall(const CallExpr *E, ProgramStateRef State, const LocationContext *LCtx)
Definition: CallEvent.cpp:1110
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:540
Expr * ignoreParenBaseCasts() LLVM_READONLY
Ignore parentheses and derived-to-base casts.
Definition: Expr.cpp:2469
const ObjCPropertyDecl * findPropertyDecl(bool CheckOverrides=true) const
Returns the property associated with this method's selector.
Definition: DeclObjC.cpp:1249
VarDecl - An instance of this class is created to represent a variable declaration or definition...
Definition: Decl.h:758
const Expr * getCallee() const
Definition: Expr.h:2246
bool isCalled(const CallDescription &CD) const
Returns true if the CallEvent is a call to a function that matches the CallDescription.
Definition: CallEvent.cpp:213
loc::MemRegionVal getCXXThis(const CXXMethodDecl *D, const StackFrameContext *SFC)
Return a memory region for the 'this' object reference.
void setTrait(SymbolRef Sym, InvalidationKinds IK)
Definition: MemRegion.cpp:1488
bool isReceiverSelfOrSuper() const
Checks if the receiver refers to 'self' or 'super'.
Definition: CallEvent.cpp:738
ObjCMethodDecl - Represents an instance or class method declaration.
Definition: DeclObjC.h:113
SVal getSelfSVal() const
Return the value of 'self' if available.
Definition: CallEvent.cpp:714
static bool isVoidPointerToNonConst(QualType T)
Definition: CallEvent.cpp:77
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:591
llvm::mapped_iterator< ArrayRef< ParmVarDecl * >::iterator, GetTypeFn > param_type_iterator
Definition: CallEvent.h:399
ArrayRef< ParmVarDecl * > parameters() const override
Return call's formal parameters.
Definition: CallEvent.cpp:342
const MemRegion * getBaseRegion() const
Definition: MemRegion.cpp:1091
param_type_iterator param_type_end() const
Definition: CallEvent.h:410
ParmVarDecl - Represents a parameter to a function.
Definition: Decl.h:1434
bool hasMutableFields() const
Determine whether this class, or any of its class subobjects, contains a mutable field.
Definition: DeclCXX.h:1250
bool isVoidType() const
Definition: Type.h:5906
const ImplicitParamDecl * getSelfDecl() const
Return the ImplicitParamDecl* associated with 'self' if this AnalysisDeclContext wraps an ObjCMethodD...
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:610
RecordDecl - Represents a struct/union/class.
Definition: Decl.h:3354
bool hasBody(const FunctionDecl *&Definition) const
Returns true if the function has a body (definition).
Definition: Decl.cpp:2561
One of these records is kept for each identifier that is lexed.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:578
MemRegionManager & getRegionManager()
Definition: SValBuilder.h:150
IdentifierInfo * getIdentifierInfoForSlot(unsigned argIndex) const
Retrieve the identifier at a given position in the selector.
Holds long-lived AST nodes (such as types and decls) that can be referred to throughout the semantic ...
Definition: ASTContext.h:128
LineState State
bool isReferenceType() const
Definition: Type.h:5721
bool isOverriding() const
Whether this method overrides any other in the class hierarchy.
Definition: DeclObjC.h:436
bool isAnyPointerType() const
Definition: Type.h:5715
CFGAutomaticObjDtor - Represents C++ object destructor implicitly generated for automatic object or t...
Definition: CFG.h:218
virtual void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const
Used to specify non-argument regions that will be invalidated as a result of this call...
Definition: CallEvent.h:194
AnalysisDeclContext * getAnalysisDeclContext() const
const Expr * getOriginExpr() const
Returns the expression whose value will be the result of this call.
Definition: CallEvent.h:225
CXXMethodDecl * getCanonicalDecl() override
Retrieves the "canonical" declaration of the given declaration.
Definition: DeclCXX.h:1984
const FunctionDecl * getAsFunctionDecl() const
getAsFunctionDecl - If this SVal is a MemRegionVal and wraps a CodeTextRegion wrapping a FunctionDecl...
Definition: SVals.cpp:52
An r-value expression (a pr-value in the C++11 taxonomy) produces a temporary value.
Definition: Specifiers.h:106
BlockDataRegion - A region that represents a block instance.
Definition: MemRegion.h:656
Represents any expression that calls an Objective-C method.
Definition: CallEvent.h:883
virtual Kind getKind() const =0
Returns the kind of call this is.
SVal getReceiverSVal() const
Returns the value of the receiver at the time of this call.
Definition: CallEvent.cpp:722
SVal getSVal(const Stmt *S) const
Get the value of arbitrary expressions at this point in the path.
Definition: CallEvent.h:185
unsigned getIndex() const
QualType getSuperType() const
Retrieve the type referred to by 'super'.
Definition: ExprObjC.h:1231
const CXXRecordDecl * getParent() const
Returns the parent of this method declaration, which is the class in which this method is defined...
Definition: DeclCXX.h:2018
An x-value expression is a reference to an object with independent storage but which can be "moved"...
Definition: Specifiers.h:115
const CFGBlock * getCallSiteBlock() const
field_range fields() const
Definition: Decl.h:3483
static void findPtrToConstParams(llvm::SmallSet< unsigned, 4 > &PreserveArgs, const CallEvent &Call)
Definition: CallEvent.cpp:145
bool isUnknownOrUndef() const
Definition: SVals.h:136
A builtin binary operation expression such as "x + y" or "x <= y".
Definition: Expr.h:2967
Selector getSelector() const
Definition: ExprObjC.cpp:306
const Stmt * getCallSite() const
static bool isPointerToConst(QualType Ty)
Returns true if a type is a pointer-to-const or reference-to-const with no further indirection...
Definition: CallEvent.cpp:131
static const ObjCMethodDecl * findDefiningRedecl(const ObjCMethodDecl *MD)
Definition: CallEvent.cpp:904
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:435
ProgramPoint getProgramPoint(bool IsPreVisit=false, const ProgramPointTag *Tag=nullptr) const
Returns an appropriate ProgramPoint for this call.
Definition: CallEvent.cpp:196
Represents an ObjC class declaration.
Definition: DeclObjC.h:1108
static bool isVariadic(const Decl *D)
Returns true if the given decl is known to be variadic.
Definition: CallEvent.cpp:303
bool isValid() const
Definition: SVals.h:140
detail::InMemoryDirectory::const_iterator I
CXXMethodDecl * getCorrespondingMethodInClass(const CXXRecordDecl *RD, bool MayBeBase=false)
Find the method in RD that corresponds to this one.
Definition: DeclCXX.cpp:1576
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, Selector Sel) const
Check if the selector may have multiple definitions (may have overrides).
Definition: CallEvent.cpp:849
virtual SourceRange getArgSourceRange(unsigned Index) const
Returns the source range for errors associated with this argument.
Definition: CallEvent.cpp:233
const Expr * getCXXThisExpr() const override
Returns the expression representing the implicit 'this' object.
Definition: CallEvent.cpp:574
ObjCMessageKind
Represents the ways an Objective-C message send can occur.
Definition: CallEvent.h:874
bool isGlobalCFunction(StringRef SpecificName=StringRef()) const
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Definition: CallEvent.cpp:121
bool isInstanceMessage() const
Determine whether this is an instance message to either a computed object or to super.
Definition: ExprObjC.h:1143
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:682
CFGBlock - Represents a single basic block in a source-level CFG.
Definition: CFG.h:377
bool argumentsMayEscape() const override
Definition: CallEvent.cpp:1081
const MemRegion * StripCasts(bool StripBaseCasts=true) const
Definition: MemRegion.cpp:1117
QualType getPointeeType() const
If this is a pointer, ObjC object pointer, or block pointer, this returns the respective pointee...
Definition: Type.cpp:414
Loc makeLoc(SymbolRef sym)
Definition: SValBuilder.h:329
ArrayRef< ParmVarDecl * > parameters() const override
Definition: CallEvent.cpp:603
bool isFunctionPointerType() const
Definition: Type.h:5730
const ObjCMethodDecl * getMethodDecl() const
Definition: ExprObjC.h:1251
static bool isCallback(QualType T)
Definition: CallEvent.cpp:53
virtual const Expr * getArgExpr(unsigned Index) const
Returns the expression associated with a given argument.
Definition: CallEvent.h:275
BlockDecl - This represents a block literal declaration, which is like an unnamed FunctionDecl...
Definition: Decl.h:3557
Expr - This represents one expression.
Definition: Expr.h:105
StringRef getName() const
Return the actual identifier string.
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:1092
Stores the currently inferred strictest bound on the runtime type of a region in a given state along ...
const FunctionDecl * getDecl() const override
Returns the declaration of the function or method that will be called.
Definition: CallEvent.cpp:420
unsigned getNumArgs() const
CallEventRef getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State)
Definition: CallEvent.cpp:1132
bool isVirtual() const
Definition: DeclCXX.h:1947
static bool isCLibraryFunction(const FunctionDecl *FD, StringRef Name=StringRef())
Returns true if the callee is an externally-visible function in the top-level namespace, such as malloc.
Represents a C++ destructor within a class.
Definition: DeclCXX.h:2551
Optional< T > getAs() const
Convert to the specified SVal type, returning None if this SVal is not of the desired type...
Definition: SVals.h:100
ObjCInterfaceDecl * getReceiverInterface() const
Retrieve the Objective-C interface to which this message is being directed, if known.
Definition: ExprObjC.cpp:327
bool hasNonNullArgumentsWithType(bool(*Condition)(QualType)) const
Returns true if the type of any of the non-null arguments satisfies the condition.
Definition: CallEvent.cpp:87
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:617
param_type_iterator param_type_begin() const
Returns an iterator over the types of the call's formal parameters.
Definition: CallEvent.h:406
bool isDependentType() const
Whether this type is a dependent type, meaning that its definition somehow depends on a template para...
Definition: Type.h:1797
RuntimeDefinition getRuntimeDefinition() const override
Returns the definition of the function or method that will be called.
Definition: CallEvent.h:439
QualType getType() const
Returns the currently inferred upper bound on the runtime type.
An expression that sends a message to the given Objective-C object or class.
Definition: ExprObjC.h:860
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:3644
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:689
CFGBaseDtor - Represents C++ object destructor implicitly generated for base object in destructor...
Definition: CFG.h:266
const SourceManager & SM
Definition: Format.cpp:1293
const clang::PrintingPolicy & getPrintingPolicy() const
Definition: ASTContext.h:608
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:479
ArrayRef< ParmVarDecl * > parameters() const
Definition: DeclObjC.h:371
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Populates the given SmallVector with the bindings in the callee's stack frame at the start of this ca...
Definition: CallEvent.cpp:349
Stmt * getBody(const FunctionDecl *&Definition) const
getBody - Retrieve the body (definition) of the function.
Definition: Decl.cpp:2597
bool isInMainFile(SourceLocation Loc) const
Returns whether the PresumedLoc for a given SourceLocation is in the main file.
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, CallEvent::BindingsTy &Bindings, SValBuilder &SVB, const CallEvent &Call, ArrayRef< ParmVarDecl * > parameters)
Definition: CallEvent.cpp:316
Defines the runtime definition of the called function.
Definition: CallEvent.h:104
PseudoObjectExpr - An expression which accesses a pseudo-object l-value.
Definition: Expr.h:4938
This class represents a description of a function call using the number of arguments and the name of ...
Definition: CallEvent.h:55
void getExtraInvalidatedValues(ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const override
Definition: CallEvent.cpp:441
Encodes a location in the source.
const FunctionDecl * getDecl() const override
Definition: CallEvent.cpp:429
const BlockDataRegion * getBlockRegion() const
Returns the region associated with this instance of the block.
Definition: CallEvent.cpp:596
const StackFrameContext * getCurrentStackFrame() const
static bool isCallStmt(const Stmt *S)
Returns true if this is a statement is a function or method call of some kind.
Definition: CallEvent.cpp:268
ProgramPoints can be "tagged" as representing points specific to a given analysis entity...
Definition: ProgramPoint.h:40
bool isValid() const
Return true if this is a valid SourceLocation object.
const std::string ID
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
Represents a call to a member function that may be written either with member call syntax (e...
Definition: ExprCXX.h:136
Represents a static or instance method of a struct/union/class.
Definition: DeclCXX.h:1903
ASTContext & getContext()
Definition: SValBuilder.h:131
ArrayRef< ParmVarDecl * > parameters() const
Definition: Decl.h:2066
SVal - This represents a symbolic expression, which can be either an L-value or an R-value...
Definition: SVals.h:63
bool isPropertyAccessor() const
Definition: DeclObjC.h:423
Represents one property declaration in an Objective-C interface.
Definition: DeclObjC.h:704
const Decl * getDecl() const
SourceLocation getBegin() const
virtual SourceRange getSourceRange() const
Returns a source range for the entire call, suitable for outputting in diagnostics.
Definition: CallEvent.h:266
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:673
Tells that a region's contents is not changed.
Definition: MemRegion.h:1397
const IdentifierInfo * getCalleeIdentifier() const
Returns the name of the callee, if its name is a simple identifier.
Definition: CallEvent.h:335
virtual const Decl * getDecl() const
Returns the declaration of the function or method that will be called.
Definition: CallEvent.h:205
Expr * getInstanceReceiver()
Returns the object expression (receiver) for an instance message, or null for a message that is not a...
Definition: ExprObjC.h:1155
static const unsigned NoArgRequirement
Definition: CallEvent.h:63
bool isStr(const char(&Str)[StrLen]) const
Return true if this is the identifier for the specified string.
QualType getType() const
Definition: Expr.h:127
redecl_range redecls() const
Returns an iterator range for all the redeclarations of the same decl.
Definition: DeclBase.h:911
ProgramStateRef invalidateRegions(unsigned BlockCount, ProgramStateRef Orig=nullptr) const
Returns a new state with all argument regions invalidated.
Definition: CallEvent.cpp:156
const LocationContext * getParent() const
bool isValid() const
Return false if no dynamic type info is available.
Represents a program point just after an implicit call event.
Definition: ProgramPoint.h:568
FunctionDecl * getDirectCallee()
If the callee is a FunctionDecl, return it. Otherwise return 0.
Definition: Expr.cpp:1216
DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *Reg)
Get dynamic type information for a region.
RuntimeDefinition getRuntimeDefinition() const override
Definition: CallEvent.cpp:936
const VarRegion * getVarRegion(const VarDecl *D, const LocationContext *LC)
getVarRegion - Retrieve or create the memory region associated with a specified VarDecl and LocationC...
Definition: MemRegion.cpp:781
QualType getPointerType(QualType T) const
Return the uniqued reference to the type for a pointer to the specified type.
ProgramStateManager & getStateManager()
Definition: SValBuilder.h:134
detail::InMemoryDirectory::const_iterator E
const MemRegion * getAsRegion() const
Definition: SVals.cpp:140
SourceLocation getEndOfDefinitionLoc() const
Definition: DeclObjC.h:1796
Represents an abstract call to a function or method along a particular path.
Definition: CallEvent.h:140
ObjCMessageKind getMessageKind() const
Returns how the message was written in the source (property access, subscript, or explicit message se...
Definition: CallEvent.cpp:782
const RecordType * getAsStructureType() const
Definition: Type.cpp:430
Expr * IgnoreParenImpCasts() LLVM_READONLY
IgnoreParenImpCasts - Ignore parentheses and implicit casts.
Definition: Expr.cpp:2486
Represents a pointer to an Objective C object.
Definition: Type.h:5220
QualType getResultType() const
Returns the result type, adjusted for references.
Definition: CallEvent.cpp:28
ObjCMethodDecl * lookupMethod(Selector Sel, bool isInstance, bool shallowCategoryLookup=false, bool followSuper=true, const ObjCCategoryDecl *C=nullptr) const
lookupMethod - This method returns an instance/class method by looking in the class, its categories, and its super classes (using a linear search).
Definition: DeclObjC.cpp:662
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:3784
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:6042
QualType getCanonicalType() const
Definition: Type.h:5528
ObjCInterfaceDecl * getInterfaceDecl() const
If this pointer points to an Objective @interface type, gets the declaration for that interface...
Definition: Type.h:5275
bool isUnknown() const
Definition: SVals.h:128
bool hasBody() const override
Determine whether this method has a body.
Definition: DeclObjC.h:486
static QualType getDeclaredResultType(const Decl *D)
Returns the result type of a function or method declaration.
Definition: CallEvent.cpp:274
CXXRecordDecl * getAsCXXRecordDecl() const
Retrieves the CXXRecordDecl that this type refers to, either because the type is a RecordType or beca...
Definition: Type.cpp:1548
const ImplicitParamDecl * getSelfDecl() const
void dump() const
Definition: CallEvent.cpp:247
MemberExpr - [C99 6.5.2.3] Structure and Union Members.
Definition: Expr.h:2378
Represents a C++ struct/union/class.
Definition: DeclCXX.h:267
SVal getCXXThisVal() const override
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:667
CFGImplicitDtor - Represents C++ object destructor implicitly generated by compiler on various occasi...
Definition: CFG.h:195
ObjCIvarDecl - Represents an ObjC instance variable.
Definition: DeclObjC.h:1866
Stmt * getParentIgnoreParenCasts(Stmt *) const
Definition: ParentMap.cpp:133
virtual unsigned getNumArgs() const =0
Returns the number of arguments (explicit and implicit).
CFGElement - Represents a top-level expression in a basic block.
Definition: CFG.h:54
virtual const CallExpr * getOriginExpr() const
Definition: CallEvent.h:484
const LocationContext * getLocationContext() const
The context in which the call is being evaluated.
Definition: CallEvent.h:215
SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:641
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:245
CallExpr - Represents a function call (C99 6.5.2.2, C++ [expr.call]).
Definition: Expr.h:2206
ObjCInterfaceDecl * getSuperClass() const
Definition: DeclObjC.cpp:314
A reference to a declared variable, function, enum, etc.
Definition: Expr.h:953
ExprValueKind getValueKind() const
getValueKind - The value kind that this expression produces.
Definition: Expr.h:402
virtual SVal getCXXThisVal() const
Returns the value of the implicit 'this' object.
Definition: CallEvent.cpp:467
An l-value expression is a reference to an object with independent storage.
Definition: Specifiers.h:110
A trivial tuple used to represent a source range.
SourceLocation getLocation() const
Definition: DeclBase.h:407
bool hasNonZeroCallbackArg() const
Returns true if any of the arguments appear to represent callbacks.
Definition: CallEvent.cpp:113
bool isConstQualified() const
Determine whether this type is const-qualified.
Definition: Type.h:5548
bool isNull() const
Return true if this QualType doesn't point to a type yet.
Definition: Type.h:683
The receiver is a superclass.
Definition: ExprObjC.h:1007
SVal getReturnValue() const
Returns the return value of the call.
Definition: CallEvent.cpp:240
const ObjCPropertyDecl * getAccessedProperty() const
Definition: CallEvent.cpp:827
This class handles loading and caching of source files into memory.
CFGTemporaryDtor - Represents C++ object destructor implicitly generated at the end of full expressio...
Definition: CFG.h:304
const NamedDecl * Result
Definition: USRFinder.cpp:70
Optional< T > getAs() const
Convert to the specified CFGElement type, returning None if this CFGElement is not of the desired typ...
Definition: CFG.h:100
void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, BindingsTy &Bindings) const override
Definition: CallEvent.cpp:653
ArrayRef< SVal > ValueList