/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

Bug Summary

File:	tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp
Warning:	line 164, column 26 Returning null reference

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ExprEngineCallAndReturn.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-eagerly-assume -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model pic -pic-level 2 -mthread-model posix -relaxed-aliasing -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -momit-leaf-frame-pointer -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-7/lib/clang/7.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/include -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/include -I /build/llvm-toolchain-snapshot-7~svn326551/include -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0/backward -internal-isystem /usr/include/clang/7.0.0/include/ -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-7/lib/clang/7.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/lib/StaticAnalyzer/Core -ferror-limit 19 -fmessage-length 0 -fvisibility-inlines-hidden -fobjc-runtime=gcc -fno-common -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -o /tmp/scan-build-2018-03-02-155150-1477-1 -x c++ /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp

→

1//=-- ExprEngineCallAndReturn.cpp - Support for call/return -----*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines ExprEngine's support for calls and returns.
11//
12//===----------------------------------------------------------------------===//

14#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
15#include "PrettyStackTraceLocationContext.h"
16#include "clang/AST/CXXInheritance.h"
17#include "clang/AST/DeclCXX.h"
18#include "clang/Analysis/Analyses/LiveVariables.h"
19#include "clang/Analysis/ConstructionContext.h"
20#include "clang/StaticAnalyzer/Core/CheckerManager.h"
21#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
22#include "llvm/ADT/SmallSet.h"
23#include "llvm/ADT/Statistic.h"
24#include "llvm/Support/SaveAndRestore.h"

26using namespace clang;
27using namespace ento;

29#define DEBUG_TYPE"ExprEngine" "ExprEngine"

31STATISTIC(NumOfDynamicDispatchPathSplits,static llvm::Statistic NumOfDynamicDispatchPathSplits = {"ExprEngine"
, "NumOfDynamicDispatchPathSplits", "The # of times we split the path due to imprecise dynamic dispatch info"
, {0}, {false}}
"The # of times we split the path due to imprecise dynamic dispatch info")static llvm::Statistic NumOfDynamicDispatchPathSplits = {"ExprEngine"
, "NumOfDynamicDispatchPathSplits", "The # of times we split the path due to imprecise dynamic dispatch info"
, {0}, {false}};

34STATISTIC(NumInlinedCalls,static llvm::Statistic NumInlinedCalls = {"ExprEngine", "NumInlinedCalls"
, "The # of times we inlined a call", {0}, {false}}
"The # of times we inlined a call")static llvm::Statistic NumInlinedCalls = {"ExprEngine", "NumInlinedCalls"
, "The # of times we inlined a call", {0}, {false}};

37STATISTIC(NumReachedInlineCountMax,static llvm::Statistic NumReachedInlineCountMax = {"ExprEngine"
, "NumReachedInlineCountMax", "The # of times we reached inline count maximum"
, {0}, {false}}
"The # of times we reached inline count maximum")static llvm::Statistic NumReachedInlineCountMax = {"ExprEngine"
, "NumReachedInlineCountMax", "The # of times we reached inline count maximum"
, {0}, {false}};

40void ExprEngine::processCallEnter(NodeBuilderContext& BC, CallEnter CE,
                                ExplodedNode *Pred) {
// Get the entry block in the CFG of the callee.
const StackFrameContext *calleeCtx = CE.getCalleeContext();
PrettyStackTraceLocationContext CrashInfo(calleeCtx);
const CFGBlock *Entry = CE.getEntry();

// Validate the CFG.
assert(Entry->empty())(static_cast <bool> (Entry->empty()) ? void (0) : __assert_fail
 ("Entry->empty()", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 48, __extension__ __PRETTY_FUNCTION__));
assert(Entry->succ_size() == 1)(static_cast <bool> (Entry->succ_size() == 1) ? void
 (0) : __assert_fail ("Entry->succ_size() == 1", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 49, __extension__ __PRETTY_FUNCTION__));

// Get the solitary successor.
const CFGBlock *Succ = *(Entry->succ_begin());

// Construct an edge representing the starting location in the callee.
BlockEdge Loc(Entry, Succ, calleeCtx);

ProgramStateRef state = Pred->getState();

// Construct a new node, notify checkers that analysis of the function has
// begun, and add the resultant nodes to the worklist.
bool isNew;
ExplodedNode *Node = G.getNode(Loc, state, false, &isNew);
Node->addPredecessor(Pred, G);
if (isNew) {
  ExplodedNodeSet DstBegin;
  processBeginOfFunction(BC, Node, DstBegin, Loc);
  Engine.enqueue(DstBegin);
}
69}

71// Find the last statement on the path to the exploded node and the
72// corresponding Block.
73static std::pair<const Stmt*,
               const CFGBlock*> getLastStmt(const ExplodedNode *Node) {
const Stmt *S = nullptr;
const CFGBlock *Blk = nullptr;
const StackFrameContext *SF =
        Node->getLocation().getLocationContext()->getCurrentStackFrame();

// Back up through the ExplodedGraph until we reach a statement node in this
// stack frame.
while (Node) {
  const ProgramPoint &PP = Node->getLocation();

  if (PP.getLocationContext()->getCurrentStackFrame() == SF) {
    if (Optional<StmtPoint> SP = PP.getAs<StmtPoint>()) {
      S = SP->getStmt();
      break;
    } else if (Optional<CallExitEnd> CEE = PP.getAs<CallExitEnd>()) {
      S = CEE->getCalleeContext()->getCallSite();
      if (S)
        break;

      // If there is no statement, this is an implicitly-generated call.
      // We'll walk backwards over it and then continue the loop to find
      // an actual statement.
      Optional<CallEnter> CE;
      do {
        Node = Node->getFirstPred();
        CE = Node->getLocationAs<CallEnter>();
      } while (!CE || CE->getCalleeContext() != CEE->getCalleeContext());

      // Continue searching the graph.
    } else if (Optional<BlockEdge> BE = PP.getAs<BlockEdge>()) {
      Blk = BE->getSrc();
    }
  } else if (Optional<CallEnter> CE = PP.getAs<CallEnter>()) {
    // If we reached the CallEnter for this function, it has no statements.
    if (CE->getCalleeContext() == SF)
      break;
  }

  if (Node->pred_empty())
    return std::make_pair(nullptr, nullptr);

  Node = *Node->pred_begin();
}

return std::make_pair(S, Blk);
120}

122/// Adjusts a return value when the called function's return type does not
123/// match the caller's expression type. This can happen when a dynamic call
124/// is devirtualized, and the overridding method has a covariant (more specific)
125/// return type than the parent's method. For C++ objects, this means we need
126/// to add base casts.
127static SVal adjustReturnValue(SVal V, QualType ExpectedTy, QualType ActualTy,
                            StoreManager &StoreMgr) {
// For now, the only adjustments we handle apply only to locations.
if (!V.getAs<Loc>())
  return V;

// If the types already match, don't do any unnecessary work.
ExpectedTy = ExpectedTy.getCanonicalType();
ActualTy = ActualTy.getCanonicalType();
if (ExpectedTy == ActualTy)
  return V;

// No adjustment is needed between Objective-C pointer types.
if (ExpectedTy->isObjCObjectPointerType() &&
    ActualTy->isObjCObjectPointerType())
  return V;

// C++ object pointers may need "derived-to-base" casts.
const CXXRecordDecl *ExpectedClass = ExpectedTy->getPointeeCXXRecordDecl();
const CXXRecordDecl *ActualClass = ActualTy->getPointeeCXXRecordDecl();
if (ExpectedClass && ActualClass) {
  CXXBasePaths Paths(/*FindAmbiguities=*/true, /*RecordPaths=*/true,
                     /*DetectVirtual=*/false);
  if (ActualClass->isDerivedFrom(ExpectedClass, Paths) &&
      !Paths.isAmbiguous(ActualTy->getCanonicalTypeUnqualified())) {
    return StoreMgr.evalDerivedToBase(V, Paths.front());
  }
}

// Unfortunately, Objective-C does not enforce that overridden methods have
// covariant return types, so we can't assert that that never happens.
// Be safe and return UnknownVal().
return UnknownVal();
160}

162void ExprEngine::removeDeadOnEndOfFunction(NodeBuilderContext& BC,
                                         ExplodedNode *Pred,
                                         ExplodedNodeSet &Dst) {
// Find the last statement in the function and the corresponding basic block.
const Stmt *LastSt = nullptr;
const CFGBlock *Blk = nullptr;
std::tie(LastSt, Blk) = getLastStmt(Pred);
if (!Blk || !LastSt) {
  Dst.Add(Pred);
  return;
}

// Here, we destroy the current location context. We use the current
// function's entire body as a diagnostic statement, with which the program
// point will be associated. However, we only want to use LastStmt as a
// reference for what to clean up if it's a ReturnStmt; otherwise, everything
// is dead.
SaveAndRestore<const NodeBuilderContext *> NodeContextRAII(currBldrCtx, &BC);
const LocationContext *LCtx = Pred->getLocationContext();
removeDead(Pred, Dst, dyn_cast<ReturnStmt>(LastSt), LCtx,
           LCtx->getAnalysisDeclContext()->getBody(),
           ProgramPoint::PostStmtPurgeDeadSymbolsKind);
184}

186static bool wasDifferentDeclUsedForInlining(CallEventRef<> Call,
  const StackFrameContext *calleeCtx) {
const Decl *RuntimeCallee = calleeCtx->getDecl();
const Decl *StaticDecl = Call->getDecl();
assert(RuntimeCallee)(static_cast <bool> (RuntimeCallee) ? void (0) : __assert_fail
 ("RuntimeCallee", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 190, __extension__ __PRETTY_FUNCTION__));
if (!StaticDecl)
  return true;
return RuntimeCallee->getCanonicalDecl() != StaticDecl->getCanonicalDecl();
194}

196/// Returns true if the CXXConstructExpr \p E was intended to construct a
197/// prvalue for the region in \p V.
198///
199/// Note that we can't just test for rvalue vs. glvalue because
200/// CXXConstructExprs embedded in DeclStmts and initializers are considered
201/// rvalues by the AST, and the analyzer would like to treat them as lvalues.
202static bool isTemporaryPRValue(const CXXConstructExpr *E, SVal V) {
if (E->isGLValue())
  return false;

const MemRegion *MR = V.getAsRegion();
if (!MR)
  return false;

return isa<CXXTempObjectRegion>(MR);
211}

213/// The call exit is simulated with a sequence of nodes, which occur between
214/// CallExitBegin and CallExitEnd. The following operations occur between the
215/// two program points:
216/// 1. CallExitBegin (triggers the start of call exit sequence)
217/// 2. Bind the return value
218/// 3. Run Remove dead bindings to clean up the dead symbols from the callee.
219/// 4. CallExitEnd (switch to the caller context)
220/// 5. PostStmt<CallExpr>
221void ExprEngine::processCallExit(ExplodedNode *CEBNode) {
// Step 1 CEBNode was generated before the call.
PrettyStackTraceLocationContext CrashInfo(CEBNode->getLocationContext());
const StackFrameContext *calleeCtx =
    CEBNode->getLocationContext()->getCurrentStackFrame();

// The parent context might not be a stack frame, so make sure we
// look up the first enclosing stack frame.
const StackFrameContext *callerCtx =
  calleeCtx->getParent()->getCurrentStackFrame();

const Stmt *CE = calleeCtx->getCallSite();
ProgramStateRef state = CEBNode->getState();
// Find the last statement in the function and the corresponding basic block.
const Stmt *LastSt = nullptr;
const CFGBlock *Blk = nullptr;
std::tie(LastSt, Blk) = getLastStmt(CEBNode);

// Generate a CallEvent /before/ cleaning the state, so that we can get the
// correct value for 'this' (if necessary).
CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<> Call = CEMgr.getCaller(calleeCtx, state);

// Step 2: generate node with bound return value: CEBNode -> BindedRetNode.

// If the callee returns an expression, bind its value to CallExpr.
if (CE) {
  if (const ReturnStmt *RS = dyn_cast_or_null<ReturnStmt>(LastSt)) {
    const LocationContext *LCtx = CEBNode->getLocationContext();
    SVal V = state->getSVal(RS, LCtx);

    // Ensure that the return type matches the type of the returned Expr.
    if (wasDifferentDeclUsedForInlining(Call, calleeCtx)) {
      QualType ReturnedTy =
        CallEvent::getDeclaredResultType(calleeCtx->getDecl());
      if (!ReturnedTy.isNull()) {
        if (const Expr *Ex = dyn_cast<Expr>(CE)) {
          V = adjustReturnValue(V, Ex->getType(), ReturnedTy,
                                getStoreManager());
        }
      }
    }

    state = state->BindExpr(CE, callerCtx, V);
  }

  // Bind the constructed object value to CXXConstructExpr.
  if (const CXXConstructExpr *CCE = dyn_cast<CXXConstructExpr>(CE)) {
    loc::MemRegionVal This =
      svalBuilder.getCXXThis(CCE->getConstructor()->getParent(), calleeCtx);
    SVal ThisV = state->getSVal(This);

    // If the constructed object is a temporary prvalue, get its bindings.
    if (isTemporaryPRValue(CCE, ThisV))
      ThisV = state->getSVal(ThisV.castAs<Loc>());

    state = state->BindExpr(CCE, callerCtx, ThisV);
  }

  if (const auto *CNE = dyn_cast<CXXNewExpr>(CE)) {
    // We are currently evaluating a CXXNewAllocator CFGElement. It takes a
    // while to reach the actual CXXNewExpr element from here, so keep the
    // region for later use.
    // Additionally cast the return value of the inlined operator new
    // (which is of type 'void *') to the correct object type.
    SVal AllocV = state->getSVal(CNE, callerCtx);
    AllocV = svalBuilder.evalCast(
        AllocV, CNE->getType(),
        getContext().getPointerType(getContext().VoidTy));

    state =
        setCXXNewAllocatorValue(state, CNE, calleeCtx->getParent(), AllocV);
  }
}

// Step 3: BindedRetNode -> CleanedNodes
// If we can find a statement and a block in the inlined function, run remove
// dead bindings before returning from the call. This is important to ensure
// that we report the issues such as leaks in the stack contexts in which
// they occurred.
ExplodedNodeSet CleanedNodes;
if (LastSt && Blk && AMgr.options.AnalysisPurgeOpt != PurgeNone) {
  static SimpleProgramPointTag retValBind("ExprEngine", "Bind Return Value");
  PostStmt Loc(LastSt, calleeCtx, &retValBind);
  bool isNew;
  ExplodedNode *BindedRetNode = G.getNode(Loc, state, false, &isNew);
  BindedRetNode->addPredecessor(CEBNode, G);
  if (!isNew)
    return;

  NodeBuilderContext Ctx(getCoreEngine(), Blk, BindedRetNode);
  currBldrCtx = &Ctx;
  // Here, we call the Symbol Reaper with 0 statement and callee location
  // context, telling it to clean up everything in the callee's context
  // (and its children). We use the callee's function body as a diagnostic
  // statement, with which the program point will be associated.
  removeDead(BindedRetNode, CleanedNodes, nullptr, calleeCtx,
             calleeCtx->getAnalysisDeclContext()->getBody(),
             ProgramPoint::PostStmtPurgeDeadSymbolsKind);
  currBldrCtx = nullptr;
} else {
  CleanedNodes.Add(CEBNode);
}

for (ExplodedNodeSet::iterator I = CleanedNodes.begin(),
                               E = CleanedNodes.end(); I != E; ++I) {

  // Step 4: Generate the CallExit and leave the callee's context.
  // CleanedNodes -> CEENode
  CallExitEnd Loc(calleeCtx, callerCtx);
  bool isNew;
  ProgramStateRef CEEState = (*I == CEBNode) ? state : (*I)->getState();

  ExplodedNode *CEENode = G.getNode(Loc, CEEState, false, &isNew);
  CEENode->addPredecessor(*I, G);
  if (!isNew)
    return;

  // Step 5: Perform the post-condition check of the CallExpr and enqueue the
  // result onto the work list.
  // CEENode -> Dst -> WorkList
  NodeBuilderContext Ctx(Engine, calleeCtx->getCallSiteBlock(), CEENode);
  SaveAndRestore<const NodeBuilderContext*> NBCSave(currBldrCtx,
      &Ctx);
  SaveAndRestore<unsigned> CBISave(currStmtIdx, calleeCtx->getIndex());

  CallEventRef<> UpdatedCall = Call.cloneWithState(CEEState);

  ExplodedNodeSet DstPostCall;
  if (const CXXNewExpr *CNE = dyn_cast_or_null<CXXNewExpr>(CE)) {
    ExplodedNodeSet DstPostPostCallCallback;
    getCheckerManager().runCheckersForPostCall(DstPostPostCallCallback,
                                               CEENode, *UpdatedCall, *this,
                                               /*WasInlined=*/true);
    for (auto I : DstPostPostCallCallback) {
      getCheckerManager().runCheckersForNewAllocator(
          CNE, getCXXNewAllocatorValue(I->getState(), CNE,
                                       calleeCtx->getParent()),
          DstPostCall, I, *this,
          /*WasInlined=*/true);
    }
  } else {
    getCheckerManager().runCheckersForPostCall(DstPostCall, CEENode,
                                               *UpdatedCall, *this,
                                               /*WasInlined=*/true);
  }
  ExplodedNodeSet Dst;
  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(Call)) {
    getCheckerManager().runCheckersForPostObjCMessage(Dst, DstPostCall, *Msg,
                                                      *this,
                                                      /*WasInlined=*/true);
  } else if (CE &&
             !(isa<CXXNewExpr>(CE) && // Called when visiting CXXNewExpr.
               AMgr.getAnalyzerOptions().mayInlineCXXAllocator())) {
    getCheckerManager().runCheckersForPostStmt(Dst, DstPostCall, CE,
                                               *this, /*WasInlined=*/true);
  } else {
    Dst.insert(DstPostCall);
  }

  // Enqueue the next element in the block.
  for (ExplodedNodeSet::iterator PSI = Dst.begin(), PSE = Dst.end();
                                 PSI != PSE; ++PSI) {
    Engine.getWorkList()->enqueue(*PSI, calleeCtx->getCallSiteBlock(),
                                  calleeCtx->getIndex()+1);
  }
}
388}

390void ExprEngine::examineStackFrames(const Decl *D, const LocationContext *LCtx,
                             bool &IsRecursive, unsigned &StackDepth) {
IsRecursive = false;
StackDepth = 0;

while (LCtx) {
  if (const StackFrameContext *SFC = dyn_cast<StackFrameContext>(LCtx)) {
    const Decl *DI = SFC->getDecl();

    // Mark recursive (and mutually recursive) functions and always count
    // them when measuring the stack depth.
    if (DI == D) {
      IsRecursive = true;
      ++StackDepth;
      LCtx = LCtx->getParent();
      continue;
    }

    // Do not count the small functions when determining the stack depth.
    AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(DI);
    const CFG *CalleeCFG = CalleeADC->getCFG();
    if (CalleeCFG->getNumBlockIDs() > AMgr.options.getAlwaysInlineSize())
      ++StackDepth;
  }
  LCtx = LCtx->getParent();
}
416}

418// The GDM component containing the dynamic dispatch bifurcation info. When
419// the exact type of the receiver is not known, we want to explore both paths -
420// one on which we do inline it and the other one on which we don't. This is
421// done to ensure we do not drop coverage.
422// This is the map from the receiver region to a bool, specifying either we
423// consider this region's information precise or not along the given path.
424namespace {
enum DynamicDispatchMode {
  DynamicDispatchModeInlined = 1,
  DynamicDispatchModeConservative
};
429} // end anonymous namespace

431REGISTER_TRAIT_WITH_PROGRAMSTATE(DynamicDispatchBifurcationMap,namespace { class DynamicDispatchBifurcationMap {}; typedef llvm
::ImmutableMap<const MemRegion *, unsigned> DynamicDispatchBifurcationMapTy
; } namespace clang { namespace ento { template <> struct
 ProgramStateTrait<DynamicDispatchBifurcationMap> : public
 ProgramStatePartialTrait<DynamicDispatchBifurcationMapTy>
 { static void *GDMIndex() { static int Index; return &Index
; } }; } }
                               CLANG_ENTO_PROGRAMSTATE_MAP(const MemRegion *,namespace { class DynamicDispatchBifurcationMap {}; typedef llvm
::ImmutableMap<const MemRegion *, unsigned> DynamicDispatchBifurcationMapTy
; } namespace clang { namespace ento { template <> struct
 ProgramStateTrait<DynamicDispatchBifurcationMap> : public
 ProgramStatePartialTrait<DynamicDispatchBifurcationMapTy>
 { static void *GDMIndex() { static int Index; return &Index
; } }; } }
                                                           unsigned))namespace { class DynamicDispatchBifurcationMap {}; typedef llvm
::ImmutableMap<const MemRegion *, unsigned> DynamicDispatchBifurcationMapTy
; } namespace clang { namespace ento { template <> struct
 ProgramStateTrait<DynamicDispatchBifurcationMap> : public
 ProgramStatePartialTrait<DynamicDispatchBifurcationMapTy>
 { static void *GDMIndex() { static int Index; return &Index
; } }; } }

435bool ExprEngine::inlineCall(const CallEvent &Call, const Decl *D,
                          NodeBuilder &Bldr, ExplodedNode *Pred,
                          ProgramStateRef State) {
assert(D)(static_cast <bool> (D) ? void (0) : __assert_fail ("D"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 438, __extension__ __PRETTY_FUNCTION__));

const LocationContext *CurLC = Pred->getLocationContext();
const StackFrameContext *CallerSFC = CurLC->getCurrentStackFrame();
const LocationContext *ParentOfCallee = CallerSFC;
if (Call.getKind() == CE_Block &&
    !cast<BlockCall>(Call).isConversionFromLambda()) {
  const BlockDataRegion *BR = cast<BlockCall>(Call).getBlockRegion();
  assert(BR && "If we have the block definition we should have its region")(static_cast <bool> (BR && "If we have the block definition we should have its region"
) ? void (0) : __assert_fail ("BR && \"If we have the block definition we should have its region\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 446, __extension__ __PRETTY_FUNCTION__));
  AnalysisDeclContext *BlockCtx = AMgr.getAnalysisDeclContext(D);
  ParentOfCallee = BlockCtx->getBlockInvocationContext(CallerSFC,
                                                       cast<BlockDecl>(D),
                                                       BR);
}

// This may be NULL, but that's fine.
const Expr *CallE = Call.getOriginExpr();

// Construct a new stack frame for the callee.
AnalysisDeclContext *CalleeADC = AMgr.getAnalysisDeclContext(D);
const StackFrameContext *CalleeSFC =
  CalleeADC->getStackFrame(ParentOfCallee, CallE,
                           currBldrCtx->getBlock(),
                           currStmtIdx);

CallEnter Loc(CallE, CalleeSFC, CurLC);

// Construct a new state which contains the mapping from actual to
// formal arguments.
State = State->enterStackFrame(Call, CalleeSFC);

bool isNew;
if (ExplodedNode *N = G.getNode(Loc, State, false, &isNew)) {
  N->addPredecessor(Pred, G);
  if (isNew)
    Engine.getWorkList()->enqueue(N);
}

// If we decided to inline the call, the successor has been manually
// added onto the work list so remove it from the node builder.
Bldr.takeNodes(Pred);

NumInlinedCalls++;
Engine.FunctionSummaries->bumpNumTimesInlined(D);

// Mark the decl as visited.
if (VisitedCallees)
  VisitedCallees->insert(D);

return true;
488}

490static ProgramStateRef getInlineFailedState(ProgramStateRef State,
                                          const Stmt *CallE) {
const void *ReplayState = State->get<ReplayWithoutInlining>();
if (!ReplayState)
  return nullptr;

assert(ReplayState == CallE && "Backtracked to the wrong call.")(static_cast <bool> (ReplayState == CallE && "Backtracked to the wrong call."
) ? void (0) : __assert_fail ("ReplayState == CallE && \"Backtracked to the wrong call.\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 496, __extension__ __PRETTY_FUNCTION__));
(void)CallE;

return State->remove<ReplayWithoutInlining>();
500}

502void ExprEngine::VisitCallExpr(const CallExpr *CE, ExplodedNode *Pred,
                             ExplodedNodeSet &dst) {
// Perform the previsit of the CallExpr.
ExplodedNodeSet dstPreVisit;
getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, CE, *this);

// Get the call in its initial state. We use this as a template to perform
// all the checks.
CallEventManager &CEMgr = getStateManager().getCallEventManager();
CallEventRef<> CallTemplate
  = CEMgr.getSimpleCall(CE, Pred->getState(), Pred->getLocationContext());

// Evaluate the function call.  We try each of the checkers
// to see if the can evaluate the function call.
ExplodedNodeSet dstCallEvaluated;
for (ExplodedNodeSet::iterator I = dstPreVisit.begin(), E = dstPreVisit.end();
     I != E; ++I) {
  evalCall(dstCallEvaluated, *I, *CallTemplate);
}

// Finally, perform the post-condition check of the CallExpr and store
// the created nodes in 'Dst'.
// Note that if the call was inlined, dstCallEvaluated will be empty.
// The post-CallExpr check will occur in processCallExit.
getCheckerManager().runCheckersForPostStmt(dst, dstCallEvaluated, CE,
                                           *this);
528}

530void ExprEngine::evalCall(ExplodedNodeSet &Dst, ExplodedNode *Pred,
                        const CallEvent &Call) {
// WARNING: At this time, the state attached to 'Call' may be older than the
// state in 'Pred'. This is a minor optimization since CheckerManager will
// use an updated CallEvent instance when calling checkers, but if 'Call' is
// ever used directly in this function all callers should be updated to pass
// the most recent state. (It is probably not worth doing the work here since
// for some callers this will not be necessary.)

// Run any pre-call checks using the generic call interface.
ExplodedNodeSet dstPreVisit;
getCheckerManager().runCheckersForPreCall(dstPreVisit, Pred, Call, *this);

// Actually evaluate the function call.  We try each of the checkers
// to see if the can evaluate the function call, and get a callback at
// defaultEvalCall if all of them fail.
ExplodedNodeSet dstCallEvaluated;
getCheckerManager().runCheckersForEvalCall(dstCallEvaluated, dstPreVisit,
                                           Call, *this);

// Finally, run any post-call checks.
getCheckerManager().runCheckersForPostCall(Dst, dstCallEvaluated,
                                           Call, *this);
553}

555ProgramStateRef ExprEngine::bindReturnValue(const CallEvent &Call,
                                          const LocationContext *LCtx,
                                          ProgramStateRef State) {
const Expr *E = Call.getOriginExpr();
if (!E)
  return State;

// Some method families have known return values.
if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
  switch (Msg->getMethodFamily()) {
  default:
    break;
  case OMF_autorelease:
  case OMF_retain:
  case OMF_self: {
    // These methods return their receivers.
    return State->BindExpr(E, LCtx, Msg->getReceiverSVal());
  }
  }
} else if (const CXXConstructorCall *C = dyn_cast<CXXConstructorCall>(&Call)){
  SVal ThisV = C->getCXXThisVal();

  // If the constructed object is a temporary prvalue, get its bindings.
  if (isTemporaryPRValue(cast<CXXConstructExpr>(E), ThisV))
    ThisV = State->getSVal(ThisV.castAs<Loc>());

  return State->BindExpr(E, LCtx, ThisV);
}

// Conjure a symbol if the return value is unknown.
QualType ResultTy = Call.getResultType();
SValBuilder &SVB = getSValBuilder();
unsigned Count = currBldrCtx->blockCount();

// See if we need to conjure a heap pointer instead of
// a regular unknown pointer.
bool IsHeapPointer = false;
if (const auto *CNE = dyn_cast<CXXNewExpr>(E))
  if (CNE->getOperatorNew()->isReplaceableGlobalAllocationFunction()) {
    // FIXME: Delegate this to evalCall in MallocChecker?
    IsHeapPointer = true;
  }

SVal R = IsHeapPointer
             ? SVB.getConjuredHeapSymbolVal(E, LCtx, Count)
             : SVB.conjureSymbolVal(nullptr, E, LCtx, ResultTy, Count);
return State->BindExpr(E, LCtx, R);
602}

604// Conservatively evaluate call by invalidating regions and binding
605// a conjured return value.
606void ExprEngine::conservativeEvalCall(const CallEvent &Call, NodeBuilder &Bldr,
                                    ExplodedNode *Pred,
                                    ProgramStateRef State) {
State = Call.invalidateRegions(currBldrCtx->blockCount(), State);
State = bindReturnValue(Call, Pred->getLocationContext(), State);

// And make the result node.
Bldr.generateNode(Call.getProgramPoint(), State, Pred);
614}

616ExprEngine::CallInlinePolicy
617ExprEngine::mayInlineCallKind(const CallEvent &Call, const ExplodedNode *Pred,
                            AnalyzerOptions &Opts,
                            const ExprEngine::EvalCallOptions &CallOpts) {
const LocationContext *CurLC = Pred->getLocationContext();
const StackFrameContext *CallerSFC = CurLC->getCurrentStackFrame();
switch (Call.getKind()) {
case CE_Function:
case CE_Block:
  break;
case CE_CXXMember:
case CE_CXXMemberOperator:
  if (!Opts.mayInlineCXXMemberFunction(CIMK_MemberFunctions))
    return CIP_DisallowedAlways;
  break;
case CE_CXXConstructor: {
  if (!Opts.mayInlineCXXMemberFunction(CIMK_Constructors))
    return CIP_DisallowedAlways;

  const CXXConstructorCall &Ctor = cast<CXXConstructorCall>(Call);

  const CXXConstructExpr *CtorExpr = Ctor.getOriginExpr();

  auto CCE = getCurrentCFGElement().getAs<CFGConstructor>();
  const ConstructionContext *CC = CCE ? CCE->getConstructionContext()
                                      : nullptr;

  if (CC && isa<NewAllocatedObjectConstructionContext>(CC) &&
      !Opts.mayInlineCXXAllocator())
    return CIP_DisallowedOnce;

  // FIXME: We don't handle constructors or destructors for arrays properly.
  // Even once we do, we still need to be careful about implicitly-generated
  // initializers for array fields in default move/copy constructors.
  // We still allow construction into ElementRegion targets when they don't
  // represent array elements.
  if (CallOpts.IsArrayCtorOrDtor)
    return CIP_DisallowedOnce;

  // Inlining constructors requires including initializers in the CFG.
  const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
  assert(ADC->getCFGBuildOptions().AddInitializers && "No CFG initializers")(static_cast <bool> (ADC->getCFGBuildOptions().AddInitializers
 && "No CFG initializers") ? void (0) : __assert_fail
 ("ADC->getCFGBuildOptions().AddInitializers && \"No CFG initializers\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 657, __extension__ __PRETTY_FUNCTION__));
  (void)ADC;

  // If the destructor is trivial, it's always safe to inline the constructor.
  if (Ctor.getDecl()->getParent()->hasTrivialDestructor())
    break;

  // For other types, only inline constructors if destructor inlining is
  // also enabled.
  if (!Opts.mayInlineCXXMemberFunction(CIMK_Destructors))
    return CIP_DisallowedAlways;

  if (CtorExpr->getConstructionKind() == CXXConstructExpr::CK_Complete) {
    // If we don't handle temporary destructors, we shouldn't inline
    // their constructors.
    if (CallOpts.IsTemporaryCtorOrDtor &&
        !Opts.includeTemporaryDtorsInCFG())
      return CIP_DisallowedOnce;

    // If we did not find the correct this-region, it would be pointless
    // to inline the constructor. Instead we will simply invalidate
    // the fake temporary target.
    if (CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion)
      return CIP_DisallowedOnce;

    // If the temporary is lifetime-extended by binding a smaller object
    // within it to a reference, automatic destructors don't work properly.
    if (CallOpts.IsTemporaryLifetimeExtendedViaSubobject)
      return CIP_DisallowedOnce;
  }

  break;
}
case CE_CXXDestructor: {
  if (!Opts.mayInlineCXXMemberFunction(CIMK_Destructors))
    return CIP_DisallowedAlways;

  // Inlining destructors requires building the CFG correctly.
  const AnalysisDeclContext *ADC = CallerSFC->getAnalysisDeclContext();
  assert(ADC->getCFGBuildOptions().AddImplicitDtors && "No CFG destructors")(static_cast <bool> (ADC->getCFGBuildOptions().AddImplicitDtors
 && "No CFG destructors") ? void (0) : __assert_fail (
"ADC->getCFGBuildOptions().AddImplicitDtors && \"No CFG destructors\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 696, __extension__ __PRETTY_FUNCTION__));
  (void)ADC;

  // FIXME: We don't handle constructors or destructors for arrays properly.
  if (CallOpts.IsArrayCtorOrDtor)
    return CIP_DisallowedOnce;

  // Allow disabling temporary destructor inlining with a separate option.
  if (CallOpts.IsTemporaryCtorOrDtor && !Opts.mayInlineCXXTemporaryDtors())
    return CIP_DisallowedOnce;

  // If we did not find the correct this-region, it would be pointless
  // to inline the destructor. Instead we will simply invalidate
  // the fake temporary target.
  if (CallOpts.IsCtorOrDtorWithImproperlyModeledTargetRegion)
    return CIP_DisallowedOnce;
  break;
}
case CE_CXXAllocator:
  if (Opts.mayInlineCXXAllocator())
    break;
  // Do not inline allocators until we model deallocators.
  // This is unfortunate, but basically necessary for smart pointers and such.
  return CIP_DisallowedAlways;
case CE_ObjCMessage:
  if (!Opts.mayInlineObjCMethod())
    return CIP_DisallowedAlways;
  if (!(Opts.getIPAMode() == IPAK_DynamicDispatch ||
        Opts.getIPAMode() == IPAK_DynamicDispatchBifurcate))
    return CIP_DisallowedAlways;
  break;
}

return CIP_Allowed;
730}

732/// Returns true if the given C++ class contains a member with the given name.
733static bool hasMember(const ASTContext &Ctx, const CXXRecordDecl *RD,
                    StringRef Name) {
const IdentifierInfo &II = Ctx.Idents.get(Name);
DeclarationName DeclName = Ctx.DeclarationNames.getIdentifier(&II);
if (!RD->lookup(DeclName).empty())
  return true;

CXXBasePaths Paths(false, false, false);
if (RD->lookupInBases(
        [DeclName](const CXXBaseSpecifier *Specifier, CXXBasePath &Path) {
          return CXXRecordDecl::FindOrdinaryMember(Specifier, Path, DeclName);
        },
        Paths))
  return true;

return false;
749}

751/// Returns true if the given C++ class is a container or iterator.
752///
753/// Our heuristic for this is whether it contains a method named 'begin()' or a
754/// nested type named 'iterator' or 'iterator_category'.
755static bool isContainerClass(const ASTContext &Ctx, const CXXRecordDecl *RD) {
return hasMember(Ctx, RD, "begin") ||
       hasMember(Ctx, RD, "iterator") ||
       hasMember(Ctx, RD, "iterator_category");
759}

761/// Returns true if the given function refers to a method of a C++ container
762/// or iterator.
763///
764/// We generally do a poor job modeling most containers right now, and might
765/// prefer not to inline their methods.
766static bool isContainerMethod(const ASTContext &Ctx,
                            const FunctionDecl *FD) {
if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(FD))
  return isContainerClass(Ctx, MD->getParent());
return false;
771}

773/// Returns true if the given function is the destructor of a class named
774/// "shared_ptr".
775static bool isCXXSharedPtrDtor(const FunctionDecl *FD) {
const CXXDestructorDecl *Dtor = dyn_cast<CXXDestructorDecl>(FD);
if (!Dtor)
  return false;

const CXXRecordDecl *RD = Dtor->getParent();
if (const IdentifierInfo *II = RD->getDeclName().getAsIdentifierInfo())
  if (II->isStr("shared_ptr"))
      return true;

return false;
786}

788/// Returns true if the function in \p CalleeADC may be inlined in general.
789///
790/// This checks static properties of the function, such as its signature and
791/// CFG, to determine whether the analyzer should ever consider inlining it,
792/// in any context.
793static bool mayInlineDecl(AnalysisDeclContext *CalleeADC,
                        AnalyzerOptions &Opts) {
// FIXME: Do not inline variadic calls.
if (CallEvent::isVariadic(CalleeADC->getDecl()))
  return false;

// Check certain C++-related inlining policies.
ASTContext &Ctx = CalleeADC->getASTContext();
if (Ctx.getLangOpts().CPlusPlus) {
  if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CalleeADC->getDecl())) {
    // Conditionally control the inlining of template functions.
    if (!Opts.mayInlineTemplateFunctions())
      if (FD->getTemplatedKind() != FunctionDecl::TK_NonTemplate)
        return false;

    // Conditionally control the inlining of C++ standard library functions.
    if (!Opts.mayInlineCXXStandardLibrary())
      if (Ctx.getSourceManager().isInSystemHeader(FD->getLocation()))
        if (AnalysisDeclContext::isInStdNamespace(FD))
          return false;

    // Conditionally control the inlining of methods on objects that look
    // like C++ containers.
    if (!Opts.mayInlineCXXContainerMethods())
      if (!Ctx.getSourceManager().isInMainFile(FD->getLocation()))
        if (isContainerMethod(Ctx, FD))
          return false;

    // Conditionally control the inlining of the destructor of C++ shared_ptr.
    // We don't currently do a good job modeling shared_ptr because we can't
    // see the reference count, so treating as opaque is probably the best
    // idea.
    if (!Opts.mayInlineCXXSharedPtrDtor())
      if (isCXXSharedPtrDtor(FD))
        return false;
  }
}

// It is possible that the CFG cannot be constructed.
// Be safe, and check if the CalleeCFG is valid.
const CFG *CalleeCFG = CalleeADC->getCFG();
if (!CalleeCFG)
  return false;

// Do not inline large functions.
if (CalleeCFG->getNumBlockIDs() > Opts.getMaxInlinableSize())
  return false;

// It is possible that the live variables analysis cannot be
// run.  If so, bail out.
if (!CalleeADC->getAnalysis<RelaxedLiveVariables>())
  return false;

return true;
847}

849bool ExprEngine::shouldInlineCall(const CallEvent &Call, const Decl *D,
                                const ExplodedNode *Pred,
                                const EvalCallOptions &CallOpts) {
if (!D)
  return false;

AnalysisManager &AMgr = getAnalysisManager();
AnalyzerOptions &Opts = AMgr.options;
AnalysisDeclContextManager &ADCMgr = AMgr.getAnalysisDeclContextManager();
AnalysisDeclContext *CalleeADC = ADCMgr.getContext(D);

// The auto-synthesized bodies are essential to inline as they are
// usually small and commonly used. Note: we should do this check early on to
// ensure we always inline these calls.
if (CalleeADC->isBodyAutosynthesized())
  return true;

if (!AMgr.shouldInlineCall())
  return false;

// Check if this function has been marked as non-inlinable.
Optional<bool> MayInline = Engine.FunctionSummaries->mayInline(D);
if (MayInline.hasValue()) {
  if (!MayInline.getValue())
    return false;

} else {
  // We haven't actually checked the static properties of this function yet.
  // Do that now, and record our decision in the function summaries.
  if (mayInlineDecl(CalleeADC, Opts)) {
    Engine.FunctionSummaries->markMayInline(D);
  } else {
    Engine.FunctionSummaries->markShouldNotInline(D);
    return false;
  }
}

// Check if we should inline a call based on its kind.
// FIXME: this checks both static and dynamic properties of the call, which
// means we're redoing a bit of work that could be cached in the function
// summary.
CallInlinePolicy CIP = mayInlineCallKind(Call, Pred, Opts, CallOpts);
if (CIP != CIP_Allowed) {
  if (CIP == CIP_DisallowedAlways) {
    assert(!MayInline.hasValue() || MayInline.getValue())(static_cast <bool> (!MayInline.hasValue() || MayInline
.getValue()) ? void (0) : __assert_fail ("!MayInline.hasValue() || MayInline.getValue()"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 893, __extension__ __PRETTY_FUNCTION__));
    Engine.FunctionSummaries->markShouldNotInline(D);
  }
  return false;
}

const CFG *CalleeCFG = CalleeADC->getCFG();

// Do not inline if recursive or we've reached max stack frame count.
bool IsRecursive = false;
unsigned StackDepth = 0;
examineStackFrames(D, Pred->getLocationContext(), IsRecursive, StackDepth);
if ((StackDepth >= Opts.InlineMaxStackDepth) &&
    ((CalleeCFG->getNumBlockIDs() > Opts.getAlwaysInlineSize())
     || IsRecursive))
  return false;

// Do not inline large functions too many times.
if ((Engine.FunctionSummaries->getNumTimesInlined(D) >
     Opts.getMaxTimesInlineLarge()) &&
     CalleeCFG->getNumBlockIDs() >=
     Opts.getMinCFGSizeTreatFunctionsAsLarge()) {
  NumReachedInlineCountMax++;
  return false;
}

if (HowToInline == Inline_Minimal &&
    (CalleeCFG->getNumBlockIDs() > Opts.getAlwaysInlineSize()
    || IsRecursive))
  return false;

return true;
925}

927static bool isTrivialObjectAssignment(const CallEvent &Call) {
const CXXInstanceCall *ICall = dyn_cast<CXXInstanceCall>(&Call);
if (!ICall)
  return false;

const CXXMethodDecl *MD = dyn_cast_or_null<CXXMethodDecl>(ICall->getDecl());
if (!MD)
  return false;
if (!(MD->isCopyAssignmentOperator() || MD->isMoveAssignmentOperator()))
  return false;

return MD->isTrivial();
939}

941void ExprEngine::defaultEvalCall(NodeBuilder &Bldr, ExplodedNode *Pred,
                               const CallEvent &CallTemplate,
                               const EvalCallOptions &CallOpts) {
// Make sure we have the most recent state attached to the call.
ProgramStateRef State = Pred->getState();
CallEventRef<> Call = CallTemplate.cloneWithState(State);
1
Null pointer value stored to field 'Obj'→
2
←
Calling copy constructor for 'CallEventRef'→
6
←
Returning from copy constructor for 'CallEventRef'→

// Special-case trivial assignment operators.
if (isTrivialObjectAssignment(*Call)) {
7
←
Calling 'IntrusiveRefCntPtr::operator*'→
  performTrivialCopy(Bldr, Pred, *Call);
  return;
}

// Try to inline the call.
// The origin expression here is just used as a kind of checksum;
// this should still be safe even for CallEvents that don't come from exprs.
const Expr *E = Call->getOriginExpr();

ProgramStateRef InlinedFailedState = getInlineFailedState(State, E);
if (InlinedFailedState) {
  // If we already tried once and failed, make sure we don't retry later.
  State = InlinedFailedState;
} else {
  RuntimeDefinition RD = Call->getRuntimeDefinition();
  const Decl *D = RD.getDecl();
  if (shouldInlineCall(*Call, D, Pred, CallOpts)) {
    if (RD.mayHaveOtherDefinitions()) {
      AnalyzerOptions &Options = getAnalysisManager().options;

      // Explore with and without inlining the call.
      if (Options.getIPAMode() == IPAK_DynamicDispatchBifurcate) {
        BifurcateCall(RD.getDispatchRegion(), *Call, D, Bldr, Pred);
        return;
      }

      // Don't inline if we're not in any dynamic dispatch mode.
      if (Options.getIPAMode() != IPAK_DynamicDispatch) {
        conservativeEvalCall(*Call, Bldr, Pred, State);
        return;
      }
    }

    // We are not bifurcating and we do have a Decl, so just inline.
    if (inlineCall(*Call, D, Bldr, Pred, State))
      return;
  }
}

// If we can't inline it, handle the return value and invalidate the regions.
conservativeEvalCall(*Call, Bldr, Pred, State);
991}

993void ExprEngine::BifurcateCall(const MemRegion *BifurReg,
                             const CallEvent &Call, const Decl *D,
                             NodeBuilder &Bldr, ExplodedNode *Pred) {
assert(BifurReg)(static_cast <bool> (BifurReg) ? void (0) : __assert_fail
 ("BifurReg", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/ExprEngineCallAndReturn.cpp"
, 996, __extension__ __PRETTY_FUNCTION__));
BifurReg = BifurReg->StripCasts();

// Check if we've performed the split already - note, we only want
// to split the path once per memory region.
ProgramStateRef State = Pred->getState();
const unsigned *BState =
                      State->get<DynamicDispatchBifurcationMap>(BifurReg);
if (BState) {
  // If we are on "inline path", keep inlining if possible.
  if (*BState == DynamicDispatchModeInlined)
    if (inlineCall(Call, D, Bldr, Pred, State))
      return;
  // If inline failed, or we are on the path where we assume we
  // don't have enough info about the receiver to inline, conjure the
  // return value and invalidate the regions.
  conservativeEvalCall(Call, Bldr, Pred, State);
  return;
}

// If we got here, this is the first time we process a message to this
// region, so split the path.
ProgramStateRef IState =
    State->set<DynamicDispatchBifurcationMap>(BifurReg,
                                             DynamicDispatchModeInlined);
inlineCall(Call, D, Bldr, Pred, IState);

ProgramStateRef NoIState =
    State->set<DynamicDispatchBifurcationMap>(BifurReg,
                                             DynamicDispatchModeConservative);
conservativeEvalCall(Call, Bldr, Pred, NoIState);

NumOfDynamicDispatchPathSplits++;
1029}

1031void ExprEngine::VisitReturnStmt(const ReturnStmt *RS, ExplodedNode *Pred,
                               ExplodedNodeSet &Dst) {
ExplodedNodeSet dstPreVisit;
getCheckerManager().runCheckersForPreStmt(dstPreVisit, Pred, RS, *this);

StmtNodeBuilder B(dstPreVisit, Dst, *currBldrCtx);

if (RS->getRetValue()) {
  for (ExplodedNodeSet::iterator it = dstPreVisit.begin(),
                                ei = dstPreVisit.end(); it != ei; ++it) {
    B.generateNode(RS, *it, (*it)->getState());
  }
}
1044}

←

/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h

→

1//===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10/// \file This file defines CallEvent and its subclasses, which represent path-
11/// sensitive instances of different kinds of function and method calls
12/// (C, C++, and Objective-C).
13//
14//===----------------------------------------------------------------------===//

16#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
17#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H

19#include "clang/AST/Decl.h"
20#include "clang/AST/DeclBase.h"
21#include "clang/AST/DeclCXX.h"
22#include "clang/AST/DeclObjC.h"
23#include "clang/AST/Expr.h"
24#include "clang/AST/ExprCXX.h"
25#include "clang/AST/ExprObjC.h"
26#include "clang/AST/Stmt.h"
27#include "clang/AST/Type.h"
28#include "clang/Basic/IdentifierTable.h"
29#include "clang/Basic/LLVM.h"
30#include "clang/Basic/SourceLocation.h"
31#include "clang/Basic/SourceManager.h"
32#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
33#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
34#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
35#include "llvm/ADT/ArrayRef.h"
36#include "llvm/ADT/IntrusiveRefCntPtr.h"
37#include "llvm/ADT/PointerIntPair.h"
38#include "llvm/ADT/PointerUnion.h"
39#include "llvm/ADT/STLExtras.h"
40#include "llvm/ADT/SmallVector.h"
41#include "llvm/ADT/StringRef.h"
42#include "llvm/Support/Allocator.h"
43#include "llvm/Support/Casting.h"
44#include "llvm/Support/ErrorHandling.h"
45#include <cassert>
46#include <limits>
47#include <utility>

49namespace clang {

51class LocationContext;
52class ProgramPoint;
53class ProgramPointTag;
54class StackFrameContext;

56namespace ento {

58enum CallEventKind {
CE_Function,
CE_CXXMember,
CE_CXXMemberOperator,
CE_CXXDestructor,
CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
CE_CXXConstructor,
CE_CXXAllocator,
CE_BEG_FUNCTION_CALLS = CE_Function,
CE_END_FUNCTION_CALLS = CE_CXXAllocator,
CE_Block,
CE_ObjCMessage
71};

73class CallEvent;

75/// This class represents a description of a function call using the number of
76/// arguments and the name of the function.
77class CallDescription {
friend CallEvent;

mutable IdentifierInfo *II = nullptr;
mutable bool IsLookupDone = false;
StringRef FuncName;
unsigned RequiredArgs;

85public:
const static unsigned NoArgRequirement = std::numeric_limits<unsigned>::max();

/// \brief Constructs a CallDescription object.
///
/// @param FuncName The name of the function that will be matched.
///
/// @param RequiredArgs The number of arguments that is expected to match a
/// call. Omit this parameter to match every occurance of call with a given
/// name regardless the number of arguments.
CallDescription(StringRef FuncName, unsigned RequiredArgs = NoArgRequirement)
    : FuncName(FuncName), RequiredArgs(RequiredArgs) {}

/// \brief Get the name of the function that this object matches.
StringRef getFunctionName() const { return FuncName; }
100};

102template<typename T = CallEvent>
103class CallEventRef : public IntrusiveRefCntPtr<const T> {
104public:
CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
3
←
Calling copy constructor for 'IntrusiveRefCntPtr'→
5
←
Returning from copy constructor for 'IntrusiveRefCntPtr'→

CallEventRef<T> cloneWithState(ProgramStateRef State) const {
  return this->get()->template cloneWithState<T>(State);
}

// Allow implicit conversions to a superclass type, since CallEventRef
// behaves like a pointer-to-const.
template <typename SuperT>
operator CallEventRef<SuperT> () const {
  return this->get();
}
118};

120/// \class RuntimeDefinition 
121/// \brief Defines the runtime definition of the called function.
122/// 
123/// Encapsulates the information we have about which Decl will be used 
124/// when the call is executed on the given path. When dealing with dynamic
125/// dispatch, the information is based on DynamicTypeInfo and might not be 
126/// precise.
127class RuntimeDefinition {
/// The Declaration of the function which could be called at runtime.
/// NULL if not available.
const Decl *D = nullptr;

/// The region representing an object (ObjC/C++) on which the method is
/// called. With dynamic dispatch, the method definition depends on the
/// runtime type of this object. NULL when the DynamicTypeInfo is
/// precise.
const MemRegion *R = nullptr;

138public:
RuntimeDefinition() = default;
RuntimeDefinition(const Decl *InD): D(InD) {}
RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}

const Decl *getDecl() { return D; }
  
/// \brief Check if the definition we have is precise. 
/// If not, it is possible that the call dispatches to another definition at 
/// execution time.
bool mayHaveOtherDefinitions() { return R != nullptr; }

/// When other definitions are possible, returns the region whose runtime type 
/// determines the method definition.
const MemRegion *getDispatchRegion() { return R; }
153};

155/// \brief Represents an abstract call to a function or method along a
156/// particular path.
157///
158/// CallEvents are created through the factory methods of CallEventManager.
159///
160/// CallEvents should always be cheap to create and destroy. In order for
161/// CallEventManager to be able to re-use CallEvent-sized memory blocks,
162/// subclasses of CallEvent may not add any data members to the base class.
163/// Use the "Data" and "Location" fields instead.
164class CallEvent {
165public:
using Kind = CallEventKind;

168private:
ProgramStateRef State;
const LocationContext *LCtx;
llvm::PointerUnion<const Expr *, const Decl *> Origin;

173protected:
// This is user data for subclasses.
const void *Data;

// This is user data for subclasses.
// This should come right before RefCount, so that the two fields can be
// packed together on LP64 platforms.
SourceLocation Location;

182private:
template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;

mutable unsigned RefCount = 0;

void Retain() const { ++RefCount; }
void Release() const;

190protected:
friend class CallEventManager;

CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
    : State(std::move(state)), LCtx(lctx), Origin(E) {}

CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
    : State(std::move(state)), LCtx(lctx), Origin(D) {}

// DO NOT MAKE PUBLIC
CallEvent(const CallEvent &Original)
    : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
      Data(Original.Data), Location(Original.Location) {}

/// Copies this CallEvent, with vtable intact, into a new block of memory.
virtual void cloneTo(void *Dest) const = 0;

/// \brief Get the value of arbitrary expressions at this point in the path.
SVal getSVal(const Stmt *S) const {
  return getState()->getSVal(S, getLocationContext());
}

using ValueList = SmallVectorImpl<SVal>;

/// \brief Used to specify non-argument regions that will be invalidated as a
/// result of this call.
virtual void getExtraInvalidatedValues(ValueList &Values,
               RegionAndSymbolInvalidationTraits *ETraits) const {}

219public:
CallEvent &operator=(const CallEvent &) = delete;
virtual ~CallEvent() = default;

/// \brief Returns the kind of call this is.
virtual Kind getKind() const = 0;

/// \brief Returns the declaration of the function or method that will be
/// called. May be null.
virtual const Decl *getDecl() const {
  return Origin.dyn_cast<const Decl *>();
}

/// \brief The state in which the call is being evaluated.
const ProgramStateRef &getState() const {
  return State;
}

/// \brief The context in which the call is being evaluated.
const LocationContext *getLocationContext() const {
  return LCtx;
}

/// \brief Returns the definition of the function or method that will be
/// called.
virtual RuntimeDefinition getRuntimeDefinition() const = 0;

/// \brief Returns the expression whose value will be the result of this call.
/// May be null.
const Expr *getOriginExpr() const {
  return Origin.dyn_cast<const Expr *>();
}

/// \brief Returns the number of arguments (explicit and implicit).
///
/// Note that this may be greater than the number of parameters in the
/// callee's declaration, and that it may include arguments not written in
/// the source.
virtual unsigned getNumArgs() const = 0;

/// \brief Returns true if the callee is known to be from a system header.
bool isInSystemHeader() const {
  const Decl *D = getDecl();
  if (!D)
    return false;

  SourceLocation Loc = D->getLocation();
  if (Loc.isValid()) {
    const SourceManager &SM =
      getState()->getStateManager().getContext().getSourceManager();
    return SM.isInSystemHeader(D->getLocation());
  }

  // Special case for implicitly-declared global operator new/delete.
  // These should be considered system functions.
  if (const auto *FD = dyn_cast<FunctionDecl>(D))
    return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal();

  return false;
}

/// \brief Returns true if the CallEvent is a call to a function that matches
/// the CallDescription.
///
/// Note that this function is not intended to be used to match Obj-C method
/// calls.
bool isCalled(const CallDescription &CD) const;

/// \brief Returns a source range for the entire call, suitable for
/// outputting in diagnostics.
virtual SourceRange getSourceRange() const {
  return getOriginExpr()->getSourceRange();
}

/// \brief Returns the value of a given argument at the time of the call.
virtual SVal getArgSVal(unsigned Index) const;

/// \brief Returns the expression associated with a given argument.
/// May be null if this expression does not appear in the source.
virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }

/// \brief Returns the source range for errors associated with this argument.
///
/// May be invalid if the argument is not written in the source.
virtual SourceRange getArgSourceRange(unsigned Index) const;

/// \brief Returns the result type, adjusted for references.
QualType getResultType() const;

/// \brief Returns the return value of the call.
///
/// This should only be called if the CallEvent was created using a state in
/// which the return value has already been bound to the origin expression.
SVal getReturnValue() const;

/// \brief Returns true if the type of any of the non-null arguments satisfies
/// the condition.
bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;

/// \brief Returns true if any of the arguments appear to represent callbacks.
bool hasNonZeroCallbackArg() const;

/// \brief Returns true if any of the arguments is void*.
bool hasVoidPointerToNonConstArg() const;

/// \brief Returns true if any of the arguments are known to escape to long-
/// term storage, even if this method will not modify them.
// NOTE: The exact semantics of this are still being defined!
// We don't really want a list of hardcoded exceptions in the long run,
// but we don't want duplicated lists of known APIs in the short term either.
virtual bool argumentsMayEscape() const {
  return hasNonZeroCallbackArg();
}

/// \brief Returns true if the callee is an externally-visible function in the
/// top-level namespace, such as \c malloc.
///
/// You can use this call to determine that a particular function really is
/// a library function and not, say, a C++ member function with the same name.
///
/// If a name is provided, the function must additionally match the given
/// name.
///
/// Note that this deliberately excludes C++ library functions in the \c std
/// namespace, but will include C library functions accessed through the
/// \c std namespace. This also does not check if the function is declared
/// as 'extern "C"', or if it uses C++ name mangling.
// FIXME: Add a helper for checking namespaces.
// FIXME: Move this down to AnyFunctionCall once checkers have more
// precise callbacks.
bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;

/// \brief Returns the name of the callee, if its name is a simple identifier.
///
/// Note that this will fail for Objective-C methods, blocks, and C++
/// overloaded operators. The former is named by a Selector rather than a
/// simple identifier, and the latter two do not have names.
// FIXME: Move this down to AnyFunctionCall once checkers have more
// precise callbacks.
const IdentifierInfo *getCalleeIdentifier() const {
  const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
  if (!ND)
    return nullptr;
  return ND->getIdentifier();
}

/// \brief Returns an appropriate ProgramPoint for this call.
ProgramPoint getProgramPoint(bool IsPreVisit = false,
                             const ProgramPointTag *Tag = nullptr) const;

/// \brief Returns a new state with all argument regions invalidated.
///
/// This accepts an alternate state in case some processing has already
/// occurred.
ProgramStateRef invalidateRegions(unsigned BlockCount,
                                  ProgramStateRef Orig = nullptr) const;

using FrameBindingTy = std::pair<Loc, SVal>;
using BindingsTy = SmallVectorImpl<FrameBindingTy>;

/// Populates the given SmallVector with the bindings in the callee's stack
/// frame at the start of this call.
virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                          BindingsTy &Bindings) const = 0;

/// Returns a copy of this CallEvent, but using the given state.
template <typename T>
CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;

/// Returns a copy of this CallEvent, but using the given state.
CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
  return cloneWithState<CallEvent>(NewState);
}

/// \brief Returns true if this is a statement is a function or method call
/// of some kind.
static bool isCallStmt(const Stmt *S);

/// \brief Returns the result type of a function or method declaration.
///
/// This will return a null QualType if the result type cannot be determined.
static QualType getDeclaredResultType(const Decl *D);

/// \brief Returns true if the given decl is known to be variadic.
///
/// \p D must not be null.
static bool isVariadic(const Decl *D);

// Iterator access to formal parameters and their types.
408private:
struct GetTypeFn {
  QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
};

413public:
/// Return call's formal parameters.
///
/// Remember that the number of formal parameters may not match the number
/// of arguments for all calls. However, the first parameter will always
/// correspond with the argument value returned by \c getArgSVal(0).
virtual ArrayRef<ParmVarDecl *> parameters() const = 0;

using param_type_iterator =
    llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;

/// Returns an iterator over the types of the call's formal parameters.
///
/// This uses the callee decl found by default name lookup rather than the
/// definition because it represents a public interface, and probably has
/// more annotations.
param_type_iterator param_type_begin() const {
  return llvm::map_iterator(parameters().begin(), GetTypeFn());
}
/// \sa param_type_begin()
param_type_iterator param_type_end() const {
  return llvm::map_iterator(parameters().end(), GetTypeFn());
}

// For debugging purposes only
void dump(raw_ostream &Out) const;
void dump() const;
440};

442/// \brief Represents a call to any sort of function that might have a
443/// FunctionDecl.
444class AnyFunctionCall : public CallEvent {
445protected:
AnyFunctionCall(const Expr *E, ProgramStateRef St,
                const LocationContext *LCtx)
    : CallEvent(E, St, LCtx) {}
AnyFunctionCall(const Decl *D, ProgramStateRef St,
                const LocationContext *LCtx)
    : CallEvent(D, St, LCtx) {}
AnyFunctionCall(const AnyFunctionCall &Other) = default;

454public:
// This function is overridden by subclasses, but they must return
// a FunctionDecl.
const FunctionDecl *getDecl() const override {
  return cast<FunctionDecl>(CallEvent::getDecl());
}

RuntimeDefinition getRuntimeDefinition() const override;

bool argumentsMayEscape() const override;

void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                  BindingsTy &Bindings) const override;

ArrayRef<ParmVarDecl *> parameters() const override;

static bool classof(const CallEvent *CA) {
  return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
         CA->getKind() <= CE_END_FUNCTION_CALLS;
}
474};

476/// \brief Represents a C function or static C++ member function call.
477///
478/// Example: \c fun()
479class SimpleFunctionCall : public AnyFunctionCall {
friend class CallEventManager;

482protected:
SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St,
                   const LocationContext *LCtx)
    : AnyFunctionCall(CE, St, LCtx) {}
SimpleFunctionCall(const SimpleFunctionCall &Other) = default;

void cloneTo(void *Dest) const override {
  new (Dest) SimpleFunctionCall(*this);
}

492public:
virtual const CallExpr *getOriginExpr() const {
  return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
}

const FunctionDecl *getDecl() const override;

unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index);
}

Kind getKind() const override { return CE_Function; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_Function;
}
510};

512/// \brief Represents a call to a block.
513///
514/// Example: <tt>^{ /* ... */ }()</tt>
515class BlockCall : public CallEvent {
friend class CallEventManager;

518protected:
BlockCall(const CallExpr *CE, ProgramStateRef St,
          const LocationContext *LCtx)
    : CallEvent(CE, St, LCtx) {}
BlockCall(const BlockCall &Other) = default;

void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }

void getExtraInvalidatedValues(ValueList &Values,
       RegionAndSymbolInvalidationTraits *ETraits) const override;

529public:
virtual const CallExpr *getOriginExpr() const {
  return cast<CallExpr>(CallEvent::getOriginExpr());
}

unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index);
}

/// \brief Returns the region associated with this instance of the block.
///
/// This may be NULL if the block's origin is unknown.
const BlockDataRegion *getBlockRegion() const;

const BlockDecl *getDecl() const override {
  const BlockDataRegion *BR = getBlockRegion();
  if (!BR)
    return nullptr;
  return BR->getDecl();
}

bool isConversionFromLambda() const {
  const BlockDecl *BD = getDecl();
  if (!BD)
    return false;

  return BD->isConversionFromLambda();
}

/// \brief For a block converted from a C++ lambda, returns the block
/// VarRegion for the variable holding the captured C++ lambda record.
const VarRegion *getRegionStoringCapturedLambda() const {
  assert(isConversionFromLambda())(static_cast <bool> (isConversionFromLambda()) ? void (
0) : __assert_fail ("isConversionFromLambda()", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 563, __extension__ __PRETTY_FUNCTION__));
  const BlockDataRegion *BR = getBlockRegion();
  assert(BR && "Block converted from lambda must have a block region")(static_cast <bool> (BR && "Block converted from lambda must have a block region"
) ? void (0) : __assert_fail ("BR && \"Block converted from lambda must have a block region\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 565, __extension__ __PRETTY_FUNCTION__));

  auto I = BR->referenced_vars_begin();
  assert(I != BR->referenced_vars_end())(static_cast <bool> (I != BR->referenced_vars_end())
 ? void (0) : __assert_fail ("I != BR->referenced_vars_end()"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 568, __extension__ __PRETTY_FUNCTION__));

  return I.getCapturedRegion();
}

RuntimeDefinition getRuntimeDefinition() const override {
  if (!isConversionFromLambda())
    return RuntimeDefinition(getDecl());

  // Clang converts lambdas to blocks with an implicit user-defined
  // conversion operator method on the lambda record that looks (roughly)
  // like:
  //
  // typedef R(^block_type)(P1, P2, ...);
  // operator block_type() const {
  //   auto Lambda = *this;
  //   return ^(P1 p1, P2 p2, ...){
  //     /* return Lambda(p1, p2, ...); */
  //   };
  // }
  //
  // Here R is the return type of the lambda and P1, P2, ... are
  // its parameter types. 'Lambda' is a fake VarDecl captured by the block
  // that is initialized to a copy of the lambda.
  //
  // Sema leaves the body of a lambda-converted block empty (it is
  // produced by CodeGen), so we can't analyze it directly. Instead, we skip
  // the block body and analyze the operator() method on the captured lambda.
  const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
  const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
  CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();

  return RuntimeDefinition(LambdaCallOperator);
}

bool argumentsMayEscape() const override {
  return true;
}

void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                  BindingsTy &Bindings) const override;

ArrayRef<ParmVarDecl*> parameters() const override;

Kind getKind() const override { return CE_Block; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_Block;
}
617};

619/// \brief Represents a non-static C++ member function call, no matter how
620/// it is written.
621class CXXInstanceCall : public AnyFunctionCall {
622protected:
CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
                const LocationContext *LCtx)
    : AnyFunctionCall(CE, St, LCtx) {}
CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
                const LocationContext *LCtx)
    : AnyFunctionCall(D, St, LCtx) {}
CXXInstanceCall(const CXXInstanceCall &Other) = default;

void getExtraInvalidatedValues(ValueList &Values, 
       RegionAndSymbolInvalidationTraits *ETraits) const override;

634public:
/// \brief Returns the expression representing the implicit 'this' object.
virtual const Expr *getCXXThisExpr() const { return nullptr; }

/// \brief Returns the value of the implicit 'this' object.
virtual SVal getCXXThisVal() const;

const FunctionDecl *getDecl() const override;

RuntimeDefinition getRuntimeDefinition() const override;

void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                  BindingsTy &Bindings) const override;

static bool classof(const CallEvent *CA) {
  return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
         CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
}
652};

654/// \brief Represents a non-static C++ member function call.
655///
656/// Example: \c obj.fun()
657class CXXMemberCall : public CXXInstanceCall {
friend class CallEventManager;

660protected:
CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
              const LocationContext *LCtx)
    : CXXInstanceCall(CE, St, LCtx) {}
CXXMemberCall(const CXXMemberCall &Other) = default;

void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }

668public:
virtual const CXXMemberCallExpr *getOriginExpr() const {
  return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
}

unsigned getNumArgs() const override {
  if (const CallExpr *CE = getOriginExpr())
    return CE->getNumArgs();
  return 0;
}

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index);
}

const Expr *getCXXThisExpr() const override;

RuntimeDefinition getRuntimeDefinition() const override;

Kind getKind() const override { return CE_CXXMember; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_CXXMember;
}
692};

694/// \brief Represents a C++ overloaded operator call where the operator is
695/// implemented as a non-static member function.
696///
697/// Example: <tt>iter + 1</tt>
698class CXXMemberOperatorCall : public CXXInstanceCall {
friend class CallEventManager;

701protected:
CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
                      const LocationContext *LCtx)
    : CXXInstanceCall(CE, St, LCtx) {}
CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;

void cloneTo(void *Dest) const override {
  new (Dest) CXXMemberOperatorCall(*this);
}

711public:
virtual const CXXOperatorCallExpr *getOriginExpr() const {
  return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
}

unsigned getNumArgs() const override {
  return getOriginExpr()->getNumArgs() - 1;
}

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index + 1);
}

const Expr *getCXXThisExpr() const override;

Kind getKind() const override { return CE_CXXMemberOperator; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_CXXMemberOperator;
}
731};

733/// \brief Represents an implicit call to a C++ destructor.
734///
735/// This can occur at the end of a scope (for automatic objects), at the end
736/// of a full-expression (for temporaries), or as part of a delete.
737class CXXDestructorCall : public CXXInstanceCall {
friend class CallEventManager;

740protected:
using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;

/// Creates an implicit destructor.
///
/// \param DD The destructor that will be called.
/// \param Trigger The statement whose completion causes this destructor call.
/// \param Target The object region to be destructed.
/// \param St The path-sensitive state at this point in the program.
/// \param LCtx The location context at this point in the program.
CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
                  const MemRegion *Target, bool IsBaseDestructor,
                  ProgramStateRef St, const LocationContext *LCtx)
    : CXXInstanceCall(DD, St, LCtx) {
  Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
  Location = Trigger->getLocEnd();
}

CXXDestructorCall(const CXXDestructorCall &Other) = default;

void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}

762public:
SourceRange getSourceRange() const override { return Location; }
unsigned getNumArgs() const override { return 0; }

RuntimeDefinition getRuntimeDefinition() const override;

/// \brief Returns the value of the implicit 'this' object.
SVal getCXXThisVal() const override;

/// Returns true if this is a call to a base class destructor.
bool isBaseDestructor() const {
  return DtorDataTy::getFromOpaqueValue(Data).getInt();
}

Kind getKind() const override { return CE_CXXDestructor; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_CXXDestructor;
}
781};

783/// \brief Represents a call to a C++ constructor.
784///
785/// Example: \c T(1)
786class CXXConstructorCall : public AnyFunctionCall {
friend class CallEventManager;

789protected:
/// Creates a constructor call.
///
/// \param CE The constructor expression as written in the source.
/// \param Target The region where the object should be constructed. If NULL,
///               a new symbolic region will be used.
/// \param St The path-sensitive state at this point in the program.
/// \param LCtx The location context at this point in the program.
CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
                   ProgramStateRef St, const LocationContext *LCtx)
    : AnyFunctionCall(CE, St, LCtx) {
  Data = Target;
}

CXXConstructorCall(const CXXConstructorCall &Other) = default;

void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }

void getExtraInvalidatedValues(ValueList &Values,
       RegionAndSymbolInvalidationTraits *ETraits) const override;

810public:
virtual const CXXConstructExpr *getOriginExpr() const {
  return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
}

const CXXConstructorDecl *getDecl() const override {
  return getOriginExpr()->getConstructor();
}

unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index);
}

/// \brief Returns the value of the implicit 'this' object.
SVal getCXXThisVal() const;

void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                  BindingsTy &Bindings) const override;

Kind getKind() const override { return CE_CXXConstructor; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_CXXConstructor;
}
836};

838/// \brief Represents the memory allocation call in a C++ new-expression.
839///
840/// This is a call to "operator new".
841class CXXAllocatorCall : public AnyFunctionCall {
friend class CallEventManager;

844protected:
CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
                 const LocationContext *LCtx)
    : AnyFunctionCall(E, St, LCtx) {}
CXXAllocatorCall(const CXXAllocatorCall &Other) = default;

void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }

852public:
virtual const CXXNewExpr *getOriginExpr() const {
  return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
}

const FunctionDecl *getDecl() const override {
  return getOriginExpr()->getOperatorNew();
}

unsigned getNumArgs() const override {
  return getOriginExpr()->getNumPlacementArgs() + 1;
}

const Expr *getArgExpr(unsigned Index) const override {
  // The first argument of an allocator call is the size of the allocation.
  if (Index == 0)
    return nullptr;
  return getOriginExpr()->getPlacementArg(Index - 1);
}

Kind getKind() const override { return CE_CXXAllocator; }

static bool classof(const CallEvent *CE) {
  return CE->getKind() == CE_CXXAllocator;
}
877};

879/// \brief Represents the ways an Objective-C message send can occur.
880//
881// Note to maintainers: OCM_Message should always be last, since it does not
882// need to fit in the Data field's low bits.
883enum ObjCMessageKind {
OCM_PropertyAccess,
OCM_Subscript,
OCM_Message
887};

889/// \brief Represents any expression that calls an Objective-C method.
890///
891/// This includes all of the kinds listed in ObjCMessageKind.
892class ObjCMethodCall : public CallEvent {
friend class CallEventManager;

const PseudoObjectExpr *getContainingPseudoObjectExpr() const;

897protected:
ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
               const LocationContext *LCtx)
    : CallEvent(Msg, St, LCtx) {
  Data = nullptr;
}

ObjCMethodCall(const ObjCMethodCall &Other) = default;

void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }

void getExtraInvalidatedValues(ValueList &Values,
       RegionAndSymbolInvalidationTraits *ETraits) const override;

/// Check if the selector may have multiple definitions (may have overrides).
virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
                                      Selector Sel) const;

915public:
virtual const ObjCMessageExpr *getOriginExpr() const {
  return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
}

const ObjCMethodDecl *getDecl() const override {
  return getOriginExpr()->getMethodDecl();
}

unsigned getNumArgs() const override {
  return getOriginExpr()->getNumArgs();
}

const Expr *getArgExpr(unsigned Index) const override {
  return getOriginExpr()->getArg(Index);
}

bool isInstanceMessage() const {
  return getOriginExpr()->isInstanceMessage();
}

ObjCMethodFamily getMethodFamily() const {
  return getOriginExpr()->getMethodFamily();
}

Selector getSelector() const {
  return getOriginExpr()->getSelector();
}

SourceRange getSourceRange() const override;

/// \brief Returns the value of the receiver at the time of this call.
SVal getReceiverSVal() const;

/// \brief Return the value of 'self' if available.
SVal getSelfSVal() const;

/// \brief Get the interface for the receiver.
///
/// This works whether this is an instance message or a class message.
/// However, it currently just uses the static type of the receiver.
const ObjCInterfaceDecl *getReceiverInterface() const {
  return getOriginExpr()->getReceiverInterface();
}

/// \brief Checks if the receiver refers to 'self' or 'super'.
bool isReceiverSelfOrSuper() const;

/// Returns how the message was written in the source (property access,
/// subscript, or explicit message send).
ObjCMessageKind getMessageKind() const;

/// Returns true if this property access or subscript is a setter (has the
/// form of an assignment).
bool isSetter() const {
  switch (getMessageKind()) {
  case OCM_Message:
    llvm_unreachable("This is not a pseudo-object access!")::llvm::llvm_unreachable_internal("This is not a pseudo-object access!"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 972);
  case OCM_PropertyAccess:
    return getNumArgs() > 0;
  case OCM_Subscript:
    return getNumArgs() > 1;
  }
  llvm_unreachable("Unknown message kind")::llvm::llvm_unreachable_internal("Unknown message kind", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 978);
}

// Returns the property accessed by this method, either explicitly via
// property syntax or implicitly via a getter or setter method. Returns
// nullptr if the call is not a prooperty access.
const ObjCPropertyDecl *getAccessedProperty() const;

RuntimeDefinition getRuntimeDefinition() const override;

bool argumentsMayEscape() const override;

void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
                                  BindingsTy &Bindings) const override;

ArrayRef<ParmVarDecl*> parameters() const override;

Kind getKind() const override { return CE_ObjCMessage; }

static bool classof(const CallEvent *CA) {
  return CA->getKind() == CE_ObjCMessage;
}
1000};

1002/// \brief Manages the lifetime of CallEvent objects.
1003///
1004/// CallEventManager provides a way to create arbitrary CallEvents "on the
1005/// stack" as if they were value objects by keeping a cache of CallEvent-sized
1006/// memory blocks. The CallEvents created by CallEventManager are only valid
1007/// for the lifetime of the OwnedCallEvent that holds them; right now these
1008/// objects cannot be copied and ownership cannot be transferred.
1009class CallEventManager {
friend class CallEvent;

llvm::BumpPtrAllocator &Alloc;
SmallVector<void *, 8> Cache;

using CallEventTemplateTy = SimpleFunctionCall;

void reclaim(const void *Memory) {
  Cache.push_back(const_cast<void *>(Memory));
}

/// Returns memory that can be initialized as a CallEvent.
void *allocate() {
  if (Cache.empty())
    return Alloc.Allocate<CallEventTemplateTy>();
  else
    return Cache.pop_back_val();
}

template <typename T, typename Arg>
T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
                "CallEvent subclasses are not all the same size");
  return new (allocate()) T(A, St, LCtx);
}

template <typename T, typename Arg1, typename Arg2>
T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
                "CallEvent subclasses are not all the same size");
  return new (allocate()) T(A1, A2, St, LCtx);
}

template <typename T, typename Arg1, typename Arg2, typename Arg3>
T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
          const LocationContext *LCtx) {
  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
                "CallEvent subclasses are not all the same size");
  return new (allocate()) T(A1, A2, A3, St, LCtx);
}

template <typename T, typename Arg1, typename Arg2, typename Arg3,
          typename Arg4>
T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
          const LocationContext *LCtx) {
  static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
                "CallEvent subclasses are not all the same size");
  return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
}

1060public:
CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}

CallEventRef<>
getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);

CallEventRef<>
getSimpleCall(const CallExpr *E, ProgramStateRef State,
              const LocationContext *LCtx);

CallEventRef<ObjCMethodCall>
getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
                  const LocationContext *LCtx) {
  return create<ObjCMethodCall>(E, State, LCtx);
}

CallEventRef<CXXConstructorCall>
getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
                      ProgramStateRef State, const LocationContext *LCtx) {
  return create<CXXConstructorCall>(E, Target, State, LCtx);
}

CallEventRef<CXXDestructorCall>
getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
                     const MemRegion *Target, bool IsBase,
                     ProgramStateRef State, const LocationContext *LCtx) {
  return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
}

CallEventRef<CXXAllocatorCall>
getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
                    const LocationContext *LCtx) {
  return create<CXXAllocatorCall>(E, State, LCtx);
}
1094};

1096template <typename T>
1097CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
assert(isa<T>(*this) && "Cloning to unrelated type")(static_cast <bool> (isa<T>(*this) && "Cloning to unrelated type"
) ? void (0) : __assert_fail ("isa<T>(*this) && \"Cloning to unrelated type\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 1098, __extension__ __PRETTY_FUNCTION__));
static_assert(sizeof(T) == sizeof(CallEvent),
              "Subclasses may not add fields");

if (NewState == State)
  return cast<T>(this);

CallEventManager &Mgr = State->getStateManager().getCallEventManager();
T *Copy = static_cast<T *>(Mgr.allocate());
cloneTo(Copy);
assert(Copy->getKind() == this->getKind() && "Bad copy")(static_cast <bool> (Copy->getKind() == this->getKind
() && "Bad copy") ? void (0) : __assert_fail ("Copy->getKind() == this->getKind() && \"Bad copy\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 1108, __extension__ __PRETTY_FUNCTION__));

Copy->State = NewState;
return Copy;
1112}

1114inline void CallEvent::Release() const {
assert(RefCount > 0 && "Reference count is already zero.")(static_cast <bool> (RefCount > 0 && "Reference count is already zero."
) ? void (0) : __assert_fail ("RefCount > 0 && \"Reference count is already zero.\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
, 1115, __extension__ __PRETTY_FUNCTION__));
--RefCount;

if (RefCount > 0)
  return;

CallEventManager &Mgr = State->getStateManager().getCallEventManager();
Mgr.reclaim(this);

this->~CallEvent();
1125}

1127} // namespace ento

1129} // namespace clang

1131namespace llvm {

1133// Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1134template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
using SimpleType = const T *;

static SimpleType
getSimplifiedValue(clang::ento::CallEventRef<T> Val) {
  return Val.get();
}
1141};

1143} // namespace llvm

1145#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H

←

/build/llvm-toolchain-snapshot-7~svn326551/include/llvm/ADT/IntrusiveRefCntPtr.h

1//==- llvm/ADT/IntrusiveRefCntPtr.h - Smart Refcounting Pointer --*- C++ -*-==//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10// This file defines the RefCountedBase, ThreadSafeRefCountedBase, and
11// IntrusiveRefCntPtr classes.
12//
13// IntrusiveRefCntPtr is a smart pointer to an object which maintains a
14// reference count.  (ThreadSafe)RefCountedBase is a mixin class that adds a
15// refcount member variable and methods for updating the refcount.  An object
16// that inherits from (ThreadSafe)RefCountedBase deletes itself when its
17// refcount hits zero.
18//
19// For example:
20//
21//   class MyClass : public RefCountedBase<MyClass> {};
22//
23//   void foo() {
24//     // Constructing an IntrusiveRefCntPtr increases the pointee's refcount by
25//     // 1 (from 0 in this case).
26//     IntrusiveRefCntPtr<MyClass> Ptr1(new MyClass());
27//
28//     // Copying an IntrusiveRefCntPtr increases the pointee's refcount by 1.
29//     IntrusiveRefCntPtr<MyClass> Ptr2(Ptr1);
30//
31//     // Constructing an IntrusiveRefCntPtr has no effect on the object's
32//     // refcount.  After a move, the moved-from pointer is null.
33//     IntrusiveRefCntPtr<MyClass> Ptr3(std::move(Ptr1));
34//     assert(Ptr1 == nullptr);
35//
36//     // Clearing an IntrusiveRefCntPtr decreases the pointee's refcount by 1.
37//     Ptr2.reset();
38//
39//     // The object deletes itself when we return from the function, because
40//     // Ptr3's destructor decrements its refcount to 0.
41//   }
42//
43// You can use IntrusiveRefCntPtr with isa<T>(), dyn_cast<T>(), etc.:
44//
45//   IntrusiveRefCntPtr<MyClass> Ptr(new MyClass());
46//   OtherClass *Other = dyn_cast<OtherClass>(Ptr);  // Ptr.get() not required
47//
48// IntrusiveRefCntPtr works with any class that
49//
50//  - inherits from (ThreadSafe)RefCountedBase,
51//  - has Retain() and Release() methods, or
52//  - specializes IntrusiveRefCntPtrInfo.
53//
54//===----------------------------------------------------------------------===//
55 
56#ifndef LLVM_ADT_INTRUSIVEREFCNTPTR_H
57#define LLVM_ADT_INTRUSIVEREFCNTPTR_H
58 
59#include <atomic>
60#include <cassert>
61#include <cstddef>
62 
63namespace llvm {
64 
65/// A CRTP mixin class that adds reference counting to a type.
66///
67/// The lifetime of an object which inherits from RefCountedBase is managed by
68/// calls to Release() and Retain(), which increment and decrement the object's
69/// refcount, respectively.  When a Release() call decrements the refcount to 0,
70/// the object deletes itself.
71template <class Derived> class RefCountedBase {
72  mutable unsigned RefCount = 0;
73 
74public:
75  RefCountedBase() = default;
76  RefCountedBase(const RefCountedBase &) {}
77 
78  void Retain() const { ++RefCount; }
79 
80  void Release() const {
81    assert(RefCount > 0 && "Reference count is already zero.")(static_cast <bool> (RefCount > 0 && "Reference count is already zero."
) ? void (0) : __assert_fail ("RefCount > 0 && \"Reference count is already zero.\""
, "/build/llvm-toolchain-snapshot-7~svn326551/include/llvm/ADT/IntrusiveRefCntPtr.h"
, 81, __extension__ __PRETTY_FUNCTION__));
82    if (--RefCount == 0)
83      delete static_cast<const Derived *>(this);
84  }
85};
86 
87/// A thread-safe version of \c RefCountedBase.
88template <class Derived> class ThreadSafeRefCountedBase {
89  mutable std::atomic<int> RefCount;
90 
91protected:
92  ThreadSafeRefCountedBase() : RefCount(0) {}
93 
94public:
95  void Retain() const { RefCount.fetch_add(1, std::memory_order_relaxed); }
96 
97  void Release() const {
98    int NewRefCount = RefCount.fetch_sub(1, std::memory_order_acq_rel) - 1;
99    assert(NewRefCount >= 0 && "Reference count was already zero.")(static_cast <bool> (NewRefCount >= 0 && "Reference count was already zero."
) ? void (0) : __assert_fail ("NewRefCount >= 0 && \"Reference count was already zero.\""
, "/build/llvm-toolchain-snapshot-7~svn326551/include/llvm/ADT/IntrusiveRefCntPtr.h"
, 99, __extension__ __PRETTY_FUNCTION__));
100    if (NewRefCount == 0)
101      delete static_cast<const Derived *>(this);
102  }
103};
104 
105/// Class you can specialize to provide custom retain/release functionality for
106/// a type.
107///
108/// Usually specializing this class is not necessary, as IntrusiveRefCntPtr
109/// works with any type which defines Retain() and Release() functions -- you
110/// can define those functions yourself if RefCountedBase doesn't work for you.
111///
112/// One case when you might want to specialize this type is if you have
113///  - Foo.h defines type Foo and includes Bar.h, and
114///  - Bar.h uses IntrusiveRefCntPtr<Foo> in inline functions.
115///
116/// Because Foo.h includes Bar.h, Bar.h can't include Foo.h in order to pull in
117/// the declaration of Foo.  Without the declaration of Foo, normally Bar.h
118/// wouldn't be able to use IntrusiveRefCntPtr<Foo>, which wants to call
119/// T::Retain and T::Release.
120///
121/// To resolve this, Bar.h could include a third header, FooFwd.h, which
122/// forward-declares Foo and specializes IntrusiveRefCntPtrInfo<Foo>.  Then
123/// Bar.h could use IntrusiveRefCntPtr<Foo>, although it still couldn't call any
124/// functions on Foo itself, because Foo would be an incomplete type.
125template <typename T> struct IntrusiveRefCntPtrInfo {
126  static void retain(T *obj) { obj->Retain(); }
127  static void release(T *obj) { obj->Release(); }
128};
129 
130/// A smart pointer to a reference-counted object that inherits from
131/// RefCountedBase or ThreadSafeRefCountedBase.
132///
133/// This class increments its pointee's reference count when it is created, and
134/// decrements its refcount when it's destroyed (or is changed to point to a
135/// different object).
136template <typename T> class IntrusiveRefCntPtr {
137  T *Obj = nullptr;
138 
139public:
140  using element_type = T;
141 
142  explicit IntrusiveRefCntPtr() = default;
143  IntrusiveRefCntPtr(T *obj) : Obj(obj) { retain(); }
144  IntrusiveRefCntPtr(const IntrusiveRefCntPtr &S) : Obj(S.Obj) { retain(); }
4
←
Null pointer value stored to 'Call.Obj'→
145  IntrusiveRefCntPtr(IntrusiveRefCntPtr &&S) : Obj(S.Obj) { S.Obj = nullptr; }
146 
147  template <class X>
148  IntrusiveRefCntPtr(IntrusiveRefCntPtr<X> &&S) : Obj(S.get()) {
149    S.Obj = nullptr;
150  }
151 
152  template <class X>
153  IntrusiveRefCntPtr(const IntrusiveRefCntPtr<X> &S) : Obj(S.get()) {
154    retain();
155  }
156 
157  ~IntrusiveRefCntPtr() { release(); }
158 
159  IntrusiveRefCntPtr &operator=(IntrusiveRefCntPtr S) {
160    swap(S);
161    return *this;
162  }
163 
164  T &operator*() const { return *Obj; }
8
←
Returning null reference
165  T *operator->() const { return Obj; }
166  T *get() const { return Obj; }
167  explicit operator bool() const { return Obj; }
168 
169  void swap(IntrusiveRefCntPtr &other) {
170    T *tmp = other.Obj;
171    other.Obj = Obj;
172    Obj = tmp;
173  }
174 
175  void reset() {
176    release();
177    Obj = nullptr;
178  }
179 
180  void resetWithoutRelease() { Obj = nullptr; }
181 
182private:
183  void retain() {
184    if (Obj)
185      IntrusiveRefCntPtrInfo<T>::retain(Obj);
186  }
187 
188  void release() {
189    if (Obj)
190      IntrusiveRefCntPtrInfo<T>::release(Obj);
191  }
192 
193  template <typename X> friend class IntrusiveRefCntPtr;
194};
195 
196template <class T, class U>
197inline bool operator==(const IntrusiveRefCntPtr<T> &A,
198                       const IntrusiveRefCntPtr<U> &B) {
199  return A.get() == B.get();
200}
201 
202template <class T, class U>
203inline bool operator!=(const IntrusiveRefCntPtr<T> &A,
204                       const IntrusiveRefCntPtr<U> &B) {
205  return A.get() != B.get();
206}
207 
208template <class T, class U>
209inline bool operator==(const IntrusiveRefCntPtr<T> &A, U *B) {
210  return A.get() == B;
211}
212 
213template <class T, class U>
214inline bool operator!=(const IntrusiveRefCntPtr<T> &A, U *B) {
215  return A.get() != B;
216}
217 
218template <class T, class U>
219inline bool operator==(T *A, const IntrusiveRefCntPtr<U> &B) {
220  return A == B.get();
221}
222 
223template <class T, class U>
224inline bool operator!=(T *A, const IntrusiveRefCntPtr<U> &B) {
225  return A != B.get();
226}
227 
228template <class T>
229bool operator==(std::nullptr_t A, const IntrusiveRefCntPtr<T> &B) {
230  return !B;
231}
232 
233template <class T>
234bool operator==(const IntrusiveRefCntPtr<T> &A, std::nullptr_t B) {
235  return B == A;
236}
237 
238template <class T>
239bool operator!=(std::nullptr_t A, const IntrusiveRefCntPtr<T> &B) {
240  return !(A == B);
241}
242 
243template <class T>
244bool operator!=(const IntrusiveRefCntPtr<T> &A, std::nullptr_t B) {
245  return !(A == B);
246}
247 
248// Make IntrusiveRefCntPtr work with dyn_cast, isa, and the other idioms from
249// Casting.h.
250template <typename From> struct simplify_type;
251 
252template <class T> struct simplify_type<IntrusiveRefCntPtr<T>> {
253  using SimpleType = T *;
254 
255  static SimpleType getSimplifiedValue(IntrusiveRefCntPtr<T> &Val) {
256    return Val.get();
257  }
258};
259 
260template <class T> struct simplify_type<const IntrusiveRefCntPtr<T>> {
261  using SimpleType = /*const*/ T *;
262 
263  static SimpleType getSimplifiedValue(const IntrusiveRefCntPtr<T> &Val) {
264    return Val.get();
265  }
266};
267 
268} // end namespace llvm
269 
270#endif // LLVM_ADT_INTRUSIVEREFCNTPTR_H