/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp

Bug Summary

File:	tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
Warning:	line 1263, column 13 Called C++ object pointer is null
Annotated Source Code

Press '?' to see keyboard shortcuts
Show analyzer invocation
clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name MemRegion.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-eagerly-assume -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model pic -pic-level 2 -mthread-model posix -relaxed-aliasing -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -momit-leaf-frame-pointer -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-7/lib/clang/7.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core -I /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/include -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/include -I /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/include -I /build/llvm-toolchain-snapshot-7~svn326551/include -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0/backward -internal-isystem /usr/include/clang/7.0.0/include/ -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-7/lib/clang/7.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-7~svn326551/build-llvm/tools/clang/lib/StaticAnalyzer/Core -ferror-limit 19 -fmessage-length 0 -fvisibility-inlines-hidden -fobjc-runtime=gcc -fno-common -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -o /tmp/scan-build-2018-03-02-155150-1477-1 -x c++ /build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
1//== MemRegion.cpp - Abstract memory regions for static analysis --*- C++ -*--//
2//
3//                     The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
10//  This file defines MemRegion and its subclasses.  MemRegion defines a
11//  partially-typed abstraction of memory useful for path-sensitive dataflow
12//  analyses.
13//
14//===----------------------------------------------------------------------===//

16#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
17#include "clang/AST/Attr.h"
18#include "clang/AST/CharUnits.h"
19#include "clang/AST/DeclObjC.h"
20#include "clang/AST/RecordLayout.h"
21#include "clang/Analysis/AnalysisDeclContext.h"
22#include "clang/Analysis/Support/BumpVector.h"
23#include "clang/Basic/SourceManager.h"
24#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
25#include "llvm/Support/raw_ostream.h"
26#include "llvm/Support/Debug.h"

28#include<functional>

30#define DEBUG_TYPE"MemRegion" "MemRegion"

32using namespace clang;
33using namespace ento;

35//===----------------------------------------------------------------------===//
36// MemRegion Construction.
37//===----------------------------------------------------------------------===//

39template <typename RegionTy, typename SuperTy, typename Arg1Ty>
40RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1,
                                       const SuperTy *superRegion) {
llvm::FoldingSetNodeID ID;
RegionTy::ProfileRegion(ID, arg1, superRegion);
void *InsertPos;
RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
                                                                 InsertPos));

if (!R) {
  R = A.Allocate<RegionTy>();
  new (R) RegionTy(arg1, superRegion);
  Regions.InsertNode(R, InsertPos);
}

return R;
55}

57template <typename RegionTy, typename SuperTy, typename Arg1Ty, typename Arg2Ty>
58RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
                                       const SuperTy *superRegion) {
llvm::FoldingSetNodeID ID;
RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
void *InsertPos;
RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
                                                                 InsertPos));

if (!R) {
  R = A.Allocate<RegionTy>();
  new (R) RegionTy(arg1, arg2, superRegion);
  Regions.InsertNode(R, InsertPos);
}

return R;
73}

75template <typename RegionTy, typename SuperTy,
        typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
77RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
                                       const Arg3Ty arg3,
                                       const SuperTy *superRegion) {
llvm::FoldingSetNodeID ID;
RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
void *InsertPos;
RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
                                                                 InsertPos));

if (!R) {
  R = A.Allocate<RegionTy>();
  new (R) RegionTy(arg1, arg2, arg3, superRegion);
  Regions.InsertNode(R, InsertPos);
}

return R;
93}

95//===----------------------------------------------------------------------===//
96// Object destruction.
97//===----------------------------------------------------------------------===//

99MemRegion::~MemRegion() {}

101MemRegionManager::~MemRegionManager() {
// All regions and their data are BumpPtrAllocated.  No need to call
// their destructors.
104}

106//===----------------------------------------------------------------------===//
107// Basic methods.
108//===----------------------------------------------------------------------===//

110bool SubRegion::isSubRegionOf(const MemRegion* R) const {
const MemRegion* r = this;
do {
  if (r == R)
    return true;
  if (const SubRegion* sr = dyn_cast<SubRegion>(r))
    r = sr->getSuperRegion();
  else
    break;
} while (r != nullptr);
return false;
121}

123MemRegionManager* SubRegion::getMemRegionManager() const {
const SubRegion* r = this;
do {
  const MemRegion *superRegion = r->getSuperRegion();
  if (const SubRegion *sr = dyn_cast<SubRegion>(superRegion)) {
    r = sr;
    continue;
  }
  return superRegion->getMemRegionManager();
} while (1);
133}

135const StackFrameContext *VarRegion::getStackFrame() const {
const StackSpaceRegion *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
return SSR ? SSR->getStackFrame() : nullptr;
138}

140//===----------------------------------------------------------------------===//
141// Region extents.
142//===----------------------------------------------------------------------===//

144DefinedOrUnknownSVal TypedValueRegion::getExtent(SValBuilder &svalBuilder) const {
ASTContext &Ctx = svalBuilder.getContext();
QualType T = getDesugaredValueType(Ctx);

if (isa<VariableArrayType>(T))
  return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
if (T->isIncompleteType())
  return UnknownVal();

CharUnits size = Ctx.getTypeSizeInChars(T);
QualType sizeTy = svalBuilder.getArrayIndexType();
return svalBuilder.makeIntVal(size.getQuantity(), sizeTy);
156}

158DefinedOrUnknownSVal FieldRegion::getExtent(SValBuilder &svalBuilder) const {
// Force callers to deal with bitfields explicitly.
if (getDecl()->isBitField())
  return UnknownVal();

DefinedOrUnknownSVal Extent = DeclRegion::getExtent(svalBuilder);

// A zero-length array at the end of a struct often stands for dynamically-
// allocated extra memory.
if (Extent.isZeroConstant()) {
  QualType T = getDesugaredValueType(svalBuilder.getContext());

  if (isa<ConstantArrayType>(T))
    return UnknownVal();
}

return Extent;
175}

177DefinedOrUnknownSVal AllocaRegion::getExtent(SValBuilder &svalBuilder) const {
return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
179}

181DefinedOrUnknownSVal SymbolicRegion::getExtent(SValBuilder &svalBuilder) const {
return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
183}

185DefinedOrUnknownSVal StringRegion::getExtent(SValBuilder &svalBuilder) const {
return svalBuilder.makeIntVal(getStringLiteral()->getByteLength()+1,
                              svalBuilder.getArrayIndexType());
188}

190ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg)
  : DeclRegion(ivd, sReg, ObjCIvarRegionKind) {}

193const ObjCIvarDecl *ObjCIvarRegion::getDecl() const {
return cast<ObjCIvarDecl>(D);
195}

197QualType ObjCIvarRegion::getValueType() const {
return getDecl()->getType();
199}

201QualType CXXBaseObjectRegion::getValueType() const {
return QualType(getDecl()->getTypeForDecl(), 0);
203}

205//===----------------------------------------------------------------------===//
206// FoldingSet profiling.
207//===----------------------------------------------------------------------===//

209void MemSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
ID.AddInteger(static_cast<unsigned>(getKind()));
211}

213void StackSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
ID.AddInteger(static_cast<unsigned>(getKind()));
ID.AddPointer(getStackFrame());
216}

218void StaticGlobalSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
ID.AddInteger(static_cast<unsigned>(getKind()));
ID.AddPointer(getCodeRegion());
221}

223void StringRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                               const StringLiteral* Str,
                               const MemRegion* superRegion) {
ID.AddInteger(static_cast<unsigned>(StringRegionKind));
ID.AddPointer(Str);
ID.AddPointer(superRegion);
229}

231void ObjCStringRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                   const ObjCStringLiteral* Str,
                                   const MemRegion* superRegion) {
ID.AddInteger(static_cast<unsigned>(ObjCStringRegionKind));
ID.AddPointer(Str);
ID.AddPointer(superRegion);
237}

239void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                               const Expr *Ex, unsigned cnt,
                               const MemRegion *superRegion) {
ID.AddInteger(static_cast<unsigned>(AllocaRegionKind));
ID.AddPointer(Ex);
ID.AddInteger(cnt);
ID.AddPointer(superRegion);
246}

248void AllocaRegion::Profile(llvm::FoldingSetNodeID& ID) const {
ProfileRegion(ID, Ex, Cnt, superRegion);
250}

252void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID& ID) const {
CompoundLiteralRegion::ProfileRegion(ID, CL, superRegion);
254}

256void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                        const CompoundLiteralExpr *CL,
                                        const MemRegion* superRegion) {
ID.AddInteger(static_cast<unsigned>(CompoundLiteralRegionKind));
ID.AddPointer(CL);
ID.AddPointer(superRegion);
262}

264void CXXThisRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                const PointerType *PT,
                                const MemRegion *sRegion) {
ID.AddInteger(static_cast<unsigned>(CXXThisRegionKind));
ID.AddPointer(PT);
ID.AddPointer(sRegion);
270}

272void CXXThisRegion::Profile(llvm::FoldingSetNodeID &ID) const {
CXXThisRegion::ProfileRegion(ID, ThisPointerTy, superRegion);
274}

276void ObjCIvarRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                 const ObjCIvarDecl *ivd,
                                 const MemRegion* superRegion) {
DeclRegion::ProfileRegion(ID, ivd, superRegion, ObjCIvarRegionKind);
280}

282void DeclRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl *D,
                             const MemRegion* superRegion, Kind k) {
ID.AddInteger(static_cast<unsigned>(k));
ID.AddPointer(D);
ID.AddPointer(superRegion);
287}

289void DeclRegion::Profile(llvm::FoldingSetNodeID& ID) const {
DeclRegion::ProfileRegion(ID, D, superRegion, getKind());
291}

293void VarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
VarRegion::ProfileRegion(ID, getDecl(), superRegion);
295}

297void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym,
                                 const MemRegion *sreg) {
ID.AddInteger(static_cast<unsigned>(MemRegion::SymbolicRegionKind));
ID.Add(sym);
ID.AddPointer(sreg);
302}

304void SymbolicRegion::Profile(llvm::FoldingSetNodeID& ID) const {
SymbolicRegion::ProfileRegion(ID, sym, getSuperRegion());
306}

308void ElementRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                QualType ElementType, SVal Idx,
                                const MemRegion* superRegion) {
ID.AddInteger(MemRegion::ElementRegionKind);
ID.Add(ElementType);
ID.AddPointer(superRegion);
Idx.Profile(ID);
315}

317void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
ElementRegion::ProfileRegion(ID, ElementType, Index, superRegion);
319}

321void FunctionCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                     const NamedDecl *FD,
                                     const MemRegion*) {
ID.AddInteger(MemRegion::FunctionCodeRegionKind);
ID.AddPointer(FD);
326}

328void FunctionCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
FunctionCodeRegion::ProfileRegion(ID, FD, superRegion);
330}

332void BlockCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                  const BlockDecl *BD, CanQualType,
                                  const AnalysisDeclContext *AC,
                                  const MemRegion*) {
ID.AddInteger(MemRegion::BlockCodeRegionKind);
ID.AddPointer(BD);
338}

340void BlockCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
BlockCodeRegion::ProfileRegion(ID, BD, locTy, AC, superRegion);
342}

344void BlockDataRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
                                  const BlockCodeRegion *BC,
                                  const LocationContext *LC,
                                  unsigned BlkCount,
                                  const MemRegion *sReg) {
ID.AddInteger(MemRegion::BlockDataRegionKind);
ID.AddPointer(BC);
ID.AddPointer(LC);
ID.AddInteger(BlkCount);
ID.AddPointer(sReg);
354}

356void BlockDataRegion::Profile(llvm::FoldingSetNodeID& ID) const {
BlockDataRegion::ProfileRegion(ID, BC, LC, BlockCount, getSuperRegion());
358}

360void CXXTempObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                      Expr const *Ex,
                                      const MemRegion *sReg) {
ID.AddPointer(Ex);
ID.AddPointer(sReg);
365}

367void CXXTempObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
ProfileRegion(ID, Ex, getSuperRegion());
369}

371void CXXBaseObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
                                      const CXXRecordDecl *RD,
                                      bool IsVirtual,
                                      const MemRegion *SReg) {
ID.AddPointer(RD);
ID.AddBoolean(IsVirtual);
ID.AddPointer(SReg);
378}

380void CXXBaseObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
ProfileRegion(ID, getDecl(), isVirtual(), superRegion);
382}

384//===----------------------------------------------------------------------===//
385// Region anchors.
386//===----------------------------------------------------------------------===//

388void GlobalsSpaceRegion::anchor() { }
389void NonStaticGlobalSpaceRegion::anchor() { }
390void StackSpaceRegion::anchor() { }
391void TypedRegion::anchor() { }
392void TypedValueRegion::anchor() { }
393void CodeTextRegion::anchor() { }
394void SubRegion::anchor() { }

396//===----------------------------------------------------------------------===//
397// Region pretty-printing.
398//===----------------------------------------------------------------------===//

400LLVM_DUMP_METHOD__attribute__((noinline)) __attribute__((__used__)) void MemRegion::dump() const {
dumpToStream(llvm::errs());
402}

404std::string MemRegion::getString() const {
std::string s;
llvm::raw_string_ostream os(s);
dumpToStream(os);
return os.str();
409}

411void MemRegion::dumpToStream(raw_ostream &os) const {
os << "<Unknown Region>";
413}

415void AllocaRegion::dumpToStream(raw_ostream &os) const {
os << "alloca{" << static_cast<const void*>(Ex) << ',' << Cnt << '}';
417}

419void FunctionCodeRegion::dumpToStream(raw_ostream &os) const {
os << "code{" << getDecl()->getDeclName().getAsString() << '}';
421}

423void BlockCodeRegion::dumpToStream(raw_ostream &os) const {
os << "block_code{" << static_cast<const void*>(this) << '}';
425}

427void BlockDataRegion::dumpToStream(raw_ostream &os) const {
os << "block_data{" << BC;
os << "; ";
for (BlockDataRegion::referenced_vars_iterator
       I = referenced_vars_begin(),
       E = referenced_vars_end(); I != E; ++I)
  os << "(" << I.getCapturedRegion() << "," <<
               I.getOriginalRegion() << ") ";
os << '}';
436}

438void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
// FIXME: More elaborate pretty-printing.
os << "{ " << static_cast<const void*>(CL) <<  " }";
441}

443void CXXTempObjectRegion::dumpToStream(raw_ostream &os) const {
os << "temp_object{" << getValueType().getAsString() << ','
   << static_cast<const void*>(Ex) << '}';
446}

448void CXXBaseObjectRegion::dumpToStream(raw_ostream &os) const {
os << "base{" << superRegion << ',' << getDecl()->getName() << '}';
450}

452void CXXThisRegion::dumpToStream(raw_ostream &os) const {
os << "this";
454}

456void ElementRegion::dumpToStream(raw_ostream &os) const {
os << "element{" << superRegion << ','
   << Index << ',' << getElementType().getAsString() << '}';
459}

461void FieldRegion::dumpToStream(raw_ostream &os) const {
os << superRegion << "->" << *getDecl();
463}

465void ObjCIvarRegion::dumpToStream(raw_ostream &os) const {
os << "ivar{" << superRegion << ',' << *getDecl() << '}';
467}

469void StringRegion::dumpToStream(raw_ostream &os) const {
assert(Str != nullptr && "Expecting non-null StringLiteral")(static_cast <bool> (Str != nullptr && "Expecting non-null StringLiteral"
) ? void (0) : __assert_fail ("Str != nullptr && \"Expecting non-null StringLiteral\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 470, __extension__ __PRETTY_FUNCTION__));
Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
472}

474void ObjCStringRegion::dumpToStream(raw_ostream &os) const {
assert(Str != nullptr && "Expecting non-null ObjCStringLiteral")(static_cast <bool> (Str != nullptr && "Expecting non-null ObjCStringLiteral"
) ? void (0) : __assert_fail ("Str != nullptr && \"Expecting non-null ObjCStringLiteral\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 475, __extension__ __PRETTY_FUNCTION__));
Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
477}

479void SymbolicRegion::dumpToStream(raw_ostream &os) const {
if (isa<HeapSpaceRegion>(getSuperRegion()))
  os << "Heap";
os << "SymRegion{" << sym << '}';
483}

485void VarRegion::dumpToStream(raw_ostream &os) const {
os << *cast<VarDecl>(D);
487}

489LLVM_DUMP_METHOD__attribute__((noinline)) __attribute__((__used__)) void RegionRawOffset::dump() const {
dumpToStream(llvm::errs());
491}

493void RegionRawOffset::dumpToStream(raw_ostream &os) const {
os << "raw_offset{" << getRegion() << ',' << getOffset().getQuantity() << '}';
495}

497void CodeSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "CodeSpaceRegion";
499}

501void StaticGlobalSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "StaticGlobalsMemSpace{" << CR << '}';
503}

505void GlobalInternalSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "GlobalInternalSpaceRegion";
507}

509void GlobalSystemSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "GlobalSystemSpaceRegion";
511}

513void GlobalImmutableSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "GlobalImmutableSpaceRegion";
515}

517void HeapSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "HeapSpaceRegion";
519}

521void UnknownSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "UnknownSpaceRegion";
523}

525void StackArgumentsSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "StackArgumentsSpaceRegion";
527}

529void StackLocalsSpaceRegion::dumpToStream(raw_ostream &os) const {
os << "StackLocalsSpaceRegion";
531}

533bool MemRegion::canPrintPretty() const {
return canPrintPrettyAsExpr();
535}

537bool MemRegion::canPrintPrettyAsExpr() const {
return false;
539}

541void MemRegion::printPretty(raw_ostream &os) const {
assert(canPrintPretty() && "This region cannot be printed pretty.")(static_cast <bool> (canPrintPretty() && "This region cannot be printed pretty."
) ? void (0) : __assert_fail ("canPrintPretty() && \"This region cannot be printed pretty.\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 542, __extension__ __PRETTY_FUNCTION__));
os << "'";
printPrettyAsExpr(os);
os << "'";
546}

548void MemRegion::printPrettyAsExpr(raw_ostream &os) const {
llvm_unreachable("This region cannot be printed pretty.")::llvm::llvm_unreachable_internal("This region cannot be printed pretty."
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 549);
550}

552bool VarRegion::canPrintPrettyAsExpr() const {
return true;
554}

556void VarRegion::printPrettyAsExpr(raw_ostream &os) const {
os << getDecl()->getName();
558}

560bool ObjCIvarRegion::canPrintPrettyAsExpr() const {
return true;
562}

564void ObjCIvarRegion::printPrettyAsExpr(raw_ostream &os) const {
os << getDecl()->getName();
566}

568bool FieldRegion::canPrintPretty() const {
return true;
570}

572bool FieldRegion::canPrintPrettyAsExpr() const {
return superRegion->canPrintPrettyAsExpr();
574}

576void FieldRegion::printPrettyAsExpr(raw_ostream &os) const {
assert(canPrintPrettyAsExpr())(static_cast <bool> (canPrintPrettyAsExpr()) ? void (0)
 : __assert_fail ("canPrintPrettyAsExpr()", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 577, __extension__ __PRETTY_FUNCTION__));
superRegion->printPrettyAsExpr(os);
os << "." << getDecl()->getName();
580}

582void FieldRegion::printPretty(raw_ostream &os) const {
if (canPrintPrettyAsExpr()) {
  os << "\'";
  printPrettyAsExpr(os);
  os << "'";
} else {
  os << "field " << "\'" << getDecl()->getName() << "'";
}
590}

592bool CXXBaseObjectRegion::canPrintPrettyAsExpr() const {
return superRegion->canPrintPrettyAsExpr();
594}

596void CXXBaseObjectRegion::printPrettyAsExpr(raw_ostream &os) const {
superRegion->printPrettyAsExpr(os);
598}

600std::string MemRegion::getDescriptiveName(bool UseQuotes) const {
std::string VariableName;
std::string ArrayIndices;
const MemRegion *R = this;
SmallString<50> buf;
llvm::raw_svector_ostream os(buf);

// Obtain array indices to add them to the variable name.
const ElementRegion *ER = nullptr;
while ((ER = R->getAs<ElementRegion>())) {
  // Index is a ConcreteInt.
  if (auto CI = ER->getIndex().getAs<nonloc::ConcreteInt>()) {
    llvm::SmallString<2> Idx;
    CI->getValue().toString(Idx);
    ArrayIndices = (llvm::Twine("[") + Idx.str() + "]" + ArrayIndices).str();
  }
  // If not a ConcreteInt, try to obtain the variable
  // name by calling 'getDescriptiveName' recursively.
  else {
    std::string Idx = ER->getDescriptiveName(false);
    if (!Idx.empty()) {
      ArrayIndices = (llvm::Twine("[") + Idx + "]" + ArrayIndices).str();
    }
  }
  R = ER->getSuperRegion();
}

// Get variable name.
if (R && R->canPrintPrettyAsExpr()) {
  R->printPrettyAsExpr(os);
  if (UseQuotes) {
    return (llvm::Twine("'") + os.str() + ArrayIndices + "'").str();
  } else {
    return (llvm::Twine(os.str()) + ArrayIndices).str();
  }
}

return VariableName;
638}

640SourceRange MemRegion::sourceRange() const {
const VarRegion *const VR = dyn_cast<VarRegion>(this->getBaseRegion());
const FieldRegion *const FR = dyn_cast<FieldRegion>(this);

// Check for more specific regions first.
// FieldRegion
if (FR) {
  return FR->getDecl()->getSourceRange();
}
// VarRegion
else if (VR) {
  return VR->getDecl()->getSourceRange();
}
// Return invalid source range (can be checked by client).
else {
  return SourceRange{};
}
657}

659//===----------------------------------------------------------------------===//
660// MemRegionManager methods.
661//===----------------------------------------------------------------------===//

663template <typename REG>
664const REG *MemRegionManager::LazyAllocate(REG*& region) {
if (!region) {
  region = A.Allocate<REG>();
  new (region) REG(this);
}

return region;
671}

673template <typename REG, typename ARG>
674const REG *MemRegionManager::LazyAllocate(REG*& region, ARG a) {
if (!region) {
  region = A.Allocate<REG>();
  new (region) REG(this, a);
}

return region;
681}

683const StackLocalsSpaceRegion*
684MemRegionManager::getStackLocalsRegion(const StackFrameContext *STC) {
assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 685, __extension__ __PRETTY_FUNCTION__));
StackLocalsSpaceRegion *&R = StackLocalsSpaceRegions[STC];

if (R)
  return R;

R = A.Allocate<StackLocalsSpaceRegion>();
new (R) StackLocalsSpaceRegion(this, STC);
return R;
694}

696const StackArgumentsSpaceRegion *
697MemRegionManager::getStackArgumentsRegion(const StackFrameContext *STC) {
assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 698, __extension__ __PRETTY_FUNCTION__));
StackArgumentsSpaceRegion *&R = StackArgumentsSpaceRegions[STC];

if (R)
  return R;

R = A.Allocate<StackArgumentsSpaceRegion>();
new (R) StackArgumentsSpaceRegion(this, STC);
return R;
707}

709const GlobalsSpaceRegion
710*MemRegionManager::getGlobalsRegion(MemRegion::Kind K,
                                  const CodeTextRegion *CR) {
if (!CR) {
  if (K == MemRegion::GlobalSystemSpaceRegionKind)
    return LazyAllocate(SystemGlobals);
  if (K == MemRegion::GlobalImmutableSpaceRegionKind)
    return LazyAllocate(ImmutableGlobals);
  assert(K == MemRegion::GlobalInternalSpaceRegionKind)(static_cast <bool> (K == MemRegion::GlobalInternalSpaceRegionKind
) ? void (0) : __assert_fail ("K == MemRegion::GlobalInternalSpaceRegionKind"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 717, __extension__ __PRETTY_FUNCTION__));
  return LazyAllocate(InternalGlobals);
}

assert(K == MemRegion::StaticGlobalSpaceRegionKind)(static_cast <bool> (K == MemRegion::StaticGlobalSpaceRegionKind
) ? void (0) : __assert_fail ("K == MemRegion::StaticGlobalSpaceRegionKind"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 721, __extension__ __PRETTY_FUNCTION__));
StaticGlobalSpaceRegion *&R = StaticsGlobalSpaceRegions[CR];
if (R)
  return R;

R = A.Allocate<StaticGlobalSpaceRegion>();
new (R) StaticGlobalSpaceRegion(this, CR);
return R;
729}

731const HeapSpaceRegion *MemRegionManager::getHeapRegion() {
return LazyAllocate(heap);
733}

735const UnknownSpaceRegion *MemRegionManager::getUnknownRegion() {
return LazyAllocate(unknown);
737}

739const CodeSpaceRegion *MemRegionManager::getCodeRegion() {
return LazyAllocate(code);
741}

743//===----------------------------------------------------------------------===//
744// Constructing regions.
745//===----------------------------------------------------------------------===//
746const StringRegion* MemRegionManager::getStringRegion(const StringLiteral* Str){
return getSubRegion<StringRegion>(
    Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
749}

751const ObjCStringRegion *
752MemRegionManager::getObjCStringRegion(const ObjCStringLiteral* Str){
return getSubRegion<ObjCStringRegion>(
    Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
755}

757/// Look through a chain of LocationContexts to either find the
758/// StackFrameContext that matches a DeclContext, or find a VarRegion
759/// for a variable captured by a block.
760static llvm::PointerUnion<const StackFrameContext *, const VarRegion *>
761getStackOrCaptureRegionForDeclContext(const LocationContext *LC,
                                    const DeclContext *DC,
                                    const VarDecl *VD) {
while (LC) {
  if (const StackFrameContext *SFC = dyn_cast<StackFrameContext>(LC)) {
    if (cast<DeclContext>(SFC->getDecl()) == DC)
      return SFC;
  }
  if (const BlockInvocationContext *BC =
      dyn_cast<BlockInvocationContext>(LC)) {
    const BlockDataRegion *BR =
      static_cast<const BlockDataRegion*>(BC->getContextData());
    // FIXME: This can be made more efficient.
    for (BlockDataRegion::referenced_vars_iterator
         I = BR->referenced_vars_begin(),
         E = BR->referenced_vars_end(); I != E; ++I) {
      const VarRegion *VR = I.getOriginalRegion();
      if (VR->getDecl() == VD)
        return cast<VarRegion>(I.getCapturedRegion());
    }
  }

  LC = LC->getParent();
}
return (const StackFrameContext *)nullptr;
786}

788const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
                                              const LocationContext *LC) {
const MemRegion *sReg = nullptr;

if (D->hasGlobalStorage() && !D->isStaticLocal()) {

  // First handle the globals defined in system headers.
  if (C.getSourceManager().isInSystemHeader(D->getLocation())) {
    // Whitelist the system globals which often DO GET modified, assume the
    // rest are immutable.
    if (D->getName().find("errno") != StringRef::npos)
      sReg = getGlobalsRegion(MemRegion::GlobalSystemSpaceRegionKind);
    else
      sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);

  // Treat other globals as GlobalInternal unless they are constants.
  } else {
    QualType GQT = D->getType();
    const Type *GT = GQT.getTypePtrOrNull();
    // TODO: We could walk the complex types here and see if everything is
    // constified.
    if (GT && GQT.isConstQualified() && GT->isArithmeticType())
      sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
    else
      sReg = getGlobalsRegion();
  }

// Finally handle static locals.
} else {
  // FIXME: Once we implement scope handling, we will need to properly lookup
  // 'D' to the proper LocationContext.
  const DeclContext *DC = D->getDeclContext();
  llvm::PointerUnion<const StackFrameContext *, const VarRegion *> V =
    getStackOrCaptureRegionForDeclContext(LC, DC, D);

  if (V.is<const VarRegion*>())
    return V.get<const VarRegion*>();

  const StackFrameContext *STC = V.get<const StackFrameContext*>();

  if (!STC) {
    // FIXME: Assign a more sensible memory space to static locals
    // we see from within blocks that we analyze as top-level declarations.
    sReg = getUnknownRegion();
  } else {
    if (D->hasLocalStorage()) {
      sReg = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
             ? static_cast<const MemRegion*>(getStackArgumentsRegion(STC))
             : static_cast<const MemRegion*>(getStackLocalsRegion(STC));
    }
    else {
      assert(D->isStaticLocal())(static_cast <bool> (D->isStaticLocal()) ? void (0) :
 __assert_fail ("D->isStaticLocal()", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 839, __extension__ __PRETTY_FUNCTION__));
      const Decl *STCD = STC->getDecl();
      if (isa<FunctionDecl>(STCD) || isa<ObjCMethodDecl>(STCD))
        sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
                                getFunctionCodeRegion(cast<NamedDecl>(STCD)));
      else if (const BlockDecl *BD = dyn_cast<BlockDecl>(STCD)) {
        // FIXME: The fallback type here is totally bogus -- though it should
        // never be queried, it will prevent uniquing with the real
        // BlockCodeRegion. Ideally we'd fix the AST so that we always had a
        // signature.
        QualType T;
        if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten())
          T = TSI->getType();
        if (T.isNull())
          T = getContext().VoidTy;
        if (!T->getAs<FunctionType>())
          T = getContext().getFunctionNoProtoType(T);
        T = getContext().getBlockPointerType(T);

        const BlockCodeRegion *BTR =
          getBlockCodeRegion(BD, C.getCanonicalType(T),
                             STC->getAnalysisDeclContext());
        sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
                                BTR);
      }
      else {
        sReg = getGlobalsRegion();
      }
    }
  }
}

return getSubRegion<VarRegion>(D, sReg);
872}

874const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
                                              const MemRegion *superR) {
return getSubRegion<VarRegion>(D, superR);
877}

879const BlockDataRegion *
880MemRegionManager::getBlockDataRegion(const BlockCodeRegion *BC,
                                   const LocationContext *LC,
                                   unsigned blockCount) {
const MemSpaceRegion *sReg = nullptr;
const BlockDecl *BD = BC->getDecl();
if (!BD->hasCaptures()) {
  // This handles 'static' blocks.
  sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
}
else {
  if (LC) {
    // FIXME: Once we implement scope handling, we want the parent region
    // to be the scope.
    const StackFrameContext *STC = LC->getCurrentStackFrame();
    assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 894, __extension__ __PRETTY_FUNCTION__));
    sReg = getStackLocalsRegion(STC);
  }
  else {
    // We allow 'LC' to be NULL for cases where want BlockDataRegions
    // without context-sensitivity.
    sReg = getUnknownRegion();
  }
}

return getSubRegion<BlockDataRegion>(BC, LC, blockCount, sReg);
905}

907const CXXTempObjectRegion *
908MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
return getSubRegion<CXXTempObjectRegion>(
    Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
911}

913const CompoundLiteralRegion*
914MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
                                         const LocationContext *LC) {
const MemSpaceRegion *sReg = nullptr;

if (CL->isFileScope())
  sReg = getGlobalsRegion();
else {
  const StackFrameContext *STC = LC->getCurrentStackFrame();
  assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 922, __extension__ __PRETTY_FUNCTION__));
  sReg = getStackLocalsRegion(STC);
}

return getSubRegion<CompoundLiteralRegion>(CL, sReg);
927}

929const ElementRegion*
930MemRegionManager::getElementRegion(QualType elementType, NonLoc Idx,
                                 const SubRegion* superRegion,
                                 ASTContext &Ctx){
QualType T = Ctx.getCanonicalType(elementType).getUnqualifiedType();

llvm::FoldingSetNodeID ID;
ElementRegion::ProfileRegion(ID, T, Idx, superRegion);

void *InsertPos;
MemRegion* data = Regions.FindNodeOrInsertPos(ID, InsertPos);
ElementRegion* R = cast_or_null<ElementRegion>(data);

if (!R) {
  R = A.Allocate<ElementRegion>();
  new (R) ElementRegion(T, Idx, superRegion);
  Regions.InsertNode(R, InsertPos);
}

return R;
949}

951const FunctionCodeRegion *
952MemRegionManager::getFunctionCodeRegion(const NamedDecl *FD) {
return getSubRegion<FunctionCodeRegion>(FD, getCodeRegion());
954}

956const BlockCodeRegion *
957MemRegionManager::getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy,
                                   AnalysisDeclContext *AC) {
return getSubRegion<BlockCodeRegion>(BD, locTy, AC, getCodeRegion());
960}


963/// getSymbolicRegion - Retrieve or create a "symbolic" memory region.
964const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
966}

968const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
970}

972const FieldRegion*
973MemRegionManager::getFieldRegion(const FieldDecl *d,
                               const SubRegion* superRegion){
return getSubRegion<FieldRegion>(d, superRegion);
976}

978const ObjCIvarRegion*
979MemRegionManager::getObjCIvarRegion(const ObjCIvarDecl *d,
                                  const SubRegion* superRegion) {
return getSubRegion<ObjCIvarRegion>(d, superRegion);
982}

984const CXXTempObjectRegion*
985MemRegionManager::getCXXTempObjectRegion(Expr const *E,
                                       LocationContext const *LC) {
const StackFrameContext *SFC = LC->getCurrentStackFrame();
assert(SFC)(static_cast <bool> (SFC) ? void (0) : __assert_fail ("SFC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 988, __extension__ __PRETTY_FUNCTION__));
return getSubRegion<CXXTempObjectRegion>(E, getStackLocalsRegion(SFC));
990}

992/// Checks whether \p BaseClass is a valid virtual or direct non-virtual base
993/// class of the type of \p Super.
994static bool isValidBaseClass(const CXXRecordDecl *BaseClass,
                           const TypedValueRegion *Super,
                           bool IsVirtual) {
BaseClass = BaseClass->getCanonicalDecl();

const CXXRecordDecl *Class = Super->getValueType()->getAsCXXRecordDecl();
if (!Class)
  return true;

if (IsVirtual)
  return Class->isVirtuallyDerivedFrom(BaseClass);

for (const auto &I : Class->bases()) {
  if (I.getType()->getAsCXXRecordDecl()->getCanonicalDecl() == BaseClass)
    return true;
}

return false;
1012}

1014const CXXBaseObjectRegion *
1015MemRegionManager::getCXXBaseObjectRegion(const CXXRecordDecl *RD,
                                       const SubRegion *Super,
                                       bool IsVirtual) {
if (isa<TypedValueRegion>(Super)) {
  assert(isValidBaseClass(RD, dyn_cast<TypedValueRegion>(Super), IsVirtual))(static_cast <bool> (isValidBaseClass(RD, dyn_cast<TypedValueRegion
>(Super), IsVirtual)) ? void (0) : __assert_fail ("isValidBaseClass(RD, dyn_cast<TypedValueRegion>(Super), IsVirtual)"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1019, __extension__ __PRETTY_FUNCTION__));
  (void)&isValidBaseClass;

  if (IsVirtual) {
    // Virtual base regions should not be layered, since the layout rules
    // are different.
    while (const CXXBaseObjectRegion *Base =
             dyn_cast<CXXBaseObjectRegion>(Super)) {
      Super = cast<SubRegion>(Base->getSuperRegion());
    }
    assert(Super && !isa<MemSpaceRegion>(Super))(static_cast <bool> (Super && !isa<MemSpaceRegion
>(Super)) ? void (0) : __assert_fail ("Super && !isa<MemSpaceRegion>(Super)"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1029, __extension__ __PRETTY_FUNCTION__));
  }
}

return getSubRegion<CXXBaseObjectRegion>(RD, IsVirtual, Super);
1034}

1036const CXXThisRegion*
1037MemRegionManager::getCXXThisRegion(QualType thisPointerTy,
                                 const LocationContext *LC) {
const PointerType *PT = thisPointerTy->getAs<PointerType>();
assert(PT)(static_cast <bool> (PT) ? void (0) : __assert_fail ("PT"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1040, __extension__ __PRETTY_FUNCTION__));
// Inside the body of the operator() of a lambda a this expr might refer to an
// object in one of the parent location contexts.
const auto *D = dyn_cast<CXXMethodDecl>(LC->getDecl());
// FIXME: when operator() of lambda is analyzed as a top level function and
// 'this' refers to a this to the enclosing scope, there is no right region to
// return.
while (!LC->inTopFrame() &&
       (!D || D->isStatic() ||
        PT != D->getThisType(getContext())->getAs<PointerType>())) {
  LC = LC->getParent();
  D = dyn_cast<CXXMethodDecl>(LC->getDecl());
}
const StackFrameContext *STC = LC->getCurrentStackFrame();
assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1054, __extension__ __PRETTY_FUNCTION__));
return getSubRegion<CXXThisRegion>(PT, getStackArgumentsRegion(STC));
1056}

1058const AllocaRegion*
1059MemRegionManager::getAllocaRegion(const Expr *E, unsigned cnt,
                                const LocationContext *LC) {
const StackFrameContext *STC = LC->getCurrentStackFrame();
assert(STC)(static_cast <bool> (STC) ? void (0) : __assert_fail ("STC"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1062, __extension__ __PRETTY_FUNCTION__));
return getSubRegion<AllocaRegion>(E, cnt, getStackLocalsRegion(STC));
1064}

1066const MemSpaceRegion *MemRegion::getMemorySpace() const {
const MemRegion *R = this;
const SubRegion* SR = dyn_cast<SubRegion>(this);

while (SR) {
  R = SR->getSuperRegion();
  SR = dyn_cast<SubRegion>(R);
}

return dyn_cast<MemSpaceRegion>(R);
1076}

1078bool MemRegion::hasStackStorage() const {
return isa<StackSpaceRegion>(getMemorySpace());
1080}

1082bool MemRegion::hasStackNonParametersStorage() const {
return isa<StackLocalsSpaceRegion>(getMemorySpace());
1084}

1086bool MemRegion::hasStackParametersStorage() const {
return isa<StackArgumentsSpaceRegion>(getMemorySpace());
1088}

1090bool MemRegion::hasGlobalsOrParametersStorage() const {
const MemSpaceRegion *MS = getMemorySpace();
return isa<StackArgumentsSpaceRegion>(MS) ||
       isa<GlobalsSpaceRegion>(MS);
1094}

1096// getBaseRegion strips away all elements and fields, and get the base region
1097// of them.
1098const MemRegion *MemRegion::getBaseRegion() const {
const MemRegion *R = this;
while (true) {
  switch (R->getKind()) {
    case MemRegion::ElementRegionKind:
    case MemRegion::FieldRegionKind:
    case MemRegion::ObjCIvarRegionKind:
    case MemRegion::CXXBaseObjectRegionKind:
      R = cast<SubRegion>(R)->getSuperRegion();
      continue;
    default:
      break;
  }
  break;
}
return R;
1114}

1116bool MemRegion::isSubRegionOf(const MemRegion *R) const {
return false;
1118}

1120//===----------------------------------------------------------------------===//
1121// View handling.
1122//===----------------------------------------------------------------------===//

1124const MemRegion *MemRegion::StripCasts(bool StripBaseCasts) const {
const MemRegion *R = this;
while (true) {
  switch (R->getKind()) {
  case ElementRegionKind: {
    const ElementRegion *ER = cast<ElementRegion>(R);
    if (!ER->getIndex().isZeroConstant())
      return R;
    R = ER->getSuperRegion();
    break;
  }
  case CXXBaseObjectRegionKind:
    if (!StripBaseCasts)
      return R;
    R = cast<CXXBaseObjectRegion>(R)->getSuperRegion();
    break;
  default:
    return R;
  }
}
1144}

1146const SymbolicRegion *MemRegion::getSymbolicBase() const {
const SubRegion *SubR = dyn_cast<SubRegion>(this);

while (SubR) {
  if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(SubR))
    return SymR;
  SubR = dyn_cast<SubRegion>(SubR->getSuperRegion());
}
return nullptr;
1155}

1157/// Perform a given operation on two integers, return whether it overflows.
1158/// Optionally write the resulting output into \p Res.
1159static bool checkedOp(
  int64_t LHS,
  int64_t RHS,
  std::function<llvm::APInt(llvm::APInt *, const llvm::APInt &, bool &)> Op,
  int64_t *Res = nullptr) {
llvm::APInt ALHS(/*BitSize=*/64, LHS, /*Signed=*/true);
llvm::APInt ARHS(/*BitSize=*/64, RHS, /*Signed=*/true);
bool Overflow;
llvm::APInt Out = Op(&ALHS, ARHS, Overflow);
if (!Overflow && Res)
  *Res = Out.getSExtValue();
return Overflow;
1171}

1173static bool checkedAdd(
  int64_t LHS,
  int64_t RHS,
  int64_t *Res=nullptr) {
return checkedOp(LHS, RHS, &llvm::APInt::sadd_ov, Res);
1178}

1180static bool checkedMul(
  int64_t LHS,
  int64_t RHS,
  int64_t *Res=nullptr) {
return checkedOp(LHS, RHS, &llvm::APInt::smul_ov, Res);
1185}

1187RegionRawOffset ElementRegion::getAsArrayOffset() const {
CharUnits offset = CharUnits::Zero();
const ElementRegion *ER = this;
const MemRegion *superR = nullptr;
ASTContext &C = getContext();

// FIXME: Handle multi-dimensional arrays.

while (ER) {
  superR = ER->getSuperRegion();

  // FIXME: generalize to symbolic offsets.
  SVal index = ER->getIndex();
  if (Optional<nonloc::ConcreteInt> CI = index.getAs<nonloc::ConcreteInt>()) {
    // Update the offset.
    int64_t i = CI->getValue().getSExtValue();

    if (i != 0) {
      QualType elemType = ER->getElementType();

      // If we are pointing to an incomplete type, go no further.
      if (elemType->isIncompleteType()) {
        superR = ER;
        break;
      }

      CharUnits size = C.getTypeSizeInChars(elemType);

      int64_t Mult;
      bool Overflow = checkedAdd(i, size.getQuantity(), &Mult);
      if (!Overflow)
        Overflow = checkedMul(Mult, offset.getQuantity());
      if (Overflow) {
        DEBUG(llvm::dbgs() << "MemRegion::getAsArrayOffset: "do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("MemRegion")) { llvm::dbgs() << "MemRegion::getAsArrayOffset: "
 << "offset overflowing, returning unknown\n"; } } while
 (false)
                           << "offset overflowing, returning unknown\n")do { if (::llvm::DebugFlag && ::llvm::isCurrentDebugType
("MemRegion")) { llvm::dbgs() << "MemRegion::getAsArrayOffset: "
 << "offset overflowing, returning unknown\n"; } } while
 (false);

        return nullptr;
      }

      offset += (i * size);
    }

    // Go to the next ElementRegion (if any).
    ER = dyn_cast<ElementRegion>(superR);
    continue;
  }

  return nullptr;
}

assert(superR && "super region cannot be NULL")(static_cast <bool> (superR && "super region cannot be NULL"
) ? void (0) : __assert_fail ("superR && \"super region cannot be NULL\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1237, __extension__ __PRETTY_FUNCTION__));
return RegionRawOffset(superR, offset);
1239}


1242/// Returns true if \p Base is an immediate base class of \p Child
1243static bool isImmediateBase(const CXXRecordDecl *Child,
                          const CXXRecordDecl *Base) {
assert(Child && "Child must not be null")(static_cast <bool> (Child && "Child must not be null"
) ? void (0) : __assert_fail ("Child && \"Child must not be null\""
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1245, __extension__ __PRETTY_FUNCTION__));
// Note that we do NOT canonicalize the base class here, because
// ASTRecordLayout doesn't either. If that leads us down the wrong path,
// so be it; at least we won't crash.
for (const auto &I : Child->bases()) {
  if (I.getType()->getAsCXXRecordDecl() == Base)
    return true;
}

return false;
1255}

1257RegionOffset MemRegion::getAsOffset() const {
const MemRegion *R = this;
const MemRegion *SymbolicOffsetBase = nullptr;
int64_t Offset = 0;

while (1) {
1
Loop condition is true.  Entering loop body→
10
←
Loop condition is true.  Entering loop body→
  switch (R->getKind()) {
2
←
Control jumps to 'case FieldRegionKind:'  at line 1384→
11
←
Called C++ object pointer is null
  case CodeSpaceRegionKind:
  case StackLocalsSpaceRegionKind:
  case StackArgumentsSpaceRegionKind:
  case HeapSpaceRegionKind:
  case UnknownSpaceRegionKind:
  case StaticGlobalSpaceRegionKind:
  case GlobalInternalSpaceRegionKind:
  case GlobalSystemSpaceRegionKind:
  case GlobalImmutableSpaceRegionKind:
    // Stores can bind directly to a region space to set a default value.
    assert(Offset == 0 && !SymbolicOffsetBase)(static_cast <bool> (Offset == 0 && !SymbolicOffsetBase
) ? void (0) : __assert_fail ("Offset == 0 && !SymbolicOffsetBase"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1274, __extension__ __PRETTY_FUNCTION__));
    goto Finish;

  case FunctionCodeRegionKind:
  case BlockCodeRegionKind:
  case BlockDataRegionKind:
    // These will never have bindings, but may end up having values requested
    // if the user does some strange casting.
    if (Offset != 0)
      SymbolicOffsetBase = R;
    goto Finish;

  case SymbolicRegionKind:
  case AllocaRegionKind:
  case CompoundLiteralRegionKind:
  case CXXThisRegionKind:
  case StringRegionKind:
  case ObjCStringRegionKind:
  case VarRegionKind:
  case CXXTempObjectRegionKind:
    // Usual base regions.
    goto Finish;

  case ObjCIvarRegionKind:
    // This is a little strange, but it's a compromise between
    // ObjCIvarRegions having unknown compile-time offsets (when using the
    // non-fragile runtime) and yet still being distinct, non-overlapping
    // regions. Thus we treat them as "like" base regions for the purposes
    // of computing offsets.
    goto Finish;

  case CXXBaseObjectRegionKind: {
    const CXXBaseObjectRegion *BOR = cast<CXXBaseObjectRegion>(R);
    R = BOR->getSuperRegion();

    QualType Ty;
    bool RootIsSymbolic = false;
    if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(R)) {
      Ty = TVR->getDesugaredValueType(getContext());
    } else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
      // If our base region is symbolic, we don't know what type it really is.
      // Pretend the type of the symbol is the true dynamic type.
      // (This will at least be self-consistent for the life of the symbol.)
      Ty = SR->getSymbol()->getType()->getPointeeType();
      RootIsSymbolic = true;
    }

    const CXXRecordDecl *Child = Ty->getAsCXXRecordDecl();
    if (!Child) {
      // We cannot compute the offset of the base class.
      SymbolicOffsetBase = R;
    } else {
      if (RootIsSymbolic) {
        // Base layers on symbolic regions may not be type-correct.
        // Double-check the inheritance here, and revert to a symbolic offset
        // if it's invalid (e.g. due to a reinterpret_cast).
        if (BOR->isVirtual()) {
          if (!Child->isVirtuallyDerivedFrom(BOR->getDecl()))
            SymbolicOffsetBase = R;
        } else {
          if (!isImmediateBase(Child, BOR->getDecl()))
            SymbolicOffsetBase = R;
        }
      }
    }

    // Don't bother calculating precise offsets if we already have a
    // symbolic offset somewhere in the chain.
    if (SymbolicOffsetBase)
      continue;

    CharUnits BaseOffset;
    const ASTRecordLayout &Layout = getContext().getASTRecordLayout(Child);
    if (BOR->isVirtual())
      BaseOffset = Layout.getVBaseClassOffset(BOR->getDecl());
    else
      BaseOffset = Layout.getBaseClassOffset(BOR->getDecl());

    // The base offset is in chars, not in bits.
    Offset += BaseOffset.getQuantity() * getContext().getCharWidth();
    break;
  }
  case ElementRegionKind: {
    const ElementRegion *ER = cast<ElementRegion>(R);
    R = ER->getSuperRegion();

    QualType EleTy = ER->getValueType();
    if (EleTy->isIncompleteType()) {
      // We cannot compute the offset of the base class.
      SymbolicOffsetBase = R;
      continue;
    }

    SVal Index = ER->getIndex();
    if (Optional<nonloc::ConcreteInt> CI =
            Index.getAs<nonloc::ConcreteInt>()) {
      // Don't bother calculating precise offsets if we already have a
      // symbolic offset somewhere in the chain.
      if (SymbolicOffsetBase)
        continue;

      int64_t i = CI->getValue().getSExtValue();
      // This type size is in bits.
      Offset += i * getContext().getTypeSize(EleTy);
    } else {
      // We cannot compute offset for non-concrete index.
      SymbolicOffsetBase = R;
    }
    break;
  }
  case FieldRegionKind: {
    const FieldRegion *FR = cast<FieldRegion>(R);
    R = FR->getSuperRegion();
3
←
Calling 'SubRegion::getSuperRegion'→
4
←
Returning from 'SubRegion::getSuperRegion'→
5
←
Value assigned to 'R'→

    const RecordDecl *RD = FR->getDecl()->getParent();
    if (RD->isUnion() || !RD->isCompleteDefinition()) {
      // We cannot compute offset for incomplete type.
      // For unions, we could treat everything as offset 0, but we'd rather
      // treat each field as a symbolic offset so they aren't stored on top
      // of each other, since we depend on things in typed regions actually
      // matching their types.
      SymbolicOffsetBase = R;
    }

    // Don't bother calculating precise offsets if we already have a
    // symbolic offset somewhere in the chain.
    if (SymbolicOffsetBase)
6
←
Assuming 'SymbolicOffsetBase' is null→
7
←
Taking false branch→
      continue;

    // Get the field number.
    unsigned idx = 0;
    for (RecordDecl::field_iterator FI = RD->field_begin(),
8
←
Loop condition is false. Execution continues on line 1410→
           FE = RD->field_end(); FI != FE; ++FI, ++idx) {
      if (FR->getDecl() == *FI)
        break;
    }
    const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
    // This is offset in bits.
    Offset += Layout.getFieldOffset(idx);
    break;
9
←
 Execution continues on line 1262→
  }
  }
}

Finish:
if (SymbolicOffsetBase)
  return RegionOffset(SymbolicOffsetBase, RegionOffset::Symbolic);
return RegionOffset(R, Offset);
1422}

1424//===----------------------------------------------------------------------===//
1425// BlockDataRegion
1426//===----------------------------------------------------------------------===//

1428std::pair<const VarRegion *, const VarRegion *>
1429BlockDataRegion::getCaptureRegions(const VarDecl *VD) {
MemRegionManager &MemMgr = *getMemRegionManager();
const VarRegion *VR = nullptr;
const VarRegion *OriginalVR = nullptr;

if (!VD->hasAttr<BlocksAttr>() && VD->hasLocalStorage()) {
  VR = MemMgr.getVarRegion(VD, this);
  OriginalVR = MemMgr.getVarRegion(VD, LC);
}
else {
  if (LC) {
    VR = MemMgr.getVarRegion(VD, LC);
    OriginalVR = VR;
  }
  else {
    VR = MemMgr.getVarRegion(VD, MemMgr.getUnknownRegion());
    OriginalVR = MemMgr.getVarRegion(VD, LC);
  }
}
return std::make_pair(VR, OriginalVR);
1449}

1451void BlockDataRegion::LazyInitializeReferencedVars() {
if (ReferencedVars)
  return;

AnalysisDeclContext *AC = getCodeRegion()->getAnalysisDeclContext();
const auto &ReferencedBlockVars = AC->getReferencedBlockVars(BC->getDecl());
auto NumBlockVars =
    std::distance(ReferencedBlockVars.begin(), ReferencedBlockVars.end());

if (NumBlockVars == 0) {
  ReferencedVars = (void*) 0x1;
  return;
}

MemRegionManager &MemMgr = *getMemRegionManager();
llvm::BumpPtrAllocator &A = MemMgr.getAllocator();
BumpVectorContext BC(A);

typedef BumpVector<const MemRegion*> VarVec;
VarVec *BV = A.Allocate<VarVec>();
new (BV) VarVec(BC, NumBlockVars);
VarVec *BVOriginal = A.Allocate<VarVec>();
new (BVOriginal) VarVec(BC, NumBlockVars);

for (const VarDecl *VD : ReferencedBlockVars) {
  const VarRegion *VR = nullptr;
  const VarRegion *OriginalVR = nullptr;
  std::tie(VR, OriginalVR) = getCaptureRegions(VD);
  assert(VR)(static_cast <bool> (VR) ? void (0) : __assert_fail ("VR"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1479, __extension__ __PRETTY_FUNCTION__));
  assert(OriginalVR)(static_cast <bool> (OriginalVR) ? void (0) : __assert_fail
 ("OriginalVR", "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1480, __extension__ __PRETTY_FUNCTION__));
  BV->push_back(VR, BC);
  BVOriginal->push_back(OriginalVR, BC);
}

ReferencedVars = BV;
OriginalVars = BVOriginal;
1487}

1489BlockDataRegion::referenced_vars_iterator
1490BlockDataRegion::referenced_vars_begin() const {
const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();

BumpVector<const MemRegion*> *Vec =
  static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);

if (Vec == (void*) 0x1)
  return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);

BumpVector<const MemRegion*> *VecOriginal =
  static_cast<BumpVector<const MemRegion*>*>(OriginalVars);

return BlockDataRegion::referenced_vars_iterator(Vec->begin(),
                                                 VecOriginal->begin());
1504}

1506BlockDataRegion::referenced_vars_iterator
1507BlockDataRegion::referenced_vars_end() const {
const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();

BumpVector<const MemRegion*> *Vec =
  static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);

if (Vec == (void*) 0x1)
  return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);

BumpVector<const MemRegion*> *VecOriginal =
  static_cast<BumpVector<const MemRegion*>*>(OriginalVars);

return BlockDataRegion::referenced_vars_iterator(Vec->end(),
                                                 VecOriginal->end());
1521}

1523const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
for (referenced_vars_iterator I = referenced_vars_begin(),
                              E = referenced_vars_end();
     I != E; ++I) {
  if (I.getCapturedRegion() == R)
    return I.getOriginalRegion();
}
return nullptr;
1531}

1533//===----------------------------------------------------------------------===//
1534// RegionAndSymbolInvalidationTraits
1535//===----------------------------------------------------------------------===//

1537void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym,
                                               InvalidationKinds IK) {
SymTraitsMap[Sym] |= IK;
1540}

1542void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR,
                                               InvalidationKinds IK) {
assert(MR)(static_cast <bool> (MR) ? void (0) : __assert_fail ("MR"
, "/build/llvm-toolchain-snapshot-7~svn326551/tools/clang/lib/StaticAnalyzer/Core/MemRegion.cpp"
, 1544, __extension__ __PRETTY_FUNCTION__));
if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
  setTrait(SR->getSymbol(), IK);
else
  MRTraitsMap[MR] |= IK;
1549}

1551bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym,
                                               InvalidationKinds IK) const {
const_symbol_iterator I = SymTraitsMap.find(Sym);
if (I != SymTraitsMap.end())
  return I->second & IK;

return false;
1558}

1560bool RegionAndSymbolInvalidationTraits::hasTrait(const MemRegion *MR,
                                               InvalidationKinds IK) const {
if (!MR)
  return false;

if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
  return hasTrait(SR->getSymbol(), IK);

const_region_iterator I = MRTraitsMap.find(MR);
if (I != MRTraitsMap.end())
  return I->second & IK;

return false;
1573}