CallEvent.h revision 09647f28d7955d0c948ebbbb376a46844056f11a
14aad88d1fd88413029dd05255306b07cb19396eeBob Wilson//===- CallEvent.h - Wrapper for all function and method calls ----*- C++ -*--// 24aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// 34aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// The LLVM Compiler Infrastructure 44aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// 54aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// This file is distributed under the University of Illinois Open Source 64aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// License. See LICENSE.TXT for details. 74aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// 84aad88d1fd88413029dd05255306b07cb19396eeBob Wilson//===----------------------------------------------------------------------===// 94aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// 104aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \file This file defines CallEvent and its subclasses, which represent path- 114aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// sensitive instances of different kinds of function and method calls 124aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// (C, C++, and Objective-C). 134aad88d1fd88413029dd05255306b07cb19396eeBob Wilson// 144aad88d1fd88413029dd05255306b07cb19396eeBob Wilson//===----------------------------------------------------------------------===// 154aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 164aad88d1fd88413029dd05255306b07cb19396eeBob Wilson#ifndef LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 174aad88d1fd88413029dd05255306b07cb19396eeBob Wilson#define LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 18aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramer 19aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramer#include "clang/Basic/SourceManager.h" 2036b56886974eae4f9c5ebc96befd3e7bfe5de338Stephen Hines#include "clang/AST/DeclCXX.h" 21aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramer#include "clang/AST/ExprCXX.h" 22aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramer#include "clang/AST/ExprObjC.h" 23aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramer#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 244aad88d1fd88413029dd05255306b07cb19396eeBob Wilson#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 254aad88d1fd88413029dd05255306b07cb19396eeBob Wilson#include "llvm/ADT/PointerIntPair.h" 26dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines 27dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hinesnamespace clang { 28aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramerclass ProgramPoint; 29aa5354c3ba93032dcc76e8c105575f31196084f1Benjamin Kramerclass ProgramPointTag; 304aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 314aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonnamespace ento { 324aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 334aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonenum CallEventKind { 344aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_Function, 354aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_Block, 364aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_BEG_SIMPLE_CALLS = CE_Function, 374aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_END_SIMPLE_CALLS = CE_Block, 384aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_CXXMember, 394aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_CXXMemberOperator, 404aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_CXXDestructor, 414aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember, 424aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor, 434aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_CXXConstructor, 444aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_CXXAllocator, 454aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_BEG_FUNCTION_CALLS = CE_Function, 464aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_END_FUNCTION_CALLS = CE_CXXAllocator, 474aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CE_ObjCMessage 484aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 494aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 504aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass CallEvent; 514aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass CallEventManager; 524aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 534aad88d1fd88413029dd05255306b07cb19396eeBob Wilsontemplate<typename T = CallEvent> 544aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass CallEventRef : public IntrusiveRefCntPtr<const T> { 554aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 564aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {} 57dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {} 58dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines 594aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEventRef<T> cloneWithState(ProgramStateRef State) const { 604aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return this->getPtr()->template cloneWithState<T>(State); 614aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 624aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 634aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // Allow implicit conversions to a superclass type, since CallEventRef 644aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // behaves like a pointer-to-const. 654aad88d1fd88413029dd05255306b07cb19396eeBob Wilson template <typename SuperT> 664aad88d1fd88413029dd05255306b07cb19396eeBob Wilson operator CallEventRef<SuperT> () const { 674aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return this->getPtr(); 684aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 694aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 704aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 714aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \brief Defines the runtime definition of the called function. 724aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass RuntimeDefinition { 734aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// The Declaration of the function which will be called at runtime. 744aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 0 if not available. 754aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const Decl *D; 764aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 774aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// The region representing an object (ObjC/C++) on which the method is 784aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// called. With dynamic dispatch, the method definition depends on the 794aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// runtime type of this object. 0 when there is no dynamic dispatch. 804aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const MemRegion *R; 814aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 82c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilsonpublic: 834aad88d1fd88413029dd05255306b07cb19396eeBob Wilson RuntimeDefinition(): D(0), R(0) {} 844aad88d1fd88413029dd05255306b07cb19396eeBob Wilson RuntimeDefinition(const Decl *InD): D(InD), R(0) {} 854aad88d1fd88413029dd05255306b07cb19396eeBob Wilson RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {} 864aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const Decl *getDecl() { return D; } 874aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const MemRegion *getDispatchRegion() { return R; } 884aad88d1fd88413029dd05255306b07cb19396eeBob Wilson bool mayHaveOtherDefinitions() { return R != 0; } 894aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 904aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 91c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson/// \brief Represents an abstract call to a function or method along a 924aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// particular path. 934aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// 944aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// CallEvents are created through the factory methods of CallEventManager. 954aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// 964aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// CallEvents should always be cheap to create and destroy. In order for 974aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// CallEventManager to be able to re-use CallEvent-sized memory blocks, 984aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// subclasses of CallEvent may not add any data members to the base class. 994aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// Use the "Data" and "Location" fields instead. 1004aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass CallEvent { 1014aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 102c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson typedef CallEventKind Kind; 1034aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1044aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprivate: 1054aad88d1fd88413029dd05255306b07cb19396eeBob Wilson ProgramStateRef State; 1064aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx; 1074aad88d1fd88413029dd05255306b07cb19396eeBob Wilson llvm::PointerUnion<const Expr *, const Decl *> Origin; 1084aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1094aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // DO NOT IMPLEMENT 1104aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEvent &operator=(const CallEvent &); 1114aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1124aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 1134aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // This is user data for subclasses. 1144aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const void *Data; 1154aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1164aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // This is user data for subclasses. 1174aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // This should come right before RefCount, so that the two fields can be 1184aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // packed together on LP64 platforms. 119c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson SourceLocation Location; 120dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines 121c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilsonprivate: 122c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson mutable unsigned RefCount; 123c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson 124c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo; 1254aad88d1fd88413029dd05255306b07cb19396eeBob Wilson void Retain() const { ++RefCount; } 1264aad88d1fd88413029dd05255306b07cb19396eeBob Wilson void Release() const; 1274aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1284aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 1294aad88d1fd88413029dd05255306b07cb19396eeBob Wilson friend class CallEventManager; 1304aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1314aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx) 1324aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : State(state), LCtx(lctx), Origin(E), RefCount(0) {} 1334aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1344aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx) 1354aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : State(state), LCtx(lctx), Origin(D), RefCount(0) {} 1364aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1374aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // DO NOT MAKE PUBLIC 1384aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEvent(const CallEvent &Original) 1394aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin), 1404aad88d1fd88413029dd05255306b07cb19396eeBob Wilson Data(Original.Data), Location(Original.Location), RefCount(0) {} 1414aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1424aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1434aad88d1fd88413029dd05255306b07cb19396eeBob Wilson ProgramStateRef getState() const { 1444aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return State; 1454aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 1464aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1474aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *getLocationContext() const { 1484aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return LCtx; 1494aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 1504aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1514aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1524aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Copies this CallEvent, with vtable intact, into a new block of memory. 153dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines virtual void cloneTo(void *Dest) const = 0; 1544aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1554aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Get the value of arbitrary expressions at this point in the path. 1564aad88d1fd88413029dd05255306b07cb19396eeBob Wilson SVal getSVal(const Stmt *S) const { 1574aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return getState()->getSVal(S, getLocationContext()); 1584aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 1594aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1604aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1614aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef SmallVectorImpl<const MemRegion *> RegionList; 1624aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1634aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Used to specify non-argument regions that will be invalidated as a 1644aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// result of this call. 1654aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual void getExtraInvalidatedRegions(RegionList &Regions) const {} 1664aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1674aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual QualType getDeclaredResultType() const = 0; 1684aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1694aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 1704aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual ~CallEvent() {} 1714aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1724aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the kind of call this is. 1734aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual Kind getKind() const = 0; 1744aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1754aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the declaration of the function or method that will be 1764aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// called. May be null. 1774aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const Decl *getDecl() const { 1784aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return Origin.dyn_cast<const Decl *>(); 1794aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 1804aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1814aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the definition of the function or method that will be 1824aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// called. 1834aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual RuntimeDefinition getRuntimeDefinition() const = 0; 1844aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1854aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the expression whose value will be the result of this call. 1864aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// May be null. 1874aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const Expr *getOriginExpr() const { 1884aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return Origin.dyn_cast<const Expr *>(); 1894aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 1904aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1914aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the number of arguments (explicit and implicit). 1924aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 1934aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Note that this may be greater than the number of parameters in the 1944aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// callee's declaration, and that it may include arguments not written in 195c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// the source. 1964aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual unsigned getNumArgs() const = 0; 1974aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 1984aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns true if the callee is known to be from a system header. 1994aad88d1fd88413029dd05255306b07cb19396eeBob Wilson bool isInSystemHeader() const { 2004aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const Decl *D = getDecl(); 2014aad88d1fd88413029dd05255306b07cb19396eeBob Wilson if (!D) 2024aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return false; 2034aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2044aad88d1fd88413029dd05255306b07cb19396eeBob Wilson SourceLocation Loc = D->getLocation(); 2054aad88d1fd88413029dd05255306b07cb19396eeBob Wilson if (Loc.isValid()) { 2064aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const SourceManager &SM = 2074aad88d1fd88413029dd05255306b07cb19396eeBob Wilson getState()->getStateManager().getContext().getSourceManager(); 2084aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return SM.isInSystemHeader(D->getLocation()); 2094aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 2104aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2114aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // Special case for implicitly-declared global operator new/delete. 2124aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // These should be considered system functions. 2134aad88d1fd88413029dd05255306b07cb19396eeBob Wilson if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) 2144aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal(); 2154aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2164aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return false; 2174aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 2184aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2194aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns a source range for the entire call, suitable for 2204aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// outputting in diagnostics. 2214aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual SourceRange getSourceRange() const { 2224aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return getOriginExpr()->getSourceRange(); 2234aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 2244aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2254aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the value of a given argument at the time of the call. 2264aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual SVal getArgSVal(unsigned Index) const; 2274aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 228c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// \brief Returns the expression associated with a given argument. 2294aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// May be null if this expression does not appear in the source. 2304aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const Expr *getArgExpr(unsigned Index) const { return 0; } 2314aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2324aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the source range for errors associated with this argument. 2334aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 2344aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// May be invalid if the argument is not written in the source. 2354aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual SourceRange getArgSourceRange(unsigned Index) const; 236dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines 2374aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns the result type, adjusted for references. 238c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson QualType getResultType() const; 239c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson 2404aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns true if any of the arguments appear to represent callbacks. 241c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson bool hasNonZeroCallbackArg() const; 242c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson 243c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// \brief Returns true if any of the arguments are known to escape to long- 244c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// term storage, even if this method will not modify them. 245c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson // NOTE: The exact semantics of this are still being defined! 246c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson // We don't really want a list of hardcoded exceptions in the long run, 247c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson // but we don't want duplicated lists of known APIs in the short term either. 248c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson virtual bool argumentsMayEscape() const { 249c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson return hasNonZeroCallbackArg(); 250c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson } 251c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson 252c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// \brief Returns an appropriate ProgramPoint for this call. 253c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson ProgramPoint getProgramPoint(bool IsPreVisit = false, 254c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson const ProgramPointTag *Tag = 0) const; 2554aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2564aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns a new state with all argument regions invalidated. 2574aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 258c52edc7d3072ce5f93a7fd4ce7636155f7ab7a1fBob Wilson /// This accepts an alternate state in case some processing has already 2594aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// occurred. 2604aad88d1fd88413029dd05255306b07cb19396eeBob Wilson ProgramStateRef invalidateRegions(unsigned BlockCount, 2614aad88d1fd88413029dd05255306b07cb19396eeBob Wilson ProgramStateRef Orig = 0) const; 2624aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2634aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef std::pair<Loc, SVal> FrameBindingTy; 2644aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef SmallVectorImpl<FrameBindingTy> BindingsTy; 2654aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2664aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Populates the given SmallVector with the bindings in the callee's stack 2674aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// frame at the start of this call. 2684aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 2694aad88d1fd88413029dd05255306b07cb19396eeBob Wilson BindingsTy &Bindings) const = 0; 2704aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2714aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Returns a copy of this CallEvent, but using the given state. 2724aad88d1fd88413029dd05255306b07cb19396eeBob Wilson template <typename T> 2734aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEventRef<T> cloneWithState(ProgramStateRef NewState) const; 2744aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2754aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Returns a copy of this CallEvent, but using the given state. 2764aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CallEventRef<> cloneWithState(ProgramStateRef NewState) const { 2774aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return cloneWithState<CallEvent>(NewState); 2784aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 2794aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2804aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Returns true if this is a statement that can be considered for 2814aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// inlining. 2824aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 2834aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// FIXME: This should go away once CallEvents are cheap and easy to 2844aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// construct from ExplodedNodes. 2854aad88d1fd88413029dd05255306b07cb19396eeBob Wilson static bool mayBeInlined(const Stmt *S); 2864aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2874aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // Iterator access to formal parameters and their types. 2884aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprivate: 2894aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef std::const_mem_fun_t<QualType, ParmVarDecl> get_type_fun; 2904aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2914aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 2924aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef const ParmVarDecl * const *param_iterator; 2934aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 2944aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Returns an iterator over the call's formal parameters. 2954aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 2964aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// If UseDefinitionParams is set, this will return the parameter decls 2974aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// used in the callee's definition (suitable for inlining). Most of the 2984aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// time it is better to use the decl found by name lookup, which likely 2994aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// carries more annotations. 3004aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 3014aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Remember that the number of formal parameters may not match the number 3024aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// of arguments for all calls. However, the first parameter will always 3034aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// correspond with the argument value returned by \c getArgSVal(0). 3044aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 3054aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// If the call has no accessible declaration (or definition, if 3064aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \p UseDefinitionParams is set), \c param_begin() will be equal to 3074aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \c param_end(). 3084aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual param_iterator param_begin() const =0; 3094aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \sa param_begin() 3104aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual param_iterator param_end() const = 0; 3114aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3124aad88d1fd88413029dd05255306b07cb19396eeBob Wilson typedef llvm::mapped_iterator<param_iterator, get_type_fun> 3134aad88d1fd88413029dd05255306b07cb19396eeBob Wilson param_type_iterator; 3144aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3154aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// Returns an iterator over the types of the call's formal parameters. 3164aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 3174aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// This uses the callee decl found by default name lookup rather than the 3184aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// definition because it represents a public interface, and probably has 3194aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// more annotations. 3204aad88d1fd88413029dd05255306b07cb19396eeBob Wilson param_type_iterator param_type_begin() const { 3214aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return llvm::map_iterator(param_begin(), 3224aad88d1fd88413029dd05255306b07cb19396eeBob Wilson get_type_fun(&ParmVarDecl::getType)); 3234aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 3244aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \sa param_type_begin() 3254aad88d1fd88413029dd05255306b07cb19396eeBob Wilson param_type_iterator param_type_end() const { 3264aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return llvm::map_iterator(param_end(), get_type_fun(&ParmVarDecl::getType)); 3274aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 3284aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3294aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // For debugging purposes only 3304aad88d1fd88413029dd05255306b07cb19396eeBob Wilson void dump(raw_ostream &Out) const; 3314aad88d1fd88413029dd05255306b07cb19396eeBob Wilson LLVM_ATTRIBUTE_USED void dump() const; 3324aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3334aad88d1fd88413029dd05255306b07cb19396eeBob Wilson static bool classof(const CallEvent *) { return true; } 3344aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 3354aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3364aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3374aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \brief Represents a call to any sort of function that might have a 3384aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// FunctionDecl. 3394aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass AnyFunctionCall : public CallEvent { 3404aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 3414aad88d1fd88413029dd05255306b07cb19396eeBob Wilson AnyFunctionCall(const Expr *E, ProgramStateRef St, 3424aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx) 3434aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : CallEvent(E, St, LCtx) {} 3444aad88d1fd88413029dd05255306b07cb19396eeBob Wilson AnyFunctionCall(const Decl *D, ProgramStateRef St, 3454aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx) 3464aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : CallEvent(D, St, LCtx) {} 3474aad88d1fd88413029dd05255306b07cb19396eeBob Wilson AnyFunctionCall(const AnyFunctionCall &Other) : CallEvent(Other) {} 3484aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3494aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual QualType getDeclaredResultType() const; 3504aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3514aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 3524aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // This function is overridden by subclasses, but they must return 3534aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // a FunctionDecl. 3544aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const FunctionDecl *getDecl() const { 3554aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return cast<FunctionDecl>(CallEvent::getDecl()); 3564aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 3574aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3584aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual RuntimeDefinition getRuntimeDefinition() const { 3594aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const FunctionDecl *FD = getDecl(); 3604aad88d1fd88413029dd05255306b07cb19396eeBob Wilson // Note that hasBody() will fill FD with the definition FunctionDecl. 3614aad88d1fd88413029dd05255306b07cb19396eeBob Wilson if (FD && FD->hasBody(FD)) 3624aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return RuntimeDefinition(FD); 3634aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return RuntimeDefinition(); 3644aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 3654aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3664aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual bool argumentsMayEscape() const; 3674aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3684aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 3694aad88d1fd88413029dd05255306b07cb19396eeBob Wilson BindingsTy &Bindings) const; 3704aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3714aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual param_iterator param_begin() const; 3724aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual param_iterator param_end() const; 3734aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3744aad88d1fd88413029dd05255306b07cb19396eeBob Wilson static bool classof(const CallEvent *CA) { 3754aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return CA->getKind() >= CE_BEG_FUNCTION_CALLS && 3764aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CA->getKind() <= CE_END_FUNCTION_CALLS; 3774aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 3784aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 3794aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3804aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \brief Represents a call to a non-C++ function, written as a CallExpr. 3814aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass SimpleCall : public AnyFunctionCall { 3824aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 3834aad88d1fd88413029dd05255306b07cb19396eeBob Wilson SimpleCall(const CallExpr *CE, ProgramStateRef St, 3844aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx) 38516717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman : AnyFunctionCall(CE, St, LCtx) {} 3864aad88d1fd88413029dd05255306b07cb19396eeBob Wilson SimpleCall(const SimpleCall &Other) : AnyFunctionCall(Other) {} 3874aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3884aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 3894aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const CallExpr *getOriginExpr() const { 3904aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return cast<CallExpr>(AnyFunctionCall::getOriginExpr()); 391dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines } 3924aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3934aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const FunctionDecl *getDecl() const; 3944aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3954aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 3964aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 3974aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual const Expr *getArgExpr(unsigned Index) const { 3984aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return getOriginExpr()->getArg(Index); 3994aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 4004aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4014aad88d1fd88413029dd05255306b07cb19396eeBob Wilson static bool classof(const CallEvent *CA) { 4024aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return CA->getKind() >= CE_BEG_SIMPLE_CALLS && 4034aad88d1fd88413029dd05255306b07cb19396eeBob Wilson CA->getKind() <= CE_END_SIMPLE_CALLS; 4044aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 4054aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 4064aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4074aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \brief Represents a C function or static C++ member function call. 4084aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// 4094aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// Example: \c fun() 4104aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass FunctionCall : public SimpleCall { 4114aad88d1fd88413029dd05255306b07cb19396eeBob Wilson friend class CallEventManager; 4124aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4134aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 4144aad88d1fd88413029dd05255306b07cb19396eeBob Wilson FunctionCall(const CallExpr *CE, ProgramStateRef St, 4154aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx) 4164aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : SimpleCall(CE, St, LCtx) {} 4174aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4184aad88d1fd88413029dd05255306b07cb19396eeBob Wilson FunctionCall(const FunctionCall &Other) : SimpleCall(Other) {} 4194aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual void cloneTo(void *Dest) const { new (Dest) FunctionCall(*this); } 4204aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4214aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonpublic: 4224aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual Kind getKind() const { return CE_Function; } 4234aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4244aad88d1fd88413029dd05255306b07cb19396eeBob Wilson static bool classof(const CallEvent *CA) { 4254aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return CA->getKind() == CE_Function; 4264aad88d1fd88413029dd05255306b07cb19396eeBob Wilson } 4274aad88d1fd88413029dd05255306b07cb19396eeBob Wilson}; 4284aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4294aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// \brief Represents a call to a block. 4304aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// 4314aad88d1fd88413029dd05255306b07cb19396eeBob Wilson/// Example: <tt>^{ /* ... */ }()</tt> 4324aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonclass BlockCall : public SimpleCall { 4334aad88d1fd88413029dd05255306b07cb19396eeBob Wilson friend class CallEventManager; 4344aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4354aad88d1fd88413029dd05255306b07cb19396eeBob Wilsonprotected: 4364aad88d1fd88413029dd05255306b07cb19396eeBob Wilson BlockCall(const CallExpr *CE, ProgramStateRef St, 4374aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const LocationContext *LCtx) 4384aad88d1fd88413029dd05255306b07cb19396eeBob Wilson : SimpleCall(CE, St, LCtx) {} 4394aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4404aad88d1fd88413029dd05255306b07cb19396eeBob Wilson BlockCall(const BlockCall &Other) : SimpleCall(Other) {} 4414aad88d1fd88413029dd05255306b07cb19396eeBob Wilson virtual void cloneTo(void *Dest) const { new (Dest) BlockCall(*this); } 44216717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman 44316717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 44416717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman 44516717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman virtual QualType getDeclaredResultType() const; 44616717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman 44716717a7c562d05915c1b30792eef24de5b264cc6Dan Gohmanpublic: 44816717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman /// \brief Returns the region associated with this instance of the block. 44916717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman /// 45016717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman /// This may be NULL if the block's origin is unknown. 45116717a7c562d05915c1b30792eef24de5b264cc6Dan Gohman const BlockDataRegion *getBlockRegion() const; 4524aad88d1fd88413029dd05255306b07cb19396eeBob Wilson 4534aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// \brief Gets the declaration of the block. 4544aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// 4554aad88d1fd88413029dd05255306b07cb19396eeBob Wilson /// This is not an override of getDecl() because AnyFunctionCall has already 456dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines /// assumed that it's a FunctionDecl. 457dce4a407a24b04eebc6a376f8e62b41aaa7b071fStephen Hines const BlockDecl *getBlockDecl() const { 4584aad88d1fd88413029dd05255306b07cb19396eeBob Wilson const BlockDataRegion *BR = getBlockRegion(); 4594aad88d1fd88413029dd05255306b07cb19396eeBob Wilson if (!BR) 4604aad88d1fd88413029dd05255306b07cb19396eeBob Wilson return 0; 461 return BR->getDecl(); 462 } 463 464 virtual RuntimeDefinition getRuntimeDefinition() const { 465 return RuntimeDefinition(getBlockDecl()); 466 } 467 468 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 469 BindingsTy &Bindings) const; 470 471 virtual param_iterator param_begin() const; 472 virtual param_iterator param_end() const; 473 474 virtual Kind getKind() const { return CE_Block; } 475 476 static bool classof(const CallEvent *CA) { 477 return CA->getKind() == CE_Block; 478 } 479}; 480 481/// \brief Represents a non-static C++ member function call, no matter how 482/// it is written. 483class CXXInstanceCall : public AnyFunctionCall { 484protected: 485 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 486 487 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St, 488 const LocationContext *LCtx) 489 : AnyFunctionCall(CE, St, LCtx) {} 490 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St, 491 const LocationContext *LCtx) 492 : AnyFunctionCall(D, St, LCtx) {} 493 494 495 CXXInstanceCall(const CXXInstanceCall &Other) : AnyFunctionCall(Other) {} 496 497public: 498 /// \brief Returns the expression representing the implicit 'this' object. 499 virtual const Expr *getCXXThisExpr() const { return 0; } 500 501 /// \brief Returns the value of the implicit 'this' object. 502 virtual SVal getCXXThisVal() const { 503 const Expr *Base = getCXXThisExpr(); 504 // FIXME: This doesn't handle an overloaded ->* operator. 505 if (!Base) 506 return UnknownVal(); 507 return getSVal(Base); 508 } 509 510 virtual const FunctionDecl *getDecl() const; 511 512 virtual RuntimeDefinition getRuntimeDefinition() const; 513 514 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 515 BindingsTy &Bindings) const; 516 517 static bool classof(const CallEvent *CA) { 518 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS && 519 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS; 520 } 521}; 522 523/// \brief Represents a non-static C++ member function call. 524/// 525/// Example: \c obj.fun() 526class CXXMemberCall : public CXXInstanceCall { 527 friend class CallEventManager; 528 529protected: 530 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St, 531 const LocationContext *LCtx) 532 : CXXInstanceCall(CE, St, LCtx) {} 533 534 CXXMemberCall(const CXXMemberCall &Other) : CXXInstanceCall(Other) {} 535 virtual void cloneTo(void *Dest) const { new (Dest) CXXMemberCall(*this); } 536 537public: 538 virtual const CXXMemberCallExpr *getOriginExpr() const { 539 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr()); 540 } 541 542 virtual unsigned getNumArgs() const { 543 if (const CallExpr *CE = getOriginExpr()) 544 return CE->getNumArgs(); 545 return 0; 546 } 547 548 virtual const Expr *getArgExpr(unsigned Index) const { 549 return getOriginExpr()->getArg(Index); 550 } 551 552 virtual const Expr *getCXXThisExpr() const; 553 554 virtual Kind getKind() const { return CE_CXXMember; } 555 556 static bool classof(const CallEvent *CA) { 557 return CA->getKind() == CE_CXXMember; 558 } 559}; 560 561/// \brief Represents a C++ overloaded operator call where the operator is 562/// implemented as a non-static member function. 563/// 564/// Example: <tt>iter + 1</tt> 565class CXXMemberOperatorCall : public CXXInstanceCall { 566 friend class CallEventManager; 567 568protected: 569 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St, 570 const LocationContext *LCtx) 571 : CXXInstanceCall(CE, St, LCtx) {} 572 573 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) 574 : CXXInstanceCall(Other) {} 575 virtual void cloneTo(void *Dest) const { 576 new (Dest) CXXMemberOperatorCall(*this); 577 } 578 579public: 580 virtual const CXXOperatorCallExpr *getOriginExpr() const { 581 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr()); 582 } 583 584 virtual unsigned getNumArgs() const { 585 return getOriginExpr()->getNumArgs() - 1; 586 } 587 virtual const Expr *getArgExpr(unsigned Index) const { 588 return getOriginExpr()->getArg(Index + 1); 589 } 590 591 virtual const Expr *getCXXThisExpr() const; 592 593 virtual Kind getKind() const { return CE_CXXMemberOperator; } 594 595 static bool classof(const CallEvent *CA) { 596 return CA->getKind() == CE_CXXMemberOperator; 597 } 598}; 599 600/// \brief Represents an implicit call to a C++ destructor. 601/// 602/// This can occur at the end of a scope (for automatic objects), at the end 603/// of a full-expression (for temporaries), or as part of a delete. 604class CXXDestructorCall : public CXXInstanceCall { 605 friend class CallEventManager; 606 607protected: 608 /// Creates an implicit destructor. 609 /// 610 /// \param DD The destructor that will be called. 611 /// \param Trigger The statement whose completion causes this destructor call. 612 /// \param Target The object region to be destructed. 613 /// \param St The path-sensitive state at this point in the program. 614 /// \param LCtx The location context at this point in the program. 615 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 616 const MemRegion *Target, ProgramStateRef St, 617 const LocationContext *LCtx) 618 : CXXInstanceCall(DD, St, LCtx) { 619 Data = Target; 620 Location = Trigger->getLocEnd(); 621 } 622 623 CXXDestructorCall(const CXXDestructorCall &Other) : CXXInstanceCall(Other) {} 624 virtual void cloneTo(void *Dest) const { new (Dest) CXXDestructorCall(*this); } 625 626public: 627 virtual SourceRange getSourceRange() const { return Location; } 628 virtual unsigned getNumArgs() const { return 0; } 629 630 /// \brief Returns the value of the implicit 'this' object. 631 virtual SVal getCXXThisVal() const; 632 633 virtual Kind getKind() const { return CE_CXXDestructor; } 634 635 static bool classof(const CallEvent *CA) { 636 return CA->getKind() == CE_CXXDestructor; 637 } 638}; 639 640/// \brief Represents a call to a C++ constructor. 641/// 642/// Example: \c T(1) 643class CXXConstructorCall : public AnyFunctionCall { 644 friend class CallEventManager; 645 646protected: 647 /// Creates a constructor call. 648 /// 649 /// \param CE The constructor expression as written in the source. 650 /// \param Target The region where the object should be constructed. If NULL, 651 /// a new symbolic region will be used. 652 /// \param St The path-sensitive state at this point in the program. 653 /// \param LCtx The location context at this point in the program. 654 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *target, 655 ProgramStateRef St, const LocationContext *LCtx) 656 : AnyFunctionCall(CE, St, LCtx) { 657 Data = target; 658 } 659 660 CXXConstructorCall(const CXXConstructorCall &Other) : AnyFunctionCall(Other){} 661 virtual void cloneTo(void *Dest) const { new (Dest) CXXConstructorCall(*this); } 662 663 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 664 665public: 666 virtual const CXXConstructExpr *getOriginExpr() const { 667 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr()); 668 } 669 670 virtual const CXXConstructorDecl *getDecl() const { 671 return getOriginExpr()->getConstructor(); 672 } 673 674 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 675 676 virtual const Expr *getArgExpr(unsigned Index) const { 677 return getOriginExpr()->getArg(Index); 678 } 679 680 /// \brief Returns the value of the implicit 'this' object. 681 SVal getCXXThisVal() const; 682 683 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 684 BindingsTy &Bindings) const; 685 686 virtual Kind getKind() const { return CE_CXXConstructor; } 687 688 static bool classof(const CallEvent *CA) { 689 return CA->getKind() == CE_CXXConstructor; 690 } 691}; 692 693/// \brief Represents the memory allocation call in a C++ new-expression. 694/// 695/// This is a call to "operator new". 696class CXXAllocatorCall : public AnyFunctionCall { 697 friend class CallEventManager; 698 699protected: 700 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St, 701 const LocationContext *LCtx) 702 : AnyFunctionCall(E, St, LCtx) {} 703 704 CXXAllocatorCall(const CXXAllocatorCall &Other) : AnyFunctionCall(Other) {} 705 virtual void cloneTo(void *Dest) const { new (Dest) CXXAllocatorCall(*this); } 706 707public: 708 virtual const CXXNewExpr *getOriginExpr() const { 709 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr()); 710 } 711 712 virtual const FunctionDecl *getDecl() const { 713 return getOriginExpr()->getOperatorNew(); 714 } 715 716 virtual unsigned getNumArgs() const { 717 return getOriginExpr()->getNumPlacementArgs() + 1; 718 } 719 720 virtual const Expr *getArgExpr(unsigned Index) const { 721 // The first argument of an allocator call is the size of the allocation. 722 if (Index == 0) 723 return 0; 724 return getOriginExpr()->getPlacementArg(Index - 1); 725 } 726 727 virtual Kind getKind() const { return CE_CXXAllocator; } 728 729 static bool classof(const CallEvent *CE) { 730 return CE->getKind() == CE_CXXAllocator; 731 } 732}; 733 734/// \brief Represents the ways an Objective-C message send can occur. 735// 736// Note to maintainers: OCM_Message should always be last, since it does not 737// need to fit in the Data field's low bits. 738enum ObjCMessageKind { 739 OCM_PropertyAccess, 740 OCM_Subscript, 741 OCM_Message 742}; 743 744/// \brief Represents any expression that calls an Objective-C method. 745/// 746/// This includes all of the kinds listed in ObjCMessageKind. 747class ObjCMethodCall : public CallEvent { 748 friend class CallEventManager; 749 750 const PseudoObjectExpr *getContainingPseudoObjectExpr() const; 751 752protected: 753 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St, 754 const LocationContext *LCtx) 755 : CallEvent(Msg, St, LCtx) { 756 Data = 0; 757 } 758 759 ObjCMethodCall(const ObjCMethodCall &Other) : CallEvent(Other) {} 760 virtual void cloneTo(void *Dest) const { new (Dest) ObjCMethodCall(*this); } 761 762 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 763 764 virtual QualType getDeclaredResultType() const; 765 766 /// Check if the selector may have multiple definitions (may have overrides). 767 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 768 Selector Sel) const; 769 770public: 771 virtual const ObjCMessageExpr *getOriginExpr() const { 772 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr()); 773 } 774 virtual const ObjCMethodDecl *getDecl() const { 775 return getOriginExpr()->getMethodDecl(); 776 } 777 virtual unsigned getNumArgs() const { 778 return getOriginExpr()->getNumArgs(); 779 } 780 virtual const Expr *getArgExpr(unsigned Index) const { 781 return getOriginExpr()->getArg(Index); 782 } 783 784 bool isInstanceMessage() const { 785 return getOriginExpr()->isInstanceMessage(); 786 } 787 ObjCMethodFamily getMethodFamily() const { 788 return getOriginExpr()->getMethodFamily(); 789 } 790 Selector getSelector() const { 791 return getOriginExpr()->getSelector(); 792 } 793 794 virtual SourceRange getSourceRange() const; 795 796 /// \brief Returns the value of the receiver at the time of this call. 797 SVal getReceiverSVal() const; 798 799 /// \brief Get the interface for the receiver. 800 /// 801 /// This works whether this is an instance message or a class message. 802 /// However, it currently just uses the static type of the receiver. 803 const ObjCInterfaceDecl *getReceiverInterface() const { 804 return getOriginExpr()->getReceiverInterface(); 805 } 806 807 /// Returns how the message was written in the source (property access, 808 /// subscript, or explicit message send). 809 ObjCMessageKind getMessageKind() const; 810 811 /// Returns true if this property access or subscript is a setter (has the 812 /// form of an assignment). 813 bool isSetter() const { 814 switch (getMessageKind()) { 815 case OCM_Message: 816 llvm_unreachable("This is not a pseudo-object access!"); 817 case OCM_PropertyAccess: 818 return getNumArgs() > 0; 819 case OCM_Subscript: 820 return getNumArgs() > 1; 821 } 822 llvm_unreachable("Unknown message kind"); 823 } 824 825 virtual RuntimeDefinition getRuntimeDefinition() const; 826 827 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 828 BindingsTy &Bindings) const; 829 830 virtual param_iterator param_begin() const; 831 virtual param_iterator param_end() const; 832 833 virtual Kind getKind() const { return CE_ObjCMessage; } 834 835 static bool classof(const CallEvent *CA) { 836 return CA->getKind() == CE_ObjCMessage; 837 } 838}; 839 840 841/// \brief Manages the lifetime of CallEvent objects. 842/// 843/// CallEventManager provides a way to create arbitrary CallEvents "on the 844/// stack" as if they were value objects by keeping a cache of CallEvent-sized 845/// memory blocks. The CallEvents created by CallEventManager are only valid 846/// for the lifetime of the OwnedCallEvent that holds them; right now these 847/// objects cannot be copied and ownership cannot be transferred. 848class CallEventManager { 849 friend class CallEvent; 850 851 llvm::BumpPtrAllocator &Alloc; 852 SmallVector<void *, 8> Cache; 853 854 void reclaim(const void *Memory) { 855 Cache.push_back(const_cast<void *>(Memory)); 856 } 857 858 /// Returns memory that can be initialized as a CallEvent. 859 void *allocate() { 860 if (Cache.empty()) 861 return Alloc.Allocate<FunctionCall>(); 862 else 863 return Cache.pop_back_val(); 864 } 865 866 template <typename T, typename Arg> 867 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) { 868 return new (allocate()) T(A, St, LCtx); 869 } 870 871 template <typename T, typename Arg1, typename Arg2> 872 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) { 873 return new (allocate()) T(A1, A2, St, LCtx); 874 } 875 876 template <typename T, typename Arg1, typename Arg2, typename Arg3> 877 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St, 878 const LocationContext *LCtx) { 879 return new (allocate()) T(A1, A2, A3, St, LCtx); 880 } 881 882public: 883 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {} 884 885 886 CallEventRef<> 887 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State); 888 889 890 CallEventRef<> 891 getSimpleCall(const CallExpr *E, ProgramStateRef State, 892 const LocationContext *LCtx); 893 894 CallEventRef<ObjCMethodCall> 895 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, 896 const LocationContext *LCtx) { 897 return create<ObjCMethodCall>(E, State, LCtx); 898 } 899 900 CallEventRef<CXXConstructorCall> 901 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, 902 ProgramStateRef State, const LocationContext *LCtx) { 903 return create<CXXConstructorCall>(E, Target, State, LCtx); 904 } 905 906 CallEventRef<CXXDestructorCall> 907 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 908 const MemRegion *Target, ProgramStateRef State, 909 const LocationContext *LCtx) { 910 return create<CXXDestructorCall>(DD, Trigger, Target, State, LCtx); 911 } 912 913 CallEventRef<CXXAllocatorCall> 914 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, 915 const LocationContext *LCtx) { 916 return create<CXXAllocatorCall>(E, State, LCtx); 917 } 918}; 919 920 921template <typename T> 922CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const { 923 assert(isa<T>(*this) && "Cloning to unrelated type"); 924 assert(sizeof(T) == sizeof(CallEvent) && "Subclasses may not add fields"); 925 926 if (NewState == State) 927 return cast<T>(this); 928 929 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 930 T *Copy = static_cast<T *>(Mgr.allocate()); 931 cloneTo(Copy); 932 assert(Copy->getKind() == this->getKind() && "Bad copy"); 933 934 Copy->State = NewState; 935 return Copy; 936} 937 938inline void CallEvent::Release() const { 939 assert(RefCount > 0 && "Reference count is already zero."); 940 --RefCount; 941 942 if (RefCount > 0) 943 return; 944 945 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 946 Mgr.reclaim(this); 947 948 this->~CallEvent(); 949} 950 951} // end namespace ento 952} // end namespace clang 953 954namespace llvm { 955 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef. 956 template<class T> struct simplify_type< clang::ento::CallEventRef<T> > { 957 typedef const T *SimpleType; 958 959 static SimpleType 960 getSimplifiedValue(const clang::ento::CallEventRef<T>& Val) { 961 return Val.getPtr(); 962 } 963 }; 964} 965 966#endif 967