CallEvent.h revision ddc0c4814788dda4ef224cd4d22d07154a6ede49
1//===- CallEvent.h - Wrapper for all function and method calls ----*- C++ -*--// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file is distributed under the University of Illinois Open Source 6// License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10/// \file This file defines CallEvent and its subclasses, which represent path- 11/// sensitive instances of different kinds of function and method calls 12/// (C, C++, and Objective-C). 13// 14//===----------------------------------------------------------------------===// 15 16#ifndef LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 17#define LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 18 19#include "clang/Basic/SourceManager.h" 20#include "clang/AST/DeclCXX.h" 21#include "clang/AST/ExprCXX.h" 22#include "clang/AST/ExprObjC.h" 23#include "clang/Analysis/AnalysisContext.h" 24#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 25#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 26#include "llvm/ADT/PointerIntPair.h" 27 28namespace clang { 29class ProgramPoint; 30class ProgramPointTag; 31 32namespace ento { 33 34enum CallEventKind { 35 CE_Function, 36 CE_Block, 37 CE_BEG_SIMPLE_CALLS = CE_Function, 38 CE_END_SIMPLE_CALLS = CE_Block, 39 CE_CXXMember, 40 CE_CXXMemberOperator, 41 CE_CXXDestructor, 42 CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember, 43 CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor, 44 CE_CXXConstructor, 45 CE_CXXAllocator, 46 CE_BEG_FUNCTION_CALLS = CE_Function, 47 CE_END_FUNCTION_CALLS = CE_CXXAllocator, 48 CE_ObjCMessage 49}; 50 51class CallEvent; 52class CallEventManager; 53 54template<typename T = CallEvent> 55class CallEventRef : public IntrusiveRefCntPtr<const T> { 56public: 57 CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {} 58 CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {} 59 60 CallEventRef<T> cloneWithState(ProgramStateRef State) const { 61 return this->getPtr()->template cloneWithState<T>(State); 62 } 63 64 // Allow implicit conversions to a superclass type, since CallEventRef 65 // behaves like a pointer-to-const. 66 template <typename SuperT> 67 operator CallEventRef<SuperT> () const { 68 return this->getPtr(); 69 } 70}; 71 72/// \class RuntimeDefinition 73/// \brief Defines the runtime definition of the called function. 74/// 75/// Encapsulates the information we have about which Decl will be used 76/// when the call is executed on the given path. When dealing with dynamic 77/// dispatch, the information is based on DynamicTypeInfo and might not be 78/// precise. 79class RuntimeDefinition { 80 /// The Declaration of the function which could be called at runtime. 81 /// NULL if not available. 82 const Decl *D; 83 84 /// The region representing an object (ObjC/C++) on which the method is 85 /// called. With dynamic dispatch, the method definition depends on the 86 /// runtime type of this object. NULL when the DynamicTypeInfo is 87 /// precise. 88 const MemRegion *R; 89 90public: 91 RuntimeDefinition(): D(0), R(0) {} 92 RuntimeDefinition(const Decl *InD): D(InD), R(0) {} 93 RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {} 94 const Decl *getDecl() { return D; } 95 96 /// \brief Check if the definition we have is precise. 97 /// If not, it is possible that the call dispatches to another definition at 98 /// execution time. 99 bool mayHaveOtherDefinitions() { return R != 0; } 100 101 /// When other definitions are possible, returns the region whose runtime type 102 /// determines the method definition. 103 const MemRegion *getDispatchRegion() { return R; } 104}; 105 106/// \brief Represents an abstract call to a function or method along a 107/// particular path. 108/// 109/// CallEvents are created through the factory methods of CallEventManager. 110/// 111/// CallEvents should always be cheap to create and destroy. In order for 112/// CallEventManager to be able to re-use CallEvent-sized memory blocks, 113/// subclasses of CallEvent may not add any data members to the base class. 114/// Use the "Data" and "Location" fields instead. 115class CallEvent { 116public: 117 typedef CallEventKind Kind; 118 119private: 120 ProgramStateRef State; 121 const LocationContext *LCtx; 122 llvm::PointerUnion<const Expr *, const Decl *> Origin; 123 124 void operator=(const CallEvent &) LLVM_DELETED_FUNCTION; 125 126protected: 127 // This is user data for subclasses. 128 const void *Data; 129 130 // This is user data for subclasses. 131 // This should come right before RefCount, so that the two fields can be 132 // packed together on LP64 platforms. 133 SourceLocation Location; 134 135private: 136 mutable unsigned RefCount; 137 138 template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo; 139 void Retain() const { ++RefCount; } 140 void Release() const; 141 142protected: 143 friend class CallEventManager; 144 145 CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx) 146 : State(state), LCtx(lctx), Origin(E), RefCount(0) {} 147 148 CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx) 149 : State(state), LCtx(lctx), Origin(D), RefCount(0) {} 150 151 // DO NOT MAKE PUBLIC 152 CallEvent(const CallEvent &Original) 153 : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin), 154 Data(Original.Data), Location(Original.Location), RefCount(0) {} 155 156 /// Copies this CallEvent, with vtable intact, into a new block of memory. 157 virtual void cloneTo(void *Dest) const = 0; 158 159 /// \brief Get the value of arbitrary expressions at this point in the path. 160 SVal getSVal(const Stmt *S) const { 161 return getState()->getSVal(S, getLocationContext()); 162 } 163 164 165 typedef SmallVectorImpl<const MemRegion *> RegionList; 166 167 /// \brief Used to specify non-argument regions that will be invalidated as a 168 /// result of this call. 169 virtual void getExtraInvalidatedRegions(RegionList &Regions) const {} 170 171public: 172 virtual ~CallEvent() {} 173 174 /// \brief Returns the kind of call this is. 175 virtual Kind getKind() const = 0; 176 177 /// \brief Returns the declaration of the function or method that will be 178 /// called. May be null. 179 virtual const Decl *getDecl() const { 180 return Origin.dyn_cast<const Decl *>(); 181 } 182 183 /// \brief The state in which the call is being evaluated. 184 ProgramStateRef getState() const { 185 return State; 186 } 187 188 /// \brief The context in which the call is being evaluated. 189 const LocationContext *getLocationContext() const { 190 return LCtx; 191 } 192 193 /// \brief Returns the definition of the function or method that will be 194 /// called. 195 virtual RuntimeDefinition getRuntimeDefinition() const = 0; 196 197 /// \brief Returns the expression whose value will be the result of this call. 198 /// May be null. 199 const Expr *getOriginExpr() const { 200 return Origin.dyn_cast<const Expr *>(); 201 } 202 203 /// \brief Returns the number of arguments (explicit and implicit). 204 /// 205 /// Note that this may be greater than the number of parameters in the 206 /// callee's declaration, and that it may include arguments not written in 207 /// the source. 208 virtual unsigned getNumArgs() const = 0; 209 210 /// \brief Returns true if the callee is known to be from a system header. 211 bool isInSystemHeader() const { 212 const Decl *D = getDecl(); 213 if (!D) 214 return false; 215 216 SourceLocation Loc = D->getLocation(); 217 if (Loc.isValid()) { 218 const SourceManager &SM = 219 getState()->getStateManager().getContext().getSourceManager(); 220 return SM.isInSystemHeader(D->getLocation()); 221 } 222 223 // Special case for implicitly-declared global operator new/delete. 224 // These should be considered system functions. 225 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) 226 return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal(); 227 228 return false; 229 } 230 231 /// \brief Returns a source range for the entire call, suitable for 232 /// outputting in diagnostics. 233 virtual SourceRange getSourceRange() const { 234 return getOriginExpr()->getSourceRange(); 235 } 236 237 /// \brief Returns the value of a given argument at the time of the call. 238 virtual SVal getArgSVal(unsigned Index) const; 239 240 /// \brief Returns the expression associated with a given argument. 241 /// May be null if this expression does not appear in the source. 242 virtual const Expr *getArgExpr(unsigned Index) const { return 0; } 243 244 /// \brief Returns the source range for errors associated with this argument. 245 /// 246 /// May be invalid if the argument is not written in the source. 247 virtual SourceRange getArgSourceRange(unsigned Index) const; 248 249 /// \brief Returns the result type, adjusted for references. 250 QualType getResultType() const; 251 252 /// \brief Returns true if any of the arguments appear to represent callbacks. 253 bool hasNonZeroCallbackArg() const; 254 255 /// \brief Returns true if any of the arguments are known to escape to long- 256 /// term storage, even if this method will not modify them. 257 // NOTE: The exact semantics of this are still being defined! 258 // We don't really want a list of hardcoded exceptions in the long run, 259 // but we don't want duplicated lists of known APIs in the short term either. 260 virtual bool argumentsMayEscape() const { 261 return hasNonZeroCallbackArg(); 262 } 263 264 /// \brief Returns an appropriate ProgramPoint for this call. 265 ProgramPoint getProgramPoint(bool IsPreVisit = false, 266 const ProgramPointTag *Tag = 0) const; 267 268 /// \brief Returns a new state with all argument regions invalidated. 269 /// 270 /// This accepts an alternate state in case some processing has already 271 /// occurred. 272 ProgramStateRef invalidateRegions(unsigned BlockCount, 273 ProgramStateRef Orig = 0) const; 274 275 typedef std::pair<Loc, SVal> FrameBindingTy; 276 typedef SmallVectorImpl<FrameBindingTy> BindingsTy; 277 278 /// Populates the given SmallVector with the bindings in the callee's stack 279 /// frame at the start of this call. 280 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 281 BindingsTy &Bindings) const = 0; 282 283 /// Returns a copy of this CallEvent, but using the given state. 284 template <typename T> 285 CallEventRef<T> cloneWithState(ProgramStateRef NewState) const; 286 287 /// Returns a copy of this CallEvent, but using the given state. 288 CallEventRef<> cloneWithState(ProgramStateRef NewState) const { 289 return cloneWithState<CallEvent>(NewState); 290 } 291 292 /// \brief Returns true if this is a statement is a function or method call 293 /// of some kind. 294 static bool isCallStmt(const Stmt *S); 295 296 /// \brief Returns the result type of a function, method declaration. 297 static QualType getDeclaredResultType(const Decl *D); 298 299 // Iterator access to formal parameters and their types. 300private: 301 typedef std::const_mem_fun_t<QualType, ParmVarDecl> get_type_fun; 302 303public: 304 typedef const ParmVarDecl * const *param_iterator; 305 306 /// Returns an iterator over the call's formal parameters. 307 /// 308 /// If UseDefinitionParams is set, this will return the parameter decls 309 /// used in the callee's definition (suitable for inlining). Most of the 310 /// time it is better to use the decl found by name lookup, which likely 311 /// carries more annotations. 312 /// 313 /// Remember that the number of formal parameters may not match the number 314 /// of arguments for all calls. However, the first parameter will always 315 /// correspond with the argument value returned by \c getArgSVal(0). 316 /// 317 /// If the call has no accessible declaration (or definition, if 318 /// \p UseDefinitionParams is set), \c param_begin() will be equal to 319 /// \c param_end(). 320 virtual param_iterator param_begin() const =0; 321 /// \sa param_begin() 322 virtual param_iterator param_end() const = 0; 323 324 typedef llvm::mapped_iterator<param_iterator, get_type_fun> 325 param_type_iterator; 326 327 /// Returns an iterator over the types of the call's formal parameters. 328 /// 329 /// This uses the callee decl found by default name lookup rather than the 330 /// definition because it represents a public interface, and probably has 331 /// more annotations. 332 param_type_iterator param_type_begin() const { 333 return llvm::map_iterator(param_begin(), 334 get_type_fun(&ParmVarDecl::getType)); 335 } 336 /// \sa param_type_begin() 337 param_type_iterator param_type_end() const { 338 return llvm::map_iterator(param_end(), get_type_fun(&ParmVarDecl::getType)); 339 } 340 341 // For debugging purposes only 342 void dump(raw_ostream &Out) const; 343 LLVM_ATTRIBUTE_USED void dump() const; 344 345 static bool classof(const CallEvent *) { return true; } 346}; 347 348 349/// \brief Represents a call to any sort of function that might have a 350/// FunctionDecl. 351class AnyFunctionCall : public CallEvent { 352protected: 353 AnyFunctionCall(const Expr *E, ProgramStateRef St, 354 const LocationContext *LCtx) 355 : CallEvent(E, St, LCtx) {} 356 AnyFunctionCall(const Decl *D, ProgramStateRef St, 357 const LocationContext *LCtx) 358 : CallEvent(D, St, LCtx) {} 359 AnyFunctionCall(const AnyFunctionCall &Other) : CallEvent(Other) {} 360 361public: 362 // This function is overridden by subclasses, but they must return 363 // a FunctionDecl. 364 virtual const FunctionDecl *getDecl() const { 365 return cast<FunctionDecl>(CallEvent::getDecl()); 366 } 367 368 virtual RuntimeDefinition getRuntimeDefinition() const { 369 const FunctionDecl *FD = getDecl(); 370 // Note that the AnalysisDeclContext will have the FunctionDecl with 371 // the definition (if one exists). 372 if (FD) { 373 AnalysisDeclContext *AD = 374 getLocationContext()->getAnalysisDeclContext()-> 375 getManager()->getContext(FD); 376 if (AD->getBody()) 377 return RuntimeDefinition(AD->getDecl()); 378 } 379 380 return RuntimeDefinition(); 381 } 382 383 virtual bool argumentsMayEscape() const; 384 385 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 386 BindingsTy &Bindings) const; 387 388 virtual param_iterator param_begin() const; 389 virtual param_iterator param_end() const; 390 391 static bool classof(const CallEvent *CA) { 392 return CA->getKind() >= CE_BEG_FUNCTION_CALLS && 393 CA->getKind() <= CE_END_FUNCTION_CALLS; 394 } 395}; 396 397/// \brief Represents a call to a non-C++ function, written as a CallExpr. 398class SimpleCall : public AnyFunctionCall { 399protected: 400 SimpleCall(const CallExpr *CE, ProgramStateRef St, 401 const LocationContext *LCtx) 402 : AnyFunctionCall(CE, St, LCtx) {} 403 SimpleCall(const SimpleCall &Other) : AnyFunctionCall(Other) {} 404 405public: 406 virtual const CallExpr *getOriginExpr() const { 407 return cast<CallExpr>(AnyFunctionCall::getOriginExpr()); 408 } 409 410 virtual const FunctionDecl *getDecl() const; 411 412 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 413 414 virtual const Expr *getArgExpr(unsigned Index) const { 415 return getOriginExpr()->getArg(Index); 416 } 417 418 static bool classof(const CallEvent *CA) { 419 return CA->getKind() >= CE_BEG_SIMPLE_CALLS && 420 CA->getKind() <= CE_END_SIMPLE_CALLS; 421 } 422}; 423 424/// \brief Represents a C function or static C++ member function call. 425/// 426/// Example: \c fun() 427class FunctionCall : public SimpleCall { 428 friend class CallEventManager; 429 430protected: 431 FunctionCall(const CallExpr *CE, ProgramStateRef St, 432 const LocationContext *LCtx) 433 : SimpleCall(CE, St, LCtx) {} 434 435 FunctionCall(const FunctionCall &Other) : SimpleCall(Other) {} 436 virtual void cloneTo(void *Dest) const { new (Dest) FunctionCall(*this); } 437 438public: 439 virtual Kind getKind() const { return CE_Function; } 440 441 static bool classof(const CallEvent *CA) { 442 return CA->getKind() == CE_Function; 443 } 444}; 445 446/// \brief Represents a call to a block. 447/// 448/// Example: <tt>^{ /* ... */ }()</tt> 449class BlockCall : public SimpleCall { 450 friend class CallEventManager; 451 452protected: 453 BlockCall(const CallExpr *CE, ProgramStateRef St, 454 const LocationContext *LCtx) 455 : SimpleCall(CE, St, LCtx) {} 456 457 BlockCall(const BlockCall &Other) : SimpleCall(Other) {} 458 virtual void cloneTo(void *Dest) const { new (Dest) BlockCall(*this); } 459 460 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 461 462public: 463 /// \brief Returns the region associated with this instance of the block. 464 /// 465 /// This may be NULL if the block's origin is unknown. 466 const BlockDataRegion *getBlockRegion() const; 467 468 /// \brief Gets the declaration of the block. 469 /// 470 /// This is not an override of getDecl() because AnyFunctionCall has already 471 /// assumed that it's a FunctionDecl. 472 const BlockDecl *getBlockDecl() const { 473 const BlockDataRegion *BR = getBlockRegion(); 474 if (!BR) 475 return 0; 476 return BR->getDecl(); 477 } 478 479 virtual RuntimeDefinition getRuntimeDefinition() const { 480 return RuntimeDefinition(getBlockDecl()); 481 } 482 483 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 484 BindingsTy &Bindings) const; 485 486 virtual param_iterator param_begin() const; 487 virtual param_iterator param_end() const; 488 489 virtual Kind getKind() const { return CE_Block; } 490 491 static bool classof(const CallEvent *CA) { 492 return CA->getKind() == CE_Block; 493 } 494}; 495 496/// \brief Represents a non-static C++ member function call, no matter how 497/// it is written. 498class CXXInstanceCall : public AnyFunctionCall { 499protected: 500 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 501 502 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St, 503 const LocationContext *LCtx) 504 : AnyFunctionCall(CE, St, LCtx) {} 505 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St, 506 const LocationContext *LCtx) 507 : AnyFunctionCall(D, St, LCtx) {} 508 509 510 CXXInstanceCall(const CXXInstanceCall &Other) : AnyFunctionCall(Other) {} 511 512public: 513 /// \brief Returns the expression representing the implicit 'this' object. 514 virtual const Expr *getCXXThisExpr() const { return 0; } 515 516 /// \brief Returns the value of the implicit 'this' object. 517 virtual SVal getCXXThisVal() const; 518 519 virtual const FunctionDecl *getDecl() const; 520 521 virtual RuntimeDefinition getRuntimeDefinition() const; 522 523 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 524 BindingsTy &Bindings) const; 525 526 static bool classof(const CallEvent *CA) { 527 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS && 528 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS; 529 } 530}; 531 532/// \brief Represents a non-static C++ member function call. 533/// 534/// Example: \c obj.fun() 535class CXXMemberCall : public CXXInstanceCall { 536 friend class CallEventManager; 537 538protected: 539 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St, 540 const LocationContext *LCtx) 541 : CXXInstanceCall(CE, St, LCtx) {} 542 543 CXXMemberCall(const CXXMemberCall &Other) : CXXInstanceCall(Other) {} 544 virtual void cloneTo(void *Dest) const { new (Dest) CXXMemberCall(*this); } 545 546public: 547 virtual const CXXMemberCallExpr *getOriginExpr() const { 548 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr()); 549 } 550 551 virtual unsigned getNumArgs() const { 552 if (const CallExpr *CE = getOriginExpr()) 553 return CE->getNumArgs(); 554 return 0; 555 } 556 557 virtual const Expr *getArgExpr(unsigned Index) const { 558 return getOriginExpr()->getArg(Index); 559 } 560 561 virtual const Expr *getCXXThisExpr() const; 562 563 virtual RuntimeDefinition getRuntimeDefinition() const; 564 565 virtual Kind getKind() const { return CE_CXXMember; } 566 567 static bool classof(const CallEvent *CA) { 568 return CA->getKind() == CE_CXXMember; 569 } 570}; 571 572/// \brief Represents a C++ overloaded operator call where the operator is 573/// implemented as a non-static member function. 574/// 575/// Example: <tt>iter + 1</tt> 576class CXXMemberOperatorCall : public CXXInstanceCall { 577 friend class CallEventManager; 578 579protected: 580 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St, 581 const LocationContext *LCtx) 582 : CXXInstanceCall(CE, St, LCtx) {} 583 584 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) 585 : CXXInstanceCall(Other) {} 586 virtual void cloneTo(void *Dest) const { 587 new (Dest) CXXMemberOperatorCall(*this); 588 } 589 590public: 591 virtual const CXXOperatorCallExpr *getOriginExpr() const { 592 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr()); 593 } 594 595 virtual unsigned getNumArgs() const { 596 return getOriginExpr()->getNumArgs() - 1; 597 } 598 virtual const Expr *getArgExpr(unsigned Index) const { 599 return getOriginExpr()->getArg(Index + 1); 600 } 601 602 virtual const Expr *getCXXThisExpr() const; 603 604 virtual Kind getKind() const { return CE_CXXMemberOperator; } 605 606 static bool classof(const CallEvent *CA) { 607 return CA->getKind() == CE_CXXMemberOperator; 608 } 609}; 610 611/// \brief Represents an implicit call to a C++ destructor. 612/// 613/// This can occur at the end of a scope (for automatic objects), at the end 614/// of a full-expression (for temporaries), or as part of a delete. 615class CXXDestructorCall : public CXXInstanceCall { 616 friend class CallEventManager; 617 618protected: 619 typedef llvm::PointerIntPair<const MemRegion *, 1, bool> DtorDataTy; 620 621 /// Creates an implicit destructor. 622 /// 623 /// \param DD The destructor that will be called. 624 /// \param Trigger The statement whose completion causes this destructor call. 625 /// \param Target The object region to be destructed. 626 /// \param St The path-sensitive state at this point in the program. 627 /// \param LCtx The location context at this point in the program. 628 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 629 const MemRegion *Target, bool IsBaseDestructor, 630 ProgramStateRef St, const LocationContext *LCtx) 631 : CXXInstanceCall(DD, St, LCtx) { 632 Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue(); 633 Location = Trigger->getLocEnd(); 634 } 635 636 CXXDestructorCall(const CXXDestructorCall &Other) : CXXInstanceCall(Other) {} 637 virtual void cloneTo(void *Dest) const { new (Dest) CXXDestructorCall(*this); } 638 639public: 640 virtual SourceRange getSourceRange() const { return Location; } 641 virtual unsigned getNumArgs() const { return 0; } 642 643 virtual RuntimeDefinition getRuntimeDefinition() const; 644 645 /// \brief Returns the value of the implicit 'this' object. 646 virtual SVal getCXXThisVal() const; 647 648 /// Returns true if this is a call to a base class destructor. 649 bool isBaseDestructor() const { 650 return DtorDataTy::getFromOpaqueValue(Data).getInt(); 651 } 652 653 virtual Kind getKind() const { return CE_CXXDestructor; } 654 655 static bool classof(const CallEvent *CA) { 656 return CA->getKind() == CE_CXXDestructor; 657 } 658}; 659 660/// \brief Represents a call to a C++ constructor. 661/// 662/// Example: \c T(1) 663class CXXConstructorCall : public AnyFunctionCall { 664 friend class CallEventManager; 665 666protected: 667 /// Creates a constructor call. 668 /// 669 /// \param CE The constructor expression as written in the source. 670 /// \param Target The region where the object should be constructed. If NULL, 671 /// a new symbolic region will be used. 672 /// \param St The path-sensitive state at this point in the program. 673 /// \param LCtx The location context at this point in the program. 674 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target, 675 ProgramStateRef St, const LocationContext *LCtx) 676 : AnyFunctionCall(CE, St, LCtx) { 677 Data = Target; 678 } 679 680 CXXConstructorCall(const CXXConstructorCall &Other) : AnyFunctionCall(Other){} 681 virtual void cloneTo(void *Dest) const { new (Dest) CXXConstructorCall(*this); } 682 683 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 684 685public: 686 virtual const CXXConstructExpr *getOriginExpr() const { 687 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr()); 688 } 689 690 virtual const CXXConstructorDecl *getDecl() const { 691 return getOriginExpr()->getConstructor(); 692 } 693 694 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 695 696 virtual const Expr *getArgExpr(unsigned Index) const { 697 return getOriginExpr()->getArg(Index); 698 } 699 700 /// \brief Returns the value of the implicit 'this' object. 701 SVal getCXXThisVal() const; 702 703 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 704 BindingsTy &Bindings) const; 705 706 virtual Kind getKind() const { return CE_CXXConstructor; } 707 708 static bool classof(const CallEvent *CA) { 709 return CA->getKind() == CE_CXXConstructor; 710 } 711}; 712 713/// \brief Represents the memory allocation call in a C++ new-expression. 714/// 715/// This is a call to "operator new". 716class CXXAllocatorCall : public AnyFunctionCall { 717 friend class CallEventManager; 718 719protected: 720 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St, 721 const LocationContext *LCtx) 722 : AnyFunctionCall(E, St, LCtx) {} 723 724 CXXAllocatorCall(const CXXAllocatorCall &Other) : AnyFunctionCall(Other) {} 725 virtual void cloneTo(void *Dest) const { new (Dest) CXXAllocatorCall(*this); } 726 727public: 728 virtual const CXXNewExpr *getOriginExpr() const { 729 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr()); 730 } 731 732 virtual const FunctionDecl *getDecl() const { 733 return getOriginExpr()->getOperatorNew(); 734 } 735 736 virtual unsigned getNumArgs() const { 737 return getOriginExpr()->getNumPlacementArgs() + 1; 738 } 739 740 virtual const Expr *getArgExpr(unsigned Index) const { 741 // The first argument of an allocator call is the size of the allocation. 742 if (Index == 0) 743 return 0; 744 return getOriginExpr()->getPlacementArg(Index - 1); 745 } 746 747 virtual Kind getKind() const { return CE_CXXAllocator; } 748 749 static bool classof(const CallEvent *CE) { 750 return CE->getKind() == CE_CXXAllocator; 751 } 752}; 753 754/// \brief Represents the ways an Objective-C message send can occur. 755// 756// Note to maintainers: OCM_Message should always be last, since it does not 757// need to fit in the Data field's low bits. 758enum ObjCMessageKind { 759 OCM_PropertyAccess, 760 OCM_Subscript, 761 OCM_Message 762}; 763 764/// \brief Represents any expression that calls an Objective-C method. 765/// 766/// This includes all of the kinds listed in ObjCMessageKind. 767class ObjCMethodCall : public CallEvent { 768 friend class CallEventManager; 769 770 const PseudoObjectExpr *getContainingPseudoObjectExpr() const; 771 772protected: 773 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St, 774 const LocationContext *LCtx) 775 : CallEvent(Msg, St, LCtx) { 776 Data = 0; 777 } 778 779 ObjCMethodCall(const ObjCMethodCall &Other) : CallEvent(Other) {} 780 virtual void cloneTo(void *Dest) const { new (Dest) ObjCMethodCall(*this); } 781 782 virtual void getExtraInvalidatedRegions(RegionList &Regions) const; 783 784 /// Check if the selector may have multiple definitions (may have overrides). 785 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 786 Selector Sel) const; 787 788public: 789 virtual const ObjCMessageExpr *getOriginExpr() const { 790 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr()); 791 } 792 virtual const ObjCMethodDecl *getDecl() const { 793 return getOriginExpr()->getMethodDecl(); 794 } 795 virtual unsigned getNumArgs() const { 796 return getOriginExpr()->getNumArgs(); 797 } 798 virtual const Expr *getArgExpr(unsigned Index) const { 799 return getOriginExpr()->getArg(Index); 800 } 801 802 bool isInstanceMessage() const { 803 return getOriginExpr()->isInstanceMessage(); 804 } 805 ObjCMethodFamily getMethodFamily() const { 806 return getOriginExpr()->getMethodFamily(); 807 } 808 Selector getSelector() const { 809 return getOriginExpr()->getSelector(); 810 } 811 812 virtual SourceRange getSourceRange() const; 813 814 /// \brief Returns the value of the receiver at the time of this call. 815 SVal getReceiverSVal() const; 816 817 /// \brief Return the value of 'self' if available. 818 SVal getSelfSVal() const; 819 820 /// \brief Get the interface for the receiver. 821 /// 822 /// This works whether this is an instance message or a class message. 823 /// However, it currently just uses the static type of the receiver. 824 const ObjCInterfaceDecl *getReceiverInterface() const { 825 return getOriginExpr()->getReceiverInterface(); 826 } 827 828 /// \brief Checks if the receiver refers to 'self' or 'super'. 829 bool isReceiverSelfOrSuper() const; 830 831 /// Returns how the message was written in the source (property access, 832 /// subscript, or explicit message send). 833 ObjCMessageKind getMessageKind() const; 834 835 /// Returns true if this property access or subscript is a setter (has the 836 /// form of an assignment). 837 bool isSetter() const { 838 switch (getMessageKind()) { 839 case OCM_Message: 840 llvm_unreachable("This is not a pseudo-object access!"); 841 case OCM_PropertyAccess: 842 return getNumArgs() > 0; 843 case OCM_Subscript: 844 return getNumArgs() > 1; 845 } 846 llvm_unreachable("Unknown message kind"); 847 } 848 849 virtual RuntimeDefinition getRuntimeDefinition() const; 850 851 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 852 BindingsTy &Bindings) const; 853 854 virtual param_iterator param_begin() const; 855 virtual param_iterator param_end() const; 856 857 virtual Kind getKind() const { return CE_ObjCMessage; } 858 859 static bool classof(const CallEvent *CA) { 860 return CA->getKind() == CE_ObjCMessage; 861 } 862}; 863 864 865/// \brief Manages the lifetime of CallEvent objects. 866/// 867/// CallEventManager provides a way to create arbitrary CallEvents "on the 868/// stack" as if they were value objects by keeping a cache of CallEvent-sized 869/// memory blocks. The CallEvents created by CallEventManager are only valid 870/// for the lifetime of the OwnedCallEvent that holds them; right now these 871/// objects cannot be copied and ownership cannot be transferred. 872class CallEventManager { 873 friend class CallEvent; 874 875 llvm::BumpPtrAllocator &Alloc; 876 SmallVector<void *, 8> Cache; 877 878 void reclaim(const void *Memory) { 879 Cache.push_back(const_cast<void *>(Memory)); 880 } 881 882 /// Returns memory that can be initialized as a CallEvent. 883 void *allocate() { 884 if (Cache.empty()) 885 return Alloc.Allocate<FunctionCall>(); 886 else 887 return Cache.pop_back_val(); 888 } 889 890 template <typename T, typename Arg> 891 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) { 892 return new (allocate()) T(A, St, LCtx); 893 } 894 895 template <typename T, typename Arg1, typename Arg2> 896 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) { 897 return new (allocate()) T(A1, A2, St, LCtx); 898 } 899 900 template <typename T, typename Arg1, typename Arg2, typename Arg3> 901 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St, 902 const LocationContext *LCtx) { 903 return new (allocate()) T(A1, A2, A3, St, LCtx); 904 } 905 906 template <typename T, typename Arg1, typename Arg2, typename Arg3, 907 typename Arg4> 908 T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St, 909 const LocationContext *LCtx) { 910 return new (allocate()) T(A1, A2, A3, A4, St, LCtx); 911 } 912 913public: 914 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {} 915 916 917 CallEventRef<> 918 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State); 919 920 921 CallEventRef<> 922 getSimpleCall(const CallExpr *E, ProgramStateRef State, 923 const LocationContext *LCtx); 924 925 CallEventRef<ObjCMethodCall> 926 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, 927 const LocationContext *LCtx) { 928 return create<ObjCMethodCall>(E, State, LCtx); 929 } 930 931 CallEventRef<CXXConstructorCall> 932 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, 933 ProgramStateRef State, const LocationContext *LCtx) { 934 return create<CXXConstructorCall>(E, Target, State, LCtx); 935 } 936 937 CallEventRef<CXXDestructorCall> 938 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 939 const MemRegion *Target, bool IsBase, 940 ProgramStateRef State, const LocationContext *LCtx) { 941 return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx); 942 } 943 944 CallEventRef<CXXAllocatorCall> 945 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, 946 const LocationContext *LCtx) { 947 return create<CXXAllocatorCall>(E, State, LCtx); 948 } 949}; 950 951 952template <typename T> 953CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const { 954 assert(isa<T>(*this) && "Cloning to unrelated type"); 955 assert(sizeof(T) == sizeof(CallEvent) && "Subclasses may not add fields"); 956 957 if (NewState == State) 958 return cast<T>(this); 959 960 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 961 T *Copy = static_cast<T *>(Mgr.allocate()); 962 cloneTo(Copy); 963 assert(Copy->getKind() == this->getKind() && "Bad copy"); 964 965 Copy->State = NewState; 966 return Copy; 967} 968 969inline void CallEvent::Release() const { 970 assert(RefCount > 0 && "Reference count is already zero."); 971 --RefCount; 972 973 if (RefCount > 0) 974 return; 975 976 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 977 Mgr.reclaim(this); 978 979 this->~CallEvent(); 980} 981 982} // end namespace ento 983} // end namespace clang 984 985namespace llvm { 986 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef. 987 template<class T> struct simplify_type< clang::ento::CallEventRef<T> > { 988 typedef const T *SimpleType; 989 990 static SimpleType 991 getSimplifiedValue(const clang::ento::CallEventRef<T>& Val) { 992 return Val.getPtr(); 993 } 994 }; 995} 996 997#endif 998