CallEvent.cpp revision 1655bcd052a67a3050fc55df8ecce57342352e68
12a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--// 22a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 32a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// The LLVM Compiler Infrastructure 42a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 52a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// This file is distributed under the University of Illinois Open Source 62a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// License. See LICENSE.TXT for details. 72a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 82a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===----------------------------------------------------------------------===// 92a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// \file This file defines CallEvent and its subclasses, which represent path- 112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// sensitive instances of different kinds of function and method calls 122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// (C, C++, and Objective-C). 132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// 142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)//===----------------------------------------------------------------------===// 152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "clang/AST/ParentMap.h" 182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)#include "clang/Analysis/ProgramPoint.h" 1990dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 2090dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "llvm/ADT/SmallSet.h" 2190dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "llvm/ADT/StringExtras.h" 2290dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)#include "llvm/Support/raw_ostream.h" 2390dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 2490dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)using namespace clang; 2590dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles)using namespace ento; 2690dce4d38c5ff5333bea97d859d4e484e27edf0cTorne (Richard Coles) 272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)QualType CallEvent::getResultType() const { 282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Expr *E = getOriginExpr(); 292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(E && "Calls without origin expressions do not have results"); 302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) QualType ResultTy = E->getType(); 312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASTContext &Ctx = getState()->getStateManager().getContext(); 332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // A function that returns a reference to 'int' will have a result type 352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // of simply 'int'. Check the origin expr's value kind to recover the 362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // proper type. 372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) switch (E->getValueKind()) { 382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) case VK_LValue: 392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ResultTy = Ctx.getLValueReferenceType(ResultTy); 402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) break; 412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) case VK_XValue: 422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ResultTy = Ctx.getRValueReferenceType(ResultTy); 432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) break; 442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) case VK_RValue: 452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // No adjustment is necessary. 462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) break; 472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return ResultTy; 502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static bool isCallbackArg(SVal V, QualType T) { 532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If the parameter is 0, it's harmless. 542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (V.isZeroConstant()) 552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If a parameter is a block or a callback, assume it can modify pointer. 582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (T->isBlockPointerType() || 592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) T->isFunctionPointerType() || 602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) T->isObjCSelType()) 612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Check if a callback is passed inside a struct (for both, struct passed by 642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // reference and by value). Dig just one level into the struct for now. 652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (T->isAnyPointerType() || T->isReferenceType()) 672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) T = T->getPointeeType(); 682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const RecordType *RT = T->getAsStructureType()) { 702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const RecordDecl *RD = RT->getDecl(); 712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (RecordDecl::field_iterator I = RD->field_begin(), E = RD->field_end(); 722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) I != E; ++I) { 732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) QualType FieldT = I->getType(); 742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType()) 752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 812a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)bool CallEvent::hasNonZeroCallbackArg() const { 832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) unsigned NumOfArgs = getNumArgs(); 842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If calling using a function pointer, assume the function does not 862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // have a callback. TODO: We could check the types of the arguments here. 872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!getDecl()) 882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) unsigned Idx = 0; 912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (CallEvent::param_type_iterator I = param_type_begin(), 922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) E = param_type_end(); 932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) I != E && Idx < NumOfArgs; ++I, ++Idx) { 942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (NumOfArgs <= Idx) 952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) break; 962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (isCallbackArg(getArgSVal(Idx), *I)) 982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 1022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)bool CallEvent::isGlobalCFunction(StringRef FunctionName) const { 1052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl()); 1062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!FD) 1072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 1082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return CheckerContext::isCLibraryFunction(FD, FunctionName); 1102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// \brief Returns true if a type is a pointer-to-const or reference-to-const 1132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// with no further indirection. 1142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static bool isPointerToConst(QualType Ty) { 1152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) QualType PointeeTy = Ty->getPointeeType(); 1162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (PointeeTy == QualType()) 1172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 1182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!PointeeTy.isConstQualified()) 1192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 1202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (PointeeTy->isAnyPointerType()) 1212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 122868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return true; 1232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// Try to retrieve the function declaration and find the function parameter 1262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// types which are pointers/references to a non-pointer const. 1272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)// We will not invalidate the corresponding argument regions. 1282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static void findPtrToConstParams(llvm::SmallSet<unsigned, 1> &PreserveArgs, 1292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CallEvent &Call) { 1302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) unsigned Idx = 0; 1312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (CallEvent::param_type_iterator I = Call.param_type_begin(), 1322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) E = Call.param_type_end(); 1332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) I != E; ++I, ++Idx) { 1342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (isPointerToConst(*I)) 1352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) PreserveArgs.insert(Idx); 1362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 1382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount, 1402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ProgramStateRef Orig) const { 1412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ProgramStateRef Result = (Orig ? Orig : getState()); 1422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SmallVector<const MemRegion *, 8> RegionsToInvalidate; 1442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) getExtraInvalidatedRegions(RegionsToInvalidate); 1452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Indexes of arguments whose values will be preserved by the call. 1472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) llvm::SmallSet<unsigned, 1> PreserveArgs; 1482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!argumentsMayEscape()) 1492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) findPtrToConstParams(PreserveArgs, *this); 1502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) { 1522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (PreserveArgs.count(Idx)) 1532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) continue; 1542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 155868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) SVal V = getArgSVal(Idx); 1562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If we are passing a location wrapped as an integer, unwrap it and 1582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // invalidate the values referred by the location. 1592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (nonloc::LocAsInteger *Wrapped = dyn_cast<nonloc::LocAsInteger>(&V)) 1602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) V = Wrapped->getLoc(); 1612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) else if (!isa<Loc>(V)) 1622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) continue; 1632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const MemRegion *R = V.getAsRegion()) { 1652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Invalidate the value of the variable passed by reference. 1662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Are we dealing with an ElementRegion? If the element type is 168868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) // a basic integer type (e.g., char, int) and the underlying region 1692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // is a variable region then strip off the ElementRegion. 1702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // FIXME: We really need to think about this for the general case 1712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // as sometimes we are reasoning about arrays and other times 1722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // about (char*), etc., is just a form of passing raw bytes. 1732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // e.g., void *p = alloca(); foo((char*)p); 1742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) { 1752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Checking for 'integral type' is probably too promiscuous, but 1762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // we'll leave it in for now until we have a systematic way of 1772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // handling all of these cases. Eventually we need to come up 1782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // with an interface to StoreManager so that this logic can be 1792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // appropriately delegated to the respective StoreManagers while 1802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // still allowing us to do checker-specific logic (e.g., 1812a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // invalidating reference counts), probably via callbacks. 1822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (ER->getElementType()->isIntegralOrEnumerationType()) { 1832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const MemRegion *superReg = ER->getSuperRegion(); 1842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (isa<VarRegion>(superReg) || isa<FieldRegion>(superReg) || 1852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) isa<ObjCIvarRegion>(superReg)) 1862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) R = cast<TypedRegion>(superReg); 1872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // FIXME: What about layers of ElementRegions? 1892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 190c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 191c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // Mark this region for invalidation. We batch invalidate regions 1922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // below for efficiency. 1932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) RegionsToInvalidate.push_back(R); 1942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 1962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 1972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Invalidate designated regions using the batch invalidation API. 1982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate 1992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // global variables. 2002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return Result->invalidateRegions(RegionsToInvalidate, getOriginExpr(), 2012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) BlockCount, getLocationContext(), 2022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) /*CausedByPointerEscape*/ true, 203c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) /*Symbols=*/0, this); 2042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit, 2072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const ProgramPointTag *Tag) const { 2082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const Expr *E = getOriginExpr()) { 2092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (IsPreVisit) 2102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return PreStmt(E, getLocationContext(), Tag); 211868fa2fe829687343ffae624259930155e16dbd8Torne (Richard Coles) return PostStmt(E, getLocationContext(), Tag); 2122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 2132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Decl *D = getDecl(); 2152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(D && "Cannot get a program point without a statement or decl"); 2162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SourceLocation Loc = getSourceRange().getBegin(); 2182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (IsPreVisit) 2192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return PreImplicitCall(D, Loc, getLocationContext(), Tag); 2202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return PostImplicitCall(D, Loc, getLocationContext(), Tag); 2212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)SVal CallEvent::getArgSVal(unsigned Index) const { 2242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Expr *ArgE = getArgExpr(Index); 2252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!ArgE) 2262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return UnknownVal(); 2272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return getSVal(ArgE); 2282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)SourceRange CallEvent::getArgSourceRange(unsigned Index) const { 2312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Expr *ArgE = getArgExpr(Index); 2322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!ArgE) 2332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return SourceRange(); 2342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return ArgE->getSourceRange(); 2352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)SVal CallEvent::getReturnValue() const { 2382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Expr *E = getOriginExpr(); 2392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!E) 2402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return UndefinedVal(); 2412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return getSVal(E); 2422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CallEvent::dump() const { 2452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) dump(llvm::errs()); 2462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CallEvent::dump(raw_ostream &Out) const { 2492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) ASTContext &Ctx = getState()->getStateManager().getContext(); 2502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const Expr *E = getOriginExpr()) { 2512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) E->printPretty(Out, 0, Ctx.getPrintingPolicy()); 2522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Out << "\n"; 2532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return; 2542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 255c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 256c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) if (const Decl *D = getDecl()) { 2572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Out << "Call to "; 2582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) D->print(Out, Ctx.getPrintingPolicy()); 2592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return; 2602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 2612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 262c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) // FIXME: a string representation of the kind would be nice. 2632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Out << "Unknown call (type " << getKind() << ")"; 2642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 266c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) 267c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)bool CallEvent::isCallStmt(const Stmt *S) { 2682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S) 2692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) || isa<CXXConstructExpr>(S) 2702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) || isa<CXXNewExpr>(S); 2712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 2722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)/// \brief Returns the result type, adjusted for references. 2742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)QualType CallEvent::getDeclaredResultType(const Decl *D) { 2752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(D); 276c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D)) 2772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return FD->getResultType(); 2782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) else if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D)) 2792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return MD->getResultType(); 280c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) return QualType(); 281c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles)} 2822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, 2842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CallEvent::BindingsTy &Bindings, 2852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SValBuilder &SVB, 2862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CallEvent &Call, 2872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CallEvent::param_iterator I, 2882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) CallEvent::param_iterator E) { 289c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) MemRegionManager &MRMgr = SVB.getRegionManager(); 2902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) unsigned Idx = 0; 292c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) for (; I != E; ++I, ++Idx) { 293c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) const ParmVarDecl *ParamDecl = *I; 2942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(ParamDecl && "Formal parameter has no decl?"); 2952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 2962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SVal ArgVal = Call.getArgSVal(Idx); 2972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!ArgVal.isUnknown()) { 2982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx)); 2992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Bindings.push_back(std::make_pair(ParamLoc, ArgVal)); 3002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 3012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 3022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // FIXME: Variadic arguments are not handled at all right now. 3042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)CallEvent::param_iterator AnyFunctionCall::param_begin() const { 3082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = getDecl(); 3092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!D) 3102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return 0; 3112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return D->param_begin(); 3132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)CallEvent::param_iterator AnyFunctionCall::param_end() const { 3162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = getDecl(); 3172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!D) 3182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return 0; 3192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return D->param_end(); 3212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void AnyFunctionCall::getInitialStackFrameContents( 3242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const StackFrameContext *CalleeCtx, 3252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) BindingsTy &Bindings) const { 3262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl()); 3272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 3282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 3292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) D->param_begin(), D->param_end()); 3302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)bool AnyFunctionCall::argumentsMayEscape() const { 3332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (hasNonZeroCallbackArg()) 3342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = getDecl(); 3372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!D) 3382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const IdentifierInfo *II = D->getIdentifier(); 3412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!II) 342c2e0dbddbe15c98d52c4786dac06cb8952a8ae6dTorne (Richard Coles) return false; 3432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // This set of "escaping" APIs is 3452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a 3472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // value into thread local storage. The value can later be retrieved with 3482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // 'void *ptheread_getspecific(pthread_key)'. So even thought the 3492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // parameter is 'const void *', the region escapes through the call. 3502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (II->isStr("pthread_setspecific")) 3512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - xpc_connection_set_context stores a value which can be retrieved later 3542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // with xpc_connection_get_context. 3552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (II->isStr("xpc_connection_set_context")) 3562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - funopen - sets a buffer for future IO calls. 3592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (II->isStr("funopen")) 3602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StringRef FName = II->getName(); 3632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - CoreFoundation functions that end with "NoCopy" can free a passed-in 3652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // buffer even if it is const. 3662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (FName.endswith("NoCopy")) 3672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can 3702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // be deallocated by NSMapRemove. 3712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos)) 3722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return true; 3732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // - Many CF containers allow objects to escape through custom 3752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // allocators/deallocators upon container construction. (PR12101) 3762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (FName.startswith("CF") || FName.startswith("CG")) { 3772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return StrInStrNoCase(FName, "InsertValue") != StringRef::npos || 3782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StrInStrNoCase(FName, "AddValue") != StringRef::npos || 3792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StrInStrNoCase(FName, "SetValue") != StringRef::npos || 3802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StrInStrNoCase(FName, "WithData") != StringRef::npos || 3812a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StrInStrNoCase(FName, "AppendValue") != StringRef::npos || 3822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) StrInStrNoCase(FName, "SetAttribute") != StringRef::npos; 3832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 3842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return false; 3862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)const FunctionDecl *SimpleCall::getDecl() const { 3902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = getOriginExpr()->getDirectCallee(); 3912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (D) 3922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return D; 3932a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3942a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl(); 3952a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 3962a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3972a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 3982a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)const FunctionDecl *CXXInstanceCall::getDecl() const { 3992a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr()); 4002a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!CE) 4012a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return AnyFunctionCall::getDecl(); 4022a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4032a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *D = CE->getDirectCallee(); 4042a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (D) 4052a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return D; 4062a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4072a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return getSVal(CE->getCallee()).getAsFunctionDecl(); 4082a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 4092a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4102a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CXXInstanceCall::getExtraInvalidatedRegions(RegionList &Regions) const { 4112a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (const MemRegion *R = getCXXThisVal().getAsRegion()) 4122a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) Regions.push_back(R); 4132a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 4142a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4152a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)SVal CXXInstanceCall::getCXXThisVal() const { 4162a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Expr *Base = getCXXThisExpr(); 4172a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // FIXME: This doesn't handle an overloaded ->* operator. 4182a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!Base) 4192a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return UnknownVal(); 4202a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4212a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) SVal ThisVal = getSVal(Base); 4222a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal)); 4232a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return ThisVal; 4242a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 4252a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4262a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4272a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const { 4282a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Do we have a decl at all? 4292a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const Decl *D = getDecl(); 4302a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!D) 4312a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4322a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4332a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // If the method is non-virtual, we know we can inline it. 4342a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CXXMethodDecl *MD = cast<CXXMethodDecl>(D); 4352a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!MD->isVirtual()) 4362a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return AnyFunctionCall::getRuntimeDefinition(); 4372a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4382a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Do we know the implicit 'this' object being called? 4392a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const MemRegion *R = getCXXThisVal().getAsRegion(); 4402a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!R) 4412a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4422a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4432a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Do we know anything about the type of 'this'? 4442a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) DynamicTypeInfo DynType = getState()->getDynamicTypeInfo(R); 4452a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!DynType.isValid()) 4462a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4472a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4482a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Is the type a C++ class? (This is mostly a defensive check.) 4492a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) QualType RegionType = DynType.getType()->getPointeeType(); 4502a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer."); 4512a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4522a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl(); 4532a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!RD || !RD->hasDefinition()) 4542a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4552a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4562a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Find the decl for this method in that class. 4572a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true); 4582a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!Result) { 4592a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We might not even get the original statically-resolved method due to 4602a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // some particularly nasty casting (e.g. casts to sister classes). 4612a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // However, we should at least be able to search up and down our own class 4622a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // hierarchy, and some real bugs have been caught by checking this. 4632a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method"); 4642a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4652a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // FIXME: This is checking that our DynamicTypeInfo is at least as good as 4662a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // the static type. However, because we currently don't update 4672a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // DynamicTypeInfo when an object is cast, we can't actually be sure the 4682a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // DynamicTypeInfo is up to date. This assert should be re-enabled once 4692a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // this is fixed. <rdar://problem/12287087> 4702a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo"); 4712a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4722a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4732a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) } 4742a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4752a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // Does the decl that we found have an implementation? 4762a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const FunctionDecl *Definition; 4772a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (!Result->hasBody(Definition)) 4782a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(); 4792a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4802a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // We found a definition. If we're not sure that this devirtualization is 4812a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // actually what will happen at runtime, make sure to provide the region so 4822a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) // that ExprEngine can decide what to do with it. 4832a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) if (DynType.canBeASubClass()) 4842a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(Definition, R->StripCasts()); 4852a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) return RuntimeDefinition(Definition, /*DispatchRegion=*/0); 4862a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)} 4872a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 4882a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles)void CXXInstanceCall::getInitialStackFrameContents( 4892a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) const StackFrameContext *CalleeCtx, 4902a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) BindingsTy &Bindings) const { 4912a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings); 4922a99a7e74a7f215066514fe81d2bfa6639d9edddTorne (Richard Coles) 493 // Handle the binding of 'this' in the new stack frame. 494 SVal ThisVal = getCXXThisVal(); 495 if (!ThisVal.isUnknown()) { 496 ProgramStateManager &StateMgr = getState()->getStateManager(); 497 SValBuilder &SVB = StateMgr.getSValBuilder(); 498 499 const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 500 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx); 501 502 // If we devirtualized to a different member function, we need to make sure 503 // we have the proper layering of CXXBaseObjectRegions. 504 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) { 505 ASTContext &Ctx = SVB.getContext(); 506 const CXXRecordDecl *Class = MD->getParent(); 507 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class)); 508 509 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager. 510 bool Failed; 511 ThisVal = StateMgr.getStoreManager().evalDynamicCast(ThisVal, Ty, Failed); 512 assert(!Failed && "Calling an incorrectly devirtualized method"); 513 } 514 515 if (!ThisVal.isUnknown()) 516 Bindings.push_back(std::make_pair(ThisLoc, ThisVal)); 517 } 518} 519 520 521 522const Expr *CXXMemberCall::getCXXThisExpr() const { 523 return getOriginExpr()->getImplicitObjectArgument(); 524} 525 526RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const { 527 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the 528 // id-expression in the class member access expression is a qualified-id, 529 // that function is called. Otherwise, its final overrider in the dynamic type 530 // of the object expression is called. 531 if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee())) 532 if (ME->hasQualifier()) 533 return AnyFunctionCall::getRuntimeDefinition(); 534 535 return CXXInstanceCall::getRuntimeDefinition(); 536} 537 538 539const Expr *CXXMemberOperatorCall::getCXXThisExpr() const { 540 return getOriginExpr()->getArg(0); 541} 542 543 544const BlockDataRegion *BlockCall::getBlockRegion() const { 545 const Expr *Callee = getOriginExpr()->getCallee(); 546 const MemRegion *DataReg = getSVal(Callee).getAsRegion(); 547 548 return dyn_cast_or_null<BlockDataRegion>(DataReg); 549} 550 551CallEvent::param_iterator BlockCall::param_begin() const { 552 const BlockDecl *D = getBlockDecl(); 553 if (!D) 554 return 0; 555 return D->param_begin(); 556} 557 558CallEvent::param_iterator BlockCall::param_end() const { 559 const BlockDecl *D = getBlockDecl(); 560 if (!D) 561 return 0; 562 return D->param_end(); 563} 564 565void BlockCall::getExtraInvalidatedRegions(RegionList &Regions) const { 566 // FIXME: This also needs to invalidate captured globals. 567 if (const MemRegion *R = getBlockRegion()) 568 Regions.push_back(R); 569} 570 571void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 572 BindingsTy &Bindings) const { 573 const BlockDecl *D = cast<BlockDecl>(CalleeCtx->getDecl()); 574 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 575 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 576 D->param_begin(), D->param_end()); 577} 578 579 580SVal CXXConstructorCall::getCXXThisVal() const { 581 if (Data) 582 return loc::MemRegionVal(static_cast<const MemRegion *>(Data)); 583 return UnknownVal(); 584} 585 586void CXXConstructorCall::getExtraInvalidatedRegions(RegionList &Regions) const { 587 if (Data) 588 Regions.push_back(static_cast<const MemRegion *>(Data)); 589} 590 591void CXXConstructorCall::getInitialStackFrameContents( 592 const StackFrameContext *CalleeCtx, 593 BindingsTy &Bindings) const { 594 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings); 595 596 SVal ThisVal = getCXXThisVal(); 597 if (!ThisVal.isUnknown()) { 598 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 599 const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 600 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx); 601 Bindings.push_back(std::make_pair(ThisLoc, ThisVal)); 602 } 603} 604 605 606 607SVal CXXDestructorCall::getCXXThisVal() const { 608 if (Data) 609 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer()); 610 return UnknownVal(); 611} 612 613RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const { 614 // Base destructors are always called non-virtually. 615 // Skip CXXInstanceCall's devirtualization logic in this case. 616 if (isBaseDestructor()) 617 return AnyFunctionCall::getRuntimeDefinition(); 618 619 return CXXInstanceCall::getRuntimeDefinition(); 620} 621 622 623CallEvent::param_iterator ObjCMethodCall::param_begin() const { 624 const ObjCMethodDecl *D = getDecl(); 625 if (!D) 626 return 0; 627 628 return D->param_begin(); 629} 630 631CallEvent::param_iterator ObjCMethodCall::param_end() const { 632 const ObjCMethodDecl *D = getDecl(); 633 if (!D) 634 return 0; 635 636 return D->param_end(); 637} 638 639void 640ObjCMethodCall::getExtraInvalidatedRegions(RegionList &Regions) const { 641 if (const MemRegion *R = getReceiverSVal().getAsRegion()) 642 Regions.push_back(R); 643} 644 645SVal ObjCMethodCall::getSelfSVal() const { 646 const LocationContext *LCtx = getLocationContext(); 647 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl(); 648 if (!SelfDecl) 649 return SVal(); 650 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx)); 651} 652 653SVal ObjCMethodCall::getReceiverSVal() const { 654 // FIXME: Is this the best way to handle class receivers? 655 if (!isInstanceMessage()) 656 return UnknownVal(); 657 658 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver()) 659 return getSVal(RecE); 660 661 // An instance message with no expression means we are sending to super. 662 // In this case the object reference is the same as 'self'. 663 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance); 664 SVal SelfVal = getSelfSVal(); 665 assert(SelfVal.isValid() && "Calling super but not in ObjC method"); 666 return SelfVal; 667} 668 669bool ObjCMethodCall::isReceiverSelfOrSuper() const { 670 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance || 671 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass) 672 return true; 673 674 if (!isInstanceMessage()) 675 return false; 676 677 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver()); 678 679 return (RecVal == getSelfSVal()); 680} 681 682SourceRange ObjCMethodCall::getSourceRange() const { 683 switch (getMessageKind()) { 684 case OCM_Message: 685 return getOriginExpr()->getSourceRange(); 686 case OCM_PropertyAccess: 687 case OCM_Subscript: 688 return getContainingPseudoObjectExpr()->getSourceRange(); 689 } 690 llvm_unreachable("unknown message kind"); 691} 692 693typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy; 694 695const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const { 696 assert(Data != 0 && "Lazy lookup not yet performed."); 697 assert(getMessageKind() != OCM_Message && "Explicit message send."); 698 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer(); 699} 700 701ObjCMessageKind ObjCMethodCall::getMessageKind() const { 702 if (Data == 0) { 703 ParentMap &PM = getLocationContext()->getParentMap(); 704 const Stmt *S = PM.getParent(getOriginExpr()); 705 if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) { 706 const Expr *Syntactic = POE->getSyntacticForm(); 707 708 // This handles the funny case of assigning to the result of a getter. 709 // This can happen if the getter returns a non-const reference. 710 if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic)) 711 Syntactic = BO->getLHS(); 712 713 ObjCMessageKind K; 714 switch (Syntactic->getStmtClass()) { 715 case Stmt::ObjCPropertyRefExprClass: 716 K = OCM_PropertyAccess; 717 break; 718 case Stmt::ObjCSubscriptRefExprClass: 719 K = OCM_Subscript; 720 break; 721 default: 722 // FIXME: Can this ever happen? 723 K = OCM_Message; 724 break; 725 } 726 727 if (K != OCM_Message) { 728 const_cast<ObjCMethodCall *>(this)->Data 729 = ObjCMessageDataTy(POE, K).getOpaqueValue(); 730 assert(getMessageKind() == K); 731 return K; 732 } 733 } 734 735 const_cast<ObjCMethodCall *>(this)->Data 736 = ObjCMessageDataTy(0, 1).getOpaqueValue(); 737 assert(getMessageKind() == OCM_Message); 738 return OCM_Message; 739 } 740 741 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data); 742 if (!Info.getPointer()) 743 return OCM_Message; 744 return static_cast<ObjCMessageKind>(Info.getInt()); 745} 746 747 748bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 749 Selector Sel) const { 750 assert(IDecl); 751 const SourceManager &SM = 752 getState()->getStateManager().getContext().getSourceManager(); 753 754 // If the class interface is declared inside the main file, assume it is not 755 // subcassed. 756 // TODO: It could actually be subclassed if the subclass is private as well. 757 // This is probably very rare. 758 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc(); 759 if (InterfLoc.isValid() && SM.isFromMainFile(InterfLoc)) 760 return false; 761 762 // Assume that property accessors are not overridden. 763 if (getMessageKind() == OCM_PropertyAccess) 764 return false; 765 766 // We assume that if the method is public (declared outside of main file) or 767 // has a parent which publicly declares the method, the method could be 768 // overridden in a subclass. 769 770 // Find the first declaration in the class hierarchy that declares 771 // the selector. 772 ObjCMethodDecl *D = 0; 773 while (true) { 774 D = IDecl->lookupMethod(Sel, true); 775 776 // Cannot find a public definition. 777 if (!D) 778 return false; 779 780 // If outside the main file, 781 if (D->getLocation().isValid() && !SM.isFromMainFile(D->getLocation())) 782 return true; 783 784 if (D->isOverriding()) { 785 // Search in the superclass on the next iteration. 786 IDecl = D->getClassInterface(); 787 if (!IDecl) 788 return false; 789 790 IDecl = IDecl->getSuperClass(); 791 if (!IDecl) 792 return false; 793 794 continue; 795 } 796 797 return false; 798 }; 799 800 llvm_unreachable("The while loop should always terminate."); 801} 802 803RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const { 804 const ObjCMessageExpr *E = getOriginExpr(); 805 assert(E); 806 Selector Sel = E->getSelector(); 807 808 if (E->isInstanceMessage()) { 809 810 // Find the the receiver type. 811 const ObjCObjectPointerType *ReceiverT = 0; 812 bool CanBeSubClassed = false; 813 QualType SupersType = E->getSuperType(); 814 const MemRegion *Receiver = 0; 815 816 if (!SupersType.isNull()) { 817 // Super always means the type of immediate predecessor to the method 818 // where the call occurs. 819 ReceiverT = cast<ObjCObjectPointerType>(SupersType); 820 } else { 821 Receiver = getReceiverSVal().getAsRegion(); 822 if (!Receiver) 823 return RuntimeDefinition(); 824 825 DynamicTypeInfo DTI = getState()->getDynamicTypeInfo(Receiver); 826 QualType DynType = DTI.getType(); 827 CanBeSubClassed = DTI.canBeASubClass(); 828 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType); 829 830 if (ReceiverT && CanBeSubClassed) 831 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) 832 if (!canBeOverridenInSubclass(IDecl, Sel)) 833 CanBeSubClassed = false; 834 } 835 836 // Lookup the method implementation. 837 if (ReceiverT) 838 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) { 839 // Repeatedly calling lookupPrivateMethod() is expensive, especially 840 // when in many cases it returns null. We cache the results so 841 // that repeated queries on the same ObjCIntefaceDecl and Selector 842 // don't incur the same cost. On some test cases, we can see the 843 // same query being issued thousands of times. 844 // 845 // NOTE: This cache is essentially a "global" variable, but it 846 // only gets lazily created when we get here. The value of the 847 // cache probably comes from it being global across ExprEngines, 848 // where the same queries may get issued. If we are worried about 849 // concurrency, or possibly loading/unloading ASTs, etc., we may 850 // need to revisit this someday. In terms of memory, this table 851 // stays around until clang quits, which also may be bad if we 852 // need to release memory. 853 typedef std::pair<const ObjCInterfaceDecl*, Selector> 854 PrivateMethodKey; 855 typedef llvm::DenseMap<PrivateMethodKey, 856 llvm::Optional<const ObjCMethodDecl *> > 857 PrivateMethodCache; 858 859 static PrivateMethodCache PMC; 860 llvm::Optional<const ObjCMethodDecl *> &Val = 861 PMC[std::make_pair(IDecl, Sel)]; 862 863 // Query lookupPrivateMethod() if the cache does not hit. 864 if (!Val.hasValue()) 865 Val = IDecl->lookupPrivateMethod(Sel); 866 867 const ObjCMethodDecl *MD = Val.getValue(); 868 if (CanBeSubClassed) 869 return RuntimeDefinition(MD, Receiver); 870 else 871 return RuntimeDefinition(MD, 0); 872 } 873 874 } else { 875 // This is a class method. 876 // If we have type info for the receiver class, we are calling via 877 // class name. 878 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) { 879 // Find/Return the method implementation. 880 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel)); 881 } 882 } 883 884 return RuntimeDefinition(); 885} 886 887void ObjCMethodCall::getInitialStackFrameContents( 888 const StackFrameContext *CalleeCtx, 889 BindingsTy &Bindings) const { 890 const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl()); 891 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 892 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 893 D->param_begin(), D->param_end()); 894 895 SVal SelfVal = getReceiverSVal(); 896 if (!SelfVal.isUnknown()) { 897 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl(); 898 MemRegionManager &MRMgr = SVB.getRegionManager(); 899 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx)); 900 Bindings.push_back(std::make_pair(SelfLoc, SelfVal)); 901 } 902} 903 904CallEventRef<> 905CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State, 906 const LocationContext *LCtx) { 907 if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE)) 908 return create<CXXMemberCall>(MCE, State, LCtx); 909 910 if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) { 911 const FunctionDecl *DirectCallee = OpCE->getDirectCallee(); 912 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee)) 913 if (MD->isInstance()) 914 return create<CXXMemberOperatorCall>(OpCE, State, LCtx); 915 916 } else if (CE->getCallee()->getType()->isBlockPointerType()) { 917 return create<BlockCall>(CE, State, LCtx); 918 } 919 920 // Otherwise, it's a normal function call, static member function call, or 921 // something we can't reason about. 922 return create<FunctionCall>(CE, State, LCtx); 923} 924 925 926CallEventRef<> 927CallEventManager::getCaller(const StackFrameContext *CalleeCtx, 928 ProgramStateRef State) { 929 const LocationContext *ParentCtx = CalleeCtx->getParent(); 930 const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame(); 931 assert(CallerCtx && "This should not be used for top-level stack frames"); 932 933 const Stmt *CallSite = CalleeCtx->getCallSite(); 934 935 if (CallSite) { 936 if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite)) 937 return getSimpleCall(CE, State, CallerCtx); 938 939 switch (CallSite->getStmtClass()) { 940 case Stmt::CXXConstructExprClass: 941 case Stmt::CXXTemporaryObjectExprClass: { 942 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 943 const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 944 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx); 945 SVal ThisVal = State->getSVal(ThisPtr); 946 947 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite), 948 ThisVal.getAsRegion(), State, CallerCtx); 949 } 950 case Stmt::CXXNewExprClass: 951 return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx); 952 case Stmt::ObjCMessageExprClass: 953 return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite), 954 State, CallerCtx); 955 default: 956 llvm_unreachable("This is not an inlineable statement."); 957 } 958 } 959 960 // Fall back to the CFG. The only thing we haven't handled yet is 961 // destructors, though this could change in the future. 962 const CFGBlock *B = CalleeCtx->getCallSiteBlock(); 963 CFGElement E = (*B)[CalleeCtx->getIndex()]; 964 assert(isa<CFGImplicitDtor>(E) && "All other CFG elements should have exprs"); 965 assert(!isa<CFGTemporaryDtor>(E) && "We don't handle temporaries yet"); 966 967 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 968 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl()); 969 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx); 970 SVal ThisVal = State->getSVal(ThisPtr); 971 972 const Stmt *Trigger; 973 if (const CFGAutomaticObjDtor *AutoDtor = dyn_cast<CFGAutomaticObjDtor>(&E)) 974 Trigger = AutoDtor->getTriggerStmt(); 975 else 976 Trigger = Dtor->getBody(); 977 978 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(), 979 isa<CFGBaseDtor>(E), State, CallerCtx); 980} 981