1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
28 #include "clang/Analysis/AnalysisDeclContext.h"
29 #include "clang/Analysis/CFG.h"
30 #include "clang/Analysis/CFGStmtMap.h"
31 #include "clang/Analysis/PathDiagnostic.h"
32 #include "clang/Analysis/ProgramPoint.h"
33 #include "clang/Basic/IdentifierTable.h"
34 #include "clang/Basic/LLVM.h"
35 #include "clang/Basic/SourceLocation.h"
36 #include "clang/Basic/SourceManager.h"
37 #include "clang/Basic/Specifiers.h"
38 #include "clang/CrossTU/CrossTranslationUnit.h"
39 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
41 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
42 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
43 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
44 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
45 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
46 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
47 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
48 #include "llvm/ADT/ArrayRef.h"
49 #include "llvm/ADT/DenseMap.h"
50 #include "llvm/ADT/None.h"
51 #include "llvm/ADT/Optional.h"
52 #include "llvm/ADT/PointerIntPair.h"
53 #include "llvm/ADT/SmallSet.h"
54 #include "llvm/ADT/SmallVector.h"
55 #include "llvm/ADT/StringExtras.h"
56 #include "llvm/ADT/StringRef.h"
57 #include "llvm/Support/Casting.h"
58 #include "llvm/Support/Compiler.h"
59 #include "llvm/Support/Debug.h"
60 #include "llvm/Support/ErrorHandling.h"
61 #include "llvm/Support/raw_ostream.h"
62 #include <cassert>
63 #include <utility>
64
65 #define DEBUG_TYPE "static-analyzer-call-event"
66
67 using namespace clang;
68 using namespace ento;
69
getResultType() const70 QualType CallEvent::getResultType() const {
71 ASTContext &Ctx = getState()->getStateManager().getContext();
72 const Expr *E = getOriginExpr();
73 if (!E)
74 return Ctx.VoidTy;
75 assert(E);
76
77 QualType ResultTy = E->getType();
78
79 // A function that returns a reference to 'int' will have a result type
80 // of simply 'int'. Check the origin expr's value kind to recover the
81 // proper type.
82 switch (E->getValueKind()) {
83 case VK_LValue:
84 ResultTy = Ctx.getLValueReferenceType(ResultTy);
85 break;
86 case VK_XValue:
87 ResultTy = Ctx.getRValueReferenceType(ResultTy);
88 break;
89 case VK_RValue:
90 // No adjustment is necessary.
91 break;
92 }
93
94 return ResultTy;
95 }
96
isCallback(QualType T)97 static bool isCallback(QualType T) {
98 // If a parameter is a block or a callback, assume it can modify pointer.
99 if (T->isBlockPointerType() ||
100 T->isFunctionPointerType() ||
101 T->isObjCSelType())
102 return true;
103
104 // Check if a callback is passed inside a struct (for both, struct passed by
105 // reference and by value). Dig just one level into the struct for now.
106
107 if (T->isAnyPointerType() || T->isReferenceType())
108 T = T->getPointeeType();
109
110 if (const RecordType *RT = T->getAsStructureType()) {
111 const RecordDecl *RD = RT->getDecl();
112 for (const auto *I : RD->fields()) {
113 QualType FieldT = I->getType();
114 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
115 return true;
116 }
117 }
118 return false;
119 }
120
isVoidPointerToNonConst(QualType T)121 static bool isVoidPointerToNonConst(QualType T) {
122 if (const auto *PT = T->getAs<PointerType>()) {
123 QualType PointeeTy = PT->getPointeeType();
124 if (PointeeTy.isConstQualified())
125 return false;
126 return PointeeTy->isVoidType();
127 } else
128 return false;
129 }
130
hasNonNullArgumentsWithType(bool (* Condition)(QualType)) const131 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
132 unsigned NumOfArgs = getNumArgs();
133
134 // If calling using a function pointer, assume the function does not
135 // satisfy the callback.
136 // TODO: We could check the types of the arguments here.
137 if (!getDecl())
138 return false;
139
140 unsigned Idx = 0;
141 for (CallEvent::param_type_iterator I = param_type_begin(),
142 E = param_type_end();
143 I != E && Idx < NumOfArgs; ++I, ++Idx) {
144 // If the parameter is 0, it's harmless.
145 if (getArgSVal(Idx).isZeroConstant())
146 continue;
147
148 if (Condition(*I))
149 return true;
150 }
151 return false;
152 }
153
hasNonZeroCallbackArg() const154 bool CallEvent::hasNonZeroCallbackArg() const {
155 return hasNonNullArgumentsWithType(isCallback);
156 }
157
hasVoidPointerToNonConstArg() const158 bool CallEvent::hasVoidPointerToNonConstArg() const {
159 return hasNonNullArgumentsWithType(isVoidPointerToNonConst);
160 }
161
isGlobalCFunction(StringRef FunctionName) const162 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
163 const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
164 if (!FD)
165 return false;
166
167 return CheckerContext::isCLibraryFunction(FD, FunctionName);
168 }
169
getCalleeAnalysisDeclContext() const170 AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const {
171 const Decl *D = getDecl();
172 if (!D)
173 return nullptr;
174
175 // TODO: For now we skip functions without definitions, even if we have
176 // our own getDecl(), because it's hard to find out which re-declaration
177 // is going to be used, and usually clients don't really care about this
178 // situation because there's a loss of precision anyway because we cannot
179 // inline the call.
180 RuntimeDefinition RD = getRuntimeDefinition();
181 if (!RD.getDecl())
182 return nullptr;
183
184 AnalysisDeclContext *ADC =
185 LCtx->getAnalysisDeclContext()->getManager()->getContext(D);
186
187 // TODO: For now we skip virtual functions, because this also rises
188 // the problem of which decl to use, but now it's across different classes.
189 if (RD.mayHaveOtherDefinitions() || RD.getDecl() != ADC->getDecl())
190 return nullptr;
191
192 return ADC;
193 }
194
195 const StackFrameContext *
getCalleeStackFrame(unsigned BlockCount) const196 CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
197 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext();
198 if (!ADC)
199 return nullptr;
200
201 const Expr *E = getOriginExpr();
202 if (!E)
203 return nullptr;
204
205 // Recover CFG block via reverse lookup.
206 // TODO: If we were to keep CFG element information as part of the CallEvent
207 // instead of doing this reverse lookup, we would be able to build the stack
208 // frame for non-expression-based calls, and also we wouldn't need the reverse
209 // lookup.
210 CFGStmtMap *Map = LCtx->getAnalysisDeclContext()->getCFGStmtMap();
211 const CFGBlock *B = Map->getBlock(E);
212 assert(B);
213
214 // Also recover CFG index by scanning the CFG block.
215 unsigned Idx = 0, Sz = B->size();
216 for (; Idx < Sz; ++Idx)
217 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
218 if (StmtElem->getStmt() == E)
219 break;
220 assert(Idx < Sz);
221
222 return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx);
223 }
224
getParameterLocation(unsigned Index,unsigned BlockCount) const225 const VarRegion *CallEvent::getParameterLocation(unsigned Index,
226 unsigned BlockCount) const {
227 const StackFrameContext *SFC = getCalleeStackFrame(BlockCount);
228 // We cannot construct a VarRegion without a stack frame.
229 if (!SFC)
230 return nullptr;
231
232 // Retrieve parameters of the definition, which are different from
233 // CallEvent's parameters() because getDecl() isn't necessarily
234 // the definition. SFC contains the definition that would be used
235 // during analysis.
236 const Decl *D = SFC->getDecl();
237
238 // TODO: Refactor into a virtual method of CallEvent, like parameters().
239 const ParmVarDecl *PVD = nullptr;
240 if (const auto *FD = dyn_cast<FunctionDecl>(D))
241 PVD = FD->parameters()[Index];
242 else if (const auto *BD = dyn_cast<BlockDecl>(D))
243 PVD = BD->parameters()[Index];
244 else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
245 PVD = MD->parameters()[Index];
246 else if (const auto *CD = dyn_cast<CXXConstructorDecl>(D))
247 PVD = CD->parameters()[Index];
248 assert(PVD && "Unexpected Decl kind!");
249
250 const VarRegion *VR =
251 State->getStateManager().getRegionManager().getVarRegion(PVD, SFC);
252
253 // This sanity check would fail if our parameter declaration doesn't
254 // correspond to the stack frame's function declaration.
255 assert(VR->getStackFrame() == SFC);
256
257 return VR;
258 }
259
260 /// Returns true if a type is a pointer-to-const or reference-to-const
261 /// with no further indirection.
isPointerToConst(QualType Ty)262 static bool isPointerToConst(QualType Ty) {
263 QualType PointeeTy = Ty->getPointeeType();
264 if (PointeeTy == QualType())
265 return false;
266 if (!PointeeTy.isConstQualified())
267 return false;
268 if (PointeeTy->isAnyPointerType())
269 return false;
270 return true;
271 }
272
273 // Try to retrieve the function declaration and find the function parameter
274 // types which are pointers/references to a non-pointer const.
275 // We will not invalidate the corresponding argument regions.
findPtrToConstParams(llvm::SmallSet<unsigned,4> & PreserveArgs,const CallEvent & Call)276 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
277 const CallEvent &Call) {
278 unsigned Idx = 0;
279 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
280 E = Call.param_type_end();
281 I != E; ++I, ++Idx) {
282 if (isPointerToConst(*I))
283 PreserveArgs.insert(Idx);
284 }
285 }
286
invalidateRegions(unsigned BlockCount,ProgramStateRef Orig) const287 ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
288 ProgramStateRef Orig) const {
289 ProgramStateRef Result = (Orig ? Orig : getState());
290
291 // Don't invalidate anything if the callee is marked pure/const.
292 if (const Decl *callee = getDecl())
293 if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
294 return Result;
295
296 SmallVector<SVal, 8> ValuesToInvalidate;
297 RegionAndSymbolInvalidationTraits ETraits;
298
299 getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
300
301 // Indexes of arguments whose values will be preserved by the call.
302 llvm::SmallSet<unsigned, 4> PreserveArgs;
303 if (!argumentsMayEscape())
304 findPtrToConstParams(PreserveArgs, *this);
305
306 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
307 // Mark this region for invalidation. We batch invalidate regions
308 // below for efficiency.
309 if (PreserveArgs.count(Idx))
310 if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
311 ETraits.setTrait(MR->getBaseRegion(),
312 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
313 // TODO: Factor this out + handle the lower level const pointers.
314
315 ValuesToInvalidate.push_back(getArgSVal(Idx));
316
317 // If a function accepts an object by argument (which would of course be a
318 // temporary that isn't lifetime-extended), invalidate the object itself,
319 // not only other objects reachable from it. This is necessary because the
320 // destructor has access to the temporary object after the call.
321 // TODO: Support placement arguments once we start
322 // constructing them directly.
323 // TODO: This is unnecessary when there's no destructor, but that's
324 // currently hard to figure out.
325 if (getKind() != CE_CXXAllocator)
326 if (isArgumentConstructedDirectly(Idx))
327 if (auto AdjIdx = getAdjustedParameterIndex(Idx))
328 if (const VarRegion *VR = getParameterLocation(*AdjIdx, BlockCount))
329 ValuesToInvalidate.push_back(loc::MemRegionVal(VR));
330 }
331
332 // Invalidate designated regions using the batch invalidation API.
333 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
334 // global variables.
335 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
336 BlockCount, getLocationContext(),
337 /*CausedByPointerEscape*/ true,
338 /*Symbols=*/nullptr, this, &ETraits);
339 }
340
getProgramPoint(bool IsPreVisit,const ProgramPointTag * Tag) const341 ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
342 const ProgramPointTag *Tag) const {
343 if (const Expr *E = getOriginExpr()) {
344 if (IsPreVisit)
345 return PreStmt(E, getLocationContext(), Tag);
346 return PostStmt(E, getLocationContext(), Tag);
347 }
348
349 const Decl *D = getDecl();
350 assert(D && "Cannot get a program point without a statement or decl");
351
352 SourceLocation Loc = getSourceRange().getBegin();
353 if (IsPreVisit)
354 return PreImplicitCall(D, Loc, getLocationContext(), Tag);
355 return PostImplicitCall(D, Loc, getLocationContext(), Tag);
356 }
357
isCalled(const CallDescription & CD) const358 bool CallEvent::isCalled(const CallDescription &CD) const {
359 // FIXME: Add ObjC Message support.
360 if (getKind() == CE_ObjCMessage)
361 return false;
362
363 const IdentifierInfo *II = getCalleeIdentifier();
364 if (!II)
365 return false;
366 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
367 if (!FD)
368 return false;
369
370 if (CD.Flags & CDF_MaybeBuiltin) {
371 return CheckerContext::isCLibraryFunction(FD, CD.getFunctionName()) &&
372 (!CD.RequiredArgs || CD.RequiredArgs <= getNumArgs()) &&
373 (!CD.RequiredParams || CD.RequiredParams <= parameters().size());
374 }
375
376 if (!CD.IsLookupDone) {
377 CD.IsLookupDone = true;
378 CD.II = &getState()->getStateManager().getContext().Idents.get(
379 CD.getFunctionName());
380 }
381
382 if (II != CD.II)
383 return false;
384
385 // If CallDescription provides prefix names, use them to improve matching
386 // accuracy.
387 if (CD.QualifiedName.size() > 1 && FD) {
388 const DeclContext *Ctx = FD->getDeclContext();
389 // See if we'll be able to match them all.
390 size_t NumUnmatched = CD.QualifiedName.size() - 1;
391 for (; Ctx && isa<NamedDecl>(Ctx); Ctx = Ctx->getParent()) {
392 if (NumUnmatched == 0)
393 break;
394
395 if (const auto *ND = dyn_cast<NamespaceDecl>(Ctx)) {
396 if (ND->getName() == CD.QualifiedName[NumUnmatched - 1])
397 --NumUnmatched;
398 continue;
399 }
400
401 if (const auto *RD = dyn_cast<RecordDecl>(Ctx)) {
402 if (RD->getName() == CD.QualifiedName[NumUnmatched - 1])
403 --NumUnmatched;
404 continue;
405 }
406 }
407
408 if (NumUnmatched > 0)
409 return false;
410 }
411
412 return (!CD.RequiredArgs || CD.RequiredArgs == getNumArgs()) &&
413 (!CD.RequiredParams || CD.RequiredParams == parameters().size());
414 }
415
getArgSVal(unsigned Index) const416 SVal CallEvent::getArgSVal(unsigned Index) const {
417 const Expr *ArgE = getArgExpr(Index);
418 if (!ArgE)
419 return UnknownVal();
420 return getSVal(ArgE);
421 }
422
getArgSourceRange(unsigned Index) const423 SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
424 const Expr *ArgE = getArgExpr(Index);
425 if (!ArgE)
426 return {};
427 return ArgE->getSourceRange();
428 }
429
getReturnValue() const430 SVal CallEvent::getReturnValue() const {
431 const Expr *E = getOriginExpr();
432 if (!E)
433 return UndefinedVal();
434 return getSVal(E);
435 }
436
dump() const437 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
438
dump(raw_ostream & Out) const439 void CallEvent::dump(raw_ostream &Out) const {
440 ASTContext &Ctx = getState()->getStateManager().getContext();
441 if (const Expr *E = getOriginExpr()) {
442 E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
443 Out << "\n";
444 return;
445 }
446
447 if (const Decl *D = getDecl()) {
448 Out << "Call to ";
449 D->print(Out, Ctx.getPrintingPolicy());
450 return;
451 }
452
453 // FIXME: a string representation of the kind would be nice.
454 Out << "Unknown call (type " << getKind() << ")";
455 }
456
isCallStmt(const Stmt * S)457 bool CallEvent::isCallStmt(const Stmt *S) {
458 return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
459 || isa<CXXConstructExpr>(S)
460 || isa<CXXNewExpr>(S);
461 }
462
getDeclaredResultType(const Decl * D)463 QualType CallEvent::getDeclaredResultType(const Decl *D) {
464 assert(D);
465 if (const auto *FD = dyn_cast<FunctionDecl>(D))
466 return FD->getReturnType();
467 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
468 return MD->getReturnType();
469 if (const auto *BD = dyn_cast<BlockDecl>(D)) {
470 // Blocks are difficult because the return type may not be stored in the
471 // BlockDecl itself. The AST should probably be enhanced, but for now we
472 // just do what we can.
473 // If the block is declared without an explicit argument list, the
474 // signature-as-written just includes the return type, not the entire
475 // function type.
476 // FIXME: All blocks should have signatures-as-written, even if the return
477 // type is inferred. (That's signified with a dependent result type.)
478 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
479 QualType Ty = TSI->getType();
480 if (const FunctionType *FT = Ty->getAs<FunctionType>())
481 Ty = FT->getReturnType();
482 if (!Ty->isDependentType())
483 return Ty;
484 }
485
486 return {};
487 }
488
489 llvm_unreachable("unknown callable kind");
490 }
491
isVariadic(const Decl * D)492 bool CallEvent::isVariadic(const Decl *D) {
493 assert(D);
494
495 if (const auto *FD = dyn_cast<FunctionDecl>(D))
496 return FD->isVariadic();
497 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
498 return MD->isVariadic();
499 if (const auto *BD = dyn_cast<BlockDecl>(D))
500 return BD->isVariadic();
501
502 llvm_unreachable("unknown callable kind");
503 }
504
addParameterValuesToBindings(const StackFrameContext * CalleeCtx,CallEvent::BindingsTy & Bindings,SValBuilder & SVB,const CallEvent & Call,ArrayRef<ParmVarDecl * > parameters)505 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
506 CallEvent::BindingsTy &Bindings,
507 SValBuilder &SVB,
508 const CallEvent &Call,
509 ArrayRef<ParmVarDecl*> parameters) {
510 MemRegionManager &MRMgr = SVB.getRegionManager();
511
512 // If the function has fewer parameters than the call has arguments, we simply
513 // do not bind any values to them.
514 unsigned NumArgs = Call.getNumArgs();
515 unsigned Idx = 0;
516 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
517 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
518 const ParmVarDecl *ParamDecl = *I;
519 assert(ParamDecl && "Formal parameter has no decl?");
520
521 // TODO: Support allocator calls.
522 if (Call.getKind() != CE_CXXAllocator)
523 if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx)))
524 continue;
525
526 // TODO: Allocators should receive the correct size and possibly alignment,
527 // determined in compile-time but not represented as arg-expressions,
528 // which makes getArgSVal() fail and return UnknownVal.
529 SVal ArgVal = Call.getArgSVal(Idx);
530 if (!ArgVal.isUnknown()) {
531 Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
532 Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
533 }
534 }
535
536 // FIXME: Variadic arguments are not handled at all right now.
537 }
538
parameters() const539 ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
540 const FunctionDecl *D = getDecl();
541 if (!D)
542 return None;
543 return D->parameters();
544 }
545
getRuntimeDefinition() const546 RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
547 const FunctionDecl *FD = getDecl();
548 if (!FD)
549 return {};
550
551 // Note that the AnalysisDeclContext will have the FunctionDecl with
552 // the definition (if one exists).
553 AnalysisDeclContext *AD =
554 getLocationContext()->getAnalysisDeclContext()->
555 getManager()->getContext(FD);
556 bool IsAutosynthesized;
557 Stmt* Body = AD->getBody(IsAutosynthesized);
558 LLVM_DEBUG({
559 if (IsAutosynthesized)
560 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
561 << "\n";
562 });
563 if (Body) {
564 const Decl* Decl = AD->getDecl();
565 return RuntimeDefinition(Decl);
566 }
567
568 SubEngine &Engine = getState()->getStateManager().getOwningEngine();
569 AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
570
571 // Try to get CTU definition only if CTUDir is provided.
572 if (!Opts.IsNaiveCTUEnabled)
573 return {};
574
575 cross_tu::CrossTranslationUnitContext &CTUCtx =
576 *Engine.getCrossTranslationUnitContext();
577 llvm::Expected<const FunctionDecl *> CTUDeclOrError =
578 CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
579 Opts.DisplayCTUProgress);
580
581 if (!CTUDeclOrError) {
582 handleAllErrors(CTUDeclOrError.takeError(),
583 [&](const cross_tu::IndexError &IE) {
584 CTUCtx.emitCrossTUDiagnostics(IE);
585 });
586 return {};
587 }
588
589 return RuntimeDefinition(*CTUDeclOrError);
590 }
591
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const592 void AnyFunctionCall::getInitialStackFrameContents(
593 const StackFrameContext *CalleeCtx,
594 BindingsTy &Bindings) const {
595 const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
596 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
597 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
598 D->parameters());
599 }
600
argumentsMayEscape() const601 bool AnyFunctionCall::argumentsMayEscape() const {
602 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
603 return true;
604
605 const FunctionDecl *D = getDecl();
606 if (!D)
607 return true;
608
609 const IdentifierInfo *II = D->getIdentifier();
610 if (!II)
611 return false;
612
613 // This set of "escaping" APIs is
614
615 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
616 // value into thread local storage. The value can later be retrieved with
617 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
618 // parameter is 'const void *', the region escapes through the call.
619 if (II->isStr("pthread_setspecific"))
620 return true;
621
622 // - xpc_connection_set_context stores a value which can be retrieved later
623 // with xpc_connection_get_context.
624 if (II->isStr("xpc_connection_set_context"))
625 return true;
626
627 // - funopen - sets a buffer for future IO calls.
628 if (II->isStr("funopen"))
629 return true;
630
631 // - __cxa_demangle - can reallocate memory and can return the pointer to
632 // the input buffer.
633 if (II->isStr("__cxa_demangle"))
634 return true;
635
636 StringRef FName = II->getName();
637
638 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
639 // buffer even if it is const.
640 if (FName.endswith("NoCopy"))
641 return true;
642
643 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
644 // be deallocated by NSMapRemove.
645 if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
646 return true;
647
648 // - Many CF containers allow objects to escape through custom
649 // allocators/deallocators upon container construction. (PR12101)
650 if (FName.startswith("CF") || FName.startswith("CG")) {
651 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
652 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
653 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
654 StrInStrNoCase(FName, "WithData") != StringRef::npos ||
655 StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
656 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
657 }
658
659 return false;
660 }
661
getDecl() const662 const FunctionDecl *SimpleFunctionCall::getDecl() const {
663 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
664 if (D)
665 return D;
666
667 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
668 }
669
getDecl() const670 const FunctionDecl *CXXInstanceCall::getDecl() const {
671 const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
672 if (!CE)
673 return AnyFunctionCall::getDecl();
674
675 const FunctionDecl *D = CE->getDirectCallee();
676 if (D)
677 return D;
678
679 return getSVal(CE->getCallee()).getAsFunctionDecl();
680 }
681
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const682 void CXXInstanceCall::getExtraInvalidatedValues(
683 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
684 SVal ThisVal = getCXXThisVal();
685 Values.push_back(ThisVal);
686
687 // Don't invalidate if the method is const and there are no mutable fields.
688 if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
689 if (!D->isConst())
690 return;
691 // Get the record decl for the class of 'This'. D->getParent() may return a
692 // base class decl, rather than the class of the instance which needs to be
693 // checked for mutable fields.
694 // TODO: We might as well look at the dynamic type of the object.
695 const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
696 QualType T = Ex->getType();
697 if (T->isPointerType()) // Arrow or implicit-this syntax?
698 T = T->getPointeeType();
699 const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
700 assert(ParentRecord);
701 if (ParentRecord->hasMutableFields())
702 return;
703 // Preserve CXXThis.
704 const MemRegion *ThisRegion = ThisVal.getAsRegion();
705 if (!ThisRegion)
706 return;
707
708 ETraits->setTrait(ThisRegion->getBaseRegion(),
709 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
710 }
711 }
712
getCXXThisVal() const713 SVal CXXInstanceCall::getCXXThisVal() const {
714 const Expr *Base = getCXXThisExpr();
715 // FIXME: This doesn't handle an overloaded ->* operator.
716 if (!Base)
717 return UnknownVal();
718
719 SVal ThisVal = getSVal(Base);
720 assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
721 return ThisVal;
722 }
723
getRuntimeDefinition() const724 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
725 // Do we have a decl at all?
726 const Decl *D = getDecl();
727 if (!D)
728 return {};
729
730 // If the method is non-virtual, we know we can inline it.
731 const auto *MD = cast<CXXMethodDecl>(D);
732 if (!MD->isVirtual())
733 return AnyFunctionCall::getRuntimeDefinition();
734
735 // Do we know the implicit 'this' object being called?
736 const MemRegion *R = getCXXThisVal().getAsRegion();
737 if (!R)
738 return {};
739
740 // Do we know anything about the type of 'this'?
741 DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
742 if (!DynType.isValid())
743 return {};
744
745 // Is the type a C++ class? (This is mostly a defensive check.)
746 QualType RegionType = DynType.getType()->getPointeeType();
747 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
748
749 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
750 if (!RD || !RD->hasDefinition())
751 return {};
752
753 // Find the decl for this method in that class.
754 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
755 if (!Result) {
756 // We might not even get the original statically-resolved method due to
757 // some particularly nasty casting (e.g. casts to sister classes).
758 // However, we should at least be able to search up and down our own class
759 // hierarchy, and some real bugs have been caught by checking this.
760 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
761
762 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
763 // the static type. However, because we currently don't update
764 // DynamicTypeInfo when an object is cast, we can't actually be sure the
765 // DynamicTypeInfo is up to date. This assert should be re-enabled once
766 // this is fixed. <rdar://problem/12287087>
767 //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
768
769 return {};
770 }
771
772 // Does the decl that we found have an implementation?
773 const FunctionDecl *Definition;
774 if (!Result->hasBody(Definition)) {
775 if (!DynType.canBeASubClass())
776 return AnyFunctionCall::getRuntimeDefinition();
777 return {};
778 }
779
780 // We found a definition. If we're not sure that this devirtualization is
781 // actually what will happen at runtime, make sure to provide the region so
782 // that ExprEngine can decide what to do with it.
783 if (DynType.canBeASubClass())
784 return RuntimeDefinition(Definition, R->StripCasts());
785 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
786 }
787
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const788 void CXXInstanceCall::getInitialStackFrameContents(
789 const StackFrameContext *CalleeCtx,
790 BindingsTy &Bindings) const {
791 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
792
793 // Handle the binding of 'this' in the new stack frame.
794 SVal ThisVal = getCXXThisVal();
795 if (!ThisVal.isUnknown()) {
796 ProgramStateManager &StateMgr = getState()->getStateManager();
797 SValBuilder &SVB = StateMgr.getSValBuilder();
798
799 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
800 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
801
802 // If we devirtualized to a different member function, we need to make sure
803 // we have the proper layering of CXXBaseObjectRegions.
804 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
805 ASTContext &Ctx = SVB.getContext();
806 const CXXRecordDecl *Class = MD->getParent();
807 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
808
809 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
810 bool Failed;
811 ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
812 if (Failed) {
813 // We might have suffered some sort of placement new earlier, so
814 // we're constructing in a completely unexpected storage.
815 // Fall back to a generic pointer cast for this-value.
816 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
817 const CXXRecordDecl *StaticClass = StaticMD->getParent();
818 QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
819 ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
820 }
821 }
822
823 if (!ThisVal.isUnknown())
824 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
825 }
826 }
827
getCXXThisExpr() const828 const Expr *CXXMemberCall::getCXXThisExpr() const {
829 return getOriginExpr()->getImplicitObjectArgument();
830 }
831
getRuntimeDefinition() const832 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
833 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
834 // id-expression in the class member access expression is a qualified-id,
835 // that function is called. Otherwise, its final overrider in the dynamic type
836 // of the object expression is called.
837 if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
838 if (ME->hasQualifier())
839 return AnyFunctionCall::getRuntimeDefinition();
840
841 return CXXInstanceCall::getRuntimeDefinition();
842 }
843
getCXXThisExpr() const844 const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
845 return getOriginExpr()->getArg(0);
846 }
847
getBlockRegion() const848 const BlockDataRegion *BlockCall::getBlockRegion() const {
849 const Expr *Callee = getOriginExpr()->getCallee();
850 const MemRegion *DataReg = getSVal(Callee).getAsRegion();
851
852 return dyn_cast_or_null<BlockDataRegion>(DataReg);
853 }
854
parameters() const855 ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
856 const BlockDecl *D = getDecl();
857 if (!D)
858 return None;
859 return D->parameters();
860 }
861
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const862 void BlockCall::getExtraInvalidatedValues(ValueList &Values,
863 RegionAndSymbolInvalidationTraits *ETraits) const {
864 // FIXME: This also needs to invalidate captured globals.
865 if (const MemRegion *R = getBlockRegion())
866 Values.push_back(loc::MemRegionVal(R));
867 }
868
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const869 void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
870 BindingsTy &Bindings) const {
871 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
872 ArrayRef<ParmVarDecl*> Params;
873 if (isConversionFromLambda()) {
874 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
875 Params = LambdaOperatorDecl->parameters();
876
877 // For blocks converted from a C++ lambda, the callee declaration is the
878 // operator() method on the lambda so we bind "this" to
879 // the lambda captured by the block.
880 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
881 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
882 Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
883 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
884 } else {
885 Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
886 }
887
888 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
889 Params);
890 }
891
getCXXThisVal() const892 SVal CXXConstructorCall::getCXXThisVal() const {
893 if (Data)
894 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
895 return UnknownVal();
896 }
897
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const898 void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
899 RegionAndSymbolInvalidationTraits *ETraits) const {
900 if (Data) {
901 loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
902 if (SymbolRef Sym = MV.getAsSymbol(true))
903 ETraits->setTrait(Sym,
904 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
905 Values.push_back(MV);
906 }
907 }
908
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const909 void CXXConstructorCall::getInitialStackFrameContents(
910 const StackFrameContext *CalleeCtx,
911 BindingsTy &Bindings) const {
912 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
913
914 SVal ThisVal = getCXXThisVal();
915 if (!ThisVal.isUnknown()) {
916 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
917 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
918 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
919 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
920 }
921 }
922
getCXXThisVal() const923 SVal CXXDestructorCall::getCXXThisVal() const {
924 if (Data)
925 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
926 return UnknownVal();
927 }
928
getRuntimeDefinition() const929 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
930 // Base destructors are always called non-virtually.
931 // Skip CXXInstanceCall's devirtualization logic in this case.
932 if (isBaseDestructor())
933 return AnyFunctionCall::getRuntimeDefinition();
934
935 return CXXInstanceCall::getRuntimeDefinition();
936 }
937
parameters() const938 ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
939 const ObjCMethodDecl *D = getDecl();
940 if (!D)
941 return None;
942 return D->parameters();
943 }
944
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const945 void ObjCMethodCall::getExtraInvalidatedValues(
946 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
947
948 // If the method call is a setter for property known to be backed by
949 // an instance variable, don't invalidate the entire receiver, just
950 // the storage for that instance variable.
951 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
952 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
953 SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
954 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
955 ETraits->setTrait(
956 IvarRegion,
957 RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
958 ETraits->setTrait(
959 IvarRegion,
960 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
961 Values.push_back(IvarLVal);
962 }
963 return;
964 }
965 }
966
967 Values.push_back(getReceiverSVal());
968 }
969
getSelfSVal() const970 SVal ObjCMethodCall::getSelfSVal() const {
971 const LocationContext *LCtx = getLocationContext();
972 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
973 if (!SelfDecl)
974 return SVal();
975 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
976 }
977
getReceiverSVal() const978 SVal ObjCMethodCall::getReceiverSVal() const {
979 // FIXME: Is this the best way to handle class receivers?
980 if (!isInstanceMessage())
981 return UnknownVal();
982
983 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
984 return getSVal(RecE);
985
986 // An instance message with no expression means we are sending to super.
987 // In this case the object reference is the same as 'self'.
988 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
989 SVal SelfVal = getSelfSVal();
990 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
991 return SelfVal;
992 }
993
isReceiverSelfOrSuper() const994 bool ObjCMethodCall::isReceiverSelfOrSuper() const {
995 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
996 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
997 return true;
998
999 if (!isInstanceMessage())
1000 return false;
1001
1002 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
1003
1004 return (RecVal == getSelfSVal());
1005 }
1006
getSourceRange() const1007 SourceRange ObjCMethodCall::getSourceRange() const {
1008 switch (getMessageKind()) {
1009 case OCM_Message:
1010 return getOriginExpr()->getSourceRange();
1011 case OCM_PropertyAccess:
1012 case OCM_Subscript:
1013 return getContainingPseudoObjectExpr()->getSourceRange();
1014 }
1015 llvm_unreachable("unknown message kind");
1016 }
1017
1018 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1019
getContainingPseudoObjectExpr() const1020 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1021 assert(Data && "Lazy lookup not yet performed.");
1022 assert(getMessageKind() != OCM_Message && "Explicit message send.");
1023 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
1024 }
1025
1026 static const Expr *
getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr * POE)1027 getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
1028 const Expr *Syntactic = POE->getSyntacticForm();
1029
1030 // This handles the funny case of assigning to the result of a getter.
1031 // This can happen if the getter returns a non-const reference.
1032 if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1033 Syntactic = BO->getLHS();
1034
1035 return Syntactic;
1036 }
1037
getMessageKind() const1038 ObjCMessageKind ObjCMethodCall::getMessageKind() const {
1039 if (!Data) {
1040 // Find the parent, ignoring implicit casts.
1041 const ParentMap &PM = getLocationContext()->getParentMap();
1042 const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1043
1044 // Check if parent is a PseudoObjectExpr.
1045 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1046 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1047
1048 ObjCMessageKind K;
1049 switch (Syntactic->getStmtClass()) {
1050 case Stmt::ObjCPropertyRefExprClass:
1051 K = OCM_PropertyAccess;
1052 break;
1053 case Stmt::ObjCSubscriptRefExprClass:
1054 K = OCM_Subscript;
1055 break;
1056 default:
1057 // FIXME: Can this ever happen?
1058 K = OCM_Message;
1059 break;
1060 }
1061
1062 if (K != OCM_Message) {
1063 const_cast<ObjCMethodCall *>(this)->Data
1064 = ObjCMessageDataTy(POE, K).getOpaqueValue();
1065 assert(getMessageKind() == K);
1066 return K;
1067 }
1068 }
1069
1070 const_cast<ObjCMethodCall *>(this)->Data
1071 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1072 assert(getMessageKind() == OCM_Message);
1073 return OCM_Message;
1074 }
1075
1076 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1077 if (!Info.getPointer())
1078 return OCM_Message;
1079 return static_cast<ObjCMessageKind>(Info.getInt());
1080 }
1081
getAccessedProperty() const1082 const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
1083 // Look for properties accessed with property syntax (foo.bar = ...)
1084 if (getMessageKind() == OCM_PropertyAccess) {
1085 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1086 assert(POE && "Property access without PseudoObjectExpr?");
1087
1088 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1089 auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1090
1091 if (RefExpr->isExplicitProperty())
1092 return RefExpr->getExplicitProperty();
1093 }
1094
1095 // Look for properties accessed with method syntax ([foo setBar:...]).
1096 const ObjCMethodDecl *MD = getDecl();
1097 if (!MD || !MD->isPropertyAccessor())
1098 return nullptr;
1099
1100 // Note: This is potentially quite slow.
1101 return MD->findPropertyDecl();
1102 }
1103
canBeOverridenInSubclass(ObjCInterfaceDecl * IDecl,Selector Sel) const1104 bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1105 Selector Sel) const {
1106 assert(IDecl);
1107 AnalysisManager &AMgr =
1108 getState()->getStateManager().getOwningEngine().getAnalysisManager();
1109 // If the class interface is declared inside the main file, assume it is not
1110 // subcassed.
1111 // TODO: It could actually be subclassed if the subclass is private as well.
1112 // This is probably very rare.
1113 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1114 if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1115 return false;
1116
1117 // Assume that property accessors are not overridden.
1118 if (getMessageKind() == OCM_PropertyAccess)
1119 return false;
1120
1121 // We assume that if the method is public (declared outside of main file) or
1122 // has a parent which publicly declares the method, the method could be
1123 // overridden in a subclass.
1124
1125 // Find the first declaration in the class hierarchy that declares
1126 // the selector.
1127 ObjCMethodDecl *D = nullptr;
1128 while (true) {
1129 D = IDecl->lookupMethod(Sel, true);
1130
1131 // Cannot find a public definition.
1132 if (!D)
1133 return false;
1134
1135 // If outside the main file,
1136 if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1137 return true;
1138
1139 if (D->isOverriding()) {
1140 // Search in the superclass on the next iteration.
1141 IDecl = D->getClassInterface();
1142 if (!IDecl)
1143 return false;
1144
1145 IDecl = IDecl->getSuperClass();
1146 if (!IDecl)
1147 return false;
1148
1149 continue;
1150 }
1151
1152 return false;
1153 };
1154
1155 llvm_unreachable("The while loop should always terminate.");
1156 }
1157
findDefiningRedecl(const ObjCMethodDecl * MD)1158 static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
1159 if (!MD)
1160 return MD;
1161
1162 // Find the redeclaration that defines the method.
1163 if (!MD->hasBody()) {
1164 for (auto I : MD->redecls())
1165 if (I->hasBody())
1166 MD = cast<ObjCMethodDecl>(I);
1167 }
1168 return MD;
1169 }
1170
isCallToSelfClass(const ObjCMessageExpr * ME)1171 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1172 const Expr* InstRec = ME->getInstanceReceiver();
1173 if (!InstRec)
1174 return false;
1175 const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1176
1177 // Check that receiver is called 'self'.
1178 if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1179 !InstRecIg->getFoundDecl()->getName().equals("self"))
1180 return false;
1181
1182 // Check that the method name is 'class'.
1183 if (ME->getSelector().getNumArgs() != 0 ||
1184 !ME->getSelector().getNameForSlot(0).equals("class"))
1185 return false;
1186
1187 return true;
1188 }
1189
getRuntimeDefinition() const1190 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1191 const ObjCMessageExpr *E = getOriginExpr();
1192 assert(E);
1193 Selector Sel = E->getSelector();
1194
1195 if (E->isInstanceMessage()) {
1196 // Find the receiver type.
1197 const ObjCObjectPointerType *ReceiverT = nullptr;
1198 bool CanBeSubClassed = false;
1199 QualType SupersType = E->getSuperType();
1200 const MemRegion *Receiver = nullptr;
1201
1202 if (!SupersType.isNull()) {
1203 // The receiver is guaranteed to be 'super' in this case.
1204 // Super always means the type of immediate predecessor to the method
1205 // where the call occurs.
1206 ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1207 } else {
1208 Receiver = getReceiverSVal().getAsRegion();
1209 if (!Receiver)
1210 return {};
1211
1212 DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1213 if (!DTI.isValid()) {
1214 assert(isa<AllocaRegion>(Receiver) &&
1215 "Unhandled untyped region class!");
1216 return {};
1217 }
1218
1219 QualType DynType = DTI.getType();
1220 CanBeSubClassed = DTI.canBeASubClass();
1221 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1222
1223 if (ReceiverT && CanBeSubClassed)
1224 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1225 if (!canBeOverridenInSubclass(IDecl, Sel))
1226 CanBeSubClassed = false;
1227 }
1228
1229 // Handle special cases of '[self classMethod]' and
1230 // '[[self class] classMethod]', which are treated by the compiler as
1231 // instance (not class) messages. We will statically dispatch to those.
1232 if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1233 // For [self classMethod], return the compiler visible declaration.
1234 if (PT->getObjectType()->isObjCClass() &&
1235 Receiver == getSelfSVal().getAsRegion())
1236 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1237
1238 // Similarly, handle [[self class] classMethod].
1239 // TODO: We are currently doing a syntactic match for this pattern with is
1240 // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1241 // shows. A better way would be to associate the meta type with the symbol
1242 // using the dynamic type info tracking and use it here. We can add a new
1243 // SVal for ObjC 'Class' values that know what interface declaration they
1244 // come from. Then 'self' in a class method would be filled in with
1245 // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1246 // do proper dynamic dispatch for class methods just like we do for
1247 // instance methods now.
1248 if (E->getInstanceReceiver())
1249 if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1250 if (isCallToSelfClass(M))
1251 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1252 }
1253
1254 // Lookup the instance method implementation.
1255 if (ReceiverT)
1256 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1257 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1258 // when in many cases it returns null. We cache the results so
1259 // that repeated queries on the same ObjCIntefaceDecl and Selector
1260 // don't incur the same cost. On some test cases, we can see the
1261 // same query being issued thousands of times.
1262 //
1263 // NOTE: This cache is essentially a "global" variable, but it
1264 // only gets lazily created when we get here. The value of the
1265 // cache probably comes from it being global across ExprEngines,
1266 // where the same queries may get issued. If we are worried about
1267 // concurrency, or possibly loading/unloading ASTs, etc., we may
1268 // need to revisit this someday. In terms of memory, this table
1269 // stays around until clang quits, which also may be bad if we
1270 // need to release memory.
1271 using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1272 using PrivateMethodCache =
1273 llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1274
1275 static PrivateMethodCache PMC;
1276 Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1277
1278 // Query lookupPrivateMethod() if the cache does not hit.
1279 if (!Val.hasValue()) {
1280 Val = IDecl->lookupPrivateMethod(Sel);
1281
1282 // If the method is a property accessor, we should try to "inline" it
1283 // even if we don't actually have an implementation.
1284 if (!*Val)
1285 if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1286 if (CompileTimeMD->isPropertyAccessor()) {
1287 if (!CompileTimeMD->getSelfDecl() &&
1288 isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1289 // If the method is an accessor in a category, and it doesn't
1290 // have a self declaration, first
1291 // try to find the method in a class extension. This
1292 // works around a bug in Sema where multiple accessors
1293 // are synthesized for properties in class
1294 // extensions that are redeclared in a category and the
1295 // the implicit parameters are not filled in for
1296 // the method on the category.
1297 // This ensures we find the accessor in the extension, which
1298 // has the implicit parameters filled in.
1299 auto *ID = CompileTimeMD->getClassInterface();
1300 for (auto *CatDecl : ID->visible_extensions()) {
1301 Val = CatDecl->getMethod(Sel,
1302 CompileTimeMD->isInstanceMethod());
1303 if (*Val)
1304 break;
1305 }
1306 }
1307 if (!*Val)
1308 Val = IDecl->lookupInstanceMethod(Sel);
1309 }
1310 }
1311
1312 const ObjCMethodDecl *MD = Val.getValue();
1313 if (MD && !MD->hasBody())
1314 MD = MD->getCanonicalDecl();
1315 if (CanBeSubClassed)
1316 return RuntimeDefinition(MD, Receiver);
1317 else
1318 return RuntimeDefinition(MD, nullptr);
1319 }
1320 } else {
1321 // This is a class method.
1322 // If we have type info for the receiver class, we are calling via
1323 // class name.
1324 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1325 // Find/Return the method implementation.
1326 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1327 }
1328 }
1329
1330 return {};
1331 }
1332
argumentsMayEscape() const1333 bool ObjCMethodCall::argumentsMayEscape() const {
1334 if (isInSystemHeader() && !isInstanceMessage()) {
1335 Selector Sel = getSelector();
1336 if (Sel.getNumArgs() == 1 &&
1337 Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1338 return true;
1339 }
1340
1341 return CallEvent::argumentsMayEscape();
1342 }
1343
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const1344 void ObjCMethodCall::getInitialStackFrameContents(
1345 const StackFrameContext *CalleeCtx,
1346 BindingsTy &Bindings) const {
1347 const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1348 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1349 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1350 D->parameters());
1351
1352 SVal SelfVal = getReceiverSVal();
1353 if (!SelfVal.isUnknown()) {
1354 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1355 MemRegionManager &MRMgr = SVB.getRegionManager();
1356 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1357 Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1358 }
1359 }
1360
1361 CallEventRef<>
getSimpleCall(const CallExpr * CE,ProgramStateRef State,const LocationContext * LCtx)1362 CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
1363 const LocationContext *LCtx) {
1364 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1365 return create<CXXMemberCall>(MCE, State, LCtx);
1366
1367 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1368 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1369 if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1370 if (MD->isInstance())
1371 return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1372
1373 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1374 return create<BlockCall>(CE, State, LCtx);
1375 }
1376
1377 // Otherwise, it's a normal function call, static member function call, or
1378 // something we can't reason about.
1379 return create<SimpleFunctionCall>(CE, State, LCtx);
1380 }
1381
1382 CallEventRef<>
getCaller(const StackFrameContext * CalleeCtx,ProgramStateRef State)1383 CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
1384 ProgramStateRef State) {
1385 const LocationContext *ParentCtx = CalleeCtx->getParent();
1386 const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1387 assert(CallerCtx && "This should not be used for top-level stack frames");
1388
1389 const Stmt *CallSite = CalleeCtx->getCallSite();
1390
1391 if (CallSite) {
1392 if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1393 return Out;
1394
1395 // All other cases are handled by getCall.
1396 assert(isa<CXXConstructExpr>(CallSite) &&
1397 "This is not an inlineable statement");
1398
1399 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1400 const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1401 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1402 SVal ThisVal = State->getSVal(ThisPtr);
1403
1404 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1405 ThisVal.getAsRegion(), State, CallerCtx);
1406 }
1407
1408 // Fall back to the CFG. The only thing we haven't handled yet is
1409 // destructors, though this could change in the future.
1410 const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1411 CFGElement E = (*B)[CalleeCtx->getIndex()];
1412 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1413 "All other CFG elements should have exprs");
1414
1415 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1416 const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1417 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1418 SVal ThisVal = State->getSVal(ThisPtr);
1419
1420 const Stmt *Trigger;
1421 if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())
1422 Trigger = AutoDtor->getTriggerStmt();
1423 else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1424 Trigger = DeleteDtor->getDeleteExpr();
1425 else
1426 Trigger = Dtor->getBody();
1427
1428 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1429 E.getAs<CFGBaseDtor>().hasValue(), State,
1430 CallerCtx);
1431 }
1432
getCall(const Stmt * S,ProgramStateRef State,const LocationContext * LC)1433 CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State,
1434 const LocationContext *LC) {
1435 if (const auto *CE = dyn_cast<CallExpr>(S)) {
1436 return getSimpleCall(CE, State, LC);
1437 } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1438 return getCXXAllocatorCall(NE, State, LC);
1439 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1440 return getObjCMethodCall(ME, State, LC);
1441 } else {
1442 return nullptr;
1443 }
1444 }
1445