1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
17 #include "clang/AST/ASTContext.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
28 #include "clang/Analysis/AnalysisDeclContext.h"
29 #include "clang/Analysis/CFG.h"
30 #include "clang/Analysis/CFGStmtMap.h"
31 #include "clang/Analysis/ProgramPoint.h"
32 #include "clang/CrossTU/CrossTranslationUnit.h"
33 #include "clang/Basic/IdentifierTable.h"
34 #include "clang/Basic/LLVM.h"
35 #include "clang/Basic/SourceLocation.h"
36 #include "clang/Basic/SourceManager.h"
37 #include "clang/Basic/Specifiers.h"
38 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
39 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
41 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h"
42 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
43 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
44 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
45 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
46 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
47 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
48 #include "llvm/ADT/ArrayRef.h"
49 #include "llvm/ADT/DenseMap.h"
50 #include "llvm/ADT/None.h"
51 #include "llvm/ADT/Optional.h"
52 #include "llvm/ADT/PointerIntPair.h"
53 #include "llvm/ADT/SmallSet.h"
54 #include "llvm/ADT/SmallVector.h"
55 #include "llvm/ADT/StringExtras.h"
56 #include "llvm/ADT/StringRef.h"
57 #include "llvm/Support/Casting.h"
58 #include "llvm/Support/Compiler.h"
59 #include "llvm/Support/Debug.h"
60 #include "llvm/Support/ErrorHandling.h"
61 #include "llvm/Support/raw_ostream.h"
62 #include <cassert>
63 #include <utility>
64
65 #define DEBUG_TYPE "static-analyzer-call-event"
66
67 using namespace clang;
68 using namespace ento;
69
getResultType() const70 QualType CallEvent::getResultType() const {
71 ASTContext &Ctx = getState()->getStateManager().getContext();
72 const Expr *E = getOriginExpr();
73 if (!E)
74 return Ctx.VoidTy;
75 assert(E);
76
77 QualType ResultTy = E->getType();
78
79 // A function that returns a reference to 'int' will have a result type
80 // of simply 'int'. Check the origin expr's value kind to recover the
81 // proper type.
82 switch (E->getValueKind()) {
83 case VK_LValue:
84 ResultTy = Ctx.getLValueReferenceType(ResultTy);
85 break;
86 case VK_XValue:
87 ResultTy = Ctx.getRValueReferenceType(ResultTy);
88 break;
89 case VK_RValue:
90 // No adjustment is necessary.
91 break;
92 }
93
94 return ResultTy;
95 }
96
isCallback(QualType T)97 static bool isCallback(QualType T) {
98 // If a parameter is a block or a callback, assume it can modify pointer.
99 if (T->isBlockPointerType() ||
100 T->isFunctionPointerType() ||
101 T->isObjCSelType())
102 return true;
103
104 // Check if a callback is passed inside a struct (for both, struct passed by
105 // reference and by value). Dig just one level into the struct for now.
106
107 if (T->isAnyPointerType() || T->isReferenceType())
108 T = T->getPointeeType();
109
110 if (const RecordType *RT = T->getAsStructureType()) {
111 const RecordDecl *RD = RT->getDecl();
112 for (const auto *I : RD->fields()) {
113 QualType FieldT = I->getType();
114 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
115 return true;
116 }
117 }
118 return false;
119 }
120
isVoidPointerToNonConst(QualType T)121 static bool isVoidPointerToNonConst(QualType T) {
122 if (const auto *PT = T->getAs<PointerType>()) {
123 QualType PointeeTy = PT->getPointeeType();
124 if (PointeeTy.isConstQualified())
125 return false;
126 return PointeeTy->isVoidType();
127 } else
128 return false;
129 }
130
hasNonNullArgumentsWithType(bool (* Condition)(QualType)) const131 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
132 unsigned NumOfArgs = getNumArgs();
133
134 // If calling using a function pointer, assume the function does not
135 // satisfy the callback.
136 // TODO: We could check the types of the arguments here.
137 if (!getDecl())
138 return false;
139
140 unsigned Idx = 0;
141 for (CallEvent::param_type_iterator I = param_type_begin(),
142 E = param_type_end();
143 I != E && Idx < NumOfArgs; ++I, ++Idx) {
144 // If the parameter is 0, it's harmless.
145 if (getArgSVal(Idx).isZeroConstant())
146 continue;
147
148 if (Condition(*I))
149 return true;
150 }
151 return false;
152 }
153
hasNonZeroCallbackArg() const154 bool CallEvent::hasNonZeroCallbackArg() const {
155 return hasNonNullArgumentsWithType(isCallback);
156 }
157
hasVoidPointerToNonConstArg() const158 bool CallEvent::hasVoidPointerToNonConstArg() const {
159 return hasNonNullArgumentsWithType(isVoidPointerToNonConst);
160 }
161
isGlobalCFunction(StringRef FunctionName) const162 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
163 const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
164 if (!FD)
165 return false;
166
167 return CheckerContext::isCLibraryFunction(FD, FunctionName);
168 }
169
getCalleeAnalysisDeclContext() const170 AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const {
171 const Decl *D = getDecl();
172
173 // If the callee is completely unknown, we cannot construct the stack frame.
174 if (!D)
175 return nullptr;
176
177 // FIXME: Skip virtual functions for now. There's no easy procedure to foresee
178 // the exact decl that should be used, especially when it's not a definition.
179 if (const Decl *RD = getRuntimeDefinition().getDecl())
180 if (RD != D)
181 return nullptr;
182
183 return LCtx->getAnalysisDeclContext()->getManager()->getContext(D);
184 }
185
getCalleeStackFrame() const186 const StackFrameContext *CallEvent::getCalleeStackFrame() const {
187 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext();
188 if (!ADC)
189 return nullptr;
190
191 const Expr *E = getOriginExpr();
192 if (!E)
193 return nullptr;
194
195 // Recover CFG block via reverse lookup.
196 // TODO: If we were to keep CFG element information as part of the CallEvent
197 // instead of doing this reverse lookup, we would be able to build the stack
198 // frame for non-expression-based calls, and also we wouldn't need the reverse
199 // lookup.
200 CFGStmtMap *Map = LCtx->getAnalysisDeclContext()->getCFGStmtMap();
201 const CFGBlock *B = Map->getBlock(E);
202 assert(B);
203
204 // Also recover CFG index by scanning the CFG block.
205 unsigned Idx = 0, Sz = B->size();
206 for (; Idx < Sz; ++Idx)
207 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
208 if (StmtElem->getStmt() == E)
209 break;
210 assert(Idx < Sz);
211
212 return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, Idx);
213 }
214
getParameterLocation(unsigned Index) const215 const VarRegion *CallEvent::getParameterLocation(unsigned Index) const {
216 const StackFrameContext *SFC = getCalleeStackFrame();
217 // We cannot construct a VarRegion without a stack frame.
218 if (!SFC)
219 return nullptr;
220
221 const ParmVarDecl *PVD = parameters()[Index];
222 const VarRegion *VR =
223 State->getStateManager().getRegionManager().getVarRegion(PVD, SFC);
224
225 // This sanity check would fail if our parameter declaration doesn't
226 // correspond to the stack frame's function declaration.
227 assert(VR->getStackFrame() == SFC);
228
229 return VR;
230 }
231
232 /// Returns true if a type is a pointer-to-const or reference-to-const
233 /// with no further indirection.
isPointerToConst(QualType Ty)234 static bool isPointerToConst(QualType Ty) {
235 QualType PointeeTy = Ty->getPointeeType();
236 if (PointeeTy == QualType())
237 return false;
238 if (!PointeeTy.isConstQualified())
239 return false;
240 if (PointeeTy->isAnyPointerType())
241 return false;
242 return true;
243 }
244
245 // Try to retrieve the function declaration and find the function parameter
246 // types which are pointers/references to a non-pointer const.
247 // We will not invalidate the corresponding argument regions.
findPtrToConstParams(llvm::SmallSet<unsigned,4> & PreserveArgs,const CallEvent & Call)248 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
249 const CallEvent &Call) {
250 unsigned Idx = 0;
251 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
252 E = Call.param_type_end();
253 I != E; ++I, ++Idx) {
254 if (isPointerToConst(*I))
255 PreserveArgs.insert(Idx);
256 }
257 }
258
invalidateRegions(unsigned BlockCount,ProgramStateRef Orig) const259 ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
260 ProgramStateRef Orig) const {
261 ProgramStateRef Result = (Orig ? Orig : getState());
262
263 // Don't invalidate anything if the callee is marked pure/const.
264 if (const Decl *callee = getDecl())
265 if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
266 return Result;
267
268 SmallVector<SVal, 8> ValuesToInvalidate;
269 RegionAndSymbolInvalidationTraits ETraits;
270
271 getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
272
273 // Indexes of arguments whose values will be preserved by the call.
274 llvm::SmallSet<unsigned, 4> PreserveArgs;
275 if (!argumentsMayEscape())
276 findPtrToConstParams(PreserveArgs, *this);
277
278 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
279 // Mark this region for invalidation. We batch invalidate regions
280 // below for efficiency.
281 if (PreserveArgs.count(Idx))
282 if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
283 ETraits.setTrait(MR->getBaseRegion(),
284 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
285 // TODO: Factor this out + handle the lower level const pointers.
286
287 ValuesToInvalidate.push_back(getArgSVal(Idx));
288 }
289
290 // Invalidate designated regions using the batch invalidation API.
291 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
292 // global variables.
293 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
294 BlockCount, getLocationContext(),
295 /*CausedByPointerEscape*/ true,
296 /*Symbols=*/nullptr, this, &ETraits);
297 }
298
getProgramPoint(bool IsPreVisit,const ProgramPointTag * Tag) const299 ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
300 const ProgramPointTag *Tag) const {
301 if (const Expr *E = getOriginExpr()) {
302 if (IsPreVisit)
303 return PreStmt(E, getLocationContext(), Tag);
304 return PostStmt(E, getLocationContext(), Tag);
305 }
306
307 const Decl *D = getDecl();
308 assert(D && "Cannot get a program point without a statement or decl");
309
310 SourceLocation Loc = getSourceRange().getBegin();
311 if (IsPreVisit)
312 return PreImplicitCall(D, Loc, getLocationContext(), Tag);
313 return PostImplicitCall(D, Loc, getLocationContext(), Tag);
314 }
315
isCalled(const CallDescription & CD) const316 bool CallEvent::isCalled(const CallDescription &CD) const {
317 // FIXME: Add ObjC Message support.
318 if (getKind() == CE_ObjCMessage)
319 return false;
320 if (!CD.IsLookupDone) {
321 CD.IsLookupDone = true;
322 CD.II = &getState()->getStateManager().getContext().Idents.get(CD.FuncName);
323 }
324 const IdentifierInfo *II = getCalleeIdentifier();
325 if (!II || II != CD.II)
326 return false;
327 return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
328 CD.RequiredArgs == getNumArgs());
329 }
330
getArgSVal(unsigned Index) const331 SVal CallEvent::getArgSVal(unsigned Index) const {
332 const Expr *ArgE = getArgExpr(Index);
333 if (!ArgE)
334 return UnknownVal();
335 return getSVal(ArgE);
336 }
337
getArgSourceRange(unsigned Index) const338 SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
339 const Expr *ArgE = getArgExpr(Index);
340 if (!ArgE)
341 return {};
342 return ArgE->getSourceRange();
343 }
344
getReturnValue() const345 SVal CallEvent::getReturnValue() const {
346 const Expr *E = getOriginExpr();
347 if (!E)
348 return UndefinedVal();
349 return getSVal(E);
350 }
351
dump() const352 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
353
dump(raw_ostream & Out) const354 void CallEvent::dump(raw_ostream &Out) const {
355 ASTContext &Ctx = getState()->getStateManager().getContext();
356 if (const Expr *E = getOriginExpr()) {
357 E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
358 Out << "\n";
359 return;
360 }
361
362 if (const Decl *D = getDecl()) {
363 Out << "Call to ";
364 D->print(Out, Ctx.getPrintingPolicy());
365 return;
366 }
367
368 // FIXME: a string representation of the kind would be nice.
369 Out << "Unknown call (type " << getKind() << ")";
370 }
371
isCallStmt(const Stmt * S)372 bool CallEvent::isCallStmt(const Stmt *S) {
373 return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
374 || isa<CXXConstructExpr>(S)
375 || isa<CXXNewExpr>(S);
376 }
377
getDeclaredResultType(const Decl * D)378 QualType CallEvent::getDeclaredResultType(const Decl *D) {
379 assert(D);
380 if (const auto *FD = dyn_cast<FunctionDecl>(D))
381 return FD->getReturnType();
382 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
383 return MD->getReturnType();
384 if (const auto *BD = dyn_cast<BlockDecl>(D)) {
385 // Blocks are difficult because the return type may not be stored in the
386 // BlockDecl itself. The AST should probably be enhanced, but for now we
387 // just do what we can.
388 // If the block is declared without an explicit argument list, the
389 // signature-as-written just includes the return type, not the entire
390 // function type.
391 // FIXME: All blocks should have signatures-as-written, even if the return
392 // type is inferred. (That's signified with a dependent result type.)
393 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
394 QualType Ty = TSI->getType();
395 if (const FunctionType *FT = Ty->getAs<FunctionType>())
396 Ty = FT->getReturnType();
397 if (!Ty->isDependentType())
398 return Ty;
399 }
400
401 return {};
402 }
403
404 llvm_unreachable("unknown callable kind");
405 }
406
isVariadic(const Decl * D)407 bool CallEvent::isVariadic(const Decl *D) {
408 assert(D);
409
410 if (const auto *FD = dyn_cast<FunctionDecl>(D))
411 return FD->isVariadic();
412 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
413 return MD->isVariadic();
414 if (const auto *BD = dyn_cast<BlockDecl>(D))
415 return BD->isVariadic();
416
417 llvm_unreachable("unknown callable kind");
418 }
419
addParameterValuesToBindings(const StackFrameContext * CalleeCtx,CallEvent::BindingsTy & Bindings,SValBuilder & SVB,const CallEvent & Call,ArrayRef<ParmVarDecl * > parameters)420 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
421 CallEvent::BindingsTy &Bindings,
422 SValBuilder &SVB,
423 const CallEvent &Call,
424 ArrayRef<ParmVarDecl*> parameters) {
425 MemRegionManager &MRMgr = SVB.getRegionManager();
426
427 // If the function has fewer parameters than the call has arguments, we simply
428 // do not bind any values to them.
429 unsigned NumArgs = Call.getNumArgs();
430 unsigned Idx = 0;
431 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
432 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
433 const ParmVarDecl *ParamDecl = *I;
434 assert(ParamDecl && "Formal parameter has no decl?");
435
436 SVal ArgVal = Call.getArgSVal(Idx);
437 if (!ArgVal.isUnknown()) {
438 Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
439 Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
440 }
441 }
442
443 // FIXME: Variadic arguments are not handled at all right now.
444 }
445
parameters() const446 ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
447 const FunctionDecl *D = getDecl();
448 if (!D)
449 return None;
450 return D->parameters();
451 }
452
getRuntimeDefinition() const453 RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
454 const FunctionDecl *FD = getDecl();
455 if (!FD)
456 return {};
457
458 // Note that the AnalysisDeclContext will have the FunctionDecl with
459 // the definition (if one exists).
460 AnalysisDeclContext *AD =
461 getLocationContext()->getAnalysisDeclContext()->
462 getManager()->getContext(FD);
463 bool IsAutosynthesized;
464 Stmt* Body = AD->getBody(IsAutosynthesized);
465 LLVM_DEBUG({
466 if (IsAutosynthesized)
467 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
468 << "\n";
469 });
470 if (Body) {
471 const Decl* Decl = AD->getDecl();
472 return RuntimeDefinition(Decl);
473 }
474
475 SubEngine *Engine = getState()->getStateManager().getOwningEngine();
476 AnalyzerOptions &Opts = Engine->getAnalysisManager().options;
477
478 // Try to get CTU definition only if CTUDir is provided.
479 if (!Opts.naiveCTUEnabled())
480 return {};
481
482 cross_tu::CrossTranslationUnitContext &CTUCtx =
483 *Engine->getCrossTranslationUnitContext();
484 llvm::Expected<const FunctionDecl *> CTUDeclOrError =
485 CTUCtx.getCrossTUDefinition(FD, Opts.getCTUDir(), Opts.getCTUIndexName());
486
487 if (!CTUDeclOrError) {
488 handleAllErrors(CTUDeclOrError.takeError(),
489 [&](const cross_tu::IndexError &IE) {
490 CTUCtx.emitCrossTUDiagnostics(IE);
491 });
492 return {};
493 }
494
495 return RuntimeDefinition(*CTUDeclOrError);
496 }
497
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const498 void AnyFunctionCall::getInitialStackFrameContents(
499 const StackFrameContext *CalleeCtx,
500 BindingsTy &Bindings) const {
501 const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
502 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
503 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
504 D->parameters());
505 }
506
argumentsMayEscape() const507 bool AnyFunctionCall::argumentsMayEscape() const {
508 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
509 return true;
510
511 const FunctionDecl *D = getDecl();
512 if (!D)
513 return true;
514
515 const IdentifierInfo *II = D->getIdentifier();
516 if (!II)
517 return false;
518
519 // This set of "escaping" APIs is
520
521 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
522 // value into thread local storage. The value can later be retrieved with
523 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
524 // parameter is 'const void *', the region escapes through the call.
525 if (II->isStr("pthread_setspecific"))
526 return true;
527
528 // - xpc_connection_set_context stores a value which can be retrieved later
529 // with xpc_connection_get_context.
530 if (II->isStr("xpc_connection_set_context"))
531 return true;
532
533 // - funopen - sets a buffer for future IO calls.
534 if (II->isStr("funopen"))
535 return true;
536
537 // - __cxa_demangle - can reallocate memory and can return the pointer to
538 // the input buffer.
539 if (II->isStr("__cxa_demangle"))
540 return true;
541
542 StringRef FName = II->getName();
543
544 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
545 // buffer even if it is const.
546 if (FName.endswith("NoCopy"))
547 return true;
548
549 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
550 // be deallocated by NSMapRemove.
551 if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
552 return true;
553
554 // - Many CF containers allow objects to escape through custom
555 // allocators/deallocators upon container construction. (PR12101)
556 if (FName.startswith("CF") || FName.startswith("CG")) {
557 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
558 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
559 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
560 StrInStrNoCase(FName, "WithData") != StringRef::npos ||
561 StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
562 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
563 }
564
565 return false;
566 }
567
getDecl() const568 const FunctionDecl *SimpleFunctionCall::getDecl() const {
569 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
570 if (D)
571 return D;
572
573 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
574 }
575
getDecl() const576 const FunctionDecl *CXXInstanceCall::getDecl() const {
577 const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
578 if (!CE)
579 return AnyFunctionCall::getDecl();
580
581 const FunctionDecl *D = CE->getDirectCallee();
582 if (D)
583 return D;
584
585 return getSVal(CE->getCallee()).getAsFunctionDecl();
586 }
587
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const588 void CXXInstanceCall::getExtraInvalidatedValues(
589 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
590 SVal ThisVal = getCXXThisVal();
591 Values.push_back(ThisVal);
592
593 // Don't invalidate if the method is const and there are no mutable fields.
594 if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
595 if (!D->isConst())
596 return;
597 // Get the record decl for the class of 'This'. D->getParent() may return a
598 // base class decl, rather than the class of the instance which needs to be
599 // checked for mutable fields.
600 // TODO: We might as well look at the dynamic type of the object.
601 const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
602 QualType T = Ex->getType();
603 if (T->isPointerType()) // Arrow or implicit-this syntax?
604 T = T->getPointeeType();
605 const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
606 assert(ParentRecord);
607 if (ParentRecord->hasMutableFields())
608 return;
609 // Preserve CXXThis.
610 const MemRegion *ThisRegion = ThisVal.getAsRegion();
611 if (!ThisRegion)
612 return;
613
614 ETraits->setTrait(ThisRegion->getBaseRegion(),
615 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
616 }
617 }
618
getCXXThisVal() const619 SVal CXXInstanceCall::getCXXThisVal() const {
620 const Expr *Base = getCXXThisExpr();
621 // FIXME: This doesn't handle an overloaded ->* operator.
622 if (!Base)
623 return UnknownVal();
624
625 SVal ThisVal = getSVal(Base);
626 assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
627 return ThisVal;
628 }
629
getRuntimeDefinition() const630 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
631 // Do we have a decl at all?
632 const Decl *D = getDecl();
633 if (!D)
634 return {};
635
636 // If the method is non-virtual, we know we can inline it.
637 const auto *MD = cast<CXXMethodDecl>(D);
638 if (!MD->isVirtual())
639 return AnyFunctionCall::getRuntimeDefinition();
640
641 // Do we know the implicit 'this' object being called?
642 const MemRegion *R = getCXXThisVal().getAsRegion();
643 if (!R)
644 return {};
645
646 // Do we know anything about the type of 'this'?
647 DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
648 if (!DynType.isValid())
649 return {};
650
651 // Is the type a C++ class? (This is mostly a defensive check.)
652 QualType RegionType = DynType.getType()->getPointeeType();
653 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
654
655 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
656 if (!RD || !RD->hasDefinition())
657 return {};
658
659 // Find the decl for this method in that class.
660 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
661 if (!Result) {
662 // We might not even get the original statically-resolved method due to
663 // some particularly nasty casting (e.g. casts to sister classes).
664 // However, we should at least be able to search up and down our own class
665 // hierarchy, and some real bugs have been caught by checking this.
666 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
667
668 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
669 // the static type. However, because we currently don't update
670 // DynamicTypeInfo when an object is cast, we can't actually be sure the
671 // DynamicTypeInfo is up to date. This assert should be re-enabled once
672 // this is fixed. <rdar://problem/12287087>
673 //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
674
675 return {};
676 }
677
678 // Does the decl that we found have an implementation?
679 const FunctionDecl *Definition;
680 if (!Result->hasBody(Definition))
681 return {};
682
683 // We found a definition. If we're not sure that this devirtualization is
684 // actually what will happen at runtime, make sure to provide the region so
685 // that ExprEngine can decide what to do with it.
686 if (DynType.canBeASubClass())
687 return RuntimeDefinition(Definition, R->StripCasts());
688 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
689 }
690
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const691 void CXXInstanceCall::getInitialStackFrameContents(
692 const StackFrameContext *CalleeCtx,
693 BindingsTy &Bindings) const {
694 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
695
696 // Handle the binding of 'this' in the new stack frame.
697 SVal ThisVal = getCXXThisVal();
698 if (!ThisVal.isUnknown()) {
699 ProgramStateManager &StateMgr = getState()->getStateManager();
700 SValBuilder &SVB = StateMgr.getSValBuilder();
701
702 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
703 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
704
705 // If we devirtualized to a different member function, we need to make sure
706 // we have the proper layering of CXXBaseObjectRegions.
707 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
708 ASTContext &Ctx = SVB.getContext();
709 const CXXRecordDecl *Class = MD->getParent();
710 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
711
712 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
713 bool Failed;
714 ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
715 if (Failed) {
716 // We might have suffered some sort of placement new earlier, so
717 // we're constructing in a completely unexpected storage.
718 // Fall back to a generic pointer cast for this-value.
719 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
720 const CXXRecordDecl *StaticClass = StaticMD->getParent();
721 QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
722 ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
723 }
724 }
725
726 if (!ThisVal.isUnknown())
727 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
728 }
729 }
730
getCXXThisExpr() const731 const Expr *CXXMemberCall::getCXXThisExpr() const {
732 return getOriginExpr()->getImplicitObjectArgument();
733 }
734
getRuntimeDefinition() const735 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
736 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
737 // id-expression in the class member access expression is a qualified-id,
738 // that function is called. Otherwise, its final overrider in the dynamic type
739 // of the object expression is called.
740 if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
741 if (ME->hasQualifier())
742 return AnyFunctionCall::getRuntimeDefinition();
743
744 return CXXInstanceCall::getRuntimeDefinition();
745 }
746
getCXXThisExpr() const747 const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
748 return getOriginExpr()->getArg(0);
749 }
750
getBlockRegion() const751 const BlockDataRegion *BlockCall::getBlockRegion() const {
752 const Expr *Callee = getOriginExpr()->getCallee();
753 const MemRegion *DataReg = getSVal(Callee).getAsRegion();
754
755 return dyn_cast_or_null<BlockDataRegion>(DataReg);
756 }
757
parameters() const758 ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
759 const BlockDecl *D = getDecl();
760 if (!D)
761 return nullptr;
762 return D->parameters();
763 }
764
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const765 void BlockCall::getExtraInvalidatedValues(ValueList &Values,
766 RegionAndSymbolInvalidationTraits *ETraits) const {
767 // FIXME: This also needs to invalidate captured globals.
768 if (const MemRegion *R = getBlockRegion())
769 Values.push_back(loc::MemRegionVal(R));
770 }
771
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const772 void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
773 BindingsTy &Bindings) const {
774 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
775 ArrayRef<ParmVarDecl*> Params;
776 if (isConversionFromLambda()) {
777 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
778 Params = LambdaOperatorDecl->parameters();
779
780 // For blocks converted from a C++ lambda, the callee declaration is the
781 // operator() method on the lambda so we bind "this" to
782 // the lambda captured by the block.
783 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
784 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
785 Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
786 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
787 } else {
788 Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
789 }
790
791 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
792 Params);
793 }
794
getCXXThisVal() const795 SVal CXXConstructorCall::getCXXThisVal() const {
796 if (Data)
797 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
798 return UnknownVal();
799 }
800
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const801 void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
802 RegionAndSymbolInvalidationTraits *ETraits) const {
803 if (Data) {
804 loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
805 if (SymbolRef Sym = MV.getAsSymbol(true))
806 ETraits->setTrait(Sym,
807 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
808 Values.push_back(MV);
809 }
810 }
811
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const812 void CXXConstructorCall::getInitialStackFrameContents(
813 const StackFrameContext *CalleeCtx,
814 BindingsTy &Bindings) const {
815 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
816
817 SVal ThisVal = getCXXThisVal();
818 if (!ThisVal.isUnknown()) {
819 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
820 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
821 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
822 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
823 }
824 }
825
getCXXThisVal() const826 SVal CXXDestructorCall::getCXXThisVal() const {
827 if (Data)
828 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
829 return UnknownVal();
830 }
831
getRuntimeDefinition() const832 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
833 // Base destructors are always called non-virtually.
834 // Skip CXXInstanceCall's devirtualization logic in this case.
835 if (isBaseDestructor())
836 return AnyFunctionCall::getRuntimeDefinition();
837
838 return CXXInstanceCall::getRuntimeDefinition();
839 }
840
parameters() const841 ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
842 const ObjCMethodDecl *D = getDecl();
843 if (!D)
844 return None;
845 return D->parameters();
846 }
847
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const848 void ObjCMethodCall::getExtraInvalidatedValues(
849 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
850
851 // If the method call is a setter for property known to be backed by
852 // an instance variable, don't invalidate the entire receiver, just
853 // the storage for that instance variable.
854 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
855 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
856 SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
857 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
858 ETraits->setTrait(
859 IvarRegion,
860 RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
861 ETraits->setTrait(
862 IvarRegion,
863 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
864 Values.push_back(IvarLVal);
865 }
866 return;
867 }
868 }
869
870 Values.push_back(getReceiverSVal());
871 }
872
getSelfSVal() const873 SVal ObjCMethodCall::getSelfSVal() const {
874 const LocationContext *LCtx = getLocationContext();
875 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
876 if (!SelfDecl)
877 return SVal();
878 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
879 }
880
getReceiverSVal() const881 SVal ObjCMethodCall::getReceiverSVal() const {
882 // FIXME: Is this the best way to handle class receivers?
883 if (!isInstanceMessage())
884 return UnknownVal();
885
886 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
887 return getSVal(RecE);
888
889 // An instance message with no expression means we are sending to super.
890 // In this case the object reference is the same as 'self'.
891 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
892 SVal SelfVal = getSelfSVal();
893 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
894 return SelfVal;
895 }
896
isReceiverSelfOrSuper() const897 bool ObjCMethodCall::isReceiverSelfOrSuper() const {
898 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
899 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
900 return true;
901
902 if (!isInstanceMessage())
903 return false;
904
905 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
906
907 return (RecVal == getSelfSVal());
908 }
909
getSourceRange() const910 SourceRange ObjCMethodCall::getSourceRange() const {
911 switch (getMessageKind()) {
912 case OCM_Message:
913 return getOriginExpr()->getSourceRange();
914 case OCM_PropertyAccess:
915 case OCM_Subscript:
916 return getContainingPseudoObjectExpr()->getSourceRange();
917 }
918 llvm_unreachable("unknown message kind");
919 }
920
921 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
922
getContainingPseudoObjectExpr() const923 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
924 assert(Data && "Lazy lookup not yet performed.");
925 assert(getMessageKind() != OCM_Message && "Explicit message send.");
926 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
927 }
928
929 static const Expr *
getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr * POE)930 getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
931 const Expr *Syntactic = POE->getSyntacticForm();
932
933 // This handles the funny case of assigning to the result of a getter.
934 // This can happen if the getter returns a non-const reference.
935 if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
936 Syntactic = BO->getLHS();
937
938 return Syntactic;
939 }
940
getMessageKind() const941 ObjCMessageKind ObjCMethodCall::getMessageKind() const {
942 if (!Data) {
943 // Find the parent, ignoring implicit casts.
944 ParentMap &PM = getLocationContext()->getParentMap();
945 const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
946
947 // Check if parent is a PseudoObjectExpr.
948 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
949 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
950
951 ObjCMessageKind K;
952 switch (Syntactic->getStmtClass()) {
953 case Stmt::ObjCPropertyRefExprClass:
954 K = OCM_PropertyAccess;
955 break;
956 case Stmt::ObjCSubscriptRefExprClass:
957 K = OCM_Subscript;
958 break;
959 default:
960 // FIXME: Can this ever happen?
961 K = OCM_Message;
962 break;
963 }
964
965 if (K != OCM_Message) {
966 const_cast<ObjCMethodCall *>(this)->Data
967 = ObjCMessageDataTy(POE, K).getOpaqueValue();
968 assert(getMessageKind() == K);
969 return K;
970 }
971 }
972
973 const_cast<ObjCMethodCall *>(this)->Data
974 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
975 assert(getMessageKind() == OCM_Message);
976 return OCM_Message;
977 }
978
979 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
980 if (!Info.getPointer())
981 return OCM_Message;
982 return static_cast<ObjCMessageKind>(Info.getInt());
983 }
984
getAccessedProperty() const985 const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
986 // Look for properties accessed with property syntax (foo.bar = ...)
987 if ( getMessageKind() == OCM_PropertyAccess) {
988 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
989 assert(POE && "Property access without PseudoObjectExpr?");
990
991 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
992 auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
993
994 if (RefExpr->isExplicitProperty())
995 return RefExpr->getExplicitProperty();
996 }
997
998 // Look for properties accessed with method syntax ([foo setBar:...]).
999 const ObjCMethodDecl *MD = getDecl();
1000 if (!MD || !MD->isPropertyAccessor())
1001 return nullptr;
1002
1003 // Note: This is potentially quite slow.
1004 return MD->findPropertyDecl();
1005 }
1006
canBeOverridenInSubclass(ObjCInterfaceDecl * IDecl,Selector Sel) const1007 bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1008 Selector Sel) const {
1009 assert(IDecl);
1010 AnalysisManager &AMgr =
1011 getState()->getStateManager().getOwningEngine()->getAnalysisManager();
1012 // If the class interface is declared inside the main file, assume it is not
1013 // subcassed.
1014 // TODO: It could actually be subclassed if the subclass is private as well.
1015 // This is probably very rare.
1016 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1017 if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1018 return false;
1019
1020 // Assume that property accessors are not overridden.
1021 if (getMessageKind() == OCM_PropertyAccess)
1022 return false;
1023
1024 // We assume that if the method is public (declared outside of main file) or
1025 // has a parent which publicly declares the method, the method could be
1026 // overridden in a subclass.
1027
1028 // Find the first declaration in the class hierarchy that declares
1029 // the selector.
1030 ObjCMethodDecl *D = nullptr;
1031 while (true) {
1032 D = IDecl->lookupMethod(Sel, true);
1033
1034 // Cannot find a public definition.
1035 if (!D)
1036 return false;
1037
1038 // If outside the main file,
1039 if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1040 return true;
1041
1042 if (D->isOverriding()) {
1043 // Search in the superclass on the next iteration.
1044 IDecl = D->getClassInterface();
1045 if (!IDecl)
1046 return false;
1047
1048 IDecl = IDecl->getSuperClass();
1049 if (!IDecl)
1050 return false;
1051
1052 continue;
1053 }
1054
1055 return false;
1056 };
1057
1058 llvm_unreachable("The while loop should always terminate.");
1059 }
1060
findDefiningRedecl(const ObjCMethodDecl * MD)1061 static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
1062 if (!MD)
1063 return MD;
1064
1065 // Find the redeclaration that defines the method.
1066 if (!MD->hasBody()) {
1067 for (auto I : MD->redecls())
1068 if (I->hasBody())
1069 MD = cast<ObjCMethodDecl>(I);
1070 }
1071 return MD;
1072 }
1073
isCallToSelfClass(const ObjCMessageExpr * ME)1074 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1075 const Expr* InstRec = ME->getInstanceReceiver();
1076 if (!InstRec)
1077 return false;
1078 const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1079
1080 // Check that receiver is called 'self'.
1081 if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1082 !InstRecIg->getFoundDecl()->getName().equals("self"))
1083 return false;
1084
1085 // Check that the method name is 'class'.
1086 if (ME->getSelector().getNumArgs() != 0 ||
1087 !ME->getSelector().getNameForSlot(0).equals("class"))
1088 return false;
1089
1090 return true;
1091 }
1092
getRuntimeDefinition() const1093 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1094 const ObjCMessageExpr *E = getOriginExpr();
1095 assert(E);
1096 Selector Sel = E->getSelector();
1097
1098 if (E->isInstanceMessage()) {
1099 // Find the receiver type.
1100 const ObjCObjectPointerType *ReceiverT = nullptr;
1101 bool CanBeSubClassed = false;
1102 QualType SupersType = E->getSuperType();
1103 const MemRegion *Receiver = nullptr;
1104
1105 if (!SupersType.isNull()) {
1106 // The receiver is guaranteed to be 'super' in this case.
1107 // Super always means the type of immediate predecessor to the method
1108 // where the call occurs.
1109 ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1110 } else {
1111 Receiver = getReceiverSVal().getAsRegion();
1112 if (!Receiver)
1113 return {};
1114
1115 DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1116 if (!DTI.isValid()) {
1117 assert(isa<AllocaRegion>(Receiver) &&
1118 "Unhandled untyped region class!");
1119 return {};
1120 }
1121
1122 QualType DynType = DTI.getType();
1123 CanBeSubClassed = DTI.canBeASubClass();
1124 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1125
1126 if (ReceiverT && CanBeSubClassed)
1127 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1128 if (!canBeOverridenInSubclass(IDecl, Sel))
1129 CanBeSubClassed = false;
1130 }
1131
1132 // Handle special cases of '[self classMethod]' and
1133 // '[[self class] classMethod]', which are treated by the compiler as
1134 // instance (not class) messages. We will statically dispatch to those.
1135 if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1136 // For [self classMethod], return the compiler visible declaration.
1137 if (PT->getObjectType()->isObjCClass() &&
1138 Receiver == getSelfSVal().getAsRegion())
1139 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1140
1141 // Similarly, handle [[self class] classMethod].
1142 // TODO: We are currently doing a syntactic match for this pattern with is
1143 // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1144 // shows. A better way would be to associate the meta type with the symbol
1145 // using the dynamic type info tracking and use it here. We can add a new
1146 // SVal for ObjC 'Class' values that know what interface declaration they
1147 // come from. Then 'self' in a class method would be filled in with
1148 // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1149 // do proper dynamic dispatch for class methods just like we do for
1150 // instance methods now.
1151 if (E->getInstanceReceiver())
1152 if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1153 if (isCallToSelfClass(M))
1154 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1155 }
1156
1157 // Lookup the instance method implementation.
1158 if (ReceiverT)
1159 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1160 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1161 // when in many cases it returns null. We cache the results so
1162 // that repeated queries on the same ObjCIntefaceDecl and Selector
1163 // don't incur the same cost. On some test cases, we can see the
1164 // same query being issued thousands of times.
1165 //
1166 // NOTE: This cache is essentially a "global" variable, but it
1167 // only gets lazily created when we get here. The value of the
1168 // cache probably comes from it being global across ExprEngines,
1169 // where the same queries may get issued. If we are worried about
1170 // concurrency, or possibly loading/unloading ASTs, etc., we may
1171 // need to revisit this someday. In terms of memory, this table
1172 // stays around until clang quits, which also may be bad if we
1173 // need to release memory.
1174 using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1175 using PrivateMethodCache =
1176 llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1177
1178 static PrivateMethodCache PMC;
1179 Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1180
1181 // Query lookupPrivateMethod() if the cache does not hit.
1182 if (!Val.hasValue()) {
1183 Val = IDecl->lookupPrivateMethod(Sel);
1184
1185 // If the method is a property accessor, we should try to "inline" it
1186 // even if we don't actually have an implementation.
1187 if (!*Val)
1188 if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1189 if (CompileTimeMD->isPropertyAccessor()) {
1190 if (!CompileTimeMD->getSelfDecl() &&
1191 isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1192 // If the method is an accessor in a category, and it doesn't
1193 // have a self declaration, first
1194 // try to find the method in a class extension. This
1195 // works around a bug in Sema where multiple accessors
1196 // are synthesized for properties in class
1197 // extensions that are redeclared in a category and the
1198 // the implicit parameters are not filled in for
1199 // the method on the category.
1200 // This ensures we find the accessor in the extension, which
1201 // has the implicit parameters filled in.
1202 auto *ID = CompileTimeMD->getClassInterface();
1203 for (auto *CatDecl : ID->visible_extensions()) {
1204 Val = CatDecl->getMethod(Sel,
1205 CompileTimeMD->isInstanceMethod());
1206 if (*Val)
1207 break;
1208 }
1209 }
1210 if (!*Val)
1211 Val = IDecl->lookupInstanceMethod(Sel);
1212 }
1213 }
1214
1215 const ObjCMethodDecl *MD = Val.getValue();
1216 if (CanBeSubClassed)
1217 return RuntimeDefinition(MD, Receiver);
1218 else
1219 return RuntimeDefinition(MD, nullptr);
1220 }
1221 } else {
1222 // This is a class method.
1223 // If we have type info for the receiver class, we are calling via
1224 // class name.
1225 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1226 // Find/Return the method implementation.
1227 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1228 }
1229 }
1230
1231 return {};
1232 }
1233
argumentsMayEscape() const1234 bool ObjCMethodCall::argumentsMayEscape() const {
1235 if (isInSystemHeader() && !isInstanceMessage()) {
1236 Selector Sel = getSelector();
1237 if (Sel.getNumArgs() == 1 &&
1238 Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1239 return true;
1240 }
1241
1242 return CallEvent::argumentsMayEscape();
1243 }
1244
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const1245 void ObjCMethodCall::getInitialStackFrameContents(
1246 const StackFrameContext *CalleeCtx,
1247 BindingsTy &Bindings) const {
1248 const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1249 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1250 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1251 D->parameters());
1252
1253 SVal SelfVal = getReceiverSVal();
1254 if (!SelfVal.isUnknown()) {
1255 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1256 MemRegionManager &MRMgr = SVB.getRegionManager();
1257 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1258 Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1259 }
1260 }
1261
1262 CallEventRef<>
getSimpleCall(const CallExpr * CE,ProgramStateRef State,const LocationContext * LCtx)1263 CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
1264 const LocationContext *LCtx) {
1265 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1266 return create<CXXMemberCall>(MCE, State, LCtx);
1267
1268 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1269 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1270 if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1271 if (MD->isInstance())
1272 return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1273
1274 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1275 return create<BlockCall>(CE, State, LCtx);
1276 }
1277
1278 // Otherwise, it's a normal function call, static member function call, or
1279 // something we can't reason about.
1280 return create<SimpleFunctionCall>(CE, State, LCtx);
1281 }
1282
1283 CallEventRef<>
getCaller(const StackFrameContext * CalleeCtx,ProgramStateRef State)1284 CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
1285 ProgramStateRef State) {
1286 const LocationContext *ParentCtx = CalleeCtx->getParent();
1287 const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1288 assert(CallerCtx && "This should not be used for top-level stack frames");
1289
1290 const Stmt *CallSite = CalleeCtx->getCallSite();
1291
1292 if (CallSite) {
1293 if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
1294 return getSimpleCall(CE, State, CallerCtx);
1295
1296 switch (CallSite->getStmtClass()) {
1297 case Stmt::CXXConstructExprClass:
1298 case Stmt::CXXTemporaryObjectExprClass: {
1299 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1300 const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1301 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1302 SVal ThisVal = State->getSVal(ThisPtr);
1303
1304 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1305 ThisVal.getAsRegion(), State, CallerCtx);
1306 }
1307 case Stmt::CXXNewExprClass:
1308 return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
1309 case Stmt::ObjCMessageExprClass:
1310 return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
1311 State, CallerCtx);
1312 default:
1313 llvm_unreachable("This is not an inlineable statement.");
1314 }
1315 }
1316
1317 // Fall back to the CFG. The only thing we haven't handled yet is
1318 // destructors, though this could change in the future.
1319 const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1320 CFGElement E = (*B)[CalleeCtx->getIndex()];
1321 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1322 "All other CFG elements should have exprs");
1323
1324 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1325 const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1326 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1327 SVal ThisVal = State->getSVal(ThisPtr);
1328
1329 const Stmt *Trigger;
1330 if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())
1331 Trigger = AutoDtor->getTriggerStmt();
1332 else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1333 Trigger = DeleteDtor->getDeleteExpr();
1334 else
1335 Trigger = Dtor->getBody();
1336
1337 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1338 E.getAs<CFGBaseDtor>().hasValue(), State,
1339 CallerCtx);
1340 }
1341