1 //===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
13 //
14 //===----------------------------------------------------------------------===//
15
16 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
17 #include "clang/AST/ASTContext.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/ParentMap.h"
26 #include "clang/AST/Stmt.h"
27 #include "clang/AST/Type.h"
28 #include "clang/Analysis/AnalysisDeclContext.h"
29 #include "clang/Analysis/CFG.h"
30 #include "clang/Analysis/CFGStmtMap.h"
31 #include "clang/Analysis/ProgramPoint.h"
32 #include "clang/CrossTU/CrossTranslationUnit.h"
33 #include "clang/Basic/IdentifierTable.h"
34 #include "clang/Basic/LLVM.h"
35 #include "clang/Basic/SourceLocation.h"
36 #include "clang/Basic/SourceManager.h"
37 #include "clang/Basic/Specifiers.h"
38 #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
39 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
41 #include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h"
42 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
43 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
44 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
45 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
46 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
47 #include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
48 #include "llvm/ADT/ArrayRef.h"
49 #include "llvm/ADT/DenseMap.h"
50 #include "llvm/ADT/None.h"
51 #include "llvm/ADT/Optional.h"
52 #include "llvm/ADT/PointerIntPair.h"
53 #include "llvm/ADT/SmallSet.h"
54 #include "llvm/ADT/SmallVector.h"
55 #include "llvm/ADT/StringExtras.h"
56 #include "llvm/ADT/StringRef.h"
57 #include "llvm/Support/Casting.h"
58 #include "llvm/Support/Compiler.h"
59 #include "llvm/Support/Debug.h"
60 #include "llvm/Support/ErrorHandling.h"
61 #include "llvm/Support/raw_ostream.h"
62 #include <cassert>
63 #include <utility>
64
65 #define DEBUG_TYPE "static-analyzer-call-event"
66
67 using namespace clang;
68 using namespace ento;
69
getResultType() const70 QualType CallEvent::getResultType() const {
71 ASTContext &Ctx = getState()->getStateManager().getContext();
72 const Expr *E = getOriginExpr();
73 if (!E)
74 return Ctx.VoidTy;
75 assert(E);
76
77 QualType ResultTy = E->getType();
78
79 // A function that returns a reference to 'int' will have a result type
80 // of simply 'int'. Check the origin expr's value kind to recover the
81 // proper type.
82 switch (E->getValueKind()) {
83 case VK_LValue:
84 ResultTy = Ctx.getLValueReferenceType(ResultTy);
85 break;
86 case VK_XValue:
87 ResultTy = Ctx.getRValueReferenceType(ResultTy);
88 break;
89 case VK_RValue:
90 // No adjustment is necessary.
91 break;
92 }
93
94 return ResultTy;
95 }
96
isCallback(QualType T)97 static bool isCallback(QualType T) {
98 // If a parameter is a block or a callback, assume it can modify pointer.
99 if (T->isBlockPointerType() ||
100 T->isFunctionPointerType() ||
101 T->isObjCSelType())
102 return true;
103
104 // Check if a callback is passed inside a struct (for both, struct passed by
105 // reference and by value). Dig just one level into the struct for now.
106
107 if (T->isAnyPointerType() || T->isReferenceType())
108 T = T->getPointeeType();
109
110 if (const RecordType *RT = T->getAsStructureType()) {
111 const RecordDecl *RD = RT->getDecl();
112 for (const auto *I : RD->fields()) {
113 QualType FieldT = I->getType();
114 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
115 return true;
116 }
117 }
118 return false;
119 }
120
isVoidPointerToNonConst(QualType T)121 static bool isVoidPointerToNonConst(QualType T) {
122 if (const auto *PT = T->getAs<PointerType>()) {
123 QualType PointeeTy = PT->getPointeeType();
124 if (PointeeTy.isConstQualified())
125 return false;
126 return PointeeTy->isVoidType();
127 } else
128 return false;
129 }
130
hasNonNullArgumentsWithType(bool (* Condition)(QualType)) const131 bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
132 unsigned NumOfArgs = getNumArgs();
133
134 // If calling using a function pointer, assume the function does not
135 // satisfy the callback.
136 // TODO: We could check the types of the arguments here.
137 if (!getDecl())
138 return false;
139
140 unsigned Idx = 0;
141 for (CallEvent::param_type_iterator I = param_type_begin(),
142 E = param_type_end();
143 I != E && Idx < NumOfArgs; ++I, ++Idx) {
144 // If the parameter is 0, it's harmless.
145 if (getArgSVal(Idx).isZeroConstant())
146 continue;
147
148 if (Condition(*I))
149 return true;
150 }
151 return false;
152 }
153
hasNonZeroCallbackArg() const154 bool CallEvent::hasNonZeroCallbackArg() const {
155 return hasNonNullArgumentsWithType(isCallback);
156 }
157
hasVoidPointerToNonConstArg() const158 bool CallEvent::hasVoidPointerToNonConstArg() const {
159 return hasNonNullArgumentsWithType(isVoidPointerToNonConst);
160 }
161
isGlobalCFunction(StringRef FunctionName) const162 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
163 const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
164 if (!FD)
165 return false;
166
167 return CheckerContext::isCLibraryFunction(FD, FunctionName);
168 }
169
getCalleeAnalysisDeclContext() const170 AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const {
171 const Decl *D = getDecl();
172 if (!D)
173 return nullptr;
174
175 // TODO: For now we skip functions without definitions, even if we have
176 // our own getDecl(), because it's hard to find out which re-declaration
177 // is going to be used, and usually clients don't really care about this
178 // situation because there's a loss of precision anyway because we cannot
179 // inline the call.
180 RuntimeDefinition RD = getRuntimeDefinition();
181 if (!RD.getDecl())
182 return nullptr;
183
184 AnalysisDeclContext *ADC =
185 LCtx->getAnalysisDeclContext()->getManager()->getContext(D);
186
187 // TODO: For now we skip virtual functions, because this also rises
188 // the problem of which decl to use, but now it's across different classes.
189 if (RD.mayHaveOtherDefinitions() || RD.getDecl() != ADC->getDecl())
190 return nullptr;
191
192 return ADC;
193 }
194
getCalleeStackFrame() const195 const StackFrameContext *CallEvent::getCalleeStackFrame() const {
196 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext();
197 if (!ADC)
198 return nullptr;
199
200 const Expr *E = getOriginExpr();
201 if (!E)
202 return nullptr;
203
204 // Recover CFG block via reverse lookup.
205 // TODO: If we were to keep CFG element information as part of the CallEvent
206 // instead of doing this reverse lookup, we would be able to build the stack
207 // frame for non-expression-based calls, and also we wouldn't need the reverse
208 // lookup.
209 CFGStmtMap *Map = LCtx->getAnalysisDeclContext()->getCFGStmtMap();
210 const CFGBlock *B = Map->getBlock(E);
211 assert(B);
212
213 // Also recover CFG index by scanning the CFG block.
214 unsigned Idx = 0, Sz = B->size();
215 for (; Idx < Sz; ++Idx)
216 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
217 if (StmtElem->getStmt() == E)
218 break;
219 assert(Idx < Sz);
220
221 return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, Idx);
222 }
223
getParameterLocation(unsigned Index) const224 const VarRegion *CallEvent::getParameterLocation(unsigned Index) const {
225 const StackFrameContext *SFC = getCalleeStackFrame();
226 // We cannot construct a VarRegion without a stack frame.
227 if (!SFC)
228 return nullptr;
229
230 // Retrieve parameters of the definition, which are different from
231 // CallEvent's parameters() because getDecl() isn't necessarily
232 // the definition. SFC contains the definition that would be used
233 // during analysis.
234 const Decl *D = SFC->getDecl();
235
236 // TODO: Refactor into a virtual method of CallEvent, like parameters().
237 const ParmVarDecl *PVD = nullptr;
238 if (const auto *FD = dyn_cast<FunctionDecl>(D))
239 PVD = FD->parameters()[Index];
240 else if (const auto *BD = dyn_cast<BlockDecl>(D))
241 PVD = BD->parameters()[Index];
242 else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
243 PVD = MD->parameters()[Index];
244 else if (const auto *CD = dyn_cast<CXXConstructorDecl>(D))
245 PVD = CD->parameters()[Index];
246 assert(PVD && "Unexpected Decl kind!");
247
248 const VarRegion *VR =
249 State->getStateManager().getRegionManager().getVarRegion(PVD, SFC);
250
251 // This sanity check would fail if our parameter declaration doesn't
252 // correspond to the stack frame's function declaration.
253 assert(VR->getStackFrame() == SFC);
254
255 return VR;
256 }
257
258 /// Returns true if a type is a pointer-to-const or reference-to-const
259 /// with no further indirection.
isPointerToConst(QualType Ty)260 static bool isPointerToConst(QualType Ty) {
261 QualType PointeeTy = Ty->getPointeeType();
262 if (PointeeTy == QualType())
263 return false;
264 if (!PointeeTy.isConstQualified())
265 return false;
266 if (PointeeTy->isAnyPointerType())
267 return false;
268 return true;
269 }
270
271 // Try to retrieve the function declaration and find the function parameter
272 // types which are pointers/references to a non-pointer const.
273 // We will not invalidate the corresponding argument regions.
findPtrToConstParams(llvm::SmallSet<unsigned,4> & PreserveArgs,const CallEvent & Call)274 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
275 const CallEvent &Call) {
276 unsigned Idx = 0;
277 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
278 E = Call.param_type_end();
279 I != E; ++I, ++Idx) {
280 if (isPointerToConst(*I))
281 PreserveArgs.insert(Idx);
282 }
283 }
284
invalidateRegions(unsigned BlockCount,ProgramStateRef Orig) const285 ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
286 ProgramStateRef Orig) const {
287 ProgramStateRef Result = (Orig ? Orig : getState());
288
289 // Don't invalidate anything if the callee is marked pure/const.
290 if (const Decl *callee = getDecl())
291 if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
292 return Result;
293
294 SmallVector<SVal, 8> ValuesToInvalidate;
295 RegionAndSymbolInvalidationTraits ETraits;
296
297 getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
298
299 // Indexes of arguments whose values will be preserved by the call.
300 llvm::SmallSet<unsigned, 4> PreserveArgs;
301 if (!argumentsMayEscape())
302 findPtrToConstParams(PreserveArgs, *this);
303
304 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
305 // Mark this region for invalidation. We batch invalidate regions
306 // below for efficiency.
307 if (PreserveArgs.count(Idx))
308 if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
309 ETraits.setTrait(MR->getBaseRegion(),
310 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
311 // TODO: Factor this out + handle the lower level const pointers.
312
313 ValuesToInvalidate.push_back(getArgSVal(Idx));
314
315 // If a function accepts an object by argument (which would of course be a
316 // temporary that isn't lifetime-extended), invalidate the object itself,
317 // not only other objects reachable from it. This is necessary because the
318 // destructor has access to the temporary object after the call.
319 // TODO: Support placement arguments once we start
320 // constructing them directly.
321 // TODO: This is unnecessary when there's no destructor, but that's
322 // currently hard to figure out.
323 if (getKind() != CE_CXXAllocator)
324 if (isArgumentConstructedDirectly(Idx))
325 if (auto AdjIdx = getAdjustedParameterIndex(Idx))
326 if (const VarRegion *VR = getParameterLocation(*AdjIdx))
327 ValuesToInvalidate.push_back(loc::MemRegionVal(VR));
328 }
329
330 // Invalidate designated regions using the batch invalidation API.
331 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
332 // global variables.
333 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
334 BlockCount, getLocationContext(),
335 /*CausedByPointerEscape*/ true,
336 /*Symbols=*/nullptr, this, &ETraits);
337 }
338
getProgramPoint(bool IsPreVisit,const ProgramPointTag * Tag) const339 ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
340 const ProgramPointTag *Tag) const {
341 if (const Expr *E = getOriginExpr()) {
342 if (IsPreVisit)
343 return PreStmt(E, getLocationContext(), Tag);
344 return PostStmt(E, getLocationContext(), Tag);
345 }
346
347 const Decl *D = getDecl();
348 assert(D && "Cannot get a program point without a statement or decl");
349
350 SourceLocation Loc = getSourceRange().getBegin();
351 if (IsPreVisit)
352 return PreImplicitCall(D, Loc, getLocationContext(), Tag);
353 return PostImplicitCall(D, Loc, getLocationContext(), Tag);
354 }
355
isCalled(const CallDescription & CD) const356 bool CallEvent::isCalled(const CallDescription &CD) const {
357 // FIXME: Add ObjC Message support.
358 if (getKind() == CE_ObjCMessage)
359 return false;
360 if (!CD.IsLookupDone) {
361 CD.IsLookupDone = true;
362 CD.II = &getState()->getStateManager().getContext().Idents.get(
363 CD.getFunctionName());
364 }
365 const IdentifierInfo *II = getCalleeIdentifier();
366 if (!II || II != CD.II)
367 return false;
368
369 const Decl *D = getDecl();
370 // If CallDescription provides prefix names, use them to improve matching
371 // accuracy.
372 if (CD.QualifiedName.size() > 1 && D) {
373 const DeclContext *Ctx = D->getDeclContext();
374 // See if we'll be able to match them all.
375 size_t NumUnmatched = CD.QualifiedName.size() - 1;
376 for (; Ctx && isa<NamedDecl>(Ctx); Ctx = Ctx->getParent()) {
377 if (NumUnmatched == 0)
378 break;
379
380 if (const auto *ND = dyn_cast<NamespaceDecl>(Ctx)) {
381 if (ND->getName() == CD.QualifiedName[NumUnmatched - 1])
382 --NumUnmatched;
383 continue;
384 }
385
386 if (const auto *RD = dyn_cast<RecordDecl>(Ctx)) {
387 if (RD->getName() == CD.QualifiedName[NumUnmatched - 1])
388 --NumUnmatched;
389 continue;
390 }
391 }
392
393 if (NumUnmatched > 0)
394 return false;
395 }
396
397 return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
398 CD.RequiredArgs == getNumArgs());
399 }
400
getArgSVal(unsigned Index) const401 SVal CallEvent::getArgSVal(unsigned Index) const {
402 const Expr *ArgE = getArgExpr(Index);
403 if (!ArgE)
404 return UnknownVal();
405 return getSVal(ArgE);
406 }
407
getArgSourceRange(unsigned Index) const408 SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
409 const Expr *ArgE = getArgExpr(Index);
410 if (!ArgE)
411 return {};
412 return ArgE->getSourceRange();
413 }
414
getReturnValue() const415 SVal CallEvent::getReturnValue() const {
416 const Expr *E = getOriginExpr();
417 if (!E)
418 return UndefinedVal();
419 return getSVal(E);
420 }
421
dump() const422 LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
423
dump(raw_ostream & Out) const424 void CallEvent::dump(raw_ostream &Out) const {
425 ASTContext &Ctx = getState()->getStateManager().getContext();
426 if (const Expr *E = getOriginExpr()) {
427 E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
428 Out << "\n";
429 return;
430 }
431
432 if (const Decl *D = getDecl()) {
433 Out << "Call to ";
434 D->print(Out, Ctx.getPrintingPolicy());
435 return;
436 }
437
438 // FIXME: a string representation of the kind would be nice.
439 Out << "Unknown call (type " << getKind() << ")";
440 }
441
isCallStmt(const Stmt * S)442 bool CallEvent::isCallStmt(const Stmt *S) {
443 return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
444 || isa<CXXConstructExpr>(S)
445 || isa<CXXNewExpr>(S);
446 }
447
getDeclaredResultType(const Decl * D)448 QualType CallEvent::getDeclaredResultType(const Decl *D) {
449 assert(D);
450 if (const auto *FD = dyn_cast<FunctionDecl>(D))
451 return FD->getReturnType();
452 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
453 return MD->getReturnType();
454 if (const auto *BD = dyn_cast<BlockDecl>(D)) {
455 // Blocks are difficult because the return type may not be stored in the
456 // BlockDecl itself. The AST should probably be enhanced, but for now we
457 // just do what we can.
458 // If the block is declared without an explicit argument list, the
459 // signature-as-written just includes the return type, not the entire
460 // function type.
461 // FIXME: All blocks should have signatures-as-written, even if the return
462 // type is inferred. (That's signified with a dependent result type.)
463 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
464 QualType Ty = TSI->getType();
465 if (const FunctionType *FT = Ty->getAs<FunctionType>())
466 Ty = FT->getReturnType();
467 if (!Ty->isDependentType())
468 return Ty;
469 }
470
471 return {};
472 }
473
474 llvm_unreachable("unknown callable kind");
475 }
476
isVariadic(const Decl * D)477 bool CallEvent::isVariadic(const Decl *D) {
478 assert(D);
479
480 if (const auto *FD = dyn_cast<FunctionDecl>(D))
481 return FD->isVariadic();
482 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D))
483 return MD->isVariadic();
484 if (const auto *BD = dyn_cast<BlockDecl>(D))
485 return BD->isVariadic();
486
487 llvm_unreachable("unknown callable kind");
488 }
489
addParameterValuesToBindings(const StackFrameContext * CalleeCtx,CallEvent::BindingsTy & Bindings,SValBuilder & SVB,const CallEvent & Call,ArrayRef<ParmVarDecl * > parameters)490 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
491 CallEvent::BindingsTy &Bindings,
492 SValBuilder &SVB,
493 const CallEvent &Call,
494 ArrayRef<ParmVarDecl*> parameters) {
495 MemRegionManager &MRMgr = SVB.getRegionManager();
496
497 // If the function has fewer parameters than the call has arguments, we simply
498 // do not bind any values to them.
499 unsigned NumArgs = Call.getNumArgs();
500 unsigned Idx = 0;
501 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
502 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
503 const ParmVarDecl *ParamDecl = *I;
504 assert(ParamDecl && "Formal parameter has no decl?");
505
506 // TODO: Support allocator calls.
507 if (Call.getKind() != CE_CXXAllocator)
508 if (Call.isArgumentConstructedDirectly(Idx))
509 continue;
510
511 // TODO: Allocators should receive the correct size and possibly alignment,
512 // determined in compile-time but not represented as arg-expressions,
513 // which makes getArgSVal() fail and return UnknownVal.
514 SVal ArgVal = Call.getArgSVal(Idx);
515 if (!ArgVal.isUnknown()) {
516 Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
517 Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
518 }
519 }
520
521 // FIXME: Variadic arguments are not handled at all right now.
522 }
523
parameters() const524 ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
525 const FunctionDecl *D = getDecl();
526 if (!D)
527 return None;
528 return D->parameters();
529 }
530
getRuntimeDefinition() const531 RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
532 const FunctionDecl *FD = getDecl();
533 if (!FD)
534 return {};
535
536 // Note that the AnalysisDeclContext will have the FunctionDecl with
537 // the definition (if one exists).
538 AnalysisDeclContext *AD =
539 getLocationContext()->getAnalysisDeclContext()->
540 getManager()->getContext(FD);
541 bool IsAutosynthesized;
542 Stmt* Body = AD->getBody(IsAutosynthesized);
543 LLVM_DEBUG({
544 if (IsAutosynthesized)
545 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
546 << "\n";
547 });
548 if (Body) {
549 const Decl* Decl = AD->getDecl();
550 return RuntimeDefinition(Decl);
551 }
552
553 SubEngine &Engine = getState()->getStateManager().getOwningEngine();
554 AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
555
556 // Try to get CTU definition only if CTUDir is provided.
557 if (!Opts.IsNaiveCTUEnabled)
558 return {};
559
560 cross_tu::CrossTranslationUnitContext &CTUCtx =
561 *Engine.getCrossTranslationUnitContext();
562 llvm::Expected<const FunctionDecl *> CTUDeclOrError =
563 CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName,
564 Opts.DisplayCTUProgress);
565
566 if (!CTUDeclOrError) {
567 handleAllErrors(CTUDeclOrError.takeError(),
568 [&](const cross_tu::IndexError &IE) {
569 CTUCtx.emitCrossTUDiagnostics(IE);
570 });
571 return {};
572 }
573
574 return RuntimeDefinition(*CTUDeclOrError);
575 }
576
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const577 void AnyFunctionCall::getInitialStackFrameContents(
578 const StackFrameContext *CalleeCtx,
579 BindingsTy &Bindings) const {
580 const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl());
581 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
582 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
583 D->parameters());
584 }
585
argumentsMayEscape() const586 bool AnyFunctionCall::argumentsMayEscape() const {
587 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
588 return true;
589
590 const FunctionDecl *D = getDecl();
591 if (!D)
592 return true;
593
594 const IdentifierInfo *II = D->getIdentifier();
595 if (!II)
596 return false;
597
598 // This set of "escaping" APIs is
599
600 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
601 // value into thread local storage. The value can later be retrieved with
602 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
603 // parameter is 'const void *', the region escapes through the call.
604 if (II->isStr("pthread_setspecific"))
605 return true;
606
607 // - xpc_connection_set_context stores a value which can be retrieved later
608 // with xpc_connection_get_context.
609 if (II->isStr("xpc_connection_set_context"))
610 return true;
611
612 // - funopen - sets a buffer for future IO calls.
613 if (II->isStr("funopen"))
614 return true;
615
616 // - __cxa_demangle - can reallocate memory and can return the pointer to
617 // the input buffer.
618 if (II->isStr("__cxa_demangle"))
619 return true;
620
621 StringRef FName = II->getName();
622
623 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
624 // buffer even if it is const.
625 if (FName.endswith("NoCopy"))
626 return true;
627
628 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
629 // be deallocated by NSMapRemove.
630 if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
631 return true;
632
633 // - Many CF containers allow objects to escape through custom
634 // allocators/deallocators upon container construction. (PR12101)
635 if (FName.startswith("CF") || FName.startswith("CG")) {
636 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
637 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
638 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
639 StrInStrNoCase(FName, "WithData") != StringRef::npos ||
640 StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
641 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
642 }
643
644 return false;
645 }
646
getDecl() const647 const FunctionDecl *SimpleFunctionCall::getDecl() const {
648 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
649 if (D)
650 return D;
651
652 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
653 }
654
getDecl() const655 const FunctionDecl *CXXInstanceCall::getDecl() const {
656 const auto *CE = cast_or_null<CallExpr>(getOriginExpr());
657 if (!CE)
658 return AnyFunctionCall::getDecl();
659
660 const FunctionDecl *D = CE->getDirectCallee();
661 if (D)
662 return D;
663
664 return getSVal(CE->getCallee()).getAsFunctionDecl();
665 }
666
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const667 void CXXInstanceCall::getExtraInvalidatedValues(
668 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
669 SVal ThisVal = getCXXThisVal();
670 Values.push_back(ThisVal);
671
672 // Don't invalidate if the method is const and there are no mutable fields.
673 if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) {
674 if (!D->isConst())
675 return;
676 // Get the record decl for the class of 'This'. D->getParent() may return a
677 // base class decl, rather than the class of the instance which needs to be
678 // checked for mutable fields.
679 // TODO: We might as well look at the dynamic type of the object.
680 const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
681 QualType T = Ex->getType();
682 if (T->isPointerType()) // Arrow or implicit-this syntax?
683 T = T->getPointeeType();
684 const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl();
685 assert(ParentRecord);
686 if (ParentRecord->hasMutableFields())
687 return;
688 // Preserve CXXThis.
689 const MemRegion *ThisRegion = ThisVal.getAsRegion();
690 if (!ThisRegion)
691 return;
692
693 ETraits->setTrait(ThisRegion->getBaseRegion(),
694 RegionAndSymbolInvalidationTraits::TK_PreserveContents);
695 }
696 }
697
getCXXThisVal() const698 SVal CXXInstanceCall::getCXXThisVal() const {
699 const Expr *Base = getCXXThisExpr();
700 // FIXME: This doesn't handle an overloaded ->* operator.
701 if (!Base)
702 return UnknownVal();
703
704 SVal ThisVal = getSVal(Base);
705 assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
706 return ThisVal;
707 }
708
getRuntimeDefinition() const709 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
710 // Do we have a decl at all?
711 const Decl *D = getDecl();
712 if (!D)
713 return {};
714
715 // If the method is non-virtual, we know we can inline it.
716 const auto *MD = cast<CXXMethodDecl>(D);
717 if (!MD->isVirtual())
718 return AnyFunctionCall::getRuntimeDefinition();
719
720 // Do we know the implicit 'this' object being called?
721 const MemRegion *R = getCXXThisVal().getAsRegion();
722 if (!R)
723 return {};
724
725 // Do we know anything about the type of 'this'?
726 DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
727 if (!DynType.isValid())
728 return {};
729
730 // Is the type a C++ class? (This is mostly a defensive check.)
731 QualType RegionType = DynType.getType()->getPointeeType();
732 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
733
734 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
735 if (!RD || !RD->hasDefinition())
736 return {};
737
738 // Find the decl for this method in that class.
739 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
740 if (!Result) {
741 // We might not even get the original statically-resolved method due to
742 // some particularly nasty casting (e.g. casts to sister classes).
743 // However, we should at least be able to search up and down our own class
744 // hierarchy, and some real bugs have been caught by checking this.
745 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
746
747 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
748 // the static type. However, because we currently don't update
749 // DynamicTypeInfo when an object is cast, we can't actually be sure the
750 // DynamicTypeInfo is up to date. This assert should be re-enabled once
751 // this is fixed. <rdar://problem/12287087>
752 //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
753
754 return {};
755 }
756
757 // Does the decl that we found have an implementation?
758 const FunctionDecl *Definition;
759 if (!Result->hasBody(Definition))
760 return {};
761
762 // We found a definition. If we're not sure that this devirtualization is
763 // actually what will happen at runtime, make sure to provide the region so
764 // that ExprEngine can decide what to do with it.
765 if (DynType.canBeASubClass())
766 return RuntimeDefinition(Definition, R->StripCasts());
767 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
768 }
769
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const770 void CXXInstanceCall::getInitialStackFrameContents(
771 const StackFrameContext *CalleeCtx,
772 BindingsTy &Bindings) const {
773 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
774
775 // Handle the binding of 'this' in the new stack frame.
776 SVal ThisVal = getCXXThisVal();
777 if (!ThisVal.isUnknown()) {
778 ProgramStateManager &StateMgr = getState()->getStateManager();
779 SValBuilder &SVB = StateMgr.getSValBuilder();
780
781 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
782 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
783
784 // If we devirtualized to a different member function, we need to make sure
785 // we have the proper layering of CXXBaseObjectRegions.
786 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
787 ASTContext &Ctx = SVB.getContext();
788 const CXXRecordDecl *Class = MD->getParent();
789 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
790
791 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
792 bool Failed;
793 ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
794 if (Failed) {
795 // We might have suffered some sort of placement new earlier, so
796 // we're constructing in a completely unexpected storage.
797 // Fall back to a generic pointer cast for this-value.
798 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl());
799 const CXXRecordDecl *StaticClass = StaticMD->getParent();
800 QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass));
801 ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy);
802 }
803 }
804
805 if (!ThisVal.isUnknown())
806 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
807 }
808 }
809
getCXXThisExpr() const810 const Expr *CXXMemberCall::getCXXThisExpr() const {
811 return getOriginExpr()->getImplicitObjectArgument();
812 }
813
getRuntimeDefinition() const814 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
815 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
816 // id-expression in the class member access expression is a qualified-id,
817 // that function is called. Otherwise, its final overrider in the dynamic type
818 // of the object expression is called.
819 if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
820 if (ME->hasQualifier())
821 return AnyFunctionCall::getRuntimeDefinition();
822
823 return CXXInstanceCall::getRuntimeDefinition();
824 }
825
getCXXThisExpr() const826 const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
827 return getOriginExpr()->getArg(0);
828 }
829
getBlockRegion() const830 const BlockDataRegion *BlockCall::getBlockRegion() const {
831 const Expr *Callee = getOriginExpr()->getCallee();
832 const MemRegion *DataReg = getSVal(Callee).getAsRegion();
833
834 return dyn_cast_or_null<BlockDataRegion>(DataReg);
835 }
836
parameters() const837 ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
838 const BlockDecl *D = getDecl();
839 if (!D)
840 return None;
841 return D->parameters();
842 }
843
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const844 void BlockCall::getExtraInvalidatedValues(ValueList &Values,
845 RegionAndSymbolInvalidationTraits *ETraits) const {
846 // FIXME: This also needs to invalidate captured globals.
847 if (const MemRegion *R = getBlockRegion())
848 Values.push_back(loc::MemRegionVal(R));
849 }
850
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const851 void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
852 BindingsTy &Bindings) const {
853 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
854 ArrayRef<ParmVarDecl*> Params;
855 if (isConversionFromLambda()) {
856 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
857 Params = LambdaOperatorDecl->parameters();
858
859 // For blocks converted from a C++ lambda, the callee declaration is the
860 // operator() method on the lambda so we bind "this" to
861 // the lambda captured by the block.
862 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
863 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
864 Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
865 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
866 } else {
867 Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
868 }
869
870 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
871 Params);
872 }
873
getCXXThisVal() const874 SVal CXXConstructorCall::getCXXThisVal() const {
875 if (Data)
876 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
877 return UnknownVal();
878 }
879
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const880 void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
881 RegionAndSymbolInvalidationTraits *ETraits) const {
882 if (Data) {
883 loc::MemRegionVal MV(static_cast<const MemRegion *>(Data));
884 if (SymbolRef Sym = MV.getAsSymbol(true))
885 ETraits->setTrait(Sym,
886 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
887 Values.push_back(MV);
888 }
889 }
890
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const891 void CXXConstructorCall::getInitialStackFrameContents(
892 const StackFrameContext *CalleeCtx,
893 BindingsTy &Bindings) const {
894 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
895
896 SVal ThisVal = getCXXThisVal();
897 if (!ThisVal.isUnknown()) {
898 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
899 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
900 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
901 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
902 }
903 }
904
getCXXThisVal() const905 SVal CXXDestructorCall::getCXXThisVal() const {
906 if (Data)
907 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
908 return UnknownVal();
909 }
910
getRuntimeDefinition() const911 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
912 // Base destructors are always called non-virtually.
913 // Skip CXXInstanceCall's devirtualization logic in this case.
914 if (isBaseDestructor())
915 return AnyFunctionCall::getRuntimeDefinition();
916
917 return CXXInstanceCall::getRuntimeDefinition();
918 }
919
parameters() const920 ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
921 const ObjCMethodDecl *D = getDecl();
922 if (!D)
923 return None;
924 return D->parameters();
925 }
926
getExtraInvalidatedValues(ValueList & Values,RegionAndSymbolInvalidationTraits * ETraits) const927 void ObjCMethodCall::getExtraInvalidatedValues(
928 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
929
930 // If the method call is a setter for property known to be backed by
931 // an instance variable, don't invalidate the entire receiver, just
932 // the storage for that instance variable.
933 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
934 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
935 SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
936 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
937 ETraits->setTrait(
938 IvarRegion,
939 RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
940 ETraits->setTrait(
941 IvarRegion,
942 RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
943 Values.push_back(IvarLVal);
944 }
945 return;
946 }
947 }
948
949 Values.push_back(getReceiverSVal());
950 }
951
getSelfSVal() const952 SVal ObjCMethodCall::getSelfSVal() const {
953 const LocationContext *LCtx = getLocationContext();
954 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
955 if (!SelfDecl)
956 return SVal();
957 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
958 }
959
getReceiverSVal() const960 SVal ObjCMethodCall::getReceiverSVal() const {
961 // FIXME: Is this the best way to handle class receivers?
962 if (!isInstanceMessage())
963 return UnknownVal();
964
965 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
966 return getSVal(RecE);
967
968 // An instance message with no expression means we are sending to super.
969 // In this case the object reference is the same as 'self'.
970 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
971 SVal SelfVal = getSelfSVal();
972 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
973 return SelfVal;
974 }
975
isReceiverSelfOrSuper() const976 bool ObjCMethodCall::isReceiverSelfOrSuper() const {
977 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
978 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
979 return true;
980
981 if (!isInstanceMessage())
982 return false;
983
984 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
985
986 return (RecVal == getSelfSVal());
987 }
988
getSourceRange() const989 SourceRange ObjCMethodCall::getSourceRange() const {
990 switch (getMessageKind()) {
991 case OCM_Message:
992 return getOriginExpr()->getSourceRange();
993 case OCM_PropertyAccess:
994 case OCM_Subscript:
995 return getContainingPseudoObjectExpr()->getSourceRange();
996 }
997 llvm_unreachable("unknown message kind");
998 }
999
1000 using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1001
getContainingPseudoObjectExpr() const1002 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1003 assert(Data && "Lazy lookup not yet performed.");
1004 assert(getMessageKind() != OCM_Message && "Explicit message send.");
1005 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
1006 }
1007
1008 static const Expr *
getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr * POE)1009 getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
1010 const Expr *Syntactic = POE->getSyntacticForm();
1011
1012 // This handles the funny case of assigning to the result of a getter.
1013 // This can happen if the getter returns a non-const reference.
1014 if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic))
1015 Syntactic = BO->getLHS();
1016
1017 return Syntactic;
1018 }
1019
getMessageKind() const1020 ObjCMessageKind ObjCMethodCall::getMessageKind() const {
1021 if (!Data) {
1022 // Find the parent, ignoring implicit casts.
1023 ParentMap &PM = getLocationContext()->getParentMap();
1024 const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
1025
1026 // Check if parent is a PseudoObjectExpr.
1027 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
1028 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1029
1030 ObjCMessageKind K;
1031 switch (Syntactic->getStmtClass()) {
1032 case Stmt::ObjCPropertyRefExprClass:
1033 K = OCM_PropertyAccess;
1034 break;
1035 case Stmt::ObjCSubscriptRefExprClass:
1036 K = OCM_Subscript;
1037 break;
1038 default:
1039 // FIXME: Can this ever happen?
1040 K = OCM_Message;
1041 break;
1042 }
1043
1044 if (K != OCM_Message) {
1045 const_cast<ObjCMethodCall *>(this)->Data
1046 = ObjCMessageDataTy(POE, K).getOpaqueValue();
1047 assert(getMessageKind() == K);
1048 return K;
1049 }
1050 }
1051
1052 const_cast<ObjCMethodCall *>(this)->Data
1053 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1054 assert(getMessageKind() == OCM_Message);
1055 return OCM_Message;
1056 }
1057
1058 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
1059 if (!Info.getPointer())
1060 return OCM_Message;
1061 return static_cast<ObjCMessageKind>(Info.getInt());
1062 }
1063
getAccessedProperty() const1064 const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
1065 // Look for properties accessed with property syntax (foo.bar = ...)
1066 if ( getMessageKind() == OCM_PropertyAccess) {
1067 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1068 assert(POE && "Property access without PseudoObjectExpr?");
1069
1070 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1071 auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
1072
1073 if (RefExpr->isExplicitProperty())
1074 return RefExpr->getExplicitProperty();
1075 }
1076
1077 // Look for properties accessed with method syntax ([foo setBar:...]).
1078 const ObjCMethodDecl *MD = getDecl();
1079 if (!MD || !MD->isPropertyAccessor())
1080 return nullptr;
1081
1082 // Note: This is potentially quite slow.
1083 return MD->findPropertyDecl();
1084 }
1085
canBeOverridenInSubclass(ObjCInterfaceDecl * IDecl,Selector Sel) const1086 bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1087 Selector Sel) const {
1088 assert(IDecl);
1089 AnalysisManager &AMgr =
1090 getState()->getStateManager().getOwningEngine().getAnalysisManager();
1091 // If the class interface is declared inside the main file, assume it is not
1092 // subcassed.
1093 // TODO: It could actually be subclassed if the subclass is private as well.
1094 // This is probably very rare.
1095 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1096 if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc))
1097 return false;
1098
1099 // Assume that property accessors are not overridden.
1100 if (getMessageKind() == OCM_PropertyAccess)
1101 return false;
1102
1103 // We assume that if the method is public (declared outside of main file) or
1104 // has a parent which publicly declares the method, the method could be
1105 // overridden in a subclass.
1106
1107 // Find the first declaration in the class hierarchy that declares
1108 // the selector.
1109 ObjCMethodDecl *D = nullptr;
1110 while (true) {
1111 D = IDecl->lookupMethod(Sel, true);
1112
1113 // Cannot find a public definition.
1114 if (!D)
1115 return false;
1116
1117 // If outside the main file,
1118 if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation()))
1119 return true;
1120
1121 if (D->isOverriding()) {
1122 // Search in the superclass on the next iteration.
1123 IDecl = D->getClassInterface();
1124 if (!IDecl)
1125 return false;
1126
1127 IDecl = IDecl->getSuperClass();
1128 if (!IDecl)
1129 return false;
1130
1131 continue;
1132 }
1133
1134 return false;
1135 };
1136
1137 llvm_unreachable("The while loop should always terminate.");
1138 }
1139
findDefiningRedecl(const ObjCMethodDecl * MD)1140 static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
1141 if (!MD)
1142 return MD;
1143
1144 // Find the redeclaration that defines the method.
1145 if (!MD->hasBody()) {
1146 for (auto I : MD->redecls())
1147 if (I->hasBody())
1148 MD = cast<ObjCMethodDecl>(I);
1149 }
1150 return MD;
1151 }
1152
isCallToSelfClass(const ObjCMessageExpr * ME)1153 static bool isCallToSelfClass(const ObjCMessageExpr *ME) {
1154 const Expr* InstRec = ME->getInstanceReceiver();
1155 if (!InstRec)
1156 return false;
1157 const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts());
1158
1159 // Check that receiver is called 'self'.
1160 if (!InstRecIg || !InstRecIg->getFoundDecl() ||
1161 !InstRecIg->getFoundDecl()->getName().equals("self"))
1162 return false;
1163
1164 // Check that the method name is 'class'.
1165 if (ME->getSelector().getNumArgs() != 0 ||
1166 !ME->getSelector().getNameForSlot(0).equals("class"))
1167 return false;
1168
1169 return true;
1170 }
1171
getRuntimeDefinition() const1172 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1173 const ObjCMessageExpr *E = getOriginExpr();
1174 assert(E);
1175 Selector Sel = E->getSelector();
1176
1177 if (E->isInstanceMessage()) {
1178 // Find the receiver type.
1179 const ObjCObjectPointerType *ReceiverT = nullptr;
1180 bool CanBeSubClassed = false;
1181 QualType SupersType = E->getSuperType();
1182 const MemRegion *Receiver = nullptr;
1183
1184 if (!SupersType.isNull()) {
1185 // The receiver is guaranteed to be 'super' in this case.
1186 // Super always means the type of immediate predecessor to the method
1187 // where the call occurs.
1188 ReceiverT = cast<ObjCObjectPointerType>(SupersType);
1189 } else {
1190 Receiver = getReceiverSVal().getAsRegion();
1191 if (!Receiver)
1192 return {};
1193
1194 DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
1195 if (!DTI.isValid()) {
1196 assert(isa<AllocaRegion>(Receiver) &&
1197 "Unhandled untyped region class!");
1198 return {};
1199 }
1200
1201 QualType DynType = DTI.getType();
1202 CanBeSubClassed = DTI.canBeASubClass();
1203 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
1204
1205 if (ReceiverT && CanBeSubClassed)
1206 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
1207 if (!canBeOverridenInSubclass(IDecl, Sel))
1208 CanBeSubClassed = false;
1209 }
1210
1211 // Handle special cases of '[self classMethod]' and
1212 // '[[self class] classMethod]', which are treated by the compiler as
1213 // instance (not class) messages. We will statically dispatch to those.
1214 if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) {
1215 // For [self classMethod], return the compiler visible declaration.
1216 if (PT->getObjectType()->isObjCClass() &&
1217 Receiver == getSelfSVal().getAsRegion())
1218 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1219
1220 // Similarly, handle [[self class] classMethod].
1221 // TODO: We are currently doing a syntactic match for this pattern with is
1222 // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m
1223 // shows. A better way would be to associate the meta type with the symbol
1224 // using the dynamic type info tracking and use it here. We can add a new
1225 // SVal for ObjC 'Class' values that know what interface declaration they
1226 // come from. Then 'self' in a class method would be filled in with
1227 // something meaningful in ObjCMethodCall::getReceiverSVal() and we could
1228 // do proper dynamic dispatch for class methods just like we do for
1229 // instance methods now.
1230 if (E->getInstanceReceiver())
1231 if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver()))
1232 if (isCallToSelfClass(M))
1233 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl()));
1234 }
1235
1236 // Lookup the instance method implementation.
1237 if (ReceiverT)
1238 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
1239 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1240 // when in many cases it returns null. We cache the results so
1241 // that repeated queries on the same ObjCIntefaceDecl and Selector
1242 // don't incur the same cost. On some test cases, we can see the
1243 // same query being issued thousands of times.
1244 //
1245 // NOTE: This cache is essentially a "global" variable, but it
1246 // only gets lazily created when we get here. The value of the
1247 // cache probably comes from it being global across ExprEngines,
1248 // where the same queries may get issued. If we are worried about
1249 // concurrency, or possibly loading/unloading ASTs, etc., we may
1250 // need to revisit this someday. In terms of memory, this table
1251 // stays around until clang quits, which also may be bad if we
1252 // need to release memory.
1253 using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>;
1254 using PrivateMethodCache =
1255 llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>;
1256
1257 static PrivateMethodCache PMC;
1258 Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
1259
1260 // Query lookupPrivateMethod() if the cache does not hit.
1261 if (!Val.hasValue()) {
1262 Val = IDecl->lookupPrivateMethod(Sel);
1263
1264 // If the method is a property accessor, we should try to "inline" it
1265 // even if we don't actually have an implementation.
1266 if (!*Val)
1267 if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
1268 if (CompileTimeMD->isPropertyAccessor()) {
1269 if (!CompileTimeMD->getSelfDecl() &&
1270 isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
1271 // If the method is an accessor in a category, and it doesn't
1272 // have a self declaration, first
1273 // try to find the method in a class extension. This
1274 // works around a bug in Sema where multiple accessors
1275 // are synthesized for properties in class
1276 // extensions that are redeclared in a category and the
1277 // the implicit parameters are not filled in for
1278 // the method on the category.
1279 // This ensures we find the accessor in the extension, which
1280 // has the implicit parameters filled in.
1281 auto *ID = CompileTimeMD->getClassInterface();
1282 for (auto *CatDecl : ID->visible_extensions()) {
1283 Val = CatDecl->getMethod(Sel,
1284 CompileTimeMD->isInstanceMethod());
1285 if (*Val)
1286 break;
1287 }
1288 }
1289 if (!*Val)
1290 Val = IDecl->lookupInstanceMethod(Sel);
1291 }
1292 }
1293
1294 const ObjCMethodDecl *MD = Val.getValue();
1295 if (CanBeSubClassed)
1296 return RuntimeDefinition(MD, Receiver);
1297 else
1298 return RuntimeDefinition(MD, nullptr);
1299 }
1300 } else {
1301 // This is a class method.
1302 // If we have type info for the receiver class, we are calling via
1303 // class name.
1304 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1305 // Find/Return the method implementation.
1306 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1307 }
1308 }
1309
1310 return {};
1311 }
1312
argumentsMayEscape() const1313 bool ObjCMethodCall::argumentsMayEscape() const {
1314 if (isInSystemHeader() && !isInstanceMessage()) {
1315 Selector Sel = getSelector();
1316 if (Sel.getNumArgs() == 1 &&
1317 Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
1318 return true;
1319 }
1320
1321 return CallEvent::argumentsMayEscape();
1322 }
1323
getInitialStackFrameContents(const StackFrameContext * CalleeCtx,BindingsTy & Bindings) const1324 void ObjCMethodCall::getInitialStackFrameContents(
1325 const StackFrameContext *CalleeCtx,
1326 BindingsTy &Bindings) const {
1327 const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
1328 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1329 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
1330 D->parameters());
1331
1332 SVal SelfVal = getReceiverSVal();
1333 if (!SelfVal.isUnknown()) {
1334 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
1335 MemRegionManager &MRMgr = SVB.getRegionManager();
1336 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
1337 Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
1338 }
1339 }
1340
1341 CallEventRef<>
getSimpleCall(const CallExpr * CE,ProgramStateRef State,const LocationContext * LCtx)1342 CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
1343 const LocationContext *LCtx) {
1344 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE))
1345 return create<CXXMemberCall>(MCE, State, LCtx);
1346
1347 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
1348 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1349 if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
1350 if (MD->isInstance())
1351 return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
1352
1353 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1354 return create<BlockCall>(CE, State, LCtx);
1355 }
1356
1357 // Otherwise, it's a normal function call, static member function call, or
1358 // something we can't reason about.
1359 return create<SimpleFunctionCall>(CE, State, LCtx);
1360 }
1361
1362 CallEventRef<>
getCaller(const StackFrameContext * CalleeCtx,ProgramStateRef State)1363 CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
1364 ProgramStateRef State) {
1365 const LocationContext *ParentCtx = CalleeCtx->getParent();
1366 const LocationContext *CallerCtx = ParentCtx->getStackFrame();
1367 assert(CallerCtx && "This should not be used for top-level stack frames");
1368
1369 const Stmt *CallSite = CalleeCtx->getCallSite();
1370
1371 if (CallSite) {
1372 if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx))
1373 return Out;
1374
1375 // All other cases are handled by getCall.
1376 assert(isa<CXXConstructExpr>(CallSite) &&
1377 "This is not an inlineable statement");
1378
1379 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1380 const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
1381 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
1382 SVal ThisVal = State->getSVal(ThisPtr);
1383
1384 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
1385 ThisVal.getAsRegion(), State, CallerCtx);
1386 }
1387
1388 // Fall back to the CFG. The only thing we haven't handled yet is
1389 // destructors, though this could change in the future.
1390 const CFGBlock *B = CalleeCtx->getCallSiteBlock();
1391 CFGElement E = (*B)[CalleeCtx->getIndex()];
1392 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1393 "All other CFG elements should have exprs");
1394
1395 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1396 const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
1397 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
1398 SVal ThisVal = State->getSVal(ThisPtr);
1399
1400 const Stmt *Trigger;
1401 if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())
1402 Trigger = AutoDtor->getTriggerStmt();
1403 else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1404 Trigger = DeleteDtor->getDeleteExpr();
1405 else
1406 Trigger = Dtor->getBody();
1407
1408 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
1409 E.getAs<CFGBaseDtor>().hasValue(), State,
1410 CallerCtx);
1411 }
1412
getCall(const Stmt * S,ProgramStateRef State,const LocationContext * LC)1413 CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State,
1414 const LocationContext *LC) {
1415 if (const auto *CE = dyn_cast<CallExpr>(S)) {
1416 return getSimpleCall(CE, State, LC);
1417 } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) {
1418 return getCXXAllocatorCall(NE, State, LC);
1419 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) {
1420 return getObjCMethodCall(ME, State, LC);
1421 } else {
1422 return nullptr;
1423 }
1424 }
1425