1 //===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 /// \file This file defines CallEvent and its subclasses, which represent path- 10 /// sensitive instances of different kinds of function and method calls 11 /// (C, C++, and Objective-C). 12 // 13 //===----------------------------------------------------------------------===// 14 15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H 16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H 17 18 #include "clang/AST/Decl.h" 19 #include "clang/AST/DeclBase.h" 20 #include "clang/AST/DeclCXX.h" 21 #include "clang/AST/DeclObjC.h" 22 #include "clang/AST/Expr.h" 23 #include "clang/AST/ExprCXX.h" 24 #include "clang/AST/ExprObjC.h" 25 #include "clang/AST/Stmt.h" 26 #include "clang/AST/Type.h" 27 #include "clang/Basic/IdentifierTable.h" 28 #include "clang/Basic/LLVM.h" 29 #include "clang/Basic/SourceLocation.h" 30 #include "clang/Basic/SourceManager.h" 31 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h" 32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 33 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" 34 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 35 #include "llvm/ADT/ArrayRef.h" 36 #include "llvm/ADT/IntrusiveRefCntPtr.h" 37 #include "llvm/ADT/PointerIntPair.h" 38 #include "llvm/ADT/PointerUnion.h" 39 #include "llvm/ADT/STLExtras.h" 40 #include "llvm/ADT/SmallVector.h" 41 #include "llvm/ADT/StringRef.h" 42 #include "llvm/ADT/iterator_range.h" 43 #include "llvm/Support/Allocator.h" 44 #include "llvm/Support/Casting.h" 45 #include "llvm/Support/ErrorHandling.h" 46 #include <cassert> 47 #include <limits> 48 #include <optional> 49 #include <utility> 50 51 namespace clang { 52 53 class LocationContext; 54 class ProgramPoint; 55 class ProgramPointTag; 56 class StackFrameContext; 57 58 namespace ento { 59 60 enum CallEventKind { 61 CE_Function, 62 CE_CXXMember, 63 CE_CXXMemberOperator, 64 CE_CXXDestructor, 65 CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember, 66 CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor, 67 CE_CXXConstructor, 68 CE_CXXInheritedConstructor, 69 CE_BEG_CXX_CONSTRUCTOR_CALLS = CE_CXXConstructor, 70 CE_END_CXX_CONSTRUCTOR_CALLS = CE_CXXInheritedConstructor, 71 CE_CXXAllocator, 72 CE_CXXDeallocator, 73 CE_BEG_FUNCTION_CALLS = CE_Function, 74 CE_END_FUNCTION_CALLS = CE_CXXDeallocator, 75 CE_Block, 76 CE_ObjCMessage 77 }; 78 79 class CallEvent; 80 81 template<typename T = CallEvent> 82 class CallEventRef : public IntrusiveRefCntPtr<const T> { 83 public: 84 CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {} 85 CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {} 86 87 // The copy assignment operator is defined as deleted pending further 88 // motivation. 89 CallEventRef &operator=(const CallEventRef &) = delete; 90 91 CallEventRef<T> cloneWithState(ProgramStateRef State) const { 92 return this->get()->template cloneWithState<T>(State); 93 } 94 95 // Allow implicit conversions to a superclass type, since CallEventRef 96 // behaves like a pointer-to-const. 97 template <typename SuperT> 98 operator CallEventRef<SuperT> () const { 99 return this->get(); 100 } 101 }; 102 103 /// \class RuntimeDefinition 104 /// Defines the runtime definition of the called function. 105 /// 106 /// Encapsulates the information we have about which Decl will be used 107 /// when the call is executed on the given path. When dealing with dynamic 108 /// dispatch, the information is based on DynamicTypeInfo and might not be 109 /// precise. 110 class RuntimeDefinition { 111 /// The Declaration of the function which could be called at runtime. 112 /// NULL if not available. 113 const Decl *D = nullptr; 114 115 /// The region representing an object (ObjC/C++) on which the method is 116 /// called. With dynamic dispatch, the method definition depends on the 117 /// runtime type of this object. NULL when the DynamicTypeInfo is 118 /// precise. 119 const MemRegion *R = nullptr; 120 121 /// A definition is foreign if it has been imported and newly created by the 122 /// ASTImporter. This can be true only if CTU is enabled. 123 const bool Foreign = false; 124 125 public: 126 RuntimeDefinition() = default; 127 RuntimeDefinition(const Decl *InD): D(InD) {} 128 RuntimeDefinition(const Decl *InD, bool Foreign) : D(InD), Foreign(Foreign) {} 129 RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {} 130 131 const Decl *getDecl() { return D; } 132 bool isForeign() const { return Foreign; } 133 134 /// Check if the definition we have is precise. 135 /// If not, it is possible that the call dispatches to another definition at 136 /// execution time. 137 bool mayHaveOtherDefinitions() { return R != nullptr; } 138 139 /// When other definitions are possible, returns the region whose runtime type 140 /// determines the method definition. 141 const MemRegion *getDispatchRegion() { return R; } 142 }; 143 144 /// Represents an abstract call to a function or method along a 145 /// particular path. 146 /// 147 /// CallEvents are created through the factory methods of CallEventManager. 148 /// 149 /// CallEvents should always be cheap to create and destroy. In order for 150 /// CallEventManager to be able to re-use CallEvent-sized memory blocks, 151 /// subclasses of CallEvent may not add any data members to the base class. 152 /// Use the "Data" and "Location" fields instead. 153 class CallEvent { 154 public: 155 using Kind = CallEventKind; 156 157 private: 158 ProgramStateRef State; 159 const LocationContext *LCtx; 160 llvm::PointerUnion<const Expr *, const Decl *> Origin; 161 CFGBlock::ConstCFGElementRef ElemRef = {nullptr, 0}; 162 mutable std::optional<bool> Foreign; // Set by CTU analysis. 163 164 protected: 165 // This is user data for subclasses. 166 const void *Data; 167 168 // This is user data for subclasses. 169 // This should come right before RefCount, so that the two fields can be 170 // packed together on LP64 platforms. 171 SourceLocation Location; 172 173 private: 174 template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo; 175 176 mutable unsigned RefCount = 0; 177 178 void Retain() const { ++RefCount; } 179 void Release() const; 180 181 protected: 182 friend class CallEventManager; 183 184 CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx, 185 CFGBlock::ConstCFGElementRef ElemRef) 186 : State(std::move(state)), LCtx(lctx), Origin(E), ElemRef(ElemRef) {} 187 188 CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx, 189 CFGBlock::ConstCFGElementRef ElemRef) 190 : State(std::move(state)), LCtx(lctx), Origin(D), ElemRef(ElemRef) {} 191 192 // DO NOT MAKE PUBLIC 193 CallEvent(const CallEvent &Original) 194 : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin), 195 ElemRef(Original.ElemRef), Data(Original.Data), 196 Location(Original.Location) {} 197 198 /// Copies this CallEvent, with vtable intact, into a new block of memory. 199 virtual void cloneTo(void *Dest) const = 0; 200 201 /// Get the value of arbitrary expressions at this point in the path. 202 SVal getSVal(const Stmt *S) const { 203 return getState()->getSVal(S, getLocationContext()); 204 } 205 206 using ValueList = SmallVectorImpl<SVal>; 207 208 /// Used to specify non-argument regions that will be invalidated as a 209 /// result of this call. 210 virtual void getExtraInvalidatedValues(ValueList &Values, 211 RegionAndSymbolInvalidationTraits *ETraits) const {} 212 213 public: 214 CallEvent &operator=(const CallEvent &) = delete; 215 virtual ~CallEvent() = default; 216 217 /// Returns the kind of call this is. 218 virtual Kind getKind() const = 0; 219 virtual StringRef getKindAsString() const = 0; 220 221 /// Returns the declaration of the function or method that will be 222 /// called. May be null. 223 virtual const Decl *getDecl() const { 224 return Origin.dyn_cast<const Decl *>(); 225 } 226 227 bool isForeign() const { 228 assert(Foreign && "Foreign must be set before querying"); 229 return *Foreign; 230 } 231 void setForeign(bool B) const { Foreign = B; } 232 233 /// The state in which the call is being evaluated. 234 const ProgramStateRef &getState() const { 235 return State; 236 } 237 238 /// The context in which the call is being evaluated. 239 const LocationContext *getLocationContext() const { 240 return LCtx; 241 } 242 243 const CFGBlock::ConstCFGElementRef &getCFGElementRef() const { 244 return ElemRef; 245 } 246 247 /// Returns the definition of the function or method that will be 248 /// called. 249 virtual RuntimeDefinition getRuntimeDefinition() const = 0; 250 251 /// Returns the expression whose value will be the result of this call. 252 /// May be null. 253 virtual const Expr *getOriginExpr() const { 254 return Origin.dyn_cast<const Expr *>(); 255 } 256 257 /// Returns the number of arguments (explicit and implicit). 258 /// 259 /// Note that this may be greater than the number of parameters in the 260 /// callee's declaration, and that it may include arguments not written in 261 /// the source. 262 virtual unsigned getNumArgs() const = 0; 263 264 /// Returns true if the callee is known to be from a system header. 265 bool isInSystemHeader() const { 266 const Decl *D = getDecl(); 267 if (!D) 268 return false; 269 270 SourceLocation Loc = D->getLocation(); 271 if (Loc.isValid()) { 272 const SourceManager &SM = 273 getState()->getStateManager().getContext().getSourceManager(); 274 return SM.isInSystemHeader(D->getLocation()); 275 } 276 277 // Special case for implicitly-declared global operator new/delete. 278 // These should be considered system functions. 279 if (const auto *FD = dyn_cast<FunctionDecl>(D)) 280 return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal(); 281 282 return false; 283 } 284 285 /// Returns a source range for the entire call, suitable for 286 /// outputting in diagnostics. 287 virtual SourceRange getSourceRange() const { 288 return getOriginExpr()->getSourceRange(); 289 } 290 291 /// Returns the value of a given argument at the time of the call. 292 virtual SVal getArgSVal(unsigned Index) const; 293 294 /// Returns the expression associated with a given argument. 295 /// May be null if this expression does not appear in the source. 296 virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; } 297 298 /// Returns the source range for errors associated with this argument. 299 /// 300 /// May be invalid if the argument is not written in the source. 301 virtual SourceRange getArgSourceRange(unsigned Index) const; 302 303 /// Returns the result type, adjusted for references. 304 QualType getResultType() const; 305 306 /// Returns the return value of the call. 307 /// 308 /// This should only be called if the CallEvent was created using a state in 309 /// which the return value has already been bound to the origin expression. 310 SVal getReturnValue() const; 311 312 /// Returns true if the type of any of the non-null arguments satisfies 313 /// the condition. 314 bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const; 315 316 /// Returns true if any of the arguments appear to represent callbacks. 317 bool hasNonZeroCallbackArg() const; 318 319 /// Returns true if any of the arguments is void*. 320 bool hasVoidPointerToNonConstArg() const; 321 322 /// Returns true if any of the arguments are known to escape to long- 323 /// term storage, even if this method will not modify them. 324 // NOTE: The exact semantics of this are still being defined! 325 // We don't really want a list of hardcoded exceptions in the long run, 326 // but we don't want duplicated lists of known APIs in the short term either. 327 virtual bool argumentsMayEscape() const { 328 return hasNonZeroCallbackArg(); 329 } 330 331 /// Returns true if the callee is an externally-visible function in the 332 /// top-level namespace, such as \c malloc. 333 /// 334 /// You can use this call to determine that a particular function really is 335 /// a library function and not, say, a C++ member function with the same name. 336 /// 337 /// If a name is provided, the function must additionally match the given 338 /// name. 339 /// 340 /// Note that this deliberately excludes C++ library functions in the \c std 341 /// namespace, but will include C library functions accessed through the 342 /// \c std namespace. This also does not check if the function is declared 343 /// as 'extern "C"', or if it uses C++ name mangling. 344 // FIXME: Add a helper for checking namespaces. 345 // FIXME: Move this down to AnyFunctionCall once checkers have more 346 // precise callbacks. 347 bool isGlobalCFunction(StringRef SpecificName = StringRef()) const; 348 349 /// Returns the name of the callee, if its name is a simple identifier. 350 /// 351 /// Note that this will fail for Objective-C methods, blocks, and C++ 352 /// overloaded operators. The former is named by a Selector rather than a 353 /// simple identifier, and the latter two do not have names. 354 // FIXME: Move this down to AnyFunctionCall once checkers have more 355 // precise callbacks. 356 const IdentifierInfo *getCalleeIdentifier() const { 357 const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl()); 358 if (!ND) 359 return nullptr; 360 return ND->getIdentifier(); 361 } 362 363 /// Returns an appropriate ProgramPoint for this call. 364 ProgramPoint getProgramPoint(bool IsPreVisit = false, 365 const ProgramPointTag *Tag = nullptr) const; 366 367 /// Returns a new state with all argument regions invalidated. 368 /// 369 /// This accepts an alternate state in case some processing has already 370 /// occurred. 371 ProgramStateRef invalidateRegions(unsigned BlockCount, 372 ProgramStateRef Orig = nullptr) const; 373 374 using FrameBindingTy = std::pair<SVal, SVal>; 375 using BindingsTy = SmallVectorImpl<FrameBindingTy>; 376 377 /// Populates the given SmallVector with the bindings in the callee's stack 378 /// frame at the start of this call. 379 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 380 BindingsTy &Bindings) const = 0; 381 382 /// Returns a copy of this CallEvent, but using the given state. 383 template <typename T> 384 CallEventRef<T> cloneWithState(ProgramStateRef NewState) const; 385 386 /// Returns a copy of this CallEvent, but using the given state. 387 CallEventRef<> cloneWithState(ProgramStateRef NewState) const { 388 return cloneWithState<CallEvent>(NewState); 389 } 390 391 /// Returns true if this is a statement is a function or method call 392 /// of some kind. 393 static bool isCallStmt(const Stmt *S); 394 395 /// Returns the result type of a function or method declaration. 396 /// 397 /// This will return a null QualType if the result type cannot be determined. 398 static QualType getDeclaredResultType(const Decl *D); 399 400 /// Returns true if the given decl is known to be variadic. 401 /// 402 /// \p D must not be null. 403 static bool isVariadic(const Decl *D); 404 405 /// Returns AnalysisDeclContext for the callee stack frame. 406 /// Currently may fail; returns null on failure. 407 AnalysisDeclContext *getCalleeAnalysisDeclContext() const; 408 409 /// Returns the callee stack frame. That stack frame will only be entered 410 /// during analysis if the call is inlined, but it may still be useful 411 /// in intermediate calculations even if the call isn't inlined. 412 /// May fail; returns null on failure. 413 const StackFrameContext *getCalleeStackFrame(unsigned BlockCount) const; 414 415 /// Returns memory location for a parameter variable within the callee stack 416 /// frame. The behavior is undefined if the block count is different from the 417 /// one that is there when call happens. May fail; returns null on failure. 418 const ParamVarRegion *getParameterLocation(unsigned Index, 419 unsigned BlockCount) const; 420 421 /// Returns true if on the current path, the argument was constructed by 422 /// calling a C++ constructor over it. This is an internal detail of the 423 /// analysis which doesn't necessarily represent the program semantics: 424 /// if we are supposed to construct an argument directly, we may still 425 /// not do that because we don't know how (i.e., construction context is 426 /// unavailable in the CFG or not supported by the analyzer). 427 bool isArgumentConstructedDirectly(unsigned Index) const { 428 // This assumes that the object was not yet removed from the state. 429 return ExprEngine::getObjectUnderConstruction( 430 getState(), {getOriginExpr(), Index}, getLocationContext()) 431 .has_value(); 432 } 433 434 /// Some calls have parameter numbering mismatched from argument numbering. 435 /// This function converts an argument index to the corresponding 436 /// parameter index. Returns std::nullopt is the argument doesn't correspond 437 /// to any parameter variable. 438 virtual std::optional<unsigned> 439 getAdjustedParameterIndex(unsigned ASTArgumentIndex) const { 440 return ASTArgumentIndex; 441 } 442 443 /// Some call event sub-classes conveniently adjust mismatching AST indices 444 /// to match parameter indices. This function converts an argument index 445 /// as understood by CallEvent to the argument index as understood by the AST. 446 virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const { 447 return CallArgumentIndex; 448 } 449 450 /// Returns the construction context of the call, if it is a C++ constructor 451 /// call or a call of a function returning a C++ class instance. Otherwise 452 /// return nullptr. 453 const ConstructionContext *getConstructionContext() const; 454 455 /// If the call returns a C++ record type then the region of its return value 456 /// can be retrieved from its construction context. 457 std::optional<SVal> getReturnValueUnderConstruction() const; 458 459 // Iterator access to formal parameters and their types. 460 private: 461 struct GetTypeFn { 462 QualType operator()(ParmVarDecl *PD) const { return PD->getType(); } 463 }; 464 465 public: 466 /// Return call's formal parameters. 467 /// 468 /// Remember that the number of formal parameters may not match the number 469 /// of arguments for all calls. However, the first parameter will always 470 /// correspond with the argument value returned by \c getArgSVal(0). 471 virtual ArrayRef<ParmVarDecl *> parameters() const = 0; 472 473 using param_type_iterator = 474 llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>; 475 476 /// Returns an iterator over the types of the call's formal parameters. 477 /// 478 /// This uses the callee decl found by default name lookup rather than the 479 /// definition because it represents a public interface, and probably has 480 /// more annotations. 481 param_type_iterator param_type_begin() const { 482 return llvm::map_iterator(parameters().begin(), GetTypeFn()); 483 } 484 /// \sa param_type_begin() 485 param_type_iterator param_type_end() const { 486 return llvm::map_iterator(parameters().end(), GetTypeFn()); 487 } 488 489 // For debugging purposes only 490 void dump(raw_ostream &Out) const; 491 void dump() const; 492 }; 493 494 /// Represents a call to any sort of function that might have a 495 /// FunctionDecl. 496 class AnyFunctionCall : public CallEvent { 497 protected: 498 AnyFunctionCall(const Expr *E, ProgramStateRef St, 499 const LocationContext *LCtx, 500 CFGBlock::ConstCFGElementRef ElemRef) 501 : CallEvent(E, St, LCtx, ElemRef) {} 502 AnyFunctionCall(const Decl *D, ProgramStateRef St, 503 const LocationContext *LCtx, 504 CFGBlock::ConstCFGElementRef ElemRef) 505 : CallEvent(D, St, LCtx, ElemRef) {} 506 AnyFunctionCall(const AnyFunctionCall &Other) = default; 507 508 public: 509 // This function is overridden by subclasses, but they must return 510 // a FunctionDecl. 511 const FunctionDecl *getDecl() const override { 512 return cast<FunctionDecl>(CallEvent::getDecl()); 513 } 514 515 RuntimeDefinition getRuntimeDefinition() const override; 516 517 bool argumentsMayEscape() const override; 518 519 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 520 BindingsTy &Bindings) const override; 521 522 ArrayRef<ParmVarDecl *> parameters() const override; 523 524 static bool classof(const CallEvent *CA) { 525 return CA->getKind() >= CE_BEG_FUNCTION_CALLS && 526 CA->getKind() <= CE_END_FUNCTION_CALLS; 527 } 528 }; 529 530 /// Represents a C function or static C++ member function call. 531 /// 532 /// Example: \c fun() 533 class SimpleFunctionCall : public AnyFunctionCall { 534 friend class CallEventManager; 535 536 protected: 537 SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St, 538 const LocationContext *LCtx, 539 CFGBlock::ConstCFGElementRef ElemRef) 540 : AnyFunctionCall(CE, St, LCtx, ElemRef) {} 541 SimpleFunctionCall(const SimpleFunctionCall &Other) = default; 542 543 void cloneTo(void *Dest) const override { 544 new (Dest) SimpleFunctionCall(*this); 545 } 546 547 public: 548 const CallExpr *getOriginExpr() const override { 549 return cast<CallExpr>(AnyFunctionCall::getOriginExpr()); 550 } 551 552 const FunctionDecl *getDecl() const override; 553 554 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); } 555 556 const Expr *getArgExpr(unsigned Index) const override { 557 return getOriginExpr()->getArg(Index); 558 } 559 560 Kind getKind() const override { return CE_Function; } 561 StringRef getKindAsString() const override { return "SimpleFunctionCall"; } 562 563 static bool classof(const CallEvent *CA) { 564 return CA->getKind() == CE_Function; 565 } 566 }; 567 568 /// Represents a call to a block. 569 /// 570 /// Example: <tt>^{ statement-body }()</tt> 571 class BlockCall : public CallEvent { 572 friend class CallEventManager; 573 574 protected: 575 BlockCall(const CallExpr *CE, ProgramStateRef St, const LocationContext *LCtx, 576 CFGBlock::ConstCFGElementRef ElemRef) 577 : CallEvent(CE, St, LCtx, ElemRef) {} 578 BlockCall(const BlockCall &Other) = default; 579 580 void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); } 581 582 void getExtraInvalidatedValues(ValueList &Values, 583 RegionAndSymbolInvalidationTraits *ETraits) const override; 584 585 public: 586 const CallExpr *getOriginExpr() const override { 587 return cast<CallExpr>(CallEvent::getOriginExpr()); 588 } 589 590 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); } 591 592 const Expr *getArgExpr(unsigned Index) const override { 593 return getOriginExpr()->getArg(Index); 594 } 595 596 /// Returns the region associated with this instance of the block. 597 /// 598 /// This may be NULL if the block's origin is unknown. 599 const BlockDataRegion *getBlockRegion() const; 600 601 const BlockDecl *getDecl() const override { 602 const BlockDataRegion *BR = getBlockRegion(); 603 if (!BR) 604 return nullptr; 605 return BR->getDecl(); 606 } 607 608 bool isConversionFromLambda() const { 609 const BlockDecl *BD = getDecl(); 610 if (!BD) 611 return false; 612 613 return BD->isConversionFromLambda(); 614 } 615 616 /// For a block converted from a C++ lambda, returns the block 617 /// VarRegion for the variable holding the captured C++ lambda record. 618 const VarRegion *getRegionStoringCapturedLambda() const { 619 assert(isConversionFromLambda()); 620 const BlockDataRegion *BR = getBlockRegion(); 621 assert(BR && "Block converted from lambda must have a block region"); 622 623 auto ReferencedVars = BR->referenced_vars(); 624 assert(!ReferencedVars.empty()); 625 return ReferencedVars.begin().getCapturedRegion(); 626 } 627 628 RuntimeDefinition getRuntimeDefinition() const override { 629 if (!isConversionFromLambda()) 630 return RuntimeDefinition(getDecl()); 631 632 // Clang converts lambdas to blocks with an implicit user-defined 633 // conversion operator method on the lambda record that looks (roughly) 634 // like: 635 // 636 // typedef R(^block_type)(P1, P2, ...); 637 // operator block_type() const { 638 // auto Lambda = *this; 639 // return ^(P1 p1, P2 p2, ...){ 640 // /* return Lambda(p1, p2, ...); */ 641 // }; 642 // } 643 // 644 // Here R is the return type of the lambda and P1, P2, ... are 645 // its parameter types. 'Lambda' is a fake VarDecl captured by the block 646 // that is initialized to a copy of the lambda. 647 // 648 // Sema leaves the body of a lambda-converted block empty (it is 649 // produced by CodeGen), so we can't analyze it directly. Instead, we skip 650 // the block body and analyze the operator() method on the captured lambda. 651 const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl(); 652 const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl(); 653 CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator(); 654 655 return RuntimeDefinition(LambdaCallOperator); 656 } 657 658 bool argumentsMayEscape() const override { 659 return true; 660 } 661 662 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 663 BindingsTy &Bindings) const override; 664 665 ArrayRef<ParmVarDecl *> parameters() const override; 666 667 Kind getKind() const override { return CE_Block; } 668 StringRef getKindAsString() const override { return "BlockCall"; } 669 670 static bool classof(const CallEvent *CA) { return CA->getKind() == CE_Block; } 671 }; 672 673 /// Represents a non-static C++ member function call, no matter how 674 /// it is written. 675 class CXXInstanceCall : public AnyFunctionCall { 676 protected: 677 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St, 678 const LocationContext *LCtx, 679 CFGBlock::ConstCFGElementRef ElemRef) 680 : AnyFunctionCall(CE, St, LCtx, ElemRef) {} 681 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St, 682 const LocationContext *LCtx, 683 CFGBlock::ConstCFGElementRef ElemRef) 684 : AnyFunctionCall(D, St, LCtx, ElemRef) {} 685 CXXInstanceCall(const CXXInstanceCall &Other) = default; 686 687 void getExtraInvalidatedValues(ValueList &Values, 688 RegionAndSymbolInvalidationTraits *ETraits) const override; 689 690 public: 691 /// Returns the expression representing the implicit 'this' object. 692 virtual const Expr *getCXXThisExpr() const { return nullptr; } 693 694 /// Returns the value of the implicit 'this' object. 695 virtual SVal getCXXThisVal() const; 696 697 const FunctionDecl *getDecl() const override; 698 699 RuntimeDefinition getRuntimeDefinition() const override; 700 701 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 702 BindingsTy &Bindings) const override; 703 704 static bool classof(const CallEvent *CA) { 705 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS && 706 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS; 707 } 708 }; 709 710 /// Represents a non-static C++ member function call. 711 /// 712 /// Example: \c obj.fun() 713 class CXXMemberCall : public CXXInstanceCall { 714 friend class CallEventManager; 715 716 protected: 717 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St, 718 const LocationContext *LCtx, 719 CFGBlock::ConstCFGElementRef ElemRef) 720 : CXXInstanceCall(CE, St, LCtx, ElemRef) {} 721 CXXMemberCall(const CXXMemberCall &Other) = default; 722 723 void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); } 724 725 public: 726 const CXXMemberCallExpr *getOriginExpr() const override { 727 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr()); 728 } 729 730 unsigned getNumArgs() const override { 731 if (const CallExpr *CE = getOriginExpr()) 732 return CE->getNumArgs(); 733 return 0; 734 } 735 736 const Expr *getArgExpr(unsigned Index) const override { 737 return getOriginExpr()->getArg(Index); 738 } 739 740 const Expr *getCXXThisExpr() const override; 741 742 RuntimeDefinition getRuntimeDefinition() const override; 743 744 Kind getKind() const override { return CE_CXXMember; } 745 StringRef getKindAsString() const override { return "CXXMemberCall"; } 746 747 static bool classof(const CallEvent *CA) { 748 return CA->getKind() == CE_CXXMember; 749 } 750 }; 751 752 /// Represents a C++ overloaded operator call where the operator is 753 /// implemented as a non-static member function. 754 /// 755 /// Example: <tt>iter + 1</tt> 756 class CXXMemberOperatorCall : public CXXInstanceCall { 757 friend class CallEventManager; 758 759 protected: 760 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St, 761 const LocationContext *LCtx, 762 CFGBlock::ConstCFGElementRef ElemRef) 763 : CXXInstanceCall(CE, St, LCtx, ElemRef) {} 764 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default; 765 766 void cloneTo(void *Dest) const override { 767 new (Dest) CXXMemberOperatorCall(*this); 768 } 769 770 public: 771 const CXXOperatorCallExpr *getOriginExpr() const override { 772 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr()); 773 } 774 775 unsigned getNumArgs() const override { 776 return getOriginExpr()->getNumArgs() - 1; 777 } 778 779 const Expr *getArgExpr(unsigned Index) const override { 780 return getOriginExpr()->getArg(Index + 1); 781 } 782 783 const Expr *getCXXThisExpr() const override; 784 785 Kind getKind() const override { return CE_CXXMemberOperator; } 786 StringRef getKindAsString() const override { return "CXXMemberOperatorCall"; } 787 788 static bool classof(const CallEvent *CA) { 789 return CA->getKind() == CE_CXXMemberOperator; 790 } 791 792 std::optional<unsigned> 793 getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override { 794 // For member operator calls argument 0 on the expression corresponds 795 // to implicit this-parameter on the declaration. 796 return (ASTArgumentIndex > 0) 797 ? std::optional<unsigned>(ASTArgumentIndex - 1) 798 : std::nullopt; 799 } 800 801 unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override { 802 // For member operator calls argument 0 on the expression corresponds 803 // to implicit this-parameter on the declaration. 804 return CallArgumentIndex + 1; 805 } 806 807 OverloadedOperatorKind getOverloadedOperator() const { 808 return getOriginExpr()->getOperator(); 809 } 810 }; 811 812 /// Represents an implicit call to a C++ destructor. 813 /// 814 /// This can occur at the end of a scope (for automatic objects), at the end 815 /// of a full-expression (for temporaries), or as part of a delete. 816 class CXXDestructorCall : public CXXInstanceCall { 817 friend class CallEventManager; 818 819 protected: 820 using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>; 821 822 /// Creates an implicit destructor. 823 /// 824 /// \param DD The destructor that will be called. 825 /// \param Trigger The statement whose completion causes this destructor call. 826 /// \param Target The object region to be destructed. 827 /// \param St The path-sensitive state at this point in the program. 828 /// \param LCtx The location context at this point in the program. 829 /// \param ElemRef The reference to this destructor in the CFG. 830 /// 831 /// FIXME: Eventually we want to drop \param Target and deduce it from 832 /// \param ElemRef. To do that we need to migrate the logic for target 833 /// region lookup from ExprEngine::ProcessImplicitDtor() and make it 834 /// independent from ExprEngine. 835 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 836 const MemRegion *Target, bool IsBaseDestructor, 837 ProgramStateRef St, const LocationContext *LCtx, 838 CFGBlock::ConstCFGElementRef ElemRef) 839 : CXXInstanceCall(DD, St, LCtx, ElemRef) { 840 Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue(); 841 Location = Trigger->getEndLoc(); 842 } 843 844 CXXDestructorCall(const CXXDestructorCall &Other) = default; 845 846 void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);} 847 848 public: 849 SourceRange getSourceRange() const override { return Location; } 850 unsigned getNumArgs() const override { return 0; } 851 852 RuntimeDefinition getRuntimeDefinition() const override; 853 854 /// Returns the value of the implicit 'this' object. 855 SVal getCXXThisVal() const override; 856 857 /// Returns true if this is a call to a base class destructor. 858 bool isBaseDestructor() const { 859 return DtorDataTy::getFromOpaqueValue(Data).getInt(); 860 } 861 862 Kind getKind() const override { return CE_CXXDestructor; } 863 StringRef getKindAsString() const override { return "CXXDestructorCall"; } 864 865 static bool classof(const CallEvent *CA) { 866 return CA->getKind() == CE_CXXDestructor; 867 } 868 }; 869 870 /// Represents any constructor invocation. This includes regular constructors 871 /// and inherited constructors. 872 class AnyCXXConstructorCall : public AnyFunctionCall { 873 protected: 874 AnyCXXConstructorCall(const Expr *E, const MemRegion *Target, 875 ProgramStateRef St, const LocationContext *LCtx, 876 CFGBlock::ConstCFGElementRef ElemRef) 877 : AnyFunctionCall(E, St, LCtx, ElemRef) { 878 assert(E && (isa<CXXConstructExpr>(E) || isa<CXXInheritedCtorInitExpr>(E))); 879 // Target may be null when the region is unknown. 880 Data = Target; 881 } 882 883 void getExtraInvalidatedValues(ValueList &Values, 884 RegionAndSymbolInvalidationTraits *ETraits) const override; 885 886 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 887 BindingsTy &Bindings) const override; 888 889 public: 890 /// Returns the value of the implicit 'this' object. 891 SVal getCXXThisVal() const; 892 893 static bool classof(const CallEvent *Call) { 894 return Call->getKind() >= CE_BEG_CXX_CONSTRUCTOR_CALLS && 895 Call->getKind() <= CE_END_CXX_CONSTRUCTOR_CALLS; 896 } 897 }; 898 899 /// Represents a call to a C++ constructor. 900 /// 901 /// Example: \c T(1) 902 class CXXConstructorCall : public AnyCXXConstructorCall { 903 friend class CallEventManager; 904 905 protected: 906 /// Creates a constructor call. 907 /// 908 /// \param CE The constructor expression as written in the source. 909 /// \param Target The region where the object should be constructed. If NULL, 910 /// a new symbolic region will be used. 911 /// \param St The path-sensitive state at this point in the program. 912 /// \param LCtx The location context at this point in the program. 913 /// \param ElemRef The reference to this constructor in the CFG. 914 /// 915 /// FIXME: Eventually we want to drop \param Target and deduce it from 916 /// \param ElemRef. 917 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target, 918 ProgramStateRef St, const LocationContext *LCtx, 919 CFGBlock::ConstCFGElementRef ElemRef) 920 : AnyCXXConstructorCall(CE, Target, St, LCtx, ElemRef) {} 921 922 CXXConstructorCall(const CXXConstructorCall &Other) = default; 923 924 void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); } 925 926 public: 927 const CXXConstructExpr *getOriginExpr() const override { 928 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr()); 929 } 930 931 const CXXConstructorDecl *getDecl() const override { 932 return getOriginExpr()->getConstructor(); 933 } 934 935 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); } 936 937 const Expr *getArgExpr(unsigned Index) const override { 938 return getOriginExpr()->getArg(Index); 939 } 940 941 Kind getKind() const override { return CE_CXXConstructor; } 942 StringRef getKindAsString() const override { return "CXXConstructorCall"; } 943 944 static bool classof(const CallEvent *CA) { 945 return CA->getKind() == CE_CXXConstructor; 946 } 947 }; 948 949 /// Represents a call to a C++ inherited constructor. 950 /// 951 /// Example: \c class T : public S { using S::S; }; T(1); 952 /// 953 // Note, it is difficult to model the parameters. This is one of the reasons 954 // why we skip analysis of inheriting constructors as top-level functions. 955 // CXXInheritedCtorInitExpr doesn't take arguments and doesn't model parameter 956 // initialization because there is none: the arguments in the outer 957 // CXXConstructExpr directly initialize the parameters of the base class 958 // constructor, and no copies are made. (Making a copy of the parameter is 959 // incorrect, at least if it's done in an observable way.) The derived class 960 // constructor doesn't even exist in the formal model. 961 /// E.g., in: 962 /// 963 /// struct X { X *p = this; ~X() {} }; 964 /// struct A { A(X x) : b(x.p == &x) {} bool b; }; 965 /// struct B : A { using A::A; }; 966 /// B b = X{}; 967 /// 968 /// ... b.b is initialized to true. 969 class CXXInheritedConstructorCall : public AnyCXXConstructorCall { 970 friend class CallEventManager; 971 972 protected: 973 CXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *CE, 974 const MemRegion *Target, ProgramStateRef St, 975 const LocationContext *LCtx, 976 CFGBlock::ConstCFGElementRef ElemRef) 977 : AnyCXXConstructorCall(CE, Target, St, LCtx, ElemRef) {} 978 979 CXXInheritedConstructorCall(const CXXInheritedConstructorCall &Other) = 980 default; 981 982 void cloneTo(void *Dest) const override { 983 new (Dest) CXXInheritedConstructorCall(*this); 984 } 985 986 public: 987 const CXXInheritedCtorInitExpr *getOriginExpr() const override { 988 return cast<CXXInheritedCtorInitExpr>(AnyFunctionCall::getOriginExpr()); 989 } 990 991 const CXXConstructorDecl *getDecl() const override { 992 return getOriginExpr()->getConstructor(); 993 } 994 995 /// Obtain the stack frame of the inheriting constructor. Argument expressions 996 /// can be found on the call site of that stack frame. 997 const StackFrameContext *getInheritingStackFrame() const; 998 999 /// Obtain the CXXConstructExpr for the sub-class that inherited the current 1000 /// constructor (possibly indirectly). It's the statement that contains 1001 /// argument expressions. 1002 const CXXConstructExpr *getInheritingConstructor() const { 1003 return cast<CXXConstructExpr>(getInheritingStackFrame()->getCallSite()); 1004 } 1005 1006 unsigned getNumArgs() const override { 1007 return getInheritingConstructor()->getNumArgs(); 1008 } 1009 1010 const Expr *getArgExpr(unsigned Index) const override { 1011 return getInheritingConstructor()->getArg(Index); 1012 } 1013 1014 SVal getArgSVal(unsigned Index) const override { 1015 return getState()->getSVal( 1016 getArgExpr(Index), 1017 getInheritingStackFrame()->getParent()->getStackFrame()); 1018 } 1019 1020 Kind getKind() const override { return CE_CXXInheritedConstructor; } 1021 StringRef getKindAsString() const override { 1022 return "CXXInheritedConstructorCall"; 1023 } 1024 1025 static bool classof(const CallEvent *CA) { 1026 return CA->getKind() == CE_CXXInheritedConstructor; 1027 } 1028 }; 1029 1030 /// Represents the memory allocation call in a C++ new-expression. 1031 /// 1032 /// This is a call to "operator new". 1033 class CXXAllocatorCall : public AnyFunctionCall { 1034 friend class CallEventManager; 1035 1036 protected: 1037 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St, 1038 const LocationContext *LCtx, 1039 CFGBlock::ConstCFGElementRef ElemRef) 1040 : AnyFunctionCall(E, St, LCtx, ElemRef) {} 1041 CXXAllocatorCall(const CXXAllocatorCall &Other) = default; 1042 1043 void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); } 1044 1045 public: 1046 const CXXNewExpr *getOriginExpr() const override { 1047 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr()); 1048 } 1049 1050 const FunctionDecl *getDecl() const override { 1051 return getOriginExpr()->getOperatorNew(); 1052 } 1053 1054 SVal getObjectUnderConstruction() const { 1055 return *ExprEngine::getObjectUnderConstruction(getState(), getOriginExpr(), 1056 getLocationContext()); 1057 } 1058 1059 /// Number of non-placement arguments to the call. It is equal to 2 for 1060 /// C++17 aligned operator new() calls that have alignment implicitly 1061 /// passed as the second argument, and to 1 for other operator new() calls. 1062 unsigned getNumImplicitArgs() const { 1063 return getOriginExpr()->passAlignment() ? 2 : 1; 1064 } 1065 1066 unsigned getNumArgs() const override { 1067 return getOriginExpr()->getNumPlacementArgs() + getNumImplicitArgs(); 1068 } 1069 1070 bool isArray() const { return getOriginExpr()->isArray(); } 1071 1072 std::optional<const clang::Expr *> getArraySizeExpr() const { 1073 return getOriginExpr()->getArraySize(); 1074 } 1075 1076 SVal getArraySizeVal() const { 1077 assert(isArray() && "The allocator call doesn't allocate and array!"); 1078 1079 return getState()->getSVal(*getArraySizeExpr(), getLocationContext()); 1080 } 1081 1082 const Expr *getArgExpr(unsigned Index) const override { 1083 // The first argument of an allocator call is the size of the allocation. 1084 if (Index < getNumImplicitArgs()) 1085 return nullptr; 1086 return getOriginExpr()->getPlacementArg(Index - getNumImplicitArgs()); 1087 } 1088 1089 /// Number of placement arguments to the operator new() call. For example, 1090 /// standard std::nothrow operator new and standard placement new both have 1091 /// 1 implicit argument (size) and 1 placement argument, while regular 1092 /// operator new() has 1 implicit argument and 0 placement arguments. 1093 const Expr *getPlacementArgExpr(unsigned Index) const { 1094 return getOriginExpr()->getPlacementArg(Index); 1095 } 1096 1097 Kind getKind() const override { return CE_CXXAllocator; } 1098 StringRef getKindAsString() const override { return "CXXAllocatorCall"; } 1099 1100 static bool classof(const CallEvent *CE) { 1101 return CE->getKind() == CE_CXXAllocator; 1102 } 1103 }; 1104 1105 /// Represents the memory deallocation call in a C++ delete-expression. 1106 /// 1107 /// This is a call to "operator delete". 1108 // FIXME: CXXDeleteExpr isn't present for custom delete operators, or even for 1109 // some those that are in the standard library, like the no-throw or align_val 1110 // versions. 1111 // Some pointers: 1112 // http://lists.llvm.org/pipermail/cfe-dev/2020-April/065080.html 1113 // clang/test/Analysis/cxx-dynamic-memory-analysis-order.cpp 1114 // clang/unittests/StaticAnalyzer/CallEventTest.cpp 1115 class CXXDeallocatorCall : public AnyFunctionCall { 1116 friend class CallEventManager; 1117 1118 protected: 1119 CXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef St, 1120 const LocationContext *LCtx, 1121 CFGBlock::ConstCFGElementRef ElemRef) 1122 : AnyFunctionCall(E, St, LCtx, ElemRef) {} 1123 CXXDeallocatorCall(const CXXDeallocatorCall &Other) = default; 1124 1125 void cloneTo(void *Dest) const override { 1126 new (Dest) CXXDeallocatorCall(*this); 1127 } 1128 1129 public: 1130 const CXXDeleteExpr *getOriginExpr() const override { 1131 return cast<CXXDeleteExpr>(AnyFunctionCall::getOriginExpr()); 1132 } 1133 1134 const FunctionDecl *getDecl() const override { 1135 return getOriginExpr()->getOperatorDelete(); 1136 } 1137 1138 unsigned getNumArgs() const override { return getDecl()->getNumParams(); } 1139 1140 const Expr *getArgExpr(unsigned Index) const override { 1141 // CXXDeleteExpr's only have a single argument. 1142 return getOriginExpr()->getArgument(); 1143 } 1144 1145 Kind getKind() const override { return CE_CXXDeallocator; } 1146 StringRef getKindAsString() const override { return "CXXDeallocatorCall"; } 1147 1148 static bool classof(const CallEvent *CE) { 1149 return CE->getKind() == CE_CXXDeallocator; 1150 } 1151 }; 1152 1153 /// Represents the ways an Objective-C message send can occur. 1154 // 1155 // Note to maintainers: OCM_Message should always be last, since it does not 1156 // need to fit in the Data field's low bits. 1157 enum ObjCMessageKind { 1158 OCM_PropertyAccess, 1159 OCM_Subscript, 1160 OCM_Message 1161 }; 1162 1163 /// Represents any expression that calls an Objective-C method. 1164 /// 1165 /// This includes all of the kinds listed in ObjCMessageKind. 1166 class ObjCMethodCall : public CallEvent { 1167 friend class CallEventManager; 1168 1169 const PseudoObjectExpr *getContainingPseudoObjectExpr() const; 1170 1171 protected: 1172 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St, 1173 const LocationContext *LCtx, 1174 CFGBlock::ConstCFGElementRef ElemRef) 1175 : CallEvent(Msg, St, LCtx, ElemRef) { 1176 Data = nullptr; 1177 } 1178 1179 ObjCMethodCall(const ObjCMethodCall &Other) = default; 1180 1181 void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); } 1182 1183 void getExtraInvalidatedValues(ValueList &Values, 1184 RegionAndSymbolInvalidationTraits *ETraits) const override; 1185 1186 /// Check if the selector may have multiple definitions (may have overrides). 1187 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 1188 Selector Sel) const; 1189 1190 public: 1191 const ObjCMessageExpr *getOriginExpr() const override { 1192 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr()); 1193 } 1194 1195 const ObjCMethodDecl *getDecl() const override { 1196 return getOriginExpr()->getMethodDecl(); 1197 } 1198 1199 unsigned getNumArgs() const override { 1200 return getOriginExpr()->getNumArgs(); 1201 } 1202 1203 const Expr *getArgExpr(unsigned Index) const override { 1204 return getOriginExpr()->getArg(Index); 1205 } 1206 1207 bool isInstanceMessage() const { 1208 return getOriginExpr()->isInstanceMessage(); 1209 } 1210 1211 ObjCMethodFamily getMethodFamily() const { 1212 return getOriginExpr()->getMethodFamily(); 1213 } 1214 1215 Selector getSelector() const { 1216 return getOriginExpr()->getSelector(); 1217 } 1218 1219 SourceRange getSourceRange() const override; 1220 1221 /// Returns the value of the receiver at the time of this call. 1222 SVal getReceiverSVal() const; 1223 1224 /// Get the interface for the receiver. 1225 /// 1226 /// This works whether this is an instance message or a class message. 1227 /// However, it currently just uses the static type of the receiver. 1228 const ObjCInterfaceDecl *getReceiverInterface() const { 1229 return getOriginExpr()->getReceiverInterface(); 1230 } 1231 1232 /// Checks if the receiver refers to 'self' or 'super'. 1233 bool isReceiverSelfOrSuper() const; 1234 1235 /// Returns how the message was written in the source (property access, 1236 /// subscript, or explicit message send). 1237 ObjCMessageKind getMessageKind() const; 1238 1239 /// Returns true if this property access or subscript is a setter (has the 1240 /// form of an assignment). 1241 bool isSetter() const { 1242 switch (getMessageKind()) { 1243 case OCM_Message: 1244 llvm_unreachable("This is not a pseudo-object access!"); 1245 case OCM_PropertyAccess: 1246 return getNumArgs() > 0; 1247 case OCM_Subscript: 1248 return getNumArgs() > 1; 1249 } 1250 llvm_unreachable("Unknown message kind"); 1251 } 1252 1253 // Returns the property accessed by this method, either explicitly via 1254 // property syntax or implicitly via a getter or setter method. Returns 1255 // nullptr if the call is not a prooperty access. 1256 const ObjCPropertyDecl *getAccessedProperty() const; 1257 1258 RuntimeDefinition getRuntimeDefinition() const override; 1259 1260 bool argumentsMayEscape() const override; 1261 1262 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 1263 BindingsTy &Bindings) const override; 1264 1265 ArrayRef<ParmVarDecl*> parameters() const override; 1266 1267 Kind getKind() const override { return CE_ObjCMessage; } 1268 StringRef getKindAsString() const override { return "ObjCMethodCall"; } 1269 1270 static bool classof(const CallEvent *CA) { 1271 return CA->getKind() == CE_ObjCMessage; 1272 } 1273 }; 1274 1275 /// Manages the lifetime of CallEvent objects. 1276 /// 1277 /// CallEventManager provides a way to create arbitrary CallEvents "on the 1278 /// stack" as if they were value objects by keeping a cache of CallEvent-sized 1279 /// memory blocks. The CallEvents created by CallEventManager are only valid 1280 /// for the lifetime of the OwnedCallEvent that holds them; right now these 1281 /// objects cannot be copied and ownership cannot be transferred. 1282 class CallEventManager { 1283 friend class CallEvent; 1284 1285 llvm::BumpPtrAllocator &Alloc; 1286 SmallVector<void *, 8> Cache; 1287 1288 using CallEventTemplateTy = SimpleFunctionCall; 1289 1290 void reclaim(const void *Memory) { 1291 Cache.push_back(const_cast<void *>(Memory)); 1292 } 1293 1294 /// Returns memory that can be initialized as a CallEvent. 1295 void *allocate() { 1296 if (Cache.empty()) 1297 return Alloc.Allocate<CallEventTemplateTy>(); 1298 else 1299 return Cache.pop_back_val(); 1300 } 1301 1302 template <typename T, typename Arg> 1303 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx, 1304 CFGBlock::ConstCFGElementRef ElemRef) { 1305 static_assert(sizeof(T) == sizeof(CallEventTemplateTy), 1306 "CallEvent subclasses are not all the same size"); 1307 return new (allocate()) T(A, St, LCtx, ElemRef); 1308 } 1309 1310 template <typename T, typename Arg1, typename Arg2> 1311 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx, 1312 CFGBlock::ConstCFGElementRef ElemRef) { 1313 static_assert(sizeof(T) == sizeof(CallEventTemplateTy), 1314 "CallEvent subclasses are not all the same size"); 1315 return new (allocate()) T(A1, A2, St, LCtx, ElemRef); 1316 } 1317 1318 template <typename T, typename Arg1, typename Arg2, typename Arg3> 1319 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St, 1320 const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef) { 1321 static_assert(sizeof(T) == sizeof(CallEventTemplateTy), 1322 "CallEvent subclasses are not all the same size"); 1323 return new (allocate()) T(A1, A2, A3, St, LCtx, ElemRef); 1324 } 1325 1326 template <typename T, typename Arg1, typename Arg2, typename Arg3, 1327 typename Arg4> 1328 T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St, 1329 const LocationContext *LCtx, CFGBlock::ConstCFGElementRef ElemRef) { 1330 static_assert(sizeof(T) == sizeof(CallEventTemplateTy), 1331 "CallEvent subclasses are not all the same size"); 1332 return new (allocate()) T(A1, A2, A3, A4, St, LCtx, ElemRef); 1333 } 1334 1335 public: 1336 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {} 1337 1338 /// Gets an outside caller given a callee context. 1339 CallEventRef<> 1340 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State); 1341 1342 /// Gets a call event for a function call, Objective-C method call, 1343 /// a 'new', or a 'delete' call. 1344 CallEventRef<> getCall(const Stmt *S, ProgramStateRef State, 1345 const LocationContext *LC, 1346 CFGBlock::ConstCFGElementRef ElemRef); 1347 1348 CallEventRef<> getSimpleCall(const CallExpr *E, ProgramStateRef State, 1349 const LocationContext *LCtx, 1350 CFGBlock::ConstCFGElementRef ElemRef); 1351 1352 CallEventRef<ObjCMethodCall> 1353 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, 1354 const LocationContext *LCtx, 1355 CFGBlock::ConstCFGElementRef ElemRef) { 1356 return create<ObjCMethodCall>(E, State, LCtx, ElemRef); 1357 } 1358 1359 CallEventRef<CXXConstructorCall> 1360 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, 1361 ProgramStateRef State, const LocationContext *LCtx, 1362 CFGBlock::ConstCFGElementRef ElemRef) { 1363 return create<CXXConstructorCall>(E, Target, State, LCtx, ElemRef); 1364 } 1365 1366 CallEventRef<CXXInheritedConstructorCall> 1367 getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E, 1368 const MemRegion *Target, ProgramStateRef State, 1369 const LocationContext *LCtx, 1370 CFGBlock::ConstCFGElementRef ElemRef) { 1371 return create<CXXInheritedConstructorCall>(E, Target, State, LCtx, ElemRef); 1372 } 1373 1374 CallEventRef<CXXDestructorCall> 1375 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 1376 const MemRegion *Target, bool IsBase, 1377 ProgramStateRef State, const LocationContext *LCtx, 1378 CFGBlock::ConstCFGElementRef ElemRef) { 1379 return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx, 1380 ElemRef); 1381 } 1382 1383 CallEventRef<CXXAllocatorCall> 1384 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, 1385 const LocationContext *LCtx, 1386 CFGBlock::ConstCFGElementRef ElemRef) { 1387 return create<CXXAllocatorCall>(E, State, LCtx, ElemRef); 1388 } 1389 1390 CallEventRef<CXXDeallocatorCall> 1391 getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State, 1392 const LocationContext *LCtx, 1393 CFGBlock::ConstCFGElementRef ElemRef) { 1394 return create<CXXDeallocatorCall>(E, State, LCtx, ElemRef); 1395 } 1396 }; 1397 1398 template <typename T> 1399 CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const { 1400 assert(isa<T>(*this) && "Cloning to unrelated type"); 1401 static_assert(sizeof(T) == sizeof(CallEvent), 1402 "Subclasses may not add fields"); 1403 1404 if (NewState == State) 1405 return cast<T>(this); 1406 1407 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 1408 T *Copy = static_cast<T *>(Mgr.allocate()); 1409 cloneTo(Copy); 1410 assert(Copy->getKind() == this->getKind() && "Bad copy"); 1411 1412 Copy->State = NewState; 1413 return Copy; 1414 } 1415 1416 inline void CallEvent::Release() const { 1417 assert(RefCount > 0 && "Reference count is already zero."); 1418 --RefCount; 1419 1420 if (RefCount > 0) 1421 return; 1422 1423 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 1424 Mgr.reclaim(this); 1425 1426 this->~CallEvent(); 1427 } 1428 1429 } // namespace ento 1430 1431 } // namespace clang 1432 1433 namespace llvm { 1434 1435 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef. 1436 template<class T> struct simplify_type< clang::ento::CallEventRef<T>> { 1437 using SimpleType = const T *; 1438 1439 static SimpleType 1440 getSimplifiedValue(clang::ento::CallEventRef<T> Val) { 1441 return Val.get(); 1442 } 1443 }; 1444 1445 } // namespace llvm 1446 1447 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H 1448