1 //===- CallEvent.h - Wrapper for all function and method calls ----*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
14 //===----------------------------------------------------------------------===//
16 #ifndef LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL
17 #define LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL
19 #include "clang/Basic/SourceManager.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/ExprCXX.h"
22 #include "clang/AST/ExprObjC.h"
23 #include "clang/Analysis/AnalysisContext.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
25 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
26 #include "llvm/ADT/PointerIntPair.h"
30 class ProgramPointTag;
37 CE_BEG_SIMPLE_CALLS = CE_Function,
38 CE_END_SIMPLE_CALLS = CE_Block,
42 CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
43 CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
46 CE_BEG_FUNCTION_CALLS = CE_Function,
47 CE_END_FUNCTION_CALLS = CE_CXXAllocator,
52 class CallEventManager;
54 template<typename T = CallEvent>
55 class CallEventRef : public IntrusiveRefCntPtr<const T> {
57 CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
58 CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
60 CallEventRef<T> cloneWithState(ProgramStateRef State) const {
61 return this->getPtr()->template cloneWithState<T>(State);
64 // Allow implicit conversions to a superclass type, since CallEventRef
65 // behaves like a pointer-to-const.
66 template <typename SuperT>
67 operator CallEventRef<SuperT> () const {
68 return this->getPtr();
72 /// \class RuntimeDefinition
73 /// \brief Defines the runtime definition of the called function.
75 /// Encapsulates the information we have about which Decl will be used
76 /// when the call is executed on the given path. When dealing with dynamic
77 /// dispatch, the information is based on DynamicTypeInfo and might not be
79 class RuntimeDefinition {
80 /// The Declaration of the function which could be called at runtime.
81 /// NULL if not available.
84 /// The region representing an object (ObjC/C++) on which the method is
85 /// called. With dynamic dispatch, the method definition depends on the
86 /// runtime type of this object. NULL when the DynamicTypeInfo is
91 RuntimeDefinition(): D(0), R(0) {}
92 RuntimeDefinition(const Decl *InD): D(InD), R(0) {}
93 RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
94 const Decl *getDecl() { return D; }
96 /// \brief Check if the definition we have is precise.
97 /// If not, it is possible that the call dispatches to another definition at
99 bool mayHaveOtherDefinitions() { return R != 0; }
101 /// When other definitions are possible, returns the region whose runtime type
102 /// determines the method definition.
103 const MemRegion *getDispatchRegion() { return R; }
106 /// \brief Represents an abstract call to a function or method along a
109 /// CallEvents are created through the factory methods of CallEventManager.
111 /// CallEvents should always be cheap to create and destroy. In order for
112 /// CallEventManager to be able to re-use CallEvent-sized memory blocks,
113 /// subclasses of CallEvent may not add any data members to the base class.
114 /// Use the "Data" and "Location" fields instead.
117 typedef CallEventKind Kind;
120 ProgramStateRef State;
121 const LocationContext *LCtx;
122 llvm::PointerUnion<const Expr *, const Decl *> Origin;
124 void operator=(const CallEvent &) LLVM_DELETED_FUNCTION;
127 // This is user data for subclasses.
130 // This is user data for subclasses.
131 // This should come right before RefCount, so that the two fields can be
132 // packed together on LP64 platforms.
133 SourceLocation Location;
136 mutable unsigned RefCount;
138 template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
139 void Retain() const { ++RefCount; }
140 void Release() const;
143 friend class CallEventManager;
145 CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
146 : State(state), LCtx(lctx), Origin(E), RefCount(0) {}
148 CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
149 : State(state), LCtx(lctx), Origin(D), RefCount(0) {}
151 // DO NOT MAKE PUBLIC
152 CallEvent(const CallEvent &Original)
153 : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
154 Data(Original.Data), Location(Original.Location), RefCount(0) {}
156 /// Copies this CallEvent, with vtable intact, into a new block of memory.
157 virtual void cloneTo(void *Dest) const = 0;
159 /// \brief Get the value of arbitrary expressions at this point in the path.
160 SVal getSVal(const Stmt *S) const {
161 return getState()->getSVal(S, getLocationContext());
165 typedef SmallVectorImpl<const MemRegion *> RegionList;
167 /// \brief Used to specify non-argument regions that will be invalidated as a
168 /// result of this call.
169 virtual void getExtraInvalidatedRegions(RegionList &Regions) const {}
172 virtual ~CallEvent() {}
174 /// \brief Returns the kind of call this is.
175 virtual Kind getKind() const = 0;
177 /// \brief Returns the declaration of the function or method that will be
178 /// called. May be null.
179 virtual const Decl *getDecl() const {
180 return Origin.dyn_cast<const Decl *>();
183 /// \brief The state in which the call is being evaluated.
184 ProgramStateRef getState() const {
188 /// \brief The context in which the call is being evaluated.
189 const LocationContext *getLocationContext() const {
193 /// \brief Returns the definition of the function or method that will be
195 virtual RuntimeDefinition getRuntimeDefinition() const = 0;
197 /// \brief Returns the expression whose value will be the result of this call.
199 const Expr *getOriginExpr() const {
200 return Origin.dyn_cast<const Expr *>();
203 /// \brief Returns the number of arguments (explicit and implicit).
205 /// Note that this may be greater than the number of parameters in the
206 /// callee's declaration, and that it may include arguments not written in
208 virtual unsigned getNumArgs() const = 0;
210 /// \brief Returns true if the callee is known to be from a system header.
211 bool isInSystemHeader() const {
212 const Decl *D = getDecl();
216 SourceLocation Loc = D->getLocation();
218 const SourceManager &SM =
219 getState()->getStateManager().getContext().getSourceManager();
220 return SM.isInSystemHeader(D->getLocation());
223 // Special case for implicitly-declared global operator new/delete.
224 // These should be considered system functions.
225 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
226 return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal();
231 /// \brief Returns a source range for the entire call, suitable for
232 /// outputting in diagnostics.
233 virtual SourceRange getSourceRange() const {
234 return getOriginExpr()->getSourceRange();
237 /// \brief Returns the value of a given argument at the time of the call.
238 virtual SVal getArgSVal(unsigned Index) const;
240 /// \brief Returns the expression associated with a given argument.
241 /// May be null if this expression does not appear in the source.
242 virtual const Expr *getArgExpr(unsigned Index) const { return 0; }
244 /// \brief Returns the source range for errors associated with this argument.
246 /// May be invalid if the argument is not written in the source.
247 virtual SourceRange getArgSourceRange(unsigned Index) const;
249 /// \brief Returns the result type, adjusted for references.
250 QualType getResultType() const;
252 /// \brief Returns the return value of the call.
254 /// This should only be called if the CallEvent was created using a state in
255 /// which the return value has already been bound to the origin expression.
256 SVal getReturnValue() const;
258 /// \brief Returns true if any of the arguments appear to represent callbacks.
259 bool hasNonZeroCallbackArg() const;
261 /// \brief Returns true if any of the arguments are known to escape to long-
262 /// term storage, even if this method will not modify them.
263 // NOTE: The exact semantics of this are still being defined!
264 // We don't really want a list of hardcoded exceptions in the long run,
265 // but we don't want duplicated lists of known APIs in the short term either.
266 virtual bool argumentsMayEscape() const {
267 return hasNonZeroCallbackArg();
270 /// \brief Returns true if the callee is an externally-visible function in the
271 /// top-level namespace, such as \c malloc.
273 /// You can use this call to determine that a particular function really is
274 /// a library function and not, say, a C++ member function with the same name.
276 /// If a name is provided, the function must additionally match the given
279 /// Note that this deliberately excludes C++ library functions in the \c std
280 /// namespace, but will include C library functions accessed through the
281 /// \c std namespace. This also does not check if the function is declared
282 /// as 'extern "C"', or if it uses C++ name mangling.
283 // FIXME: Add a helper for checking namespaces.
284 // FIXME: Move this down to AnyFunctionCall once checkers have more
285 // precise callbacks.
286 bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
288 /// \brief Returns the name of the callee, if its name is a simple identifier.
290 /// Note that this will fail for Objective-C methods, blocks, and C++
291 /// overloaded operators. The former is named by a Selector rather than a
292 /// simple identifier, and the latter two do not have names.
293 // FIXME: Move this down to AnyFunctionCall once checkers have more
294 // precise callbacks.
295 const IdentifierInfo *getCalleeIdentifier() const {
296 const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(getDecl());
299 return ND->getIdentifier();
302 /// \brief Returns an appropriate ProgramPoint for this call.
303 ProgramPoint getProgramPoint(bool IsPreVisit = false,
304 const ProgramPointTag *Tag = 0) const;
306 /// \brief Returns a new state with all argument regions invalidated.
308 /// This accepts an alternate state in case some processing has already
310 ProgramStateRef invalidateRegions(unsigned BlockCount,
311 ProgramStateRef Orig = 0) const;
313 typedef std::pair<Loc, SVal> FrameBindingTy;
314 typedef SmallVectorImpl<FrameBindingTy> BindingsTy;
316 /// Populates the given SmallVector with the bindings in the callee's stack
317 /// frame at the start of this call.
318 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
319 BindingsTy &Bindings) const = 0;
321 /// Returns a copy of this CallEvent, but using the given state.
322 template <typename T>
323 CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;
325 /// Returns a copy of this CallEvent, but using the given state.
326 CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
327 return cloneWithState<CallEvent>(NewState);
330 /// \brief Returns true if this is a statement is a function or method call
332 static bool isCallStmt(const Stmt *S);
334 /// \brief Returns the result type of a function, method declaration.
335 static QualType getDeclaredResultType(const Decl *D);
337 // Iterator access to formal parameters and their types.
339 typedef std::const_mem_fun_t<QualType, ParmVarDecl> get_type_fun;
342 typedef const ParmVarDecl * const *param_iterator;
344 /// Returns an iterator over the call's formal parameters.
346 /// If UseDefinitionParams is set, this will return the parameter decls
347 /// used in the callee's definition (suitable for inlining). Most of the
348 /// time it is better to use the decl found by name lookup, which likely
349 /// carries more annotations.
351 /// Remember that the number of formal parameters may not match the number
352 /// of arguments for all calls. However, the first parameter will always
353 /// correspond with the argument value returned by \c getArgSVal(0).
355 /// If the call has no accessible declaration (or definition, if
356 /// \p UseDefinitionParams is set), \c param_begin() will be equal to
358 virtual param_iterator param_begin() const =0;
359 /// \sa param_begin()
360 virtual param_iterator param_end() const = 0;
362 typedef llvm::mapped_iterator<param_iterator, get_type_fun>
365 /// Returns an iterator over the types of the call's formal parameters.
367 /// This uses the callee decl found by default name lookup rather than the
368 /// definition because it represents a public interface, and probably has
369 /// more annotations.
370 param_type_iterator param_type_begin() const {
371 return llvm::map_iterator(param_begin(),
372 get_type_fun(&ParmVarDecl::getType));
374 /// \sa param_type_begin()
375 param_type_iterator param_type_end() const {
376 return llvm::map_iterator(param_end(), get_type_fun(&ParmVarDecl::getType));
379 // For debugging purposes only
380 void dump(raw_ostream &Out) const;
381 LLVM_ATTRIBUTE_USED void dump() const;
385 /// \brief Represents a call to any sort of function that might have a
387 class AnyFunctionCall : public CallEvent {
389 AnyFunctionCall(const Expr *E, ProgramStateRef St,
390 const LocationContext *LCtx)
391 : CallEvent(E, St, LCtx) {}
392 AnyFunctionCall(const Decl *D, ProgramStateRef St,
393 const LocationContext *LCtx)
394 : CallEvent(D, St, LCtx) {}
395 AnyFunctionCall(const AnyFunctionCall &Other) : CallEvent(Other) {}
398 // This function is overridden by subclasses, but they must return
400 virtual const FunctionDecl *getDecl() const {
401 return cast<FunctionDecl>(CallEvent::getDecl());
404 virtual RuntimeDefinition getRuntimeDefinition() const {
405 const FunctionDecl *FD = getDecl();
406 // Note that the AnalysisDeclContext will have the FunctionDecl with
407 // the definition (if one exists).
409 AnalysisDeclContext *AD =
410 getLocationContext()->getAnalysisDeclContext()->
411 getManager()->getContext(FD);
413 return RuntimeDefinition(AD->getDecl());
416 return RuntimeDefinition();
419 virtual bool argumentsMayEscape() const;
421 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
422 BindingsTy &Bindings) const;
424 virtual param_iterator param_begin() const;
425 virtual param_iterator param_end() const;
427 static bool classof(const CallEvent *CA) {
428 return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
429 CA->getKind() <= CE_END_FUNCTION_CALLS;
433 /// \brief Represents a call to a non-C++ function, written as a CallExpr.
434 class SimpleCall : public AnyFunctionCall {
436 SimpleCall(const CallExpr *CE, ProgramStateRef St,
437 const LocationContext *LCtx)
438 : AnyFunctionCall(CE, St, LCtx) {}
439 SimpleCall(const SimpleCall &Other) : AnyFunctionCall(Other) {}
442 virtual const CallExpr *getOriginExpr() const {
443 return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
446 virtual const FunctionDecl *getDecl() const;
448 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); }
450 virtual const Expr *getArgExpr(unsigned Index) const {
451 return getOriginExpr()->getArg(Index);
454 static bool classof(const CallEvent *CA) {
455 return CA->getKind() >= CE_BEG_SIMPLE_CALLS &&
456 CA->getKind() <= CE_END_SIMPLE_CALLS;
460 /// \brief Represents a C function or static C++ member function call.
462 /// Example: \c fun()
463 class FunctionCall : public SimpleCall {
464 friend class CallEventManager;
467 FunctionCall(const CallExpr *CE, ProgramStateRef St,
468 const LocationContext *LCtx)
469 : SimpleCall(CE, St, LCtx) {}
471 FunctionCall(const FunctionCall &Other) : SimpleCall(Other) {}
472 virtual void cloneTo(void *Dest) const { new (Dest) FunctionCall(*this); }
475 virtual Kind getKind() const { return CE_Function; }
477 static bool classof(const CallEvent *CA) {
478 return CA->getKind() == CE_Function;
482 /// \brief Represents a call to a block.
484 /// Example: <tt>^{ /* ... */ }()</tt>
485 class BlockCall : public SimpleCall {
486 friend class CallEventManager;
489 BlockCall(const CallExpr *CE, ProgramStateRef St,
490 const LocationContext *LCtx)
491 : SimpleCall(CE, St, LCtx) {}
493 BlockCall(const BlockCall &Other) : SimpleCall(Other) {}
494 virtual void cloneTo(void *Dest) const { new (Dest) BlockCall(*this); }
496 virtual void getExtraInvalidatedRegions(RegionList &Regions) const;
499 /// \brief Returns the region associated with this instance of the block.
501 /// This may be NULL if the block's origin is unknown.
502 const BlockDataRegion *getBlockRegion() const;
504 /// \brief Gets the declaration of the block.
506 /// This is not an override of getDecl() because AnyFunctionCall has already
507 /// assumed that it's a FunctionDecl.
508 const BlockDecl *getBlockDecl() const {
509 const BlockDataRegion *BR = getBlockRegion();
512 return BR->getDecl();
515 virtual RuntimeDefinition getRuntimeDefinition() const {
516 return RuntimeDefinition(getBlockDecl());
519 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
520 BindingsTy &Bindings) const;
522 virtual param_iterator param_begin() const;
523 virtual param_iterator param_end() const;
525 virtual Kind getKind() const { return CE_Block; }
527 static bool classof(const CallEvent *CA) {
528 return CA->getKind() == CE_Block;
532 /// \brief Represents a non-static C++ member function call, no matter how
534 class CXXInstanceCall : public AnyFunctionCall {
536 virtual void getExtraInvalidatedRegions(RegionList &Regions) const;
538 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
539 const LocationContext *LCtx)
540 : AnyFunctionCall(CE, St, LCtx) {}
541 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
542 const LocationContext *LCtx)
543 : AnyFunctionCall(D, St, LCtx) {}
546 CXXInstanceCall(const CXXInstanceCall &Other) : AnyFunctionCall(Other) {}
549 /// \brief Returns the expression representing the implicit 'this' object.
550 virtual const Expr *getCXXThisExpr() const { return 0; }
552 /// \brief Returns the value of the implicit 'this' object.
553 virtual SVal getCXXThisVal() const;
555 virtual const FunctionDecl *getDecl() const;
557 virtual RuntimeDefinition getRuntimeDefinition() const;
559 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
560 BindingsTy &Bindings) const;
562 static bool classof(const CallEvent *CA) {
563 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
564 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
568 /// \brief Represents a non-static C++ member function call.
570 /// Example: \c obj.fun()
571 class CXXMemberCall : public CXXInstanceCall {
572 friend class CallEventManager;
575 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
576 const LocationContext *LCtx)
577 : CXXInstanceCall(CE, St, LCtx) {}
579 CXXMemberCall(const CXXMemberCall &Other) : CXXInstanceCall(Other) {}
580 virtual void cloneTo(void *Dest) const { new (Dest) CXXMemberCall(*this); }
583 virtual const CXXMemberCallExpr *getOriginExpr() const {
584 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
587 virtual unsigned getNumArgs() const {
588 if (const CallExpr *CE = getOriginExpr())
589 return CE->getNumArgs();
593 virtual const Expr *getArgExpr(unsigned Index) const {
594 return getOriginExpr()->getArg(Index);
597 virtual const Expr *getCXXThisExpr() const;
599 virtual RuntimeDefinition getRuntimeDefinition() const;
601 virtual Kind getKind() const { return CE_CXXMember; }
603 static bool classof(const CallEvent *CA) {
604 return CA->getKind() == CE_CXXMember;
608 /// \brief Represents a C++ overloaded operator call where the operator is
609 /// implemented as a non-static member function.
611 /// Example: <tt>iter + 1</tt>
612 class CXXMemberOperatorCall : public CXXInstanceCall {
613 friend class CallEventManager;
616 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
617 const LocationContext *LCtx)
618 : CXXInstanceCall(CE, St, LCtx) {}
620 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other)
621 : CXXInstanceCall(Other) {}
622 virtual void cloneTo(void *Dest) const {
623 new (Dest) CXXMemberOperatorCall(*this);
627 virtual const CXXOperatorCallExpr *getOriginExpr() const {
628 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
631 virtual unsigned getNumArgs() const {
632 return getOriginExpr()->getNumArgs() - 1;
634 virtual const Expr *getArgExpr(unsigned Index) const {
635 return getOriginExpr()->getArg(Index + 1);
638 virtual const Expr *getCXXThisExpr() const;
640 virtual Kind getKind() const { return CE_CXXMemberOperator; }
642 static bool classof(const CallEvent *CA) {
643 return CA->getKind() == CE_CXXMemberOperator;
647 /// \brief Represents an implicit call to a C++ destructor.
649 /// This can occur at the end of a scope (for automatic objects), at the end
650 /// of a full-expression (for temporaries), or as part of a delete.
651 class CXXDestructorCall : public CXXInstanceCall {
652 friend class CallEventManager;
655 typedef llvm::PointerIntPair<const MemRegion *, 1, bool> DtorDataTy;
657 /// Creates an implicit destructor.
659 /// \param DD The destructor that will be called.
660 /// \param Trigger The statement whose completion causes this destructor call.
661 /// \param Target The object region to be destructed.
662 /// \param St The path-sensitive state at this point in the program.
663 /// \param LCtx The location context at this point in the program.
664 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
665 const MemRegion *Target, bool IsBaseDestructor,
666 ProgramStateRef St, const LocationContext *LCtx)
667 : CXXInstanceCall(DD, St, LCtx) {
668 Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
669 Location = Trigger->getLocEnd();
672 CXXDestructorCall(const CXXDestructorCall &Other) : CXXInstanceCall(Other) {}
673 virtual void cloneTo(void *Dest) const { new (Dest) CXXDestructorCall(*this); }
676 virtual SourceRange getSourceRange() const { return Location; }
677 virtual unsigned getNumArgs() const { return 0; }
679 virtual RuntimeDefinition getRuntimeDefinition() const;
681 /// \brief Returns the value of the implicit 'this' object.
682 virtual SVal getCXXThisVal() const;
684 /// Returns true if this is a call to a base class destructor.
685 bool isBaseDestructor() const {
686 return DtorDataTy::getFromOpaqueValue(Data).getInt();
689 virtual Kind getKind() const { return CE_CXXDestructor; }
691 static bool classof(const CallEvent *CA) {
692 return CA->getKind() == CE_CXXDestructor;
696 /// \brief Represents a call to a C++ constructor.
699 class CXXConstructorCall : public AnyFunctionCall {
700 friend class CallEventManager;
703 /// Creates a constructor call.
705 /// \param CE The constructor expression as written in the source.
706 /// \param Target The region where the object should be constructed. If NULL,
707 /// a new symbolic region will be used.
708 /// \param St The path-sensitive state at this point in the program.
709 /// \param LCtx The location context at this point in the program.
710 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
711 ProgramStateRef St, const LocationContext *LCtx)
712 : AnyFunctionCall(CE, St, LCtx) {
716 CXXConstructorCall(const CXXConstructorCall &Other) : AnyFunctionCall(Other){}
717 virtual void cloneTo(void *Dest) const { new (Dest) CXXConstructorCall(*this); }
719 virtual void getExtraInvalidatedRegions(RegionList &Regions) const;
722 virtual const CXXConstructExpr *getOriginExpr() const {
723 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
726 virtual const CXXConstructorDecl *getDecl() const {
727 return getOriginExpr()->getConstructor();
730 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); }
732 virtual const Expr *getArgExpr(unsigned Index) const {
733 return getOriginExpr()->getArg(Index);
736 /// \brief Returns the value of the implicit 'this' object.
737 SVal getCXXThisVal() const;
739 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
740 BindingsTy &Bindings) const;
742 virtual Kind getKind() const { return CE_CXXConstructor; }
744 static bool classof(const CallEvent *CA) {
745 return CA->getKind() == CE_CXXConstructor;
749 /// \brief Represents the memory allocation call in a C++ new-expression.
751 /// This is a call to "operator new".
752 class CXXAllocatorCall : public AnyFunctionCall {
753 friend class CallEventManager;
756 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
757 const LocationContext *LCtx)
758 : AnyFunctionCall(E, St, LCtx) {}
760 CXXAllocatorCall(const CXXAllocatorCall &Other) : AnyFunctionCall(Other) {}
761 virtual void cloneTo(void *Dest) const { new (Dest) CXXAllocatorCall(*this); }
764 virtual const CXXNewExpr *getOriginExpr() const {
765 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
768 virtual const FunctionDecl *getDecl() const {
769 return getOriginExpr()->getOperatorNew();
772 virtual unsigned getNumArgs() const {
773 return getOriginExpr()->getNumPlacementArgs() + 1;
776 virtual const Expr *getArgExpr(unsigned Index) const {
777 // The first argument of an allocator call is the size of the allocation.
780 return getOriginExpr()->getPlacementArg(Index - 1);
783 virtual Kind getKind() const { return CE_CXXAllocator; }
785 static bool classof(const CallEvent *CE) {
786 return CE->getKind() == CE_CXXAllocator;
790 /// \brief Represents the ways an Objective-C message send can occur.
792 // Note to maintainers: OCM_Message should always be last, since it does not
793 // need to fit in the Data field's low bits.
794 enum ObjCMessageKind {
800 /// \brief Represents any expression that calls an Objective-C method.
802 /// This includes all of the kinds listed in ObjCMessageKind.
803 class ObjCMethodCall : public CallEvent {
804 friend class CallEventManager;
806 const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
809 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
810 const LocationContext *LCtx)
811 : CallEvent(Msg, St, LCtx) {
815 ObjCMethodCall(const ObjCMethodCall &Other) : CallEvent(Other) {}
816 virtual void cloneTo(void *Dest) const { new (Dest) ObjCMethodCall(*this); }
818 virtual void getExtraInvalidatedRegions(RegionList &Regions) const;
820 /// Check if the selector may have multiple definitions (may have overrides).
821 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
825 virtual const ObjCMessageExpr *getOriginExpr() const {
826 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
828 virtual const ObjCMethodDecl *getDecl() const {
829 return getOriginExpr()->getMethodDecl();
831 virtual unsigned getNumArgs() const {
832 return getOriginExpr()->getNumArgs();
834 virtual const Expr *getArgExpr(unsigned Index) const {
835 return getOriginExpr()->getArg(Index);
838 bool isInstanceMessage() const {
839 return getOriginExpr()->isInstanceMessage();
841 ObjCMethodFamily getMethodFamily() const {
842 return getOriginExpr()->getMethodFamily();
844 Selector getSelector() const {
845 return getOriginExpr()->getSelector();
848 virtual SourceRange getSourceRange() const;
850 /// \brief Returns the value of the receiver at the time of this call.
851 SVal getReceiverSVal() const;
853 /// \brief Return the value of 'self' if available.
854 SVal getSelfSVal() const;
856 /// \brief Get the interface for the receiver.
858 /// This works whether this is an instance message or a class message.
859 /// However, it currently just uses the static type of the receiver.
860 const ObjCInterfaceDecl *getReceiverInterface() const {
861 return getOriginExpr()->getReceiverInterface();
864 /// \brief Checks if the receiver refers to 'self' or 'super'.
865 bool isReceiverSelfOrSuper() const;
867 /// Returns how the message was written in the source (property access,
868 /// subscript, or explicit message send).
869 ObjCMessageKind getMessageKind() const;
871 /// Returns true if this property access or subscript is a setter (has the
872 /// form of an assignment).
873 bool isSetter() const {
874 switch (getMessageKind()) {
876 llvm_unreachable("This is not a pseudo-object access!");
877 case OCM_PropertyAccess:
878 return getNumArgs() > 0;
880 return getNumArgs() > 1;
882 llvm_unreachable("Unknown message kind");
885 virtual RuntimeDefinition getRuntimeDefinition() const;
887 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
888 BindingsTy &Bindings) const;
890 virtual param_iterator param_begin() const;
891 virtual param_iterator param_end() const;
893 virtual Kind getKind() const { return CE_ObjCMessage; }
895 static bool classof(const CallEvent *CA) {
896 return CA->getKind() == CE_ObjCMessage;
901 /// \brief Manages the lifetime of CallEvent objects.
903 /// CallEventManager provides a way to create arbitrary CallEvents "on the
904 /// stack" as if they were value objects by keeping a cache of CallEvent-sized
905 /// memory blocks. The CallEvents created by CallEventManager are only valid
906 /// for the lifetime of the OwnedCallEvent that holds them; right now these
907 /// objects cannot be copied and ownership cannot be transferred.
908 class CallEventManager {
909 friend class CallEvent;
911 llvm::BumpPtrAllocator &Alloc;
912 SmallVector<void *, 8> Cache;
914 void reclaim(const void *Memory) {
915 Cache.push_back(const_cast<void *>(Memory));
918 /// Returns memory that can be initialized as a CallEvent.
921 return Alloc.Allocate<FunctionCall>();
923 return Cache.pop_back_val();
926 template <typename T, typename Arg>
927 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
928 return new (allocate()) T(A, St, LCtx);
931 template <typename T, typename Arg1, typename Arg2>
932 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
933 return new (allocate()) T(A1, A2, St, LCtx);
936 template <typename T, typename Arg1, typename Arg2, typename Arg3>
937 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
938 const LocationContext *LCtx) {
939 return new (allocate()) T(A1, A2, A3, St, LCtx);
942 template <typename T, typename Arg1, typename Arg2, typename Arg3,
944 T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
945 const LocationContext *LCtx) {
946 return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
950 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
954 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
958 getSimpleCall(const CallExpr *E, ProgramStateRef State,
959 const LocationContext *LCtx);
961 CallEventRef<ObjCMethodCall>
962 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
963 const LocationContext *LCtx) {
964 return create<ObjCMethodCall>(E, State, LCtx);
967 CallEventRef<CXXConstructorCall>
968 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
969 ProgramStateRef State, const LocationContext *LCtx) {
970 return create<CXXConstructorCall>(E, Target, State, LCtx);
973 CallEventRef<CXXDestructorCall>
974 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
975 const MemRegion *Target, bool IsBase,
976 ProgramStateRef State, const LocationContext *LCtx) {
977 return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
980 CallEventRef<CXXAllocatorCall>
981 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
982 const LocationContext *LCtx) {
983 return create<CXXAllocatorCall>(E, State, LCtx);
988 template <typename T>
989 CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
990 assert(isa<T>(*this) && "Cloning to unrelated type");
991 assert(sizeof(T) == sizeof(CallEvent) && "Subclasses may not add fields");
993 if (NewState == State)
994 return cast<T>(this);
996 CallEventManager &Mgr = State->getStateManager().getCallEventManager();
997 T *Copy = static_cast<T *>(Mgr.allocate());
999 assert(Copy->getKind() == this->getKind() && "Bad copy");
1001 Copy->State = NewState;
1005 inline void CallEvent::Release() const {
1006 assert(RefCount > 0 && "Reference count is already zero.");
1012 CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1018 } // end namespace ento
1019 } // end namespace clang
1022 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1023 template<class T> struct simplify_type< clang::ento::CallEventRef<T> > {
1024 typedef const T *SimpleType;
1027 getSimplifiedValue(const clang::ento::CallEventRef<T>& Val) {
1028 return Val.getPtr();