1 //===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--//
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 /// \file This file defines CallEvent and its subclasses, which represent path-
11 /// sensitive instances of different kinds of function and method calls
12 /// (C, C++, and Objective-C).
14 //===----------------------------------------------------------------------===//
16 #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
17 #include "clang/AST/ParentMap.h"
18 #include "clang/Analysis/ProgramPoint.h"
19 #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
20 #include "llvm/ADT/SmallSet.h"
21 #include "llvm/ADT/StringExtras.h"
22 #include "llvm/Support/raw_ostream.h"
24 using namespace clang;
27 QualType CallEvent::getResultType() const {
28 const Expr *E = getOriginExpr();
29 assert(E && "Calls without origin expressions do not have results");
30 QualType ResultTy = E->getType();
32 ASTContext &Ctx = getState()->getStateManager().getContext();
34 // A function that returns a reference to 'int' will have a result type
35 // of simply 'int'. Check the origin expr's value kind to recover the
37 switch (E->getValueKind()) {
39 ResultTy = Ctx.getLValueReferenceType(ResultTy);
42 ResultTy = Ctx.getRValueReferenceType(ResultTy);
45 // No adjustment is necessary.
52 static bool isCallbackArg(SVal V, QualType T) {
53 // If the parameter is 0, it's harmless.
54 if (V.isZeroConstant())
57 // If a parameter is a block or a callback, assume it can modify pointer.
58 if (T->isBlockPointerType() ||
59 T->isFunctionPointerType() ||
63 // Check if a callback is passed inside a struct (for both, struct passed by
64 // reference and by value). Dig just one level into the struct for now.
66 if (T->isAnyPointerType() || T->isReferenceType())
67 T = T->getPointeeType();
69 if (const RecordType *RT = T->getAsStructureType()) {
70 const RecordDecl *RD = RT->getDecl();
71 for (RecordDecl::field_iterator I = RD->field_begin(), E = RD->field_end();
73 QualType FieldT = I->getType();
74 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
82 bool CallEvent::hasNonZeroCallbackArg() const {
83 unsigned NumOfArgs = getNumArgs();
85 // If calling using a function pointer, assume the function does not
86 // have a callback. TODO: We could check the types of the arguments here.
91 for (CallEvent::param_type_iterator I = param_type_begin(),
93 I != E && Idx < NumOfArgs; ++I, ++Idx) {
97 if (isCallbackArg(getArgSVal(Idx), *I))
104 bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
105 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
109 return CheckerContext::isCLibraryFunction(FD, FunctionName);
112 /// \brief Returns true if a type is a pointer-to-const or reference-to-const
113 /// with no further indirection.
114 static bool isPointerToConst(QualType Ty) {
115 QualType PointeeTy = Ty->getPointeeType();
116 if (PointeeTy == QualType())
118 if (!PointeeTy.isConstQualified())
120 if (PointeeTy->isAnyPointerType())
125 // Try to retrieve the function declaration and find the function parameter
126 // types which are pointers/references to a non-pointer const.
127 // We will not invalidate the corresponding argument regions.
128 static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
129 const CallEvent &Call) {
131 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
132 E = Call.param_type_end();
133 I != E; ++I, ++Idx) {
134 if (isPointerToConst(*I))
135 PreserveArgs.insert(Idx);
139 ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
140 ProgramStateRef Orig) const {
141 ProgramStateRef Result = (Orig ? Orig : getState());
143 SmallVector<SVal, 8> ConstValues;
144 SmallVector<SVal, 8> ValuesToInvalidate;
146 getExtraInvalidatedValues(ValuesToInvalidate);
148 // Indexes of arguments whose values will be preserved by the call.
149 llvm::SmallSet<unsigned, 4> PreserveArgs;
150 if (!argumentsMayEscape())
151 findPtrToConstParams(PreserveArgs, *this);
153 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
154 // Mark this region for invalidation. We batch invalidate regions
155 // below for efficiency.
156 if (PreserveArgs.count(Idx))
157 ConstValues.push_back(getArgSVal(Idx));
159 ValuesToInvalidate.push_back(getArgSVal(Idx));
162 // Invalidate designated regions using the batch invalidation API.
163 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
165 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
166 BlockCount, getLocationContext(),
167 /*CausedByPointerEscape*/ true,
168 /*Symbols=*/0, this, ConstValues);
171 ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
172 const ProgramPointTag *Tag) const {
173 if (const Expr *E = getOriginExpr()) {
175 return PreStmt(E, getLocationContext(), Tag);
176 return PostStmt(E, getLocationContext(), Tag);
179 const Decl *D = getDecl();
180 assert(D && "Cannot get a program point without a statement or decl");
182 SourceLocation Loc = getSourceRange().getBegin();
184 return PreImplicitCall(D, Loc, getLocationContext(), Tag);
185 return PostImplicitCall(D, Loc, getLocationContext(), Tag);
188 SVal CallEvent::getArgSVal(unsigned Index) const {
189 const Expr *ArgE = getArgExpr(Index);
192 return getSVal(ArgE);
195 SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
196 const Expr *ArgE = getArgExpr(Index);
198 return SourceRange();
199 return ArgE->getSourceRange();
202 SVal CallEvent::getReturnValue() const {
203 const Expr *E = getOriginExpr();
205 return UndefinedVal();
209 void CallEvent::dump() const {
213 void CallEvent::dump(raw_ostream &Out) const {
214 ASTContext &Ctx = getState()->getStateManager().getContext();
215 if (const Expr *E = getOriginExpr()) {
216 E->printPretty(Out, 0, Ctx.getPrintingPolicy());
221 if (const Decl *D = getDecl()) {
223 D->print(Out, Ctx.getPrintingPolicy());
227 // FIXME: a string representation of the kind would be nice.
228 Out << "Unknown call (type " << getKind() << ")";
232 bool CallEvent::isCallStmt(const Stmt *S) {
233 return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
234 || isa<CXXConstructExpr>(S)
235 || isa<CXXNewExpr>(S);
238 QualType CallEvent::getDeclaredResultType(const Decl *D) {
240 if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D))
241 return FD->getResultType();
242 else if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D))
243 return MD->getResultType();
247 static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
248 CallEvent::BindingsTy &Bindings,
250 const CallEvent &Call,
251 CallEvent::param_iterator I,
252 CallEvent::param_iterator E) {
253 MemRegionManager &MRMgr = SVB.getRegionManager();
256 for (; I != E; ++I, ++Idx) {
257 const ParmVarDecl *ParamDecl = *I;
258 assert(ParamDecl && "Formal parameter has no decl?");
260 SVal ArgVal = Call.getArgSVal(Idx);
261 if (!ArgVal.isUnknown()) {
262 Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
263 Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
267 // FIXME: Variadic arguments are not handled at all right now.
271 CallEvent::param_iterator AnyFunctionCall::param_begin() const {
272 const FunctionDecl *D = getDecl();
276 return D->param_begin();
279 CallEvent::param_iterator AnyFunctionCall::param_end() const {
280 const FunctionDecl *D = getDecl();
284 return D->param_end();
287 void AnyFunctionCall::getInitialStackFrameContents(
288 const StackFrameContext *CalleeCtx,
289 BindingsTy &Bindings) const {
290 const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl());
291 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
292 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
293 D->param_begin(), D->param_end());
296 bool AnyFunctionCall::argumentsMayEscape() const {
297 if (hasNonZeroCallbackArg())
300 const FunctionDecl *D = getDecl();
304 const IdentifierInfo *II = D->getIdentifier();
308 // This set of "escaping" APIs is
310 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
311 // value into thread local storage. The value can later be retrieved with
312 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
313 // parameter is 'const void *', the region escapes through the call.
314 if (II->isStr("pthread_setspecific"))
317 // - xpc_connection_set_context stores a value which can be retrieved later
318 // with xpc_connection_get_context.
319 if (II->isStr("xpc_connection_set_context"))
322 // - funopen - sets a buffer for future IO calls.
323 if (II->isStr("funopen"))
326 StringRef FName = II->getName();
328 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
329 // buffer even if it is const.
330 if (FName.endswith("NoCopy"))
333 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
334 // be deallocated by NSMapRemove.
335 if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
338 // - Many CF containers allow objects to escape through custom
339 // allocators/deallocators upon container construction. (PR12101)
340 if (FName.startswith("CF") || FName.startswith("CG")) {
341 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
342 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
343 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
344 StrInStrNoCase(FName, "WithData") != StringRef::npos ||
345 StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
346 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
353 const FunctionDecl *SimpleCall::getDecl() const {
354 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
358 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
362 const FunctionDecl *CXXInstanceCall::getDecl() const {
363 const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr());
365 return AnyFunctionCall::getDecl();
367 const FunctionDecl *D = CE->getDirectCallee();
371 return getSVal(CE->getCallee()).getAsFunctionDecl();
374 void CXXInstanceCall::getExtraInvalidatedValues(ValueList &Values) const {
375 Values.push_back(getCXXThisVal());
378 SVal CXXInstanceCall::getCXXThisVal() const {
379 const Expr *Base = getCXXThisExpr();
380 // FIXME: This doesn't handle an overloaded ->* operator.
384 SVal ThisVal = getSVal(Base);
385 assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
390 RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
391 // Do we have a decl at all?
392 const Decl *D = getDecl();
394 return RuntimeDefinition();
396 // If the method is non-virtual, we know we can inline it.
397 const CXXMethodDecl *MD = cast<CXXMethodDecl>(D);
398 if (!MD->isVirtual())
399 return AnyFunctionCall::getRuntimeDefinition();
401 // Do we know the implicit 'this' object being called?
402 const MemRegion *R = getCXXThisVal().getAsRegion();
404 return RuntimeDefinition();
406 // Do we know anything about the type of 'this'?
407 DynamicTypeInfo DynType = getState()->getDynamicTypeInfo(R);
408 if (!DynType.isValid())
409 return RuntimeDefinition();
411 // Is the type a C++ class? (This is mostly a defensive check.)
412 QualType RegionType = DynType.getType()->getPointeeType();
413 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
415 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
416 if (!RD || !RD->hasDefinition())
417 return RuntimeDefinition();
419 // Find the decl for this method in that class.
420 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
422 // We might not even get the original statically-resolved method due to
423 // some particularly nasty casting (e.g. casts to sister classes).
424 // However, we should at least be able to search up and down our own class
425 // hierarchy, and some real bugs have been caught by checking this.
426 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
428 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
429 // the static type. However, because we currently don't update
430 // DynamicTypeInfo when an object is cast, we can't actually be sure the
431 // DynamicTypeInfo is up to date. This assert should be re-enabled once
432 // this is fixed. <rdar://problem/12287087>
433 //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
435 return RuntimeDefinition();
438 // Does the decl that we found have an implementation?
439 const FunctionDecl *Definition;
440 if (!Result->hasBody(Definition))
441 return RuntimeDefinition();
443 // We found a definition. If we're not sure that this devirtualization is
444 // actually what will happen at runtime, make sure to provide the region so
445 // that ExprEngine can decide what to do with it.
446 if (DynType.canBeASubClass())
447 return RuntimeDefinition(Definition, R->StripCasts());
448 return RuntimeDefinition(Definition, /*DispatchRegion=*/0);
451 void CXXInstanceCall::getInitialStackFrameContents(
452 const StackFrameContext *CalleeCtx,
453 BindingsTy &Bindings) const {
454 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
456 // Handle the binding of 'this' in the new stack frame.
457 SVal ThisVal = getCXXThisVal();
458 if (!ThisVal.isUnknown()) {
459 ProgramStateManager &StateMgr = getState()->getStateManager();
460 SValBuilder &SVB = StateMgr.getSValBuilder();
462 const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
463 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
465 // If we devirtualized to a different member function, we need to make sure
466 // we have the proper layering of CXXBaseObjectRegions.
467 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
468 ASTContext &Ctx = SVB.getContext();
469 const CXXRecordDecl *Class = MD->getParent();
470 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
472 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
474 ThisVal = StateMgr.getStoreManager().evalDynamicCast(ThisVal, Ty, Failed);
475 assert(!Failed && "Calling an incorrectly devirtualized method");
478 if (!ThisVal.isUnknown())
479 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
485 const Expr *CXXMemberCall::getCXXThisExpr() const {
486 return getOriginExpr()->getImplicitObjectArgument();
489 RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
490 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
491 // id-expression in the class member access expression is a qualified-id,
492 // that function is called. Otherwise, its final overrider in the dynamic type
493 // of the object expression is called.
494 if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
495 if (ME->hasQualifier())
496 return AnyFunctionCall::getRuntimeDefinition();
498 return CXXInstanceCall::getRuntimeDefinition();
502 const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
503 return getOriginExpr()->getArg(0);
507 const BlockDataRegion *BlockCall::getBlockRegion() const {
508 const Expr *Callee = getOriginExpr()->getCallee();
509 const MemRegion *DataReg = getSVal(Callee).getAsRegion();
511 return dyn_cast_or_null<BlockDataRegion>(DataReg);
514 CallEvent::param_iterator BlockCall::param_begin() const {
515 const BlockDecl *D = getBlockDecl();
518 return D->param_begin();
521 CallEvent::param_iterator BlockCall::param_end() const {
522 const BlockDecl *D = getBlockDecl();
525 return D->param_end();
528 void BlockCall::getExtraInvalidatedValues(ValueList &Values) const {
529 // FIXME: This also needs to invalidate captured globals.
530 if (const MemRegion *R = getBlockRegion())
531 Values.push_back(loc::MemRegionVal(R));
534 void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
535 BindingsTy &Bindings) const {
536 const BlockDecl *D = cast<BlockDecl>(CalleeCtx->getDecl());
537 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
538 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
539 D->param_begin(), D->param_end());
543 SVal CXXConstructorCall::getCXXThisVal() const {
545 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
549 void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values) const {
551 Values.push_back(loc::MemRegionVal(static_cast<const MemRegion *>(Data)));
554 void CXXConstructorCall::getInitialStackFrameContents(
555 const StackFrameContext *CalleeCtx,
556 BindingsTy &Bindings) const {
557 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
559 SVal ThisVal = getCXXThisVal();
560 if (!ThisVal.isUnknown()) {
561 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
562 const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
563 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
564 Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
570 SVal CXXDestructorCall::getCXXThisVal() const {
572 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
576 RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
577 // Base destructors are always called non-virtually.
578 // Skip CXXInstanceCall's devirtualization logic in this case.
579 if (isBaseDestructor())
580 return AnyFunctionCall::getRuntimeDefinition();
582 return CXXInstanceCall::getRuntimeDefinition();
586 CallEvent::param_iterator ObjCMethodCall::param_begin() const {
587 const ObjCMethodDecl *D = getDecl();
591 return D->param_begin();
594 CallEvent::param_iterator ObjCMethodCall::param_end() const {
595 const ObjCMethodDecl *D = getDecl();
599 return D->param_end();
603 ObjCMethodCall::getExtraInvalidatedValues(ValueList &Values) const {
604 Values.push_back(getReceiverSVal());
607 SVal ObjCMethodCall::getSelfSVal() const {
608 const LocationContext *LCtx = getLocationContext();
609 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
612 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
615 SVal ObjCMethodCall::getReceiverSVal() const {
616 // FIXME: Is this the best way to handle class receivers?
617 if (!isInstanceMessage())
620 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
621 return getSVal(RecE);
623 // An instance message with no expression means we are sending to super.
624 // In this case the object reference is the same as 'self'.
625 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
626 SVal SelfVal = getSelfSVal();
627 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
631 bool ObjCMethodCall::isReceiverSelfOrSuper() const {
632 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
633 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
636 if (!isInstanceMessage())
639 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
641 return (RecVal == getSelfSVal());
644 SourceRange ObjCMethodCall::getSourceRange() const {
645 switch (getMessageKind()) {
647 return getOriginExpr()->getSourceRange();
648 case OCM_PropertyAccess:
650 return getContainingPseudoObjectExpr()->getSourceRange();
652 llvm_unreachable("unknown message kind");
655 typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
657 const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
658 assert(Data != 0 && "Lazy lookup not yet performed.");
659 assert(getMessageKind() != OCM_Message && "Explicit message send.");
660 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
663 ObjCMessageKind ObjCMethodCall::getMessageKind() const {
665 ParentMap &PM = getLocationContext()->getParentMap();
666 const Stmt *S = PM.getParent(getOriginExpr());
667 if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
668 const Expr *Syntactic = POE->getSyntacticForm();
670 // This handles the funny case of assigning to the result of a getter.
671 // This can happen if the getter returns a non-const reference.
672 if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic))
673 Syntactic = BO->getLHS();
676 switch (Syntactic->getStmtClass()) {
677 case Stmt::ObjCPropertyRefExprClass:
678 K = OCM_PropertyAccess;
680 case Stmt::ObjCSubscriptRefExprClass:
684 // FIXME: Can this ever happen?
689 if (K != OCM_Message) {
690 const_cast<ObjCMethodCall *>(this)->Data
691 = ObjCMessageDataTy(POE, K).getOpaqueValue();
692 assert(getMessageKind() == K);
697 const_cast<ObjCMethodCall *>(this)->Data
698 = ObjCMessageDataTy(0, 1).getOpaqueValue();
699 assert(getMessageKind() == OCM_Message);
703 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
704 if (!Info.getPointer())
706 return static_cast<ObjCMessageKind>(Info.getInt());
710 bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
711 Selector Sel) const {
713 const SourceManager &SM =
714 getState()->getStateManager().getContext().getSourceManager();
716 // If the class interface is declared inside the main file, assume it is not
718 // TODO: It could actually be subclassed if the subclass is private as well.
719 // This is probably very rare.
720 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
721 if (InterfLoc.isValid() && SM.isFromMainFile(InterfLoc))
724 // Assume that property accessors are not overridden.
725 if (getMessageKind() == OCM_PropertyAccess)
728 // We assume that if the method is public (declared outside of main file) or
729 // has a parent which publicly declares the method, the method could be
730 // overridden in a subclass.
732 // Find the first declaration in the class hierarchy that declares
734 ObjCMethodDecl *D = 0;
736 D = IDecl->lookupMethod(Sel, true);
738 // Cannot find a public definition.
742 // If outside the main file,
743 if (D->getLocation().isValid() && !SM.isFromMainFile(D->getLocation()))
746 if (D->isOverriding()) {
747 // Search in the superclass on the next iteration.
748 IDecl = D->getClassInterface();
752 IDecl = IDecl->getSuperClass();
762 llvm_unreachable("The while loop should always terminate.");
765 RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
766 const ObjCMessageExpr *E = getOriginExpr();
768 Selector Sel = E->getSelector();
770 if (E->isInstanceMessage()) {
772 // Find the the receiver type.
773 const ObjCObjectPointerType *ReceiverT = 0;
774 bool CanBeSubClassed = false;
775 QualType SupersType = E->getSuperType();
776 const MemRegion *Receiver = 0;
778 if (!SupersType.isNull()) {
779 // Super always means the type of immediate predecessor to the method
780 // where the call occurs.
781 ReceiverT = cast<ObjCObjectPointerType>(SupersType);
783 Receiver = getReceiverSVal().getAsRegion();
785 return RuntimeDefinition();
787 DynamicTypeInfo DTI = getState()->getDynamicTypeInfo(Receiver);
788 QualType DynType = DTI.getType();
789 CanBeSubClassed = DTI.canBeASubClass();
790 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType);
792 if (ReceiverT && CanBeSubClassed)
793 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
794 if (!canBeOverridenInSubclass(IDecl, Sel))
795 CanBeSubClassed = false;
798 // Lookup the method implementation.
800 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
801 // Repeatedly calling lookupPrivateMethod() is expensive, especially
802 // when in many cases it returns null. We cache the results so
803 // that repeated queries on the same ObjCIntefaceDecl and Selector
804 // don't incur the same cost. On some test cases, we can see the
805 // same query being issued thousands of times.
807 // NOTE: This cache is essentially a "global" variable, but it
808 // only gets lazily created when we get here. The value of the
809 // cache probably comes from it being global across ExprEngines,
810 // where the same queries may get issued. If we are worried about
811 // concurrency, or possibly loading/unloading ASTs, etc., we may
812 // need to revisit this someday. In terms of memory, this table
813 // stays around until clang quits, which also may be bad if we
814 // need to release memory.
815 typedef std::pair<const ObjCInterfaceDecl*, Selector>
817 typedef llvm::DenseMap<PrivateMethodKey,
818 Optional<const ObjCMethodDecl *> >
821 static PrivateMethodCache PMC;
822 Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
824 // Query lookupPrivateMethod() if the cache does not hit.
826 Val = IDecl->lookupPrivateMethod(Sel);
828 const ObjCMethodDecl *MD = Val.getValue();
830 return RuntimeDefinition(MD, Receiver);
832 return RuntimeDefinition(MD, 0);
836 // This is a class method.
837 // If we have type info for the receiver class, we are calling via
839 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
840 // Find/Return the method implementation.
841 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
845 return RuntimeDefinition();
848 void ObjCMethodCall::getInitialStackFrameContents(
849 const StackFrameContext *CalleeCtx,
850 BindingsTy &Bindings) const {
851 const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
852 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
853 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
854 D->param_begin(), D->param_end());
856 SVal SelfVal = getReceiverSVal();
857 if (!SelfVal.isUnknown()) {
858 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
859 MemRegionManager &MRMgr = SVB.getRegionManager();
860 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
861 Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
866 CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
867 const LocationContext *LCtx) {
868 if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE))
869 return create<CXXMemberCall>(MCE, State, LCtx);
871 if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
872 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
873 if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
874 if (MD->isInstance())
875 return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
877 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
878 return create<BlockCall>(CE, State, LCtx);
881 // Otherwise, it's a normal function call, static member function call, or
882 // something we can't reason about.
883 return create<FunctionCall>(CE, State, LCtx);
888 CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
889 ProgramStateRef State) {
890 const LocationContext *ParentCtx = CalleeCtx->getParent();
891 const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame();
892 assert(CallerCtx && "This should not be used for top-level stack frames");
894 const Stmt *CallSite = CalleeCtx->getCallSite();
897 if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
898 return getSimpleCall(CE, State, CallerCtx);
900 switch (CallSite->getStmtClass()) {
901 case Stmt::CXXConstructExprClass:
902 case Stmt::CXXTemporaryObjectExprClass: {
903 SValBuilder &SVB = State->getStateManager().getSValBuilder();
904 const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
905 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
906 SVal ThisVal = State->getSVal(ThisPtr);
908 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
909 ThisVal.getAsRegion(), State, CallerCtx);
911 case Stmt::CXXNewExprClass:
912 return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
913 case Stmt::ObjCMessageExprClass:
914 return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
917 llvm_unreachable("This is not an inlineable statement.");
921 // Fall back to the CFG. The only thing we haven't handled yet is
922 // destructors, though this could change in the future.
923 const CFGBlock *B = CalleeCtx->getCallSiteBlock();
924 CFGElement E = (*B)[CalleeCtx->getIndex()];
925 assert(E.getAs<CFGImplicitDtor>() &&
926 "All other CFG elements should have exprs");
927 assert(!E.getAs<CFGTemporaryDtor>() && "We don't handle temporaries yet");
929 SValBuilder &SVB = State->getStateManager().getSValBuilder();
930 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
931 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
932 SVal ThisVal = State->getSVal(ThisPtr);
935 if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())
936 Trigger = AutoDtor->getTriggerStmt();
938 Trigger = Dtor->getBody();
940 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
941 E.getAs<CFGBaseDtor>().hasValue(), State,