1 //===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
7 //===----------------------------------------------------------------------===//
9 /// \file This file defines CallEvent and its subclasses, which represent path-
10 /// sensitive instances of different kinds of function and method calls
11 /// (C, C++, and Objective-C).
13 //===----------------------------------------------------------------------===//
15 #ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
16 #define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/DeclBase.h"
20 #include "clang/AST/DeclCXX.h"
21 #include "clang/AST/DeclObjC.h"
22 #include "clang/AST/Expr.h"
23 #include "clang/AST/ExprCXX.h"
24 #include "clang/AST/ExprObjC.h"
25 #include "clang/AST/Stmt.h"
26 #include "clang/AST/Type.h"
27 #include "clang/Basic/IdentifierTable.h"
28 #include "clang/Basic/LLVM.h"
29 #include "clang/Basic/SourceLocation.h"
30 #include "clang/Basic/SourceManager.h"
31 #include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
32 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
33 #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
34 #include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
35 #include "llvm/ADT/ArrayRef.h"
36 #include "llvm/ADT/IntrusiveRefCntPtr.h"
37 #include "llvm/ADT/PointerIntPair.h"
38 #include "llvm/ADT/PointerUnion.h"
39 #include "llvm/ADT/STLExtras.h"
40 #include "llvm/ADT/SmallVector.h"
41 #include "llvm/ADT/StringRef.h"
42 #include "llvm/Support/Allocator.h"
43 #include "llvm/Support/Casting.h"
44 #include "llvm/Support/ErrorHandling.h"
51 class LocationContext;
53 class ProgramPointTag;
54 class StackFrameContext;
63 CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
64 CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
67 CE_BEG_FUNCTION_CALLS = CE_Function,
68 CE_END_FUNCTION_CALLS = CE_CXXAllocator,
74 class CallDescription;
76 template<typename T = CallEvent>
77 class CallEventRef : public IntrusiveRefCntPtr<const T> {
79 CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
80 CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
82 CallEventRef<T> cloneWithState(ProgramStateRef State) const {
83 return this->get()->template cloneWithState<T>(State);
86 // Allow implicit conversions to a superclass type, since CallEventRef
87 // behaves like a pointer-to-const.
88 template <typename SuperT>
89 operator CallEventRef<SuperT> () const {
94 /// \class RuntimeDefinition
95 /// Defines the runtime definition of the called function.
97 /// Encapsulates the information we have about which Decl will be used
98 /// when the call is executed on the given path. When dealing with dynamic
99 /// dispatch, the information is based on DynamicTypeInfo and might not be
101 class RuntimeDefinition {
102 /// The Declaration of the function which could be called at runtime.
103 /// NULL if not available.
104 const Decl *D = nullptr;
106 /// The region representing an object (ObjC/C++) on which the method is
107 /// called. With dynamic dispatch, the method definition depends on the
108 /// runtime type of this object. NULL when the DynamicTypeInfo is
110 const MemRegion *R = nullptr;
113 RuntimeDefinition() = default;
114 RuntimeDefinition(const Decl *InD): D(InD) {}
115 RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
117 const Decl *getDecl() { return D; }
119 /// Check if the definition we have is precise.
120 /// If not, it is possible that the call dispatches to another definition at
122 bool mayHaveOtherDefinitions() { return R != nullptr; }
124 /// When other definitions are possible, returns the region whose runtime type
125 /// determines the method definition.
126 const MemRegion *getDispatchRegion() { return R; }
129 /// Represents an abstract call to a function or method along a
132 /// CallEvents are created through the factory methods of CallEventManager.
134 /// CallEvents should always be cheap to create and destroy. In order for
135 /// CallEventManager to be able to re-use CallEvent-sized memory blocks,
136 /// subclasses of CallEvent may not add any data members to the base class.
137 /// Use the "Data" and "Location" fields instead.
140 using Kind = CallEventKind;
143 ProgramStateRef State;
144 const LocationContext *LCtx;
145 llvm::PointerUnion<const Expr *, const Decl *> Origin;
148 // This is user data for subclasses.
151 // This is user data for subclasses.
152 // This should come right before RefCount, so that the two fields can be
153 // packed together on LP64 platforms.
154 SourceLocation Location;
157 template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
159 mutable unsigned RefCount = 0;
161 void Retain() const { ++RefCount; }
162 void Release() const;
165 friend class CallEventManager;
167 CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
168 : State(std::move(state)), LCtx(lctx), Origin(E) {}
170 CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
171 : State(std::move(state)), LCtx(lctx), Origin(D) {}
173 // DO NOT MAKE PUBLIC
174 CallEvent(const CallEvent &Original)
175 : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
176 Data(Original.Data), Location(Original.Location) {}
178 /// Copies this CallEvent, with vtable intact, into a new block of memory.
179 virtual void cloneTo(void *Dest) const = 0;
181 /// Get the value of arbitrary expressions at this point in the path.
182 SVal getSVal(const Stmt *S) const {
183 return getState()->getSVal(S, getLocationContext());
186 using ValueList = SmallVectorImpl<SVal>;
188 /// Used to specify non-argument regions that will be invalidated as a
189 /// result of this call.
190 virtual void getExtraInvalidatedValues(ValueList &Values,
191 RegionAndSymbolInvalidationTraits *ETraits) const {}
194 CallEvent &operator=(const CallEvent &) = delete;
195 virtual ~CallEvent() = default;
197 /// Returns the kind of call this is.
198 virtual Kind getKind() const = 0;
200 /// Returns the declaration of the function or method that will be
201 /// called. May be null.
202 virtual const Decl *getDecl() const {
203 return Origin.dyn_cast<const Decl *>();
206 /// The state in which the call is being evaluated.
207 const ProgramStateRef &getState() const {
211 /// The context in which the call is being evaluated.
212 const LocationContext *getLocationContext() const {
216 /// Returns the definition of the function or method that will be
218 virtual RuntimeDefinition getRuntimeDefinition() const = 0;
220 /// Returns the expression whose value will be the result of this call.
222 const Expr *getOriginExpr() const {
223 return Origin.dyn_cast<const Expr *>();
226 /// Returns the number of arguments (explicit and implicit).
228 /// Note that this may be greater than the number of parameters in the
229 /// callee's declaration, and that it may include arguments not written in
231 virtual unsigned getNumArgs() const = 0;
233 /// Returns true if the callee is known to be from a system header.
234 bool isInSystemHeader() const {
235 const Decl *D = getDecl();
239 SourceLocation Loc = D->getLocation();
241 const SourceManager &SM =
242 getState()->getStateManager().getContext().getSourceManager();
243 return SM.isInSystemHeader(D->getLocation());
246 // Special case for implicitly-declared global operator new/delete.
247 // These should be considered system functions.
248 if (const auto *FD = dyn_cast<FunctionDecl>(D))
249 return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal();
254 /// Returns true if the CallEvent is a call to a function that matches
255 /// the CallDescription.
257 /// Note that this function is not intended to be used to match Obj-C method
259 bool isCalled(const CallDescription &CD) const;
261 /// Returns a source range for the entire call, suitable for
262 /// outputting in diagnostics.
263 virtual SourceRange getSourceRange() const {
264 return getOriginExpr()->getSourceRange();
267 /// Returns the value of a given argument at the time of the call.
268 virtual SVal getArgSVal(unsigned Index) const;
270 /// Returns the expression associated with a given argument.
271 /// May be null if this expression does not appear in the source.
272 virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }
274 /// Returns the source range for errors associated with this argument.
276 /// May be invalid if the argument is not written in the source.
277 virtual SourceRange getArgSourceRange(unsigned Index) const;
279 /// Returns the result type, adjusted for references.
280 QualType getResultType() const;
282 /// Returns the return value of the call.
284 /// This should only be called if the CallEvent was created using a state in
285 /// which the return value has already been bound to the origin expression.
286 SVal getReturnValue() const;
288 /// Returns true if the type of any of the non-null arguments satisfies
290 bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;
292 /// Returns true if any of the arguments appear to represent callbacks.
293 bool hasNonZeroCallbackArg() const;
295 /// Returns true if any of the arguments is void*.
296 bool hasVoidPointerToNonConstArg() const;
298 /// Returns true if any of the arguments are known to escape to long-
299 /// term storage, even if this method will not modify them.
300 // NOTE: The exact semantics of this are still being defined!
301 // We don't really want a list of hardcoded exceptions in the long run,
302 // but we don't want duplicated lists of known APIs in the short term either.
303 virtual bool argumentsMayEscape() const {
304 return hasNonZeroCallbackArg();
307 /// Returns true if the callee is an externally-visible function in the
308 /// top-level namespace, such as \c malloc.
310 /// You can use this call to determine that a particular function really is
311 /// a library function and not, say, a C++ member function with the same name.
313 /// If a name is provided, the function must additionally match the given
316 /// Note that this deliberately excludes C++ library functions in the \c std
317 /// namespace, but will include C library functions accessed through the
318 /// \c std namespace. This also does not check if the function is declared
319 /// as 'extern "C"', or if it uses C++ name mangling.
320 // FIXME: Add a helper for checking namespaces.
321 // FIXME: Move this down to AnyFunctionCall once checkers have more
322 // precise callbacks.
323 bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
325 /// Returns the name of the callee, if its name is a simple identifier.
327 /// Note that this will fail for Objective-C methods, blocks, and C++
328 /// overloaded operators. The former is named by a Selector rather than a
329 /// simple identifier, and the latter two do not have names.
330 // FIXME: Move this down to AnyFunctionCall once checkers have more
331 // precise callbacks.
332 const IdentifierInfo *getCalleeIdentifier() const {
333 const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
336 return ND->getIdentifier();
339 /// Returns an appropriate ProgramPoint for this call.
340 ProgramPoint getProgramPoint(bool IsPreVisit = false,
341 const ProgramPointTag *Tag = nullptr) const;
343 /// Returns a new state with all argument regions invalidated.
345 /// This accepts an alternate state in case some processing has already
347 ProgramStateRef invalidateRegions(unsigned BlockCount,
348 ProgramStateRef Orig = nullptr) const;
350 using FrameBindingTy = std::pair<SVal, SVal>;
351 using BindingsTy = SmallVectorImpl<FrameBindingTy>;
353 /// Populates the given SmallVector with the bindings in the callee's stack
354 /// frame at the start of this call.
355 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
356 BindingsTy &Bindings) const = 0;
358 /// Returns a copy of this CallEvent, but using the given state.
359 template <typename T>
360 CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;
362 /// Returns a copy of this CallEvent, but using the given state.
363 CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
364 return cloneWithState<CallEvent>(NewState);
367 /// Returns true if this is a statement is a function or method call
369 static bool isCallStmt(const Stmt *S);
371 /// Returns the result type of a function or method declaration.
373 /// This will return a null QualType if the result type cannot be determined.
374 static QualType getDeclaredResultType(const Decl *D);
376 /// Returns true if the given decl is known to be variadic.
378 /// \p D must not be null.
379 static bool isVariadic(const Decl *D);
381 /// Returns AnalysisDeclContext for the callee stack frame.
382 /// Currently may fail; returns null on failure.
383 AnalysisDeclContext *getCalleeAnalysisDeclContext() const;
385 /// Returns the callee stack frame. That stack frame will only be entered
386 /// during analysis if the call is inlined, but it may still be useful
387 /// in intermediate calculations even if the call isn't inlined.
388 /// May fail; returns null on failure.
389 const StackFrameContext *getCalleeStackFrame(unsigned BlockCount) const;
391 /// Returns memory location for a parameter variable within the callee stack
392 /// frame. May fail; returns null on failure.
393 const VarRegion *getParameterLocation(unsigned Index,
394 unsigned BlockCount) const;
396 /// Returns true if on the current path, the argument was constructed by
397 /// calling a C++ constructor over it. This is an internal detail of the
398 /// analysis which doesn't necessarily represent the program semantics:
399 /// if we are supposed to construct an argument directly, we may still
400 /// not do that because we don't know how (i.e., construction context is
401 /// unavailable in the CFG or not supported by the analyzer).
402 bool isArgumentConstructedDirectly(unsigned Index) const {
403 // This assumes that the object was not yet removed from the state.
404 return ExprEngine::getObjectUnderConstruction(
405 getState(), {getOriginExpr(), Index}, getLocationContext()).hasValue();
408 /// Some calls have parameter numbering mismatched from argument numbering.
409 /// This function converts an argument index to the corresponding
410 /// parameter index. Returns None is the argument doesn't correspond
411 /// to any parameter variable.
412 virtual Optional<unsigned>
413 getAdjustedParameterIndex(unsigned ASTArgumentIndex) const {
414 return ASTArgumentIndex;
417 /// Some call event sub-classes conveniently adjust mismatching AST indices
418 /// to match parameter indices. This function converts an argument index
419 /// as understood by CallEvent to the argument index as understood by the AST.
420 virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const {
421 return CallArgumentIndex;
424 // Iterator access to formal parameters and their types.
427 QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
431 /// Return call's formal parameters.
433 /// Remember that the number of formal parameters may not match the number
434 /// of arguments for all calls. However, the first parameter will always
435 /// correspond with the argument value returned by \c getArgSVal(0).
436 virtual ArrayRef<ParmVarDecl *> parameters() const = 0;
438 using param_type_iterator =
439 llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;
441 /// Returns an iterator over the types of the call's formal parameters.
443 /// This uses the callee decl found by default name lookup rather than the
444 /// definition because it represents a public interface, and probably has
445 /// more annotations.
446 param_type_iterator param_type_begin() const {
447 return llvm::map_iterator(parameters().begin(), GetTypeFn());
449 /// \sa param_type_begin()
450 param_type_iterator param_type_end() const {
451 return llvm::map_iterator(parameters().end(), GetTypeFn());
454 // For debugging purposes only
455 void dump(raw_ostream &Out) const;
459 /// Represents a call to any sort of function that might have a
461 class AnyFunctionCall : public CallEvent {
463 AnyFunctionCall(const Expr *E, ProgramStateRef St,
464 const LocationContext *LCtx)
465 : CallEvent(E, St, LCtx) {}
466 AnyFunctionCall(const Decl *D, ProgramStateRef St,
467 const LocationContext *LCtx)
468 : CallEvent(D, St, LCtx) {}
469 AnyFunctionCall(const AnyFunctionCall &Other) = default;
472 // This function is overridden by subclasses, but they must return
474 const FunctionDecl *getDecl() const override {
475 return cast<FunctionDecl>(CallEvent::getDecl());
478 RuntimeDefinition getRuntimeDefinition() const override;
480 bool argumentsMayEscape() const override;
482 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
483 BindingsTy &Bindings) const override;
485 ArrayRef<ParmVarDecl *> parameters() const override;
487 static bool classof(const CallEvent *CA) {
488 return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
489 CA->getKind() <= CE_END_FUNCTION_CALLS;
493 /// Represents a C function or static C++ member function call.
495 /// Example: \c fun()
496 class SimpleFunctionCall : public AnyFunctionCall {
497 friend class CallEventManager;
500 SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St,
501 const LocationContext *LCtx)
502 : AnyFunctionCall(CE, St, LCtx) {}
503 SimpleFunctionCall(const SimpleFunctionCall &Other) = default;
505 void cloneTo(void *Dest) const override {
506 new (Dest) SimpleFunctionCall(*this);
510 virtual const CallExpr *getOriginExpr() const {
511 return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
514 const FunctionDecl *getDecl() const override;
516 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
518 const Expr *getArgExpr(unsigned Index) const override {
519 return getOriginExpr()->getArg(Index);
522 Kind getKind() const override { return CE_Function; }
524 static bool classof(const CallEvent *CA) {
525 return CA->getKind() == CE_Function;
529 /// Represents a call to a block.
531 /// Example: <tt>^{ /* ... */ }()</tt>
532 class BlockCall : public CallEvent {
533 friend class CallEventManager;
536 BlockCall(const CallExpr *CE, ProgramStateRef St,
537 const LocationContext *LCtx)
538 : CallEvent(CE, St, LCtx) {}
539 BlockCall(const BlockCall &Other) = default;
541 void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }
543 void getExtraInvalidatedValues(ValueList &Values,
544 RegionAndSymbolInvalidationTraits *ETraits) const override;
547 virtual const CallExpr *getOriginExpr() const {
548 return cast<CallExpr>(CallEvent::getOriginExpr());
551 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
553 const Expr *getArgExpr(unsigned Index) const override {
554 return getOriginExpr()->getArg(Index);
557 /// Returns the region associated with this instance of the block.
559 /// This may be NULL if the block's origin is unknown.
560 const BlockDataRegion *getBlockRegion() const;
562 const BlockDecl *getDecl() const override {
563 const BlockDataRegion *BR = getBlockRegion();
566 return BR->getDecl();
569 bool isConversionFromLambda() const {
570 const BlockDecl *BD = getDecl();
574 return BD->isConversionFromLambda();
577 /// For a block converted from a C++ lambda, returns the block
578 /// VarRegion for the variable holding the captured C++ lambda record.
579 const VarRegion *getRegionStoringCapturedLambda() const {
580 assert(isConversionFromLambda());
581 const BlockDataRegion *BR = getBlockRegion();
582 assert(BR && "Block converted from lambda must have a block region");
584 auto I = BR->referenced_vars_begin();
585 assert(I != BR->referenced_vars_end());
587 return I.getCapturedRegion();
590 RuntimeDefinition getRuntimeDefinition() const override {
591 if (!isConversionFromLambda())
592 return RuntimeDefinition(getDecl());
594 // Clang converts lambdas to blocks with an implicit user-defined
595 // conversion operator method on the lambda record that looks (roughly)
598 // typedef R(^block_type)(P1, P2, ...);
599 // operator block_type() const {
600 // auto Lambda = *this;
601 // return ^(P1 p1, P2 p2, ...){
602 // /* return Lambda(p1, p2, ...); */
606 // Here R is the return type of the lambda and P1, P2, ... are
607 // its parameter types. 'Lambda' is a fake VarDecl captured by the block
608 // that is initialized to a copy of the lambda.
610 // Sema leaves the body of a lambda-converted block empty (it is
611 // produced by CodeGen), so we can't analyze it directly. Instead, we skip
612 // the block body and analyze the operator() method on the captured lambda.
613 const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
614 const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
615 CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();
617 return RuntimeDefinition(LambdaCallOperator);
620 bool argumentsMayEscape() const override {
624 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
625 BindingsTy &Bindings) const override;
627 ArrayRef<ParmVarDecl*> parameters() const override;
629 Kind getKind() const override { return CE_Block; }
631 static bool classof(const CallEvent *CA) {
632 return CA->getKind() == CE_Block;
636 /// Represents a non-static C++ member function call, no matter how
638 class CXXInstanceCall : public AnyFunctionCall {
640 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
641 const LocationContext *LCtx)
642 : AnyFunctionCall(CE, St, LCtx) {}
643 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
644 const LocationContext *LCtx)
645 : AnyFunctionCall(D, St, LCtx) {}
646 CXXInstanceCall(const CXXInstanceCall &Other) = default;
648 void getExtraInvalidatedValues(ValueList &Values,
649 RegionAndSymbolInvalidationTraits *ETraits) const override;
652 /// Returns the expression representing the implicit 'this' object.
653 virtual const Expr *getCXXThisExpr() const { return nullptr; }
655 /// Returns the value of the implicit 'this' object.
656 virtual SVal getCXXThisVal() const;
658 const FunctionDecl *getDecl() const override;
660 RuntimeDefinition getRuntimeDefinition() const override;
662 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
663 BindingsTy &Bindings) const override;
665 static bool classof(const CallEvent *CA) {
666 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
667 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
671 /// Represents a non-static C++ member function call.
673 /// Example: \c obj.fun()
674 class CXXMemberCall : public CXXInstanceCall {
675 friend class CallEventManager;
678 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
679 const LocationContext *LCtx)
680 : CXXInstanceCall(CE, St, LCtx) {}
681 CXXMemberCall(const CXXMemberCall &Other) = default;
683 void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }
686 virtual const CXXMemberCallExpr *getOriginExpr() const {
687 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
690 unsigned getNumArgs() const override {
691 if (const CallExpr *CE = getOriginExpr())
692 return CE->getNumArgs();
696 const Expr *getArgExpr(unsigned Index) const override {
697 return getOriginExpr()->getArg(Index);
700 const Expr *getCXXThisExpr() const override;
702 RuntimeDefinition getRuntimeDefinition() const override;
704 Kind getKind() const override { return CE_CXXMember; }
706 static bool classof(const CallEvent *CA) {
707 return CA->getKind() == CE_CXXMember;
711 /// Represents a C++ overloaded operator call where the operator is
712 /// implemented as a non-static member function.
714 /// Example: <tt>iter + 1</tt>
715 class CXXMemberOperatorCall : public CXXInstanceCall {
716 friend class CallEventManager;
719 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
720 const LocationContext *LCtx)
721 : CXXInstanceCall(CE, St, LCtx) {}
722 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;
724 void cloneTo(void *Dest) const override {
725 new (Dest) CXXMemberOperatorCall(*this);
729 virtual const CXXOperatorCallExpr *getOriginExpr() const {
730 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
733 unsigned getNumArgs() const override {
734 return getOriginExpr()->getNumArgs() - 1;
737 const Expr *getArgExpr(unsigned Index) const override {
738 return getOriginExpr()->getArg(Index + 1);
741 const Expr *getCXXThisExpr() const override;
743 Kind getKind() const override { return CE_CXXMemberOperator; }
745 static bool classof(const CallEvent *CA) {
746 return CA->getKind() == CE_CXXMemberOperator;
750 getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override {
751 // For member operator calls argument 0 on the expression corresponds
752 // to implicit this-parameter on the declaration.
753 return (ASTArgumentIndex > 0) ? Optional<unsigned>(ASTArgumentIndex - 1)
757 unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override {
758 // For member operator calls argument 0 on the expression corresponds
759 // to implicit this-parameter on the declaration.
760 return CallArgumentIndex + 1;
764 /// Represents an implicit call to a C++ destructor.
766 /// This can occur at the end of a scope (for automatic objects), at the end
767 /// of a full-expression (for temporaries), or as part of a delete.
768 class CXXDestructorCall : public CXXInstanceCall {
769 friend class CallEventManager;
772 using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;
774 /// Creates an implicit destructor.
776 /// \param DD The destructor that will be called.
777 /// \param Trigger The statement whose completion causes this destructor call.
778 /// \param Target The object region to be destructed.
779 /// \param St The path-sensitive state at this point in the program.
780 /// \param LCtx The location context at this point in the program.
781 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
782 const MemRegion *Target, bool IsBaseDestructor,
783 ProgramStateRef St, const LocationContext *LCtx)
784 : CXXInstanceCall(DD, St, LCtx) {
785 Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
786 Location = Trigger->getEndLoc();
789 CXXDestructorCall(const CXXDestructorCall &Other) = default;
791 void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}
794 SourceRange getSourceRange() const override { return Location; }
795 unsigned getNumArgs() const override { return 0; }
797 RuntimeDefinition getRuntimeDefinition() const override;
799 /// Returns the value of the implicit 'this' object.
800 SVal getCXXThisVal() const override;
802 /// Returns true if this is a call to a base class destructor.
803 bool isBaseDestructor() const {
804 return DtorDataTy::getFromOpaqueValue(Data).getInt();
807 Kind getKind() const override { return CE_CXXDestructor; }
809 static bool classof(const CallEvent *CA) {
810 return CA->getKind() == CE_CXXDestructor;
814 /// Represents a call to a C++ constructor.
817 class CXXConstructorCall : public AnyFunctionCall {
818 friend class CallEventManager;
821 /// Creates a constructor call.
823 /// \param CE The constructor expression as written in the source.
824 /// \param Target The region where the object should be constructed. If NULL,
825 /// a new symbolic region will be used.
826 /// \param St The path-sensitive state at this point in the program.
827 /// \param LCtx The location context at this point in the program.
828 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
829 ProgramStateRef St, const LocationContext *LCtx)
830 : AnyFunctionCall(CE, St, LCtx) {
834 CXXConstructorCall(const CXXConstructorCall &Other) = default;
836 void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }
838 void getExtraInvalidatedValues(ValueList &Values,
839 RegionAndSymbolInvalidationTraits *ETraits) const override;
842 virtual const CXXConstructExpr *getOriginExpr() const {
843 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
846 const CXXConstructorDecl *getDecl() const override {
847 return getOriginExpr()->getConstructor();
850 unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
852 const Expr *getArgExpr(unsigned Index) const override {
853 return getOriginExpr()->getArg(Index);
856 /// Returns the value of the implicit 'this' object.
857 SVal getCXXThisVal() const;
859 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
860 BindingsTy &Bindings) const override;
862 Kind getKind() const override { return CE_CXXConstructor; }
864 static bool classof(const CallEvent *CA) {
865 return CA->getKind() == CE_CXXConstructor;
869 /// Represents the memory allocation call in a C++ new-expression.
871 /// This is a call to "operator new".
872 class CXXAllocatorCall : public AnyFunctionCall {
873 friend class CallEventManager;
876 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
877 const LocationContext *LCtx)
878 : AnyFunctionCall(E, St, LCtx) {}
879 CXXAllocatorCall(const CXXAllocatorCall &Other) = default;
881 void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }
884 virtual const CXXNewExpr *getOriginExpr() const {
885 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
888 const FunctionDecl *getDecl() const override {
889 return getOriginExpr()->getOperatorNew();
892 /// Number of non-placement arguments to the call. It is equal to 2 for
893 /// C++17 aligned operator new() calls that have alignment implicitly
894 /// passed as the second argument, and to 1 for other operator new() calls.
895 unsigned getNumImplicitArgs() const {
896 return getOriginExpr()->passAlignment() ? 2 : 1;
899 unsigned getNumArgs() const override {
900 return getOriginExpr()->getNumPlacementArgs() + getNumImplicitArgs();
903 const Expr *getArgExpr(unsigned Index) const override {
904 // The first argument of an allocator call is the size of the allocation.
905 if (Index < getNumImplicitArgs())
907 return getOriginExpr()->getPlacementArg(Index - getNumImplicitArgs());
910 /// Number of placement arguments to the operator new() call. For example,
911 /// standard std::nothrow operator new and standard placement new both have
912 /// 1 implicit argument (size) and 1 placement argument, while regular
913 /// operator new() has 1 implicit argument and 0 placement arguments.
914 const Expr *getPlacementArgExpr(unsigned Index) const {
915 return getOriginExpr()->getPlacementArg(Index);
918 Kind getKind() const override { return CE_CXXAllocator; }
920 static bool classof(const CallEvent *CE) {
921 return CE->getKind() == CE_CXXAllocator;
925 /// Represents the ways an Objective-C message send can occur.
927 // Note to maintainers: OCM_Message should always be last, since it does not
928 // need to fit in the Data field's low bits.
929 enum ObjCMessageKind {
935 /// Represents any expression that calls an Objective-C method.
937 /// This includes all of the kinds listed in ObjCMessageKind.
938 class ObjCMethodCall : public CallEvent {
939 friend class CallEventManager;
941 const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
944 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
945 const LocationContext *LCtx)
946 : CallEvent(Msg, St, LCtx) {
950 ObjCMethodCall(const ObjCMethodCall &Other) = default;
952 void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }
954 void getExtraInvalidatedValues(ValueList &Values,
955 RegionAndSymbolInvalidationTraits *ETraits) const override;
957 /// Check if the selector may have multiple definitions (may have overrides).
958 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
962 virtual const ObjCMessageExpr *getOriginExpr() const {
963 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
966 const ObjCMethodDecl *getDecl() const override {
967 return getOriginExpr()->getMethodDecl();
970 unsigned getNumArgs() const override {
971 return getOriginExpr()->getNumArgs();
974 const Expr *getArgExpr(unsigned Index) const override {
975 return getOriginExpr()->getArg(Index);
978 bool isInstanceMessage() const {
979 return getOriginExpr()->isInstanceMessage();
982 ObjCMethodFamily getMethodFamily() const {
983 return getOriginExpr()->getMethodFamily();
986 Selector getSelector() const {
987 return getOriginExpr()->getSelector();
990 SourceRange getSourceRange() const override;
992 /// Returns the value of the receiver at the time of this call.
993 SVal getReceiverSVal() const;
995 /// Return the value of 'self' if available.
996 SVal getSelfSVal() const;
998 /// Get the interface for the receiver.
1000 /// This works whether this is an instance message or a class message.
1001 /// However, it currently just uses the static type of the receiver.
1002 const ObjCInterfaceDecl *getReceiverInterface() const {
1003 return getOriginExpr()->getReceiverInterface();
1006 /// Checks if the receiver refers to 'self' or 'super'.
1007 bool isReceiverSelfOrSuper() const;
1009 /// Returns how the message was written in the source (property access,
1010 /// subscript, or explicit message send).
1011 ObjCMessageKind getMessageKind() const;
1013 /// Returns true if this property access or subscript is a setter (has the
1014 /// form of an assignment).
1015 bool isSetter() const {
1016 switch (getMessageKind()) {
1018 llvm_unreachable("This is not a pseudo-object access!");
1019 case OCM_PropertyAccess:
1020 return getNumArgs() > 0;
1022 return getNumArgs() > 1;
1024 llvm_unreachable("Unknown message kind");
1027 // Returns the property accessed by this method, either explicitly via
1028 // property syntax or implicitly via a getter or setter method. Returns
1029 // nullptr if the call is not a prooperty access.
1030 const ObjCPropertyDecl *getAccessedProperty() const;
1032 RuntimeDefinition getRuntimeDefinition() const override;
1034 bool argumentsMayEscape() const override;
1036 void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
1037 BindingsTy &Bindings) const override;
1039 ArrayRef<ParmVarDecl*> parameters() const override;
1041 Kind getKind() const override { return CE_ObjCMessage; }
1043 static bool classof(const CallEvent *CA) {
1044 return CA->getKind() == CE_ObjCMessage;
1048 enum CallDescriptionFlags : int {
1049 /// Describes a C standard function that is sometimes implemented as a macro
1050 /// that expands to a compiler builtin with some __builtin prefix.
1051 /// The builtin may as well have a few extra arguments on top of the requested
1052 /// number of arguments.
1053 CDF_MaybeBuiltin = 1 << 0,
1056 /// This class represents a description of a function call using the number of
1057 /// arguments and the name of the function.
1058 class CallDescription {
1061 mutable IdentifierInfo *II = nullptr;
1062 mutable bool IsLookupDone = false;
1063 // The list of the qualified names used to identify the specified CallEvent,
1064 // e.g. "{a, b}" represent the qualified names, like "a::b".
1065 std::vector<const char *> QualifiedName;
1066 Optional<unsigned> RequiredArgs;
1067 Optional<size_t> RequiredParams;
1070 // A constructor helper.
1071 static Optional<size_t> readRequiredParams(Optional<unsigned> RequiredArgs,
1072 Optional<size_t> RequiredParams) {
1074 return RequiredParams;
1076 return static_cast<size_t>(*RequiredArgs);
1081 /// Constructs a CallDescription object.
1083 /// @param QualifiedName The list of the name qualifiers of the function that
1084 /// will be matched. The user is allowed to skip any of the qualifiers.
1085 /// For example, {"std", "basic_string", "c_str"} would match both
1086 /// std::basic_string<...>::c_str() and std::__1::basic_string<...>::c_str().
1088 /// @param RequiredArgs The number of arguments that is expected to match a
1089 /// call. Omit this parameter to match every occurrence of call with a given
1090 /// name regardless the number of arguments.
1091 CallDescription(int Flags, ArrayRef<const char *> QualifiedName,
1092 Optional<unsigned> RequiredArgs = None,
1093 Optional<size_t> RequiredParams = None)
1094 : QualifiedName(QualifiedName), RequiredArgs(RequiredArgs),
1095 RequiredParams(readRequiredParams(RequiredArgs, RequiredParams)),
1098 /// Construct a CallDescription with default flags.
1099 CallDescription(ArrayRef<const char *> QualifiedName,
1100 Optional<unsigned> RequiredArgs = None,
1101 Optional<size_t> RequiredParams = None)
1102 : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {}
1104 /// Get the name of the function that this object matches.
1105 StringRef getFunctionName() const { return QualifiedName.back(); }
1108 /// An immutable map from CallDescriptions to arbitrary data. Provides a unified
1109 /// way for checkers to react on function calls.
1110 template <typename T> class CallDescriptionMap {
1111 // Some call descriptions aren't easily hashable (eg., the ones with qualified
1112 // names in which some sections are omitted), so let's put them
1113 // in a simple vector and use linear lookup.
1114 // TODO: Implement an actual map for fast lookup for "hashable" call
1115 // descriptions (eg., the ones for C functions that just match the name).
1116 std::vector<std::pair<CallDescription, T>> LinearMap;
1120 std::initializer_list<std::pair<CallDescription, T>> &&List)
1121 : LinearMap(List) {}
1123 ~CallDescriptionMap() = default;
1125 // These maps are usually stored once per checker, so let's make sure
1126 // we don't do redundant copies.
1127 CallDescriptionMap(const CallDescriptionMap &) = delete;
1128 CallDescriptionMap &operator=(const CallDescription &) = delete;
1130 const T *lookup(const CallEvent &Call) const {
1131 // Slow path: linear lookup.
1132 // TODO: Implement some sort of fast path.
1133 for (const std::pair<CallDescription, T> &I : LinearMap)
1134 if (Call.isCalled(I.first))
1141 /// Manages the lifetime of CallEvent objects.
1143 /// CallEventManager provides a way to create arbitrary CallEvents "on the
1144 /// stack" as if they were value objects by keeping a cache of CallEvent-sized
1145 /// memory blocks. The CallEvents created by CallEventManager are only valid
1146 /// for the lifetime of the OwnedCallEvent that holds them; right now these
1147 /// objects cannot be copied and ownership cannot be transferred.
1148 class CallEventManager {
1149 friend class CallEvent;
1151 llvm::BumpPtrAllocator &Alloc;
1152 SmallVector<void *, 8> Cache;
1154 using CallEventTemplateTy = SimpleFunctionCall;
1156 void reclaim(const void *Memory) {
1157 Cache.push_back(const_cast<void *>(Memory));
1160 /// Returns memory that can be initialized as a CallEvent.
1163 return Alloc.Allocate<CallEventTemplateTy>();
1165 return Cache.pop_back_val();
1168 template <typename T, typename Arg>
1169 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170 static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171 "CallEvent subclasses are not all the same size");
1172 return new (allocate()) T(A, St, LCtx);
1175 template <typename T, typename Arg1, typename Arg2>
1176 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1177 static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1178 "CallEvent subclasses are not all the same size");
1179 return new (allocate()) T(A1, A2, St, LCtx);
1182 template <typename T, typename Arg1, typename Arg2, typename Arg3>
1183 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
1184 const LocationContext *LCtx) {
1185 static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1186 "CallEvent subclasses are not all the same size");
1187 return new (allocate()) T(A1, A2, A3, St, LCtx);
1190 template <typename T, typename Arg1, typename Arg2, typename Arg3,
1192 T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
1193 const LocationContext *LCtx) {
1194 static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1195 "CallEvent subclasses are not all the same size");
1196 return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
1200 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
1202 /// Gets an outside caller given a callee context.
1204 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
1206 /// Gets a call event for a function call, Objective-C method call,
1207 /// or a 'new' call.
1209 getCall(const Stmt *S, ProgramStateRef State,
1210 const LocationContext *LC);
1213 getSimpleCall(const CallExpr *E, ProgramStateRef State,
1214 const LocationContext *LCtx);
1216 CallEventRef<ObjCMethodCall>
1217 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
1218 const LocationContext *LCtx) {
1219 return create<ObjCMethodCall>(E, State, LCtx);
1222 CallEventRef<CXXConstructorCall>
1223 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
1224 ProgramStateRef State, const LocationContext *LCtx) {
1225 return create<CXXConstructorCall>(E, Target, State, LCtx);
1228 CallEventRef<CXXDestructorCall>
1229 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
1230 const MemRegion *Target, bool IsBase,
1231 ProgramStateRef State, const LocationContext *LCtx) {
1232 return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
1235 CallEventRef<CXXAllocatorCall>
1236 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
1237 const LocationContext *LCtx) {
1238 return create<CXXAllocatorCall>(E, State, LCtx);
1242 template <typename T>
1243 CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1244 assert(isa<T>(*this) && "Cloning to unrelated type");
1245 static_assert(sizeof(T) == sizeof(CallEvent),
1246 "Subclasses may not add fields");
1248 if (NewState == State)
1249 return cast<T>(this);
1251 CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1252 T *Copy = static_cast<T *>(Mgr.allocate());
1254 assert(Copy->getKind() == this->getKind() && "Bad copy");
1256 Copy->State = NewState;
1260 inline void CallEvent::Release() const {
1261 assert(RefCount > 0 && "Reference count is already zero.");
1267 CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1275 } // namespace clang
1279 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1280 template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
1281 using SimpleType = const T *;
1284 getSimplifiedValue(clang::ento::CallEventRef<T> Val) {
1291 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H