CallEvent.h revision 263508
1121054Semax//===- CallEvent.h - Wrapper for all function and method calls ----*- C++ -*--// 2121054Semax// 3121054Semax// The LLVM Compiler Infrastructure 4121054Semax// 5121054Semax// This file is distributed under the University of Illinois Open Source 6121054Semax// License. See LICENSE.TXT for details. 7121054Semax// 8121054Semax//===----------------------------------------------------------------------===// 9121054Semax// 10121054Semax/// \file This file defines CallEvent and its subclasses, which represent path- 11121054Semax/// sensitive instances of different kinds of function and method calls 12121054Semax/// (C, C++, and Objective-C). 13121054Semax// 14121054Semax//===----------------------------------------------------------------------===// 15121054Semax 16121054Semax#ifndef LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 17121054Semax#define LLVM_CLANG_STATICANALYZER_PATHSENSITIVE_CALL 18121054Semax 19121054Semax#include "clang/AST/DeclCXX.h" 20121054Semax#include "clang/AST/ExprCXX.h" 21121054Semax#include "clang/AST/ExprObjC.h" 22121054Semax#include "clang/Analysis/AnalysisContext.h" 23121054Semax#include "clang/Basic/SourceManager.h" 24121054Semax#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 25121054Semax#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 26121054Semax#include "llvm/ADT/PointerIntPair.h" 27121054Semax 28121054Semaxnamespace clang { 29121054Semaxclass ProgramPoint; 30121054Semaxclass ProgramPointTag; 31121054Semax 32131739Srunamespace ento { 33121054Semax 34121054Semaxenum CallEventKind { 35121054Semax CE_Function, 36131739Sru CE_Block, 37121054Semax CE_BEG_SIMPLE_CALLS = CE_Function, 38121054Semax CE_END_SIMPLE_CALLS = CE_Block, 39121054Semax CE_CXXMember, 40121054Semax CE_CXXMemberOperator, 41121054Semax CE_CXXDestructor, 42121054Semax CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember, 43121054Semax CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor, 44121054Semax CE_CXXConstructor, 45121054Semax CE_CXXAllocator, 46121054Semax CE_BEG_FUNCTION_CALLS = CE_Function, 47121054Semax CE_END_FUNCTION_CALLS = CE_CXXAllocator, 48121054Semax CE_ObjCMessage 49131739Sru}; 50121054Semax 51121054Semaxclass CallEvent; 52121054Semaxclass CallEventManager; 53121054Semax 54121054Semaxtemplate<typename T = CallEvent> 55121054Semaxclass CallEventRef : public IntrusiveRefCntPtr<const T> { 56131739Srupublic: 57121054Semax CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {} 58121054Semax CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {} 59121054Semax 60121054Semax CallEventRef<T> cloneWithState(ProgramStateRef State) const { 61121054Semax return this->getPtr()->template cloneWithState<T>(State); 62121054Semax } 63 64 // Allow implicit conversions to a superclass type, since CallEventRef 65 // behaves like a pointer-to-const. 66 template <typename SuperT> 67 operator CallEventRef<SuperT> () const { 68 return this->getPtr(); 69 } 70}; 71 72/// \class RuntimeDefinition 73/// \brief Defines the runtime definition of the called function. 74/// 75/// Encapsulates the information we have about which Decl will be used 76/// when the call is executed on the given path. When dealing with dynamic 77/// dispatch, the information is based on DynamicTypeInfo and might not be 78/// precise. 79class RuntimeDefinition { 80 /// The Declaration of the function which could be called at runtime. 81 /// NULL if not available. 82 const Decl *D; 83 84 /// The region representing an object (ObjC/C++) on which the method is 85 /// called. With dynamic dispatch, the method definition depends on the 86 /// runtime type of this object. NULL when the DynamicTypeInfo is 87 /// precise. 88 const MemRegion *R; 89 90public: 91 RuntimeDefinition(): D(0), R(0) {} 92 RuntimeDefinition(const Decl *InD): D(InD), R(0) {} 93 RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {} 94 const Decl *getDecl() { return D; } 95 96 /// \brief Check if the definition we have is precise. 97 /// If not, it is possible that the call dispatches to another definition at 98 /// execution time. 99 bool mayHaveOtherDefinitions() { return R != 0; } 100 101 /// When other definitions are possible, returns the region whose runtime type 102 /// determines the method definition. 103 const MemRegion *getDispatchRegion() { return R; } 104}; 105 106/// \brief Represents an abstract call to a function or method along a 107/// particular path. 108/// 109/// CallEvents are created through the factory methods of CallEventManager. 110/// 111/// CallEvents should always be cheap to create and destroy. In order for 112/// CallEventManager to be able to re-use CallEvent-sized memory blocks, 113/// subclasses of CallEvent may not add any data members to the base class. 114/// Use the "Data" and "Location" fields instead. 115class CallEvent { 116public: 117 typedef CallEventKind Kind; 118 119private: 120 ProgramStateRef State; 121 const LocationContext *LCtx; 122 llvm::PointerUnion<const Expr *, const Decl *> Origin; 123 124 void operator=(const CallEvent &) LLVM_DELETED_FUNCTION; 125 126protected: 127 // This is user data for subclasses. 128 const void *Data; 129 130 // This is user data for subclasses. 131 // This should come right before RefCount, so that the two fields can be 132 // packed together on LP64 platforms. 133 SourceLocation Location; 134 135private: 136 mutable unsigned RefCount; 137 138 template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo; 139 void Retain() const { ++RefCount; } 140 void Release() const; 141 142protected: 143 friend class CallEventManager; 144 145 CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx) 146 : State(state), LCtx(lctx), Origin(E), RefCount(0) {} 147 148 CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx) 149 : State(state), LCtx(lctx), Origin(D), RefCount(0) {} 150 151 // DO NOT MAKE PUBLIC 152 CallEvent(const CallEvent &Original) 153 : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin), 154 Data(Original.Data), Location(Original.Location), RefCount(0) {} 155 156 /// Copies this CallEvent, with vtable intact, into a new block of memory. 157 virtual void cloneTo(void *Dest) const = 0; 158 159 /// \brief Get the value of arbitrary expressions at this point in the path. 160 SVal getSVal(const Stmt *S) const { 161 return getState()->getSVal(S, getLocationContext()); 162 } 163 164 165 typedef SmallVectorImpl<SVal> ValueList; 166 167 /// \brief Used to specify non-argument regions that will be invalidated as a 168 /// result of this call. 169 virtual void getExtraInvalidatedValues(ValueList &Values) const {} 170 171public: 172 virtual ~CallEvent() {} 173 174 /// \brief Returns the kind of call this is. 175 virtual Kind getKind() const = 0; 176 177 /// \brief Returns the declaration of the function or method that will be 178 /// called. May be null. 179 virtual const Decl *getDecl() const { 180 return Origin.dyn_cast<const Decl *>(); 181 } 182 183 /// \brief The state in which the call is being evaluated. 184 const ProgramStateRef &getState() const { 185 return State; 186 } 187 188 /// \brief The context in which the call is being evaluated. 189 const LocationContext *getLocationContext() const { 190 return LCtx; 191 } 192 193 /// \brief Returns the definition of the function or method that will be 194 /// called. 195 virtual RuntimeDefinition getRuntimeDefinition() const = 0; 196 197 /// \brief Returns the expression whose value will be the result of this call. 198 /// May be null. 199 const Expr *getOriginExpr() const { 200 return Origin.dyn_cast<const Expr *>(); 201 } 202 203 /// \brief Returns the number of arguments (explicit and implicit). 204 /// 205 /// Note that this may be greater than the number of parameters in the 206 /// callee's declaration, and that it may include arguments not written in 207 /// the source. 208 virtual unsigned getNumArgs() const = 0; 209 210 /// \brief Returns true if the callee is known to be from a system header. 211 bool isInSystemHeader() const { 212 const Decl *D = getDecl(); 213 if (!D) 214 return false; 215 216 SourceLocation Loc = D->getLocation(); 217 if (Loc.isValid()) { 218 const SourceManager &SM = 219 getState()->getStateManager().getContext().getSourceManager(); 220 return SM.isInSystemHeader(D->getLocation()); 221 } 222 223 // Special case for implicitly-declared global operator new/delete. 224 // These should be considered system functions. 225 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D)) 226 return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal(); 227 228 return false; 229 } 230 231 /// \brief Returns a source range for the entire call, suitable for 232 /// outputting in diagnostics. 233 virtual SourceRange getSourceRange() const { 234 return getOriginExpr()->getSourceRange(); 235 } 236 237 /// \brief Returns the value of a given argument at the time of the call. 238 virtual SVal getArgSVal(unsigned Index) const; 239 240 /// \brief Returns the expression associated with a given argument. 241 /// May be null if this expression does not appear in the source. 242 virtual const Expr *getArgExpr(unsigned Index) const { return 0; } 243 244 /// \brief Returns the source range for errors associated with this argument. 245 /// 246 /// May be invalid if the argument is not written in the source. 247 virtual SourceRange getArgSourceRange(unsigned Index) const; 248 249 /// \brief Returns the result type, adjusted for references. 250 QualType getResultType() const; 251 252 /// \brief Returns the return value of the call. 253 /// 254 /// This should only be called if the CallEvent was created using a state in 255 /// which the return value has already been bound to the origin expression. 256 SVal getReturnValue() const; 257 258 /// \brief Returns true if any of the arguments appear to represent callbacks. 259 bool hasNonZeroCallbackArg() const; 260 261 /// \brief Returns true if any of the arguments are known to escape to long- 262 /// term storage, even if this method will not modify them. 263 // NOTE: The exact semantics of this are still being defined! 264 // We don't really want a list of hardcoded exceptions in the long run, 265 // but we don't want duplicated lists of known APIs in the short term either. 266 virtual bool argumentsMayEscape() const { 267 return hasNonZeroCallbackArg(); 268 } 269 270 /// \brief Returns true if the callee is an externally-visible function in the 271 /// top-level namespace, such as \c malloc. 272 /// 273 /// You can use this call to determine that a particular function really is 274 /// a library function and not, say, a C++ member function with the same name. 275 /// 276 /// If a name is provided, the function must additionally match the given 277 /// name. 278 /// 279 /// Note that this deliberately excludes C++ library functions in the \c std 280 /// namespace, but will include C library functions accessed through the 281 /// \c std namespace. This also does not check if the function is declared 282 /// as 'extern "C"', or if it uses C++ name mangling. 283 // FIXME: Add a helper for checking namespaces. 284 // FIXME: Move this down to AnyFunctionCall once checkers have more 285 // precise callbacks. 286 bool isGlobalCFunction(StringRef SpecificName = StringRef()) const; 287 288 /// \brief Returns the name of the callee, if its name is a simple identifier. 289 /// 290 /// Note that this will fail for Objective-C methods, blocks, and C++ 291 /// overloaded operators. The former is named by a Selector rather than a 292 /// simple identifier, and the latter two do not have names. 293 // FIXME: Move this down to AnyFunctionCall once checkers have more 294 // precise callbacks. 295 const IdentifierInfo *getCalleeIdentifier() const { 296 const NamedDecl *ND = dyn_cast_or_null<NamedDecl>(getDecl()); 297 if (!ND) 298 return 0; 299 return ND->getIdentifier(); 300 } 301 302 /// \brief Returns an appropriate ProgramPoint for this call. 303 ProgramPoint getProgramPoint(bool IsPreVisit = false, 304 const ProgramPointTag *Tag = 0) const; 305 306 /// \brief Returns a new state with all argument regions invalidated. 307 /// 308 /// This accepts an alternate state in case some processing has already 309 /// occurred. 310 ProgramStateRef invalidateRegions(unsigned BlockCount, 311 ProgramStateRef Orig = 0) const; 312 313 typedef std::pair<Loc, SVal> FrameBindingTy; 314 typedef SmallVectorImpl<FrameBindingTy> BindingsTy; 315 316 /// Populates the given SmallVector with the bindings in the callee's stack 317 /// frame at the start of this call. 318 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 319 BindingsTy &Bindings) const = 0; 320 321 /// Returns a copy of this CallEvent, but using the given state. 322 template <typename T> 323 CallEventRef<T> cloneWithState(ProgramStateRef NewState) const; 324 325 /// Returns a copy of this CallEvent, but using the given state. 326 CallEventRef<> cloneWithState(ProgramStateRef NewState) const { 327 return cloneWithState<CallEvent>(NewState); 328 } 329 330 /// \brief Returns true if this is a statement is a function or method call 331 /// of some kind. 332 static bool isCallStmt(const Stmt *S); 333 334 /// \brief Returns the result type of a function or method declaration. 335 /// 336 /// This will return a null QualType if the result type cannot be determined. 337 static QualType getDeclaredResultType(const Decl *D); 338 339 /// \brief Returns true if the given decl is known to be variadic. 340 /// 341 /// \p D must not be null. 342 static bool isVariadic(const Decl *D); 343 344 // Iterator access to formal parameters and their types. 345private: 346 typedef std::const_mem_fun_t<QualType, ParmVarDecl> get_type_fun; 347 348public: 349 typedef const ParmVarDecl * const *param_iterator; 350 351 /// Returns an iterator over the call's formal parameters. 352 /// 353 /// Remember that the number of formal parameters may not match the number 354 /// of arguments for all calls. However, the first parameter will always 355 /// correspond with the argument value returned by \c getArgSVal(0). 356 /// 357 /// If the call has no accessible declaration, \c param_begin() will be equal 358 /// to \c param_end(). 359 virtual param_iterator param_begin() const = 0; 360 /// \sa param_begin() 361 virtual param_iterator param_end() const = 0; 362 363 typedef llvm::mapped_iterator<param_iterator, get_type_fun> 364 param_type_iterator; 365 366 /// Returns an iterator over the types of the call's formal parameters. 367 /// 368 /// This uses the callee decl found by default name lookup rather than the 369 /// definition because it represents a public interface, and probably has 370 /// more annotations. 371 param_type_iterator param_type_begin() const { 372 return llvm::map_iterator(param_begin(), 373 get_type_fun(&ParmVarDecl::getType)); 374 } 375 /// \sa param_type_begin() 376 param_type_iterator param_type_end() const { 377 return llvm::map_iterator(param_end(), get_type_fun(&ParmVarDecl::getType)); 378 } 379 380 // For debugging purposes only 381 void dump(raw_ostream &Out) const; 382 LLVM_ATTRIBUTE_USED void dump() const; 383}; 384 385 386/// \brief Represents a call to any sort of function that might have a 387/// FunctionDecl. 388class AnyFunctionCall : public CallEvent { 389protected: 390 AnyFunctionCall(const Expr *E, ProgramStateRef St, 391 const LocationContext *LCtx) 392 : CallEvent(E, St, LCtx) {} 393 AnyFunctionCall(const Decl *D, ProgramStateRef St, 394 const LocationContext *LCtx) 395 : CallEvent(D, St, LCtx) {} 396 AnyFunctionCall(const AnyFunctionCall &Other) : CallEvent(Other) {} 397 398public: 399 // This function is overridden by subclasses, but they must return 400 // a FunctionDecl. 401 virtual const FunctionDecl *getDecl() const { 402 return cast<FunctionDecl>(CallEvent::getDecl()); 403 } 404 405 virtual RuntimeDefinition getRuntimeDefinition() const { 406 const FunctionDecl *FD = getDecl(); 407 // Note that the AnalysisDeclContext will have the FunctionDecl with 408 // the definition (if one exists). 409 if (FD) { 410 AnalysisDeclContext *AD = 411 getLocationContext()->getAnalysisDeclContext()-> 412 getManager()->getContext(FD); 413 if (AD->getBody()) 414 return RuntimeDefinition(AD->getDecl()); 415 } 416 417 return RuntimeDefinition(); 418 } 419 420 virtual bool argumentsMayEscape() const; 421 422 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 423 BindingsTy &Bindings) const; 424 425 virtual param_iterator param_begin() const; 426 virtual param_iterator param_end() const; 427 428 static bool classof(const CallEvent *CA) { 429 return CA->getKind() >= CE_BEG_FUNCTION_CALLS && 430 CA->getKind() <= CE_END_FUNCTION_CALLS; 431 } 432}; 433 434/// \brief Represents a call to a non-C++ function, written as a CallExpr. 435class SimpleCall : public AnyFunctionCall { 436protected: 437 SimpleCall(const CallExpr *CE, ProgramStateRef St, 438 const LocationContext *LCtx) 439 : AnyFunctionCall(CE, St, LCtx) {} 440 SimpleCall(const SimpleCall &Other) : AnyFunctionCall(Other) {} 441 442public: 443 virtual const CallExpr *getOriginExpr() const { 444 return cast<CallExpr>(AnyFunctionCall::getOriginExpr()); 445 } 446 447 virtual const FunctionDecl *getDecl() const; 448 449 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 450 451 virtual const Expr *getArgExpr(unsigned Index) const { 452 return getOriginExpr()->getArg(Index); 453 } 454 455 static bool classof(const CallEvent *CA) { 456 return CA->getKind() >= CE_BEG_SIMPLE_CALLS && 457 CA->getKind() <= CE_END_SIMPLE_CALLS; 458 } 459}; 460 461/// \brief Represents a C function or static C++ member function call. 462/// 463/// Example: \c fun() 464class FunctionCall : public SimpleCall { 465 friend class CallEventManager; 466 467protected: 468 FunctionCall(const CallExpr *CE, ProgramStateRef St, 469 const LocationContext *LCtx) 470 : SimpleCall(CE, St, LCtx) {} 471 472 FunctionCall(const FunctionCall &Other) : SimpleCall(Other) {} 473 virtual void cloneTo(void *Dest) const { new (Dest) FunctionCall(*this); } 474 475public: 476 virtual Kind getKind() const { return CE_Function; } 477 478 static bool classof(const CallEvent *CA) { 479 return CA->getKind() == CE_Function; 480 } 481}; 482 483/// \brief Represents a call to a block. 484/// 485/// Example: <tt>^{ /* ... */ }()</tt> 486class BlockCall : public SimpleCall { 487 friend class CallEventManager; 488 489protected: 490 BlockCall(const CallExpr *CE, ProgramStateRef St, 491 const LocationContext *LCtx) 492 : SimpleCall(CE, St, LCtx) {} 493 494 BlockCall(const BlockCall &Other) : SimpleCall(Other) {} 495 virtual void cloneTo(void *Dest) const { new (Dest) BlockCall(*this); } 496 497 virtual void getExtraInvalidatedValues(ValueList &Values) const; 498 499public: 500 /// \brief Returns the region associated with this instance of the block. 501 /// 502 /// This may be NULL if the block's origin is unknown. 503 const BlockDataRegion *getBlockRegion() const; 504 505 /// \brief Gets the declaration of the block. 506 /// 507 /// This is not an override of getDecl() because AnyFunctionCall has already 508 /// assumed that it's a FunctionDecl. 509 const BlockDecl *getBlockDecl() const { 510 const BlockDataRegion *BR = getBlockRegion(); 511 if (!BR) 512 return 0; 513 return BR->getDecl(); 514 } 515 516 virtual RuntimeDefinition getRuntimeDefinition() const { 517 return RuntimeDefinition(getBlockDecl()); 518 } 519 520 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 521 BindingsTy &Bindings) const; 522 523 virtual param_iterator param_begin() const; 524 virtual param_iterator param_end() const; 525 526 virtual Kind getKind() const { return CE_Block; } 527 528 static bool classof(const CallEvent *CA) { 529 return CA->getKind() == CE_Block; 530 } 531}; 532 533/// \brief Represents a non-static C++ member function call, no matter how 534/// it is written. 535class CXXInstanceCall : public AnyFunctionCall { 536protected: 537 virtual void getExtraInvalidatedValues(ValueList &Values) const; 538 539 CXXInstanceCall(const CallExpr *CE, ProgramStateRef St, 540 const LocationContext *LCtx) 541 : AnyFunctionCall(CE, St, LCtx) {} 542 CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St, 543 const LocationContext *LCtx) 544 : AnyFunctionCall(D, St, LCtx) {} 545 546 547 CXXInstanceCall(const CXXInstanceCall &Other) : AnyFunctionCall(Other) {} 548 549public: 550 /// \brief Returns the expression representing the implicit 'this' object. 551 virtual const Expr *getCXXThisExpr() const { return 0; } 552 553 /// \brief Returns the value of the implicit 'this' object. 554 virtual SVal getCXXThisVal() const; 555 556 virtual const FunctionDecl *getDecl() const; 557 558 virtual RuntimeDefinition getRuntimeDefinition() const; 559 560 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 561 BindingsTy &Bindings) const; 562 563 static bool classof(const CallEvent *CA) { 564 return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS && 565 CA->getKind() <= CE_END_CXX_INSTANCE_CALLS; 566 } 567}; 568 569/// \brief Represents a non-static C++ member function call. 570/// 571/// Example: \c obj.fun() 572class CXXMemberCall : public CXXInstanceCall { 573 friend class CallEventManager; 574 575protected: 576 CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St, 577 const LocationContext *LCtx) 578 : CXXInstanceCall(CE, St, LCtx) {} 579 580 CXXMemberCall(const CXXMemberCall &Other) : CXXInstanceCall(Other) {} 581 virtual void cloneTo(void *Dest) const { new (Dest) CXXMemberCall(*this); } 582 583public: 584 virtual const CXXMemberCallExpr *getOriginExpr() const { 585 return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr()); 586 } 587 588 virtual unsigned getNumArgs() const { 589 if (const CallExpr *CE = getOriginExpr()) 590 return CE->getNumArgs(); 591 return 0; 592 } 593 594 virtual const Expr *getArgExpr(unsigned Index) const { 595 return getOriginExpr()->getArg(Index); 596 } 597 598 virtual const Expr *getCXXThisExpr() const; 599 600 virtual RuntimeDefinition getRuntimeDefinition() const; 601 602 virtual Kind getKind() const { return CE_CXXMember; } 603 604 static bool classof(const CallEvent *CA) { 605 return CA->getKind() == CE_CXXMember; 606 } 607}; 608 609/// \brief Represents a C++ overloaded operator call where the operator is 610/// implemented as a non-static member function. 611/// 612/// Example: <tt>iter + 1</tt> 613class CXXMemberOperatorCall : public CXXInstanceCall { 614 friend class CallEventManager; 615 616protected: 617 CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St, 618 const LocationContext *LCtx) 619 : CXXInstanceCall(CE, St, LCtx) {} 620 621 CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) 622 : CXXInstanceCall(Other) {} 623 virtual void cloneTo(void *Dest) const { 624 new (Dest) CXXMemberOperatorCall(*this); 625 } 626 627public: 628 virtual const CXXOperatorCallExpr *getOriginExpr() const { 629 return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr()); 630 } 631 632 virtual unsigned getNumArgs() const { 633 return getOriginExpr()->getNumArgs() - 1; 634 } 635 virtual const Expr *getArgExpr(unsigned Index) const { 636 return getOriginExpr()->getArg(Index + 1); 637 } 638 639 virtual const Expr *getCXXThisExpr() const; 640 641 virtual Kind getKind() const { return CE_CXXMemberOperator; } 642 643 static bool classof(const CallEvent *CA) { 644 return CA->getKind() == CE_CXXMemberOperator; 645 } 646}; 647 648/// \brief Represents an implicit call to a C++ destructor. 649/// 650/// This can occur at the end of a scope (for automatic objects), at the end 651/// of a full-expression (for temporaries), or as part of a delete. 652class CXXDestructorCall : public CXXInstanceCall { 653 friend class CallEventManager; 654 655protected: 656 typedef llvm::PointerIntPair<const MemRegion *, 1, bool> DtorDataTy; 657 658 /// Creates an implicit destructor. 659 /// 660 /// \param DD The destructor that will be called. 661 /// \param Trigger The statement whose completion causes this destructor call. 662 /// \param Target The object region to be destructed. 663 /// \param St The path-sensitive state at this point in the program. 664 /// \param LCtx The location context at this point in the program. 665 CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 666 const MemRegion *Target, bool IsBaseDestructor, 667 ProgramStateRef St, const LocationContext *LCtx) 668 : CXXInstanceCall(DD, St, LCtx) { 669 Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue(); 670 Location = Trigger->getLocEnd(); 671 } 672 673 CXXDestructorCall(const CXXDestructorCall &Other) : CXXInstanceCall(Other) {} 674 virtual void cloneTo(void *Dest) const { new (Dest) CXXDestructorCall(*this); } 675 676public: 677 virtual SourceRange getSourceRange() const { return Location; } 678 virtual unsigned getNumArgs() const { return 0; } 679 680 virtual RuntimeDefinition getRuntimeDefinition() const; 681 682 /// \brief Returns the value of the implicit 'this' object. 683 virtual SVal getCXXThisVal() const; 684 685 /// Returns true if this is a call to a base class destructor. 686 bool isBaseDestructor() const { 687 return DtorDataTy::getFromOpaqueValue(Data).getInt(); 688 } 689 690 virtual Kind getKind() const { return CE_CXXDestructor; } 691 692 static bool classof(const CallEvent *CA) { 693 return CA->getKind() == CE_CXXDestructor; 694 } 695}; 696 697/// \brief Represents a call to a C++ constructor. 698/// 699/// Example: \c T(1) 700class CXXConstructorCall : public AnyFunctionCall { 701 friend class CallEventManager; 702 703protected: 704 /// Creates a constructor call. 705 /// 706 /// \param CE The constructor expression as written in the source. 707 /// \param Target The region where the object should be constructed. If NULL, 708 /// a new symbolic region will be used. 709 /// \param St The path-sensitive state at this point in the program. 710 /// \param LCtx The location context at this point in the program. 711 CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target, 712 ProgramStateRef St, const LocationContext *LCtx) 713 : AnyFunctionCall(CE, St, LCtx) { 714 Data = Target; 715 } 716 717 CXXConstructorCall(const CXXConstructorCall &Other) : AnyFunctionCall(Other){} 718 virtual void cloneTo(void *Dest) const { new (Dest) CXXConstructorCall(*this); } 719 720 virtual void getExtraInvalidatedValues(ValueList &Values) const; 721 722public: 723 virtual const CXXConstructExpr *getOriginExpr() const { 724 return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr()); 725 } 726 727 virtual const CXXConstructorDecl *getDecl() const { 728 return getOriginExpr()->getConstructor(); 729 } 730 731 virtual unsigned getNumArgs() const { return getOriginExpr()->getNumArgs(); } 732 733 virtual const Expr *getArgExpr(unsigned Index) const { 734 return getOriginExpr()->getArg(Index); 735 } 736 737 /// \brief Returns the value of the implicit 'this' object. 738 SVal getCXXThisVal() const; 739 740 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 741 BindingsTy &Bindings) const; 742 743 virtual Kind getKind() const { return CE_CXXConstructor; } 744 745 static bool classof(const CallEvent *CA) { 746 return CA->getKind() == CE_CXXConstructor; 747 } 748}; 749 750/// \brief Represents the memory allocation call in a C++ new-expression. 751/// 752/// This is a call to "operator new". 753class CXXAllocatorCall : public AnyFunctionCall { 754 friend class CallEventManager; 755 756protected: 757 CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St, 758 const LocationContext *LCtx) 759 : AnyFunctionCall(E, St, LCtx) {} 760 761 CXXAllocatorCall(const CXXAllocatorCall &Other) : AnyFunctionCall(Other) {} 762 virtual void cloneTo(void *Dest) const { new (Dest) CXXAllocatorCall(*this); } 763 764public: 765 virtual const CXXNewExpr *getOriginExpr() const { 766 return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr()); 767 } 768 769 virtual const FunctionDecl *getDecl() const { 770 return getOriginExpr()->getOperatorNew(); 771 } 772 773 virtual unsigned getNumArgs() const { 774 return getOriginExpr()->getNumPlacementArgs() + 1; 775 } 776 777 virtual const Expr *getArgExpr(unsigned Index) const { 778 // The first argument of an allocator call is the size of the allocation. 779 if (Index == 0) 780 return 0; 781 return getOriginExpr()->getPlacementArg(Index - 1); 782 } 783 784 virtual Kind getKind() const { return CE_CXXAllocator; } 785 786 static bool classof(const CallEvent *CE) { 787 return CE->getKind() == CE_CXXAllocator; 788 } 789}; 790 791/// \brief Represents the ways an Objective-C message send can occur. 792// 793// Note to maintainers: OCM_Message should always be last, since it does not 794// need to fit in the Data field's low bits. 795enum ObjCMessageKind { 796 OCM_PropertyAccess, 797 OCM_Subscript, 798 OCM_Message 799}; 800 801/// \brief Represents any expression that calls an Objective-C method. 802/// 803/// This includes all of the kinds listed in ObjCMessageKind. 804class ObjCMethodCall : public CallEvent { 805 friend class CallEventManager; 806 807 const PseudoObjectExpr *getContainingPseudoObjectExpr() const; 808 809protected: 810 ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St, 811 const LocationContext *LCtx) 812 : CallEvent(Msg, St, LCtx) { 813 Data = 0; 814 } 815 816 ObjCMethodCall(const ObjCMethodCall &Other) : CallEvent(Other) {} 817 virtual void cloneTo(void *Dest) const { new (Dest) ObjCMethodCall(*this); } 818 819 virtual void getExtraInvalidatedValues(ValueList &Values) const; 820 821 /// Check if the selector may have multiple definitions (may have overrides). 822 virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 823 Selector Sel) const; 824 825public: 826 virtual const ObjCMessageExpr *getOriginExpr() const { 827 return cast<ObjCMessageExpr>(CallEvent::getOriginExpr()); 828 } 829 virtual const ObjCMethodDecl *getDecl() const { 830 return getOriginExpr()->getMethodDecl(); 831 } 832 virtual unsigned getNumArgs() const { 833 return getOriginExpr()->getNumArgs(); 834 } 835 virtual const Expr *getArgExpr(unsigned Index) const { 836 return getOriginExpr()->getArg(Index); 837 } 838 839 bool isInstanceMessage() const { 840 return getOriginExpr()->isInstanceMessage(); 841 } 842 ObjCMethodFamily getMethodFamily() const { 843 return getOriginExpr()->getMethodFamily(); 844 } 845 Selector getSelector() const { 846 return getOriginExpr()->getSelector(); 847 } 848 849 virtual SourceRange getSourceRange() const; 850 851 /// \brief Returns the value of the receiver at the time of this call. 852 SVal getReceiverSVal() const; 853 854 /// \brief Return the value of 'self' if available. 855 SVal getSelfSVal() const; 856 857 /// \brief Get the interface for the receiver. 858 /// 859 /// This works whether this is an instance message or a class message. 860 /// However, it currently just uses the static type of the receiver. 861 const ObjCInterfaceDecl *getReceiverInterface() const { 862 return getOriginExpr()->getReceiverInterface(); 863 } 864 865 /// \brief Checks if the receiver refers to 'self' or 'super'. 866 bool isReceiverSelfOrSuper() const; 867 868 /// Returns how the message was written in the source (property access, 869 /// subscript, or explicit message send). 870 ObjCMessageKind getMessageKind() const; 871 872 /// Returns true if this property access or subscript is a setter (has the 873 /// form of an assignment). 874 bool isSetter() const { 875 switch (getMessageKind()) { 876 case OCM_Message: 877 llvm_unreachable("This is not a pseudo-object access!"); 878 case OCM_PropertyAccess: 879 return getNumArgs() > 0; 880 case OCM_Subscript: 881 return getNumArgs() > 1; 882 } 883 llvm_unreachable("Unknown message kind"); 884 } 885 886 virtual RuntimeDefinition getRuntimeDefinition() const; 887 888 virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 889 BindingsTy &Bindings) const; 890 891 virtual param_iterator param_begin() const; 892 virtual param_iterator param_end() const; 893 894 virtual Kind getKind() const { return CE_ObjCMessage; } 895 896 static bool classof(const CallEvent *CA) { 897 return CA->getKind() == CE_ObjCMessage; 898 } 899}; 900 901 902/// \brief Manages the lifetime of CallEvent objects. 903/// 904/// CallEventManager provides a way to create arbitrary CallEvents "on the 905/// stack" as if they were value objects by keeping a cache of CallEvent-sized 906/// memory blocks. The CallEvents created by CallEventManager are only valid 907/// for the lifetime of the OwnedCallEvent that holds them; right now these 908/// objects cannot be copied and ownership cannot be transferred. 909class CallEventManager { 910 friend class CallEvent; 911 912 llvm::BumpPtrAllocator &Alloc; 913 SmallVector<void *, 8> Cache; 914 915 void reclaim(const void *Memory) { 916 Cache.push_back(const_cast<void *>(Memory)); 917 } 918 919 /// Returns memory that can be initialized as a CallEvent. 920 void *allocate() { 921 if (Cache.empty()) 922 return Alloc.Allocate<FunctionCall>(); 923 else 924 return Cache.pop_back_val(); 925 } 926 927 template <typename T, typename Arg> 928 T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) { 929 return new (allocate()) T(A, St, LCtx); 930 } 931 932 template <typename T, typename Arg1, typename Arg2> 933 T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) { 934 return new (allocate()) T(A1, A2, St, LCtx); 935 } 936 937 template <typename T, typename Arg1, typename Arg2, typename Arg3> 938 T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St, 939 const LocationContext *LCtx) { 940 return new (allocate()) T(A1, A2, A3, St, LCtx); 941 } 942 943 template <typename T, typename Arg1, typename Arg2, typename Arg3, 944 typename Arg4> 945 T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St, 946 const LocationContext *LCtx) { 947 return new (allocate()) T(A1, A2, A3, A4, St, LCtx); 948 } 949 950public: 951 CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {} 952 953 954 CallEventRef<> 955 getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State); 956 957 958 CallEventRef<> 959 getSimpleCall(const CallExpr *E, ProgramStateRef State, 960 const LocationContext *LCtx); 961 962 CallEventRef<ObjCMethodCall> 963 getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State, 964 const LocationContext *LCtx) { 965 return create<ObjCMethodCall>(E, State, LCtx); 966 } 967 968 CallEventRef<CXXConstructorCall> 969 getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target, 970 ProgramStateRef State, const LocationContext *LCtx) { 971 return create<CXXConstructorCall>(E, Target, State, LCtx); 972 } 973 974 CallEventRef<CXXDestructorCall> 975 getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger, 976 const MemRegion *Target, bool IsBase, 977 ProgramStateRef State, const LocationContext *LCtx) { 978 return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx); 979 } 980 981 CallEventRef<CXXAllocatorCall> 982 getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State, 983 const LocationContext *LCtx) { 984 return create<CXXAllocatorCall>(E, State, LCtx); 985 } 986}; 987 988 989template <typename T> 990CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const { 991 assert(isa<T>(*this) && "Cloning to unrelated type"); 992 assert(sizeof(T) == sizeof(CallEvent) && "Subclasses may not add fields"); 993 994 if (NewState == State) 995 return cast<T>(this); 996 997 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 998 T *Copy = static_cast<T *>(Mgr.allocate()); 999 cloneTo(Copy); 1000 assert(Copy->getKind() == this->getKind() && "Bad copy"); 1001 1002 Copy->State = NewState; 1003 return Copy; 1004} 1005 1006inline void CallEvent::Release() const { 1007 assert(RefCount > 0 && "Reference count is already zero."); 1008 --RefCount; 1009 1010 if (RefCount > 0) 1011 return; 1012 1013 CallEventManager &Mgr = State->getStateManager().getCallEventManager(); 1014 Mgr.reclaim(this); 1015 1016 this->~CallEvent(); 1017} 1018 1019} // end namespace ento 1020} // end namespace clang 1021 1022namespace llvm { 1023 // Support isa<>, cast<>, and dyn_cast<> for CallEventRef. 1024 template<class T> struct simplify_type< clang::ento::CallEventRef<T> > { 1025 typedef const T *SimpleType; 1026 1027 static SimpleType 1028 getSimplifiedValue(clang::ento::CallEventRef<T> Val) { 1029 return Val.getPtr(); 1030 } 1031 }; 1032} 1033 1034#endif 1035