1//===- CallEvent.cpp - Wrapper for all function and method calls ----------===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9/// \file This file defines CallEvent and its subclasses, which represent path- 10/// sensitive instances of different kinds of function and method calls 11/// (C, C++, and Objective-C). 12// 13//===----------------------------------------------------------------------===// 14 15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" 16#include "clang/AST/ASTContext.h" 17#include "clang/AST/Attr.h" 18#include "clang/AST/Decl.h" 19#include "clang/AST/DeclBase.h" 20#include "clang/AST/DeclCXX.h" 21#include "clang/AST/DeclObjC.h" 22#include "clang/AST/Expr.h" 23#include "clang/AST/ExprCXX.h" 24#include "clang/AST/ExprObjC.h" 25#include "clang/AST/ParentMap.h" 26#include "clang/AST/Stmt.h" 27#include "clang/AST/Type.h" 28#include "clang/Analysis/AnalysisDeclContext.h" 29#include "clang/Analysis/CFG.h" 30#include "clang/Analysis/CFGStmtMap.h" 31#include "clang/Analysis/PathDiagnostic.h" 32#include "clang/Analysis/ProgramPoint.h" 33#include "clang/Basic/IdentifierTable.h" 34#include "clang/Basic/LLVM.h" 35#include "clang/Basic/SourceLocation.h" 36#include "clang/Basic/SourceManager.h" 37#include "clang/Basic/Specifiers.h" 38#include "clang/CrossTU/CrossTranslationUnit.h" 39#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" 40#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h" 41#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h" 42#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h" 43#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h" 44#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h" 45#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h" 46#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h" 47#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h" 48#include "llvm/ADT/ArrayRef.h" 49#include "llvm/ADT/DenseMap.h" 50#include "llvm/ADT/None.h" 51#include "llvm/ADT/Optional.h" 52#include "llvm/ADT/PointerIntPair.h" 53#include "llvm/ADT/SmallSet.h" 54#include "llvm/ADT/SmallVector.h" 55#include "llvm/ADT/StringExtras.h" 56#include "llvm/ADT/StringRef.h" 57#include "llvm/Support/Casting.h" 58#include "llvm/Support/Compiler.h" 59#include "llvm/Support/Debug.h" 60#include "llvm/Support/ErrorHandling.h" 61#include "llvm/Support/raw_ostream.h" 62#include <cassert> 63#include <utility> 64 65#define DEBUG_TYPE "static-analyzer-call-event" 66 67using namespace clang; 68using namespace ento; 69 70QualType CallEvent::getResultType() const { 71 ASTContext &Ctx = getState()->getStateManager().getContext(); 72 const Expr *E = getOriginExpr(); 73 if (!E) 74 return Ctx.VoidTy; 75 assert(E); 76 77 QualType ResultTy = E->getType(); 78 79 // A function that returns a reference to 'int' will have a result type 80 // of simply 'int'. Check the origin expr's value kind to recover the 81 // proper type. 82 switch (E->getValueKind()) { 83 case VK_LValue: 84 ResultTy = Ctx.getLValueReferenceType(ResultTy); 85 break; 86 case VK_XValue: 87 ResultTy = Ctx.getRValueReferenceType(ResultTy); 88 break; 89 case VK_RValue: 90 // No adjustment is necessary. 91 break; 92 } 93 94 return ResultTy; 95} 96 97static bool isCallback(QualType T) { 98 // If a parameter is a block or a callback, assume it can modify pointer. 99 if (T->isBlockPointerType() || 100 T->isFunctionPointerType() || 101 T->isObjCSelType()) 102 return true; 103 104 // Check if a callback is passed inside a struct (for both, struct passed by 105 // reference and by value). Dig just one level into the struct for now. 106 107 if (T->isAnyPointerType() || T->isReferenceType()) 108 T = T->getPointeeType(); 109 110 if (const RecordType *RT = T->getAsStructureType()) { 111 const RecordDecl *RD = RT->getDecl(); 112 for (const auto *I : RD->fields()) { 113 QualType FieldT = I->getType(); 114 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType()) 115 return true; 116 } 117 } 118 return false; 119} 120 121static bool isVoidPointerToNonConst(QualType T) { 122 if (const auto *PT = T->getAs<PointerType>()) { 123 QualType PointeeTy = PT->getPointeeType(); 124 if (PointeeTy.isConstQualified()) 125 return false; 126 return PointeeTy->isVoidType(); 127 } else 128 return false; 129} 130 131bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const { 132 unsigned NumOfArgs = getNumArgs(); 133 134 // If calling using a function pointer, assume the function does not 135 // satisfy the callback. 136 // TODO: We could check the types of the arguments here. 137 if (!getDecl()) 138 return false; 139 140 unsigned Idx = 0; 141 for (CallEvent::param_type_iterator I = param_type_begin(), 142 E = param_type_end(); 143 I != E && Idx < NumOfArgs; ++I, ++Idx) { 144 // If the parameter is 0, it's harmless. 145 if (getArgSVal(Idx).isZeroConstant()) 146 continue; 147 148 if (Condition(*I)) 149 return true; 150 } 151 return false; 152} 153 154bool CallEvent::hasNonZeroCallbackArg() const { 155 return hasNonNullArgumentsWithType(isCallback); 156} 157 158bool CallEvent::hasVoidPointerToNonConstArg() const { 159 return hasNonNullArgumentsWithType(isVoidPointerToNonConst); 160} 161 162bool CallEvent::isGlobalCFunction(StringRef FunctionName) const { 163 const auto *FD = dyn_cast_or_null<FunctionDecl>(getDecl()); 164 if (!FD) 165 return false; 166 167 return CheckerContext::isCLibraryFunction(FD, FunctionName); 168} 169 170AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const { 171 const Decl *D = getDecl(); 172 if (!D) 173 return nullptr; 174 175 // TODO: For now we skip functions without definitions, even if we have 176 // our own getDecl(), because it's hard to find out which re-declaration 177 // is going to be used, and usually clients don't really care about this 178 // situation because there's a loss of precision anyway because we cannot 179 // inline the call. 180 RuntimeDefinition RD = getRuntimeDefinition(); 181 if (!RD.getDecl()) 182 return nullptr; 183 184 AnalysisDeclContext *ADC = 185 LCtx->getAnalysisDeclContext()->getManager()->getContext(D); 186 187 // TODO: For now we skip virtual functions, because this also rises 188 // the problem of which decl to use, but now it's across different classes. 189 if (RD.mayHaveOtherDefinitions() || RD.getDecl() != ADC->getDecl()) 190 return nullptr; 191 192 return ADC; 193} 194 195const StackFrameContext * 196CallEvent::getCalleeStackFrame(unsigned BlockCount) const { 197 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext(); 198 if (!ADC) 199 return nullptr; 200 201 const Expr *E = getOriginExpr(); 202 if (!E) 203 return nullptr; 204 205 // Recover CFG block via reverse lookup. 206 // TODO: If we were to keep CFG element information as part of the CallEvent 207 // instead of doing this reverse lookup, we would be able to build the stack 208 // frame for non-expression-based calls, and also we wouldn't need the reverse 209 // lookup. 210 CFGStmtMap *Map = LCtx->getAnalysisDeclContext()->getCFGStmtMap(); 211 const CFGBlock *B = Map->getBlock(E); 212 assert(B); 213 214 // Also recover CFG index by scanning the CFG block. 215 unsigned Idx = 0, Sz = B->size(); 216 for (; Idx < Sz; ++Idx) 217 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>()) 218 if (StmtElem->getStmt() == E) 219 break; 220 assert(Idx < Sz); 221 222 return ADC->getManager()->getStackFrame(ADC, LCtx, E, B, BlockCount, Idx); 223} 224 225const VarRegion *CallEvent::getParameterLocation(unsigned Index, 226 unsigned BlockCount) const { 227 const StackFrameContext *SFC = getCalleeStackFrame(BlockCount); 228 // We cannot construct a VarRegion without a stack frame. 229 if (!SFC) 230 return nullptr; 231 232 // Retrieve parameters of the definition, which are different from 233 // CallEvent's parameters() because getDecl() isn't necessarily 234 // the definition. SFC contains the definition that would be used 235 // during analysis. 236 const Decl *D = SFC->getDecl(); 237 238 // TODO: Refactor into a virtual method of CallEvent, like parameters(). 239 const ParmVarDecl *PVD = nullptr; 240 if (const auto *FD = dyn_cast<FunctionDecl>(D)) 241 PVD = FD->parameters()[Index]; 242 else if (const auto *BD = dyn_cast<BlockDecl>(D)) 243 PVD = BD->parameters()[Index]; 244 else if (const auto *MD = dyn_cast<ObjCMethodDecl>(D)) 245 PVD = MD->parameters()[Index]; 246 else if (const auto *CD = dyn_cast<CXXConstructorDecl>(D)) 247 PVD = CD->parameters()[Index]; 248 assert(PVD && "Unexpected Decl kind!"); 249 250 const VarRegion *VR = 251 State->getStateManager().getRegionManager().getVarRegion(PVD, SFC); 252 253 // This sanity check would fail if our parameter declaration doesn't 254 // correspond to the stack frame's function declaration. 255 assert(VR->getStackFrame() == SFC); 256 257 return VR; 258} 259 260/// Returns true if a type is a pointer-to-const or reference-to-const 261/// with no further indirection. 262static bool isPointerToConst(QualType Ty) { 263 QualType PointeeTy = Ty->getPointeeType(); 264 if (PointeeTy == QualType()) 265 return false; 266 if (!PointeeTy.isConstQualified()) 267 return false; 268 if (PointeeTy->isAnyPointerType()) 269 return false; 270 return true; 271} 272 273// Try to retrieve the function declaration and find the function parameter 274// types which are pointers/references to a non-pointer const. 275// We will not invalidate the corresponding argument regions. 276static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs, 277 const CallEvent &Call) { 278 unsigned Idx = 0; 279 for (CallEvent::param_type_iterator I = Call.param_type_begin(), 280 E = Call.param_type_end(); 281 I != E; ++I, ++Idx) { 282 if (isPointerToConst(*I)) 283 PreserveArgs.insert(Idx); 284 } 285} 286 287ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount, 288 ProgramStateRef Orig) const { 289 ProgramStateRef Result = (Orig ? Orig : getState()); 290 291 // Don't invalidate anything if the callee is marked pure/const. 292 if (const Decl *callee = getDecl()) 293 if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>()) 294 return Result; 295 296 SmallVector<SVal, 8> ValuesToInvalidate; 297 RegionAndSymbolInvalidationTraits ETraits; 298 299 getExtraInvalidatedValues(ValuesToInvalidate, &ETraits); 300 301 // Indexes of arguments whose values will be preserved by the call. 302 llvm::SmallSet<unsigned, 4> PreserveArgs; 303 if (!argumentsMayEscape()) 304 findPtrToConstParams(PreserveArgs, *this); 305 306 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) { 307 // Mark this region for invalidation. We batch invalidate regions 308 // below for efficiency. 309 if (PreserveArgs.count(Idx)) 310 if (const MemRegion *MR = getArgSVal(Idx).getAsRegion()) 311 ETraits.setTrait(MR->getBaseRegion(), 312 RegionAndSymbolInvalidationTraits::TK_PreserveContents); 313 // TODO: Factor this out + handle the lower level const pointers. 314 315 ValuesToInvalidate.push_back(getArgSVal(Idx)); 316 317 // If a function accepts an object by argument (which would of course be a 318 // temporary that isn't lifetime-extended), invalidate the object itself, 319 // not only other objects reachable from it. This is necessary because the 320 // destructor has access to the temporary object after the call. 321 // TODO: Support placement arguments once we start 322 // constructing them directly. 323 // TODO: This is unnecessary when there's no destructor, but that's 324 // currently hard to figure out. 325 if (getKind() != CE_CXXAllocator) 326 if (isArgumentConstructedDirectly(Idx)) 327 if (auto AdjIdx = getAdjustedParameterIndex(Idx)) 328 if (const VarRegion *VR = getParameterLocation(*AdjIdx, BlockCount)) 329 ValuesToInvalidate.push_back(loc::MemRegionVal(VR)); 330 } 331 332 // Invalidate designated regions using the batch invalidation API. 333 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate 334 // global variables. 335 return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(), 336 BlockCount, getLocationContext(), 337 /*CausedByPointerEscape*/ true, 338 /*Symbols=*/nullptr, this, &ETraits); 339} 340 341ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit, 342 const ProgramPointTag *Tag) const { 343 if (const Expr *E = getOriginExpr()) { 344 if (IsPreVisit) 345 return PreStmt(E, getLocationContext(), Tag); 346 return PostStmt(E, getLocationContext(), Tag); 347 } 348 349 const Decl *D = getDecl(); 350 assert(D && "Cannot get a program point without a statement or decl"); 351 352 SourceLocation Loc = getSourceRange().getBegin(); 353 if (IsPreVisit) 354 return PreImplicitCall(D, Loc, getLocationContext(), Tag); 355 return PostImplicitCall(D, Loc, getLocationContext(), Tag); 356} 357 358bool CallEvent::isCalled(const CallDescription &CD) const { 359 // FIXME: Add ObjC Message support. 360 if (getKind() == CE_ObjCMessage) 361 return false; 362 363 const IdentifierInfo *II = getCalleeIdentifier(); 364 if (!II) 365 return false; 366 const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl()); 367 if (!FD) 368 return false; 369 370 if (CD.Flags & CDF_MaybeBuiltin) { 371 return CheckerContext::isCLibraryFunction(FD, CD.getFunctionName()) && 372 (!CD.RequiredArgs || CD.RequiredArgs <= getNumArgs()) && 373 (!CD.RequiredParams || CD.RequiredParams <= parameters().size()); 374 } 375 376 if (!CD.IsLookupDone) { 377 CD.IsLookupDone = true; 378 CD.II = &getState()->getStateManager().getContext().Idents.get( 379 CD.getFunctionName()); 380 } 381 382 if (II != CD.II) 383 return false; 384 385 // If CallDescription provides prefix names, use them to improve matching 386 // accuracy. 387 if (CD.QualifiedName.size() > 1 && FD) { 388 const DeclContext *Ctx = FD->getDeclContext(); 389 // See if we'll be able to match them all. 390 size_t NumUnmatched = CD.QualifiedName.size() - 1; 391 for (; Ctx && isa<NamedDecl>(Ctx); Ctx = Ctx->getParent()) { 392 if (NumUnmatched == 0) 393 break; 394 395 if (const auto *ND = dyn_cast<NamespaceDecl>(Ctx)) { 396 if (ND->getName() == CD.QualifiedName[NumUnmatched - 1]) 397 --NumUnmatched; 398 continue; 399 } 400 401 if (const auto *RD = dyn_cast<RecordDecl>(Ctx)) { 402 if (RD->getName() == CD.QualifiedName[NumUnmatched - 1]) 403 --NumUnmatched; 404 continue; 405 } 406 } 407 408 if (NumUnmatched > 0) 409 return false; 410 } 411 412 return (!CD.RequiredArgs || CD.RequiredArgs == getNumArgs()) && 413 (!CD.RequiredParams || CD.RequiredParams == parameters().size()); 414} 415 416SVal CallEvent::getArgSVal(unsigned Index) const { 417 const Expr *ArgE = getArgExpr(Index); 418 if (!ArgE) 419 return UnknownVal(); 420 return getSVal(ArgE); 421} 422 423SourceRange CallEvent::getArgSourceRange(unsigned Index) const { 424 const Expr *ArgE = getArgExpr(Index); 425 if (!ArgE) 426 return {}; 427 return ArgE->getSourceRange(); 428} 429 430SVal CallEvent::getReturnValue() const { 431 const Expr *E = getOriginExpr(); 432 if (!E) 433 return UndefinedVal(); 434 return getSVal(E); 435} 436 437LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); } 438 439void CallEvent::dump(raw_ostream &Out) const { 440 ASTContext &Ctx = getState()->getStateManager().getContext(); 441 if (const Expr *E = getOriginExpr()) { 442 E->printPretty(Out, nullptr, Ctx.getPrintingPolicy()); 443 Out << "\n"; 444 return; 445 } 446 447 if (const Decl *D = getDecl()) { 448 Out << "Call to "; 449 D->print(Out, Ctx.getPrintingPolicy()); 450 return; 451 } 452 453 // FIXME: a string representation of the kind would be nice. 454 Out << "Unknown call (type " << getKind() << ")"; 455} 456 457bool CallEvent::isCallStmt(const Stmt *S) { 458 return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S) 459 || isa<CXXConstructExpr>(S) 460 || isa<CXXNewExpr>(S); 461} 462 463QualType CallEvent::getDeclaredResultType(const Decl *D) { 464 assert(D); 465 if (const auto *FD = dyn_cast<FunctionDecl>(D)) 466 return FD->getReturnType(); 467 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D)) 468 return MD->getReturnType(); 469 if (const auto *BD = dyn_cast<BlockDecl>(D)) { 470 // Blocks are difficult because the return type may not be stored in the 471 // BlockDecl itself. The AST should probably be enhanced, but for now we 472 // just do what we can. 473 // If the block is declared without an explicit argument list, the 474 // signature-as-written just includes the return type, not the entire 475 // function type. 476 // FIXME: All blocks should have signatures-as-written, even if the return 477 // type is inferred. (That's signified with a dependent result type.) 478 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) { 479 QualType Ty = TSI->getType(); 480 if (const FunctionType *FT = Ty->getAs<FunctionType>()) 481 Ty = FT->getReturnType(); 482 if (!Ty->isDependentType()) 483 return Ty; 484 } 485 486 return {}; 487 } 488 489 llvm_unreachable("unknown callable kind"); 490} 491 492bool CallEvent::isVariadic(const Decl *D) { 493 assert(D); 494 495 if (const auto *FD = dyn_cast<FunctionDecl>(D)) 496 return FD->isVariadic(); 497 if (const auto *MD = dyn_cast<ObjCMethodDecl>(D)) 498 return MD->isVariadic(); 499 if (const auto *BD = dyn_cast<BlockDecl>(D)) 500 return BD->isVariadic(); 501 502 llvm_unreachable("unknown callable kind"); 503} 504 505static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx, 506 CallEvent::BindingsTy &Bindings, 507 SValBuilder &SVB, 508 const CallEvent &Call, 509 ArrayRef<ParmVarDecl*> parameters) { 510 MemRegionManager &MRMgr = SVB.getRegionManager(); 511 512 // If the function has fewer parameters than the call has arguments, we simply 513 // do not bind any values to them. 514 unsigned NumArgs = Call.getNumArgs(); 515 unsigned Idx = 0; 516 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end(); 517 for (; I != E && Idx < NumArgs; ++I, ++Idx) { 518 const ParmVarDecl *ParamDecl = *I; 519 assert(ParamDecl && "Formal parameter has no decl?"); 520 521 // TODO: Support allocator calls. 522 if (Call.getKind() != CE_CXXAllocator) 523 if (Call.isArgumentConstructedDirectly(Call.getASTArgumentIndex(Idx))) 524 continue; 525 526 // TODO: Allocators should receive the correct size and possibly alignment, 527 // determined in compile-time but not represented as arg-expressions, 528 // which makes getArgSVal() fail and return UnknownVal. 529 SVal ArgVal = Call.getArgSVal(Idx); 530 if (!ArgVal.isUnknown()) { 531 Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx)); 532 Bindings.push_back(std::make_pair(ParamLoc, ArgVal)); 533 } 534 } 535 536 // FIXME: Variadic arguments are not handled at all right now. 537} 538 539ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const { 540 const FunctionDecl *D = getDecl(); 541 if (!D) 542 return None; 543 return D->parameters(); 544} 545 546RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const { 547 const FunctionDecl *FD = getDecl(); 548 if (!FD) 549 return {}; 550 551 // Note that the AnalysisDeclContext will have the FunctionDecl with 552 // the definition (if one exists). 553 AnalysisDeclContext *AD = 554 getLocationContext()->getAnalysisDeclContext()-> 555 getManager()->getContext(FD); 556 bool IsAutosynthesized; 557 Stmt* Body = AD->getBody(IsAutosynthesized); 558 LLVM_DEBUG({ 559 if (IsAutosynthesized) 560 llvm::dbgs() << "Using autosynthesized body for " << FD->getName() 561 << "\n"; 562 }); 563 if (Body) { 564 const Decl* Decl = AD->getDecl(); 565 return RuntimeDefinition(Decl); 566 } 567 568 SubEngine &Engine = getState()->getStateManager().getOwningEngine(); 569 AnalyzerOptions &Opts = Engine.getAnalysisManager().options; 570 571 // Try to get CTU definition only if CTUDir is provided. 572 if (!Opts.IsNaiveCTUEnabled) 573 return {}; 574 575 cross_tu::CrossTranslationUnitContext &CTUCtx = 576 *Engine.getCrossTranslationUnitContext(); 577 llvm::Expected<const FunctionDecl *> CTUDeclOrError = 578 CTUCtx.getCrossTUDefinition(FD, Opts.CTUDir, Opts.CTUIndexName, 579 Opts.DisplayCTUProgress); 580 581 if (!CTUDeclOrError) { 582 handleAllErrors(CTUDeclOrError.takeError(), 583 [&](const cross_tu::IndexError &IE) { 584 CTUCtx.emitCrossTUDiagnostics(IE); 585 }); 586 return {}; 587 } 588 589 return RuntimeDefinition(*CTUDeclOrError); 590} 591 592void AnyFunctionCall::getInitialStackFrameContents( 593 const StackFrameContext *CalleeCtx, 594 BindingsTy &Bindings) const { 595 const auto *D = cast<FunctionDecl>(CalleeCtx->getDecl()); 596 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 597 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 598 D->parameters()); 599} 600 601bool AnyFunctionCall::argumentsMayEscape() const { 602 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg()) 603 return true; 604 605 const FunctionDecl *D = getDecl(); 606 if (!D) 607 return true; 608 609 const IdentifierInfo *II = D->getIdentifier(); 610 if (!II) 611 return false; 612 613 // This set of "escaping" APIs is 614 615 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a 616 // value into thread local storage. The value can later be retrieved with 617 // 'void *ptheread_getspecific(pthread_key)'. So even thought the 618 // parameter is 'const void *', the region escapes through the call. 619 if (II->isStr("pthread_setspecific")) 620 return true; 621 622 // - xpc_connection_set_context stores a value which can be retrieved later 623 // with xpc_connection_get_context. 624 if (II->isStr("xpc_connection_set_context")) 625 return true; 626 627 // - funopen - sets a buffer for future IO calls. 628 if (II->isStr("funopen")) 629 return true; 630 631 // - __cxa_demangle - can reallocate memory and can return the pointer to 632 // the input buffer. 633 if (II->isStr("__cxa_demangle")) 634 return true; 635 636 StringRef FName = II->getName(); 637 638 // - CoreFoundation functions that end with "NoCopy" can free a passed-in 639 // buffer even if it is const. 640 if (FName.endswith("NoCopy")) 641 return true; 642 643 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can 644 // be deallocated by NSMapRemove. 645 if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos)) 646 return true; 647 648 // - Many CF containers allow objects to escape through custom 649 // allocators/deallocators upon container construction. (PR12101) 650 if (FName.startswith("CF") || FName.startswith("CG")) { 651 return StrInStrNoCase(FName, "InsertValue") != StringRef::npos || 652 StrInStrNoCase(FName, "AddValue") != StringRef::npos || 653 StrInStrNoCase(FName, "SetValue") != StringRef::npos || 654 StrInStrNoCase(FName, "WithData") != StringRef::npos || 655 StrInStrNoCase(FName, "AppendValue") != StringRef::npos || 656 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos; 657 } 658 659 return false; 660} 661 662const FunctionDecl *SimpleFunctionCall::getDecl() const { 663 const FunctionDecl *D = getOriginExpr()->getDirectCallee(); 664 if (D) 665 return D; 666 667 return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl(); 668} 669 670const FunctionDecl *CXXInstanceCall::getDecl() const { 671 const auto *CE = cast_or_null<CallExpr>(getOriginExpr()); 672 if (!CE) 673 return AnyFunctionCall::getDecl(); 674 675 const FunctionDecl *D = CE->getDirectCallee(); 676 if (D) 677 return D; 678 679 return getSVal(CE->getCallee()).getAsFunctionDecl(); 680} 681 682void CXXInstanceCall::getExtraInvalidatedValues( 683 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const { 684 SVal ThisVal = getCXXThisVal(); 685 Values.push_back(ThisVal); 686 687 // Don't invalidate if the method is const and there are no mutable fields. 688 if (const auto *D = cast_or_null<CXXMethodDecl>(getDecl())) { 689 if (!D->isConst()) 690 return; 691 // Get the record decl for the class of 'This'. D->getParent() may return a 692 // base class decl, rather than the class of the instance which needs to be 693 // checked for mutable fields. 694 // TODO: We might as well look at the dynamic type of the object. 695 const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts(); 696 QualType T = Ex->getType(); 697 if (T->isPointerType()) // Arrow or implicit-this syntax? 698 T = T->getPointeeType(); 699 const CXXRecordDecl *ParentRecord = T->getAsCXXRecordDecl(); 700 assert(ParentRecord); 701 if (ParentRecord->hasMutableFields()) 702 return; 703 // Preserve CXXThis. 704 const MemRegion *ThisRegion = ThisVal.getAsRegion(); 705 if (!ThisRegion) 706 return; 707 708 ETraits->setTrait(ThisRegion->getBaseRegion(), 709 RegionAndSymbolInvalidationTraits::TK_PreserveContents); 710 } 711} 712 713SVal CXXInstanceCall::getCXXThisVal() const { 714 const Expr *Base = getCXXThisExpr(); 715 // FIXME: This doesn't handle an overloaded ->* operator. 716 if (!Base) 717 return UnknownVal(); 718 719 SVal ThisVal = getSVal(Base); 720 assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>()); 721 return ThisVal; 722} 723 724RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const { 725 // Do we have a decl at all? 726 const Decl *D = getDecl(); 727 if (!D) 728 return {}; 729 730 // If the method is non-virtual, we know we can inline it. 731 const auto *MD = cast<CXXMethodDecl>(D); 732 if (!MD->isVirtual()) 733 return AnyFunctionCall::getRuntimeDefinition(); 734 735 // Do we know the implicit 'this' object being called? 736 const MemRegion *R = getCXXThisVal().getAsRegion(); 737 if (!R) 738 return {}; 739 740 // Do we know anything about the type of 'this'? 741 DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R); 742 if (!DynType.isValid()) 743 return {}; 744 745 // Is the type a C++ class? (This is mostly a defensive check.) 746 QualType RegionType = DynType.getType()->getPointeeType(); 747 assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer."); 748 749 const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl(); 750 if (!RD || !RD->hasDefinition()) 751 return {}; 752 753 // Find the decl for this method in that class. 754 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true); 755 if (!Result) { 756 // We might not even get the original statically-resolved method due to 757 // some particularly nasty casting (e.g. casts to sister classes). 758 // However, we should at least be able to search up and down our own class 759 // hierarchy, and some real bugs have been caught by checking this. 760 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method"); 761 762 // FIXME: This is checking that our DynamicTypeInfo is at least as good as 763 // the static type. However, because we currently don't update 764 // DynamicTypeInfo when an object is cast, we can't actually be sure the 765 // DynamicTypeInfo is up to date. This assert should be re-enabled once 766 // this is fixed. <rdar://problem/12287087> 767 //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo"); 768 769 return {}; 770 } 771 772 // Does the decl that we found have an implementation? 773 const FunctionDecl *Definition; 774 if (!Result->hasBody(Definition)) { 775 if (!DynType.canBeASubClass()) 776 return AnyFunctionCall::getRuntimeDefinition(); 777 return {}; 778 } 779 780 // We found a definition. If we're not sure that this devirtualization is 781 // actually what will happen at runtime, make sure to provide the region so 782 // that ExprEngine can decide what to do with it. 783 if (DynType.canBeASubClass()) 784 return RuntimeDefinition(Definition, R->StripCasts()); 785 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr); 786} 787 788void CXXInstanceCall::getInitialStackFrameContents( 789 const StackFrameContext *CalleeCtx, 790 BindingsTy &Bindings) const { 791 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings); 792 793 // Handle the binding of 'this' in the new stack frame. 794 SVal ThisVal = getCXXThisVal(); 795 if (!ThisVal.isUnknown()) { 796 ProgramStateManager &StateMgr = getState()->getStateManager(); 797 SValBuilder &SVB = StateMgr.getSValBuilder(); 798 799 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 800 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx); 801 802 // If we devirtualized to a different member function, we need to make sure 803 // we have the proper layering of CXXBaseObjectRegions. 804 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) { 805 ASTContext &Ctx = SVB.getContext(); 806 const CXXRecordDecl *Class = MD->getParent(); 807 QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class)); 808 809 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager. 810 bool Failed; 811 ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed); 812 if (Failed) { 813 // We might have suffered some sort of placement new earlier, so 814 // we're constructing in a completely unexpected storage. 815 // Fall back to a generic pointer cast for this-value. 816 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(getDecl()); 817 const CXXRecordDecl *StaticClass = StaticMD->getParent(); 818 QualType StaticTy = Ctx.getPointerType(Ctx.getRecordType(StaticClass)); 819 ThisVal = SVB.evalCast(ThisVal, Ty, StaticTy); 820 } 821 } 822 823 if (!ThisVal.isUnknown()) 824 Bindings.push_back(std::make_pair(ThisLoc, ThisVal)); 825 } 826} 827 828const Expr *CXXMemberCall::getCXXThisExpr() const { 829 return getOriginExpr()->getImplicitObjectArgument(); 830} 831 832RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const { 833 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the 834 // id-expression in the class member access expression is a qualified-id, 835 // that function is called. Otherwise, its final overrider in the dynamic type 836 // of the object expression is called. 837 if (const auto *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee())) 838 if (ME->hasQualifier()) 839 return AnyFunctionCall::getRuntimeDefinition(); 840 841 return CXXInstanceCall::getRuntimeDefinition(); 842} 843 844const Expr *CXXMemberOperatorCall::getCXXThisExpr() const { 845 return getOriginExpr()->getArg(0); 846} 847 848const BlockDataRegion *BlockCall::getBlockRegion() const { 849 const Expr *Callee = getOriginExpr()->getCallee(); 850 const MemRegion *DataReg = getSVal(Callee).getAsRegion(); 851 852 return dyn_cast_or_null<BlockDataRegion>(DataReg); 853} 854 855ArrayRef<ParmVarDecl*> BlockCall::parameters() const { 856 const BlockDecl *D = getDecl(); 857 if (!D) 858 return None; 859 return D->parameters(); 860} 861 862void BlockCall::getExtraInvalidatedValues(ValueList &Values, 863 RegionAndSymbolInvalidationTraits *ETraits) const { 864 // FIXME: This also needs to invalidate captured globals. 865 if (const MemRegion *R = getBlockRegion()) 866 Values.push_back(loc::MemRegionVal(R)); 867} 868 869void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx, 870 BindingsTy &Bindings) const { 871 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 872 ArrayRef<ParmVarDecl*> Params; 873 if (isConversionFromLambda()) { 874 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 875 Params = LambdaOperatorDecl->parameters(); 876 877 // For blocks converted from a C++ lambda, the callee declaration is the 878 // operator() method on the lambda so we bind "this" to 879 // the lambda captured by the block. 880 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda(); 881 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion); 882 Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx); 883 Bindings.push_back(std::make_pair(ThisLoc, ThisVal)); 884 } else { 885 Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters(); 886 } 887 888 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 889 Params); 890} 891 892SVal CXXConstructorCall::getCXXThisVal() const { 893 if (Data) 894 return loc::MemRegionVal(static_cast<const MemRegion *>(Data)); 895 return UnknownVal(); 896} 897 898void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values, 899 RegionAndSymbolInvalidationTraits *ETraits) const { 900 if (Data) { 901 loc::MemRegionVal MV(static_cast<const MemRegion *>(Data)); 902 if (SymbolRef Sym = MV.getAsSymbol(true)) 903 ETraits->setTrait(Sym, 904 RegionAndSymbolInvalidationTraits::TK_SuppressEscape); 905 Values.push_back(MV); 906 } 907} 908 909void CXXConstructorCall::getInitialStackFrameContents( 910 const StackFrameContext *CalleeCtx, 911 BindingsTy &Bindings) const { 912 AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings); 913 914 SVal ThisVal = getCXXThisVal(); 915 if (!ThisVal.isUnknown()) { 916 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 917 const auto *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 918 Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx); 919 Bindings.push_back(std::make_pair(ThisLoc, ThisVal)); 920 } 921} 922 923SVal CXXDestructorCall::getCXXThisVal() const { 924 if (Data) 925 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer()); 926 return UnknownVal(); 927} 928 929RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const { 930 // Base destructors are always called non-virtually. 931 // Skip CXXInstanceCall's devirtualization logic in this case. 932 if (isBaseDestructor()) 933 return AnyFunctionCall::getRuntimeDefinition(); 934 935 return CXXInstanceCall::getRuntimeDefinition(); 936} 937 938ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const { 939 const ObjCMethodDecl *D = getDecl(); 940 if (!D) 941 return None; 942 return D->parameters(); 943} 944 945void ObjCMethodCall::getExtraInvalidatedValues( 946 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const { 947 948 // If the method call is a setter for property known to be backed by 949 // an instance variable, don't invalidate the entire receiver, just 950 // the storage for that instance variable. 951 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) { 952 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) { 953 SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal()); 954 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) { 955 ETraits->setTrait( 956 IvarRegion, 957 RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion); 958 ETraits->setTrait( 959 IvarRegion, 960 RegionAndSymbolInvalidationTraits::TK_SuppressEscape); 961 Values.push_back(IvarLVal); 962 } 963 return; 964 } 965 } 966 967 Values.push_back(getReceiverSVal()); 968} 969 970SVal ObjCMethodCall::getSelfSVal() const { 971 const LocationContext *LCtx = getLocationContext(); 972 const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl(); 973 if (!SelfDecl) 974 return SVal(); 975 return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx)); 976} 977 978SVal ObjCMethodCall::getReceiverSVal() const { 979 // FIXME: Is this the best way to handle class receivers? 980 if (!isInstanceMessage()) 981 return UnknownVal(); 982 983 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver()) 984 return getSVal(RecE); 985 986 // An instance message with no expression means we are sending to super. 987 // In this case the object reference is the same as 'self'. 988 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance); 989 SVal SelfVal = getSelfSVal(); 990 assert(SelfVal.isValid() && "Calling super but not in ObjC method"); 991 return SelfVal; 992} 993 994bool ObjCMethodCall::isReceiverSelfOrSuper() const { 995 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance || 996 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass) 997 return true; 998 999 if (!isInstanceMessage()) 1000 return false; 1001 1002 SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver()); 1003 1004 return (RecVal == getSelfSVal()); 1005} 1006 1007SourceRange ObjCMethodCall::getSourceRange() const { 1008 switch (getMessageKind()) { 1009 case OCM_Message: 1010 return getOriginExpr()->getSourceRange(); 1011 case OCM_PropertyAccess: 1012 case OCM_Subscript: 1013 return getContainingPseudoObjectExpr()->getSourceRange(); 1014 } 1015 llvm_unreachable("unknown message kind"); 1016} 1017 1018using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>; 1019 1020const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const { 1021 assert(Data && "Lazy lookup not yet performed."); 1022 assert(getMessageKind() != OCM_Message && "Explicit message send."); 1023 return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer(); 1024} 1025 1026static const Expr * 1027getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) { 1028 const Expr *Syntactic = POE->getSyntacticForm(); 1029 1030 // This handles the funny case of assigning to the result of a getter. 1031 // This can happen if the getter returns a non-const reference. 1032 if (const auto *BO = dyn_cast<BinaryOperator>(Syntactic)) 1033 Syntactic = BO->getLHS(); 1034 1035 return Syntactic; 1036} 1037 1038ObjCMessageKind ObjCMethodCall::getMessageKind() const { 1039 if (!Data) { 1040 // Find the parent, ignoring implicit casts. 1041 const ParentMap &PM = getLocationContext()->getParentMap(); 1042 const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr()); 1043 1044 // Check if parent is a PseudoObjectExpr. 1045 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) { 1046 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE); 1047 1048 ObjCMessageKind K; 1049 switch (Syntactic->getStmtClass()) { 1050 case Stmt::ObjCPropertyRefExprClass: 1051 K = OCM_PropertyAccess; 1052 break; 1053 case Stmt::ObjCSubscriptRefExprClass: 1054 K = OCM_Subscript; 1055 break; 1056 default: 1057 // FIXME: Can this ever happen? 1058 K = OCM_Message; 1059 break; 1060 } 1061 1062 if (K != OCM_Message) { 1063 const_cast<ObjCMethodCall *>(this)->Data 1064 = ObjCMessageDataTy(POE, K).getOpaqueValue(); 1065 assert(getMessageKind() == K); 1066 return K; 1067 } 1068 } 1069 1070 const_cast<ObjCMethodCall *>(this)->Data 1071 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue(); 1072 assert(getMessageKind() == OCM_Message); 1073 return OCM_Message; 1074 } 1075 1076 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data); 1077 if (!Info.getPointer()) 1078 return OCM_Message; 1079 return static_cast<ObjCMessageKind>(Info.getInt()); 1080} 1081 1082const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const { 1083 // Look for properties accessed with property syntax (foo.bar = ...) 1084 if (getMessageKind() == OCM_PropertyAccess) { 1085 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr(); 1086 assert(POE && "Property access without PseudoObjectExpr?"); 1087 1088 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE); 1089 auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic); 1090 1091 if (RefExpr->isExplicitProperty()) 1092 return RefExpr->getExplicitProperty(); 1093 } 1094 1095 // Look for properties accessed with method syntax ([foo setBar:...]). 1096 const ObjCMethodDecl *MD = getDecl(); 1097 if (!MD || !MD->isPropertyAccessor()) 1098 return nullptr; 1099 1100 // Note: This is potentially quite slow. 1101 return MD->findPropertyDecl(); 1102} 1103 1104bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl, 1105 Selector Sel) const { 1106 assert(IDecl); 1107 AnalysisManager &AMgr = 1108 getState()->getStateManager().getOwningEngine().getAnalysisManager(); 1109 // If the class interface is declared inside the main file, assume it is not 1110 // subcassed. 1111 // TODO: It could actually be subclassed if the subclass is private as well. 1112 // This is probably very rare. 1113 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc(); 1114 if (InterfLoc.isValid() && AMgr.isInCodeFile(InterfLoc)) 1115 return false; 1116 1117 // Assume that property accessors are not overridden. 1118 if (getMessageKind() == OCM_PropertyAccess) 1119 return false; 1120 1121 // We assume that if the method is public (declared outside of main file) or 1122 // has a parent which publicly declares the method, the method could be 1123 // overridden in a subclass. 1124 1125 // Find the first declaration in the class hierarchy that declares 1126 // the selector. 1127 ObjCMethodDecl *D = nullptr; 1128 while (true) { 1129 D = IDecl->lookupMethod(Sel, true); 1130 1131 // Cannot find a public definition. 1132 if (!D) 1133 return false; 1134 1135 // If outside the main file, 1136 if (D->getLocation().isValid() && !AMgr.isInCodeFile(D->getLocation())) 1137 return true; 1138 1139 if (D->isOverriding()) { 1140 // Search in the superclass on the next iteration. 1141 IDecl = D->getClassInterface(); 1142 if (!IDecl) 1143 return false; 1144 1145 IDecl = IDecl->getSuperClass(); 1146 if (!IDecl) 1147 return false; 1148 1149 continue; 1150 } 1151 1152 return false; 1153 }; 1154 1155 llvm_unreachable("The while loop should always terminate."); 1156} 1157 1158static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) { 1159 if (!MD) 1160 return MD; 1161 1162 // Find the redeclaration that defines the method. 1163 if (!MD->hasBody()) { 1164 for (auto I : MD->redecls()) 1165 if (I->hasBody()) 1166 MD = cast<ObjCMethodDecl>(I); 1167 } 1168 return MD; 1169} 1170 1171static bool isCallToSelfClass(const ObjCMessageExpr *ME) { 1172 const Expr* InstRec = ME->getInstanceReceiver(); 1173 if (!InstRec) 1174 return false; 1175 const auto *InstRecIg = dyn_cast<DeclRefExpr>(InstRec->IgnoreParenImpCasts()); 1176 1177 // Check that receiver is called 'self'. 1178 if (!InstRecIg || !InstRecIg->getFoundDecl() || 1179 !InstRecIg->getFoundDecl()->getName().equals("self")) 1180 return false; 1181 1182 // Check that the method name is 'class'. 1183 if (ME->getSelector().getNumArgs() != 0 || 1184 !ME->getSelector().getNameForSlot(0).equals("class")) 1185 return false; 1186 1187 return true; 1188} 1189 1190RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const { 1191 const ObjCMessageExpr *E = getOriginExpr(); 1192 assert(E); 1193 Selector Sel = E->getSelector(); 1194 1195 if (E->isInstanceMessage()) { 1196 // Find the receiver type. 1197 const ObjCObjectPointerType *ReceiverT = nullptr; 1198 bool CanBeSubClassed = false; 1199 QualType SupersType = E->getSuperType(); 1200 const MemRegion *Receiver = nullptr; 1201 1202 if (!SupersType.isNull()) { 1203 // The receiver is guaranteed to be 'super' in this case. 1204 // Super always means the type of immediate predecessor to the method 1205 // where the call occurs. 1206 ReceiverT = cast<ObjCObjectPointerType>(SupersType); 1207 } else { 1208 Receiver = getReceiverSVal().getAsRegion(); 1209 if (!Receiver) 1210 return {}; 1211 1212 DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver); 1213 if (!DTI.isValid()) { 1214 assert(isa<AllocaRegion>(Receiver) && 1215 "Unhandled untyped region class!"); 1216 return {}; 1217 } 1218 1219 QualType DynType = DTI.getType(); 1220 CanBeSubClassed = DTI.canBeASubClass(); 1221 ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType()); 1222 1223 if (ReceiverT && CanBeSubClassed) 1224 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) 1225 if (!canBeOverridenInSubclass(IDecl, Sel)) 1226 CanBeSubClassed = false; 1227 } 1228 1229 // Handle special cases of '[self classMethod]' and 1230 // '[[self class] classMethod]', which are treated by the compiler as 1231 // instance (not class) messages. We will statically dispatch to those. 1232 if (auto *PT = dyn_cast_or_null<ObjCObjectPointerType>(ReceiverT)) { 1233 // For [self classMethod], return the compiler visible declaration. 1234 if (PT->getObjectType()->isObjCClass() && 1235 Receiver == getSelfSVal().getAsRegion()) 1236 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl())); 1237 1238 // Similarly, handle [[self class] classMethod]. 1239 // TODO: We are currently doing a syntactic match for this pattern with is 1240 // limiting as the test cases in Analysis/inlining/InlineObjCClassMethod.m 1241 // shows. A better way would be to associate the meta type with the symbol 1242 // using the dynamic type info tracking and use it here. We can add a new 1243 // SVal for ObjC 'Class' values that know what interface declaration they 1244 // come from. Then 'self' in a class method would be filled in with 1245 // something meaningful in ObjCMethodCall::getReceiverSVal() and we could 1246 // do proper dynamic dispatch for class methods just like we do for 1247 // instance methods now. 1248 if (E->getInstanceReceiver()) 1249 if (const auto *M = dyn_cast<ObjCMessageExpr>(E->getInstanceReceiver())) 1250 if (isCallToSelfClass(M)) 1251 return RuntimeDefinition(findDefiningRedecl(E->getMethodDecl())); 1252 } 1253 1254 // Lookup the instance method implementation. 1255 if (ReceiverT) 1256 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) { 1257 // Repeatedly calling lookupPrivateMethod() is expensive, especially 1258 // when in many cases it returns null. We cache the results so 1259 // that repeated queries on the same ObjCIntefaceDecl and Selector 1260 // don't incur the same cost. On some test cases, we can see the 1261 // same query being issued thousands of times. 1262 // 1263 // NOTE: This cache is essentially a "global" variable, but it 1264 // only gets lazily created when we get here. The value of the 1265 // cache probably comes from it being global across ExprEngines, 1266 // where the same queries may get issued. If we are worried about 1267 // concurrency, or possibly loading/unloading ASTs, etc., we may 1268 // need to revisit this someday. In terms of memory, this table 1269 // stays around until clang quits, which also may be bad if we 1270 // need to release memory. 1271 using PrivateMethodKey = std::pair<const ObjCInterfaceDecl *, Selector>; 1272 using PrivateMethodCache = 1273 llvm::DenseMap<PrivateMethodKey, Optional<const ObjCMethodDecl *>>; 1274 1275 static PrivateMethodCache PMC; 1276 Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)]; 1277 1278 // Query lookupPrivateMethod() if the cache does not hit. 1279 if (!Val.hasValue()) { 1280 Val = IDecl->lookupPrivateMethod(Sel); 1281 1282 // If the method is a property accessor, we should try to "inline" it 1283 // even if we don't actually have an implementation. 1284 if (!*Val) 1285 if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl()) 1286 if (CompileTimeMD->isPropertyAccessor()) { 1287 if (!CompileTimeMD->getSelfDecl() && 1288 isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) { 1289 // If the method is an accessor in a category, and it doesn't 1290 // have a self declaration, first 1291 // try to find the method in a class extension. This 1292 // works around a bug in Sema where multiple accessors 1293 // are synthesized for properties in class 1294 // extensions that are redeclared in a category and the 1295 // the implicit parameters are not filled in for 1296 // the method on the category. 1297 // This ensures we find the accessor in the extension, which 1298 // has the implicit parameters filled in. 1299 auto *ID = CompileTimeMD->getClassInterface(); 1300 for (auto *CatDecl : ID->visible_extensions()) { 1301 Val = CatDecl->getMethod(Sel, 1302 CompileTimeMD->isInstanceMethod()); 1303 if (*Val) 1304 break; 1305 } 1306 } 1307 if (!*Val) 1308 Val = IDecl->lookupInstanceMethod(Sel); 1309 } 1310 } 1311 1312 const ObjCMethodDecl *MD = Val.getValue(); 1313 if (MD && !MD->hasBody()) 1314 MD = MD->getCanonicalDecl(); 1315 if (CanBeSubClassed) 1316 return RuntimeDefinition(MD, Receiver); 1317 else 1318 return RuntimeDefinition(MD, nullptr); 1319 } 1320 } else { 1321 // This is a class method. 1322 // If we have type info for the receiver class, we are calling via 1323 // class name. 1324 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) { 1325 // Find/Return the method implementation. 1326 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel)); 1327 } 1328 } 1329 1330 return {}; 1331} 1332 1333bool ObjCMethodCall::argumentsMayEscape() const { 1334 if (isInSystemHeader() && !isInstanceMessage()) { 1335 Selector Sel = getSelector(); 1336 if (Sel.getNumArgs() == 1 && 1337 Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer")) 1338 return true; 1339 } 1340 1341 return CallEvent::argumentsMayEscape(); 1342} 1343 1344void ObjCMethodCall::getInitialStackFrameContents( 1345 const StackFrameContext *CalleeCtx, 1346 BindingsTy &Bindings) const { 1347 const auto *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl()); 1348 SValBuilder &SVB = getState()->getStateManager().getSValBuilder(); 1349 addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this, 1350 D->parameters()); 1351 1352 SVal SelfVal = getReceiverSVal(); 1353 if (!SelfVal.isUnknown()) { 1354 const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl(); 1355 MemRegionManager &MRMgr = SVB.getRegionManager(); 1356 Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx)); 1357 Bindings.push_back(std::make_pair(SelfLoc, SelfVal)); 1358 } 1359} 1360 1361CallEventRef<> 1362CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State, 1363 const LocationContext *LCtx) { 1364 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(CE)) 1365 return create<CXXMemberCall>(MCE, State, LCtx); 1366 1367 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) { 1368 const FunctionDecl *DirectCallee = OpCE->getDirectCallee(); 1369 if (const auto *MD = dyn_cast<CXXMethodDecl>(DirectCallee)) 1370 if (MD->isInstance()) 1371 return create<CXXMemberOperatorCall>(OpCE, State, LCtx); 1372 1373 } else if (CE->getCallee()->getType()->isBlockPointerType()) { 1374 return create<BlockCall>(CE, State, LCtx); 1375 } 1376 1377 // Otherwise, it's a normal function call, static member function call, or 1378 // something we can't reason about. 1379 return create<SimpleFunctionCall>(CE, State, LCtx); 1380} 1381 1382CallEventRef<> 1383CallEventManager::getCaller(const StackFrameContext *CalleeCtx, 1384 ProgramStateRef State) { 1385 const LocationContext *ParentCtx = CalleeCtx->getParent(); 1386 const LocationContext *CallerCtx = ParentCtx->getStackFrame(); 1387 assert(CallerCtx && "This should not be used for top-level stack frames"); 1388 1389 const Stmt *CallSite = CalleeCtx->getCallSite(); 1390 1391 if (CallSite) { 1392 if (CallEventRef<> Out = getCall(CallSite, State, CallerCtx)) 1393 return Out; 1394 1395 // All other cases are handled by getCall. 1396 assert(isa<CXXConstructExpr>(CallSite) && 1397 "This is not an inlineable statement"); 1398 1399 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 1400 const auto *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl()); 1401 Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx); 1402 SVal ThisVal = State->getSVal(ThisPtr); 1403 1404 return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite), 1405 ThisVal.getAsRegion(), State, CallerCtx); 1406 } 1407 1408 // Fall back to the CFG. The only thing we haven't handled yet is 1409 // destructors, though this could change in the future. 1410 const CFGBlock *B = CalleeCtx->getCallSiteBlock(); 1411 CFGElement E = (*B)[CalleeCtx->getIndex()]; 1412 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) && 1413 "All other CFG elements should have exprs"); 1414 1415 SValBuilder &SVB = State->getStateManager().getSValBuilder(); 1416 const auto *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl()); 1417 Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx); 1418 SVal ThisVal = State->getSVal(ThisPtr); 1419 1420 const Stmt *Trigger; 1421 if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>()) 1422 Trigger = AutoDtor->getTriggerStmt(); 1423 else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>()) 1424 Trigger = DeleteDtor->getDeleteExpr(); 1425 else 1426 Trigger = Dtor->getBody(); 1427 1428 return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(), 1429 E.getAs<CFGBaseDtor>().hasValue(), State, 1430 CallerCtx); 1431} 1432 1433CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State, 1434 const LocationContext *LC) { 1435 if (const auto *CE = dyn_cast<CallExpr>(S)) { 1436 return getSimpleCall(CE, State, LC); 1437 } else if (const auto *NE = dyn_cast<CXXNewExpr>(S)) { 1438 return getCXXAllocatorCall(NE, State, LC); 1439 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(S)) { 1440 return getObjCMethodCall(ME, State, LC); 1441 } else { 1442 return nullptr; 1443 } 1444} 1445