1//===- TaggedUnionModeling.h -------------------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#ifndef LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAGGEDUNIONMODELING_H
10#define LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAGGEDUNIONMODELING_H
11
12#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
13#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
14#include "clang/StaticAnalyzer/Core/Checker.h"
15#include "clang/StaticAnalyzer/Core/CheckerManager.h"
16#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
17#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
18#include <numeric>
19
20namespace clang::ento::tagged_union_modeling {
21
22// The implementation of all these functions can be found in the file
23// StdVariantChecker.cpp under the same directory as this file.
24
25bool isCopyConstructorCall(const CallEvent &Call);
26bool isCopyAssignmentCall(const CallEvent &Call);
27bool isMoveAssignmentCall(const CallEvent &Call);
28bool isMoveConstructorCall(const CallEvent &Call);
29bool isStdType(const Type *Type, const std::string &TypeName);
30bool isStdVariant(const Type *Type);
31
32// When invalidating regions, we also have to follow that by invalidating the
33// corresponding custom data in the program state.
34template <class TypeMap>
35ProgramStateRef
36removeInformationStoredForDeadInstances(const CallEvent &Call,
37 ProgramStateRef State,
38 ArrayRef<const MemRegion *> Regions) {
39 // If we do not know anything about the call we shall not continue.
40 // If the call is happens within a system header it is implementation detail.
41 // We should not take it into consideration.
42 if (Call.isInSystemHeader())
43 return State;
44
45 for (const MemRegion *Region : Regions)
46 State = State->remove<TypeMap>(Region);
47
48 return State;
49}
50
51template <class TypeMap>
52void handleConstructorAndAssignment(const CallEvent &Call, CheckerContext &C,
53 SVal ThisSVal) {
54 ProgramStateRef State = C.getState();
55
56 if (!State)
57 return;
58
59 auto ArgSVal = Call.getArgSVal(Index: 0);
60 const auto *ThisRegion = ThisSVal.getAsRegion();
61 const auto *ArgMemRegion = ArgSVal.getAsRegion();
62
63 // Make changes to the state according to type of constructor/assignment
64 bool IsCopy = isCopyConstructorCall(Call) || isCopyAssignmentCall(Call);
65 bool IsMove = isMoveConstructorCall(Call) || isMoveAssignmentCall(Call);
66 // First we handle copy and move operations
67 if (IsCopy || IsMove) {
68 const QualType *OtherQType = State->get<TypeMap>(ArgMemRegion);
69
70 // If the argument of a copy constructor or assignment is unknown then
71 // we will not know the argument of the copied to object.
72 if (!OtherQType) {
73 State = State->remove<TypeMap>(ThisRegion);
74 } else {
75 // When move semantics is used we can only know that the moved from
76 // object must be in a destructible state. Other usage of the object
77 // than destruction is undefined.
78 if (IsMove)
79 State = State->remove<TypeMap>(ArgMemRegion);
80
81 State = State->set<TypeMap>(ThisRegion, *OtherQType);
82 }
83 } else {
84 // Value constructor
85 auto ArgQType = ArgSVal.getType(C.getASTContext());
86 const Type *ArgTypePtr = ArgQType.getTypePtr();
87
88 QualType WoPointer = ArgTypePtr->getPointeeType();
89 State = State->set<TypeMap>(ThisRegion, WoPointer);
90 }
91
92 C.addTransition(State);
93}
94
95} // namespace clang::ento::tagged_union_modeling
96
97#endif // LLVM_CLANG_LIB_STATICANALYZER_CHECKERS_TAGGEDUNIONMODELING_H
98