1//===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9/// \file This file defines CallEvent and its subclasses, which represent path-
10/// sensitive instances of different kinds of function and method calls
11/// (C, C++, and Objective-C).
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16#include "clang/AST/ASTContext.h"
17#include "clang/AST/Attr.h"
18#include "clang/AST/Decl.h"
19#include "clang/AST/DeclBase.h"
20#include "clang/AST/DeclCXX.h"
21#include "clang/AST/DeclObjC.h"
22#include "clang/AST/Expr.h"
23#include "clang/AST/ExprCXX.h"
24#include "clang/AST/ExprObjC.h"
25#include "clang/AST/ParentMap.h"
26#include "clang/AST/Stmt.h"
27#include "clang/AST/Type.h"
28#include "clang/Analysis/AnalysisDeclContext.h"
29#include "clang/Analysis/CFG.h"
30#include "clang/Analysis/CFGStmtMap.h"
31#include "clang/Analysis/PathDiagnostic.h"
32#include "clang/Analysis/ProgramPoint.h"
33#include "clang/Basic/IdentifierTable.h"
34#include "clang/Basic/LLVM.h"
35#include "clang/Basic/SourceLocation.h"
36#include "clang/Basic/Specifiers.h"
37#include "clang/CrossTU/CrossTranslationUnit.h"
38#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
39#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
41#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
42#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
43#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
44#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
45#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
46#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
47#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
48#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
49#include "llvm/ADT/ArrayRef.h"
50#include "llvm/ADT/DenseMap.h"
51#include "llvm/ADT/ImmutableList.h"
52#include "llvm/ADT/PointerIntPair.h"
53#include "llvm/ADT/SmallSet.h"
54#include "llvm/ADT/SmallVector.h"
55#include "llvm/ADT/StringExtras.h"
56#include "llvm/ADT/StringRef.h"
57#include "llvm/Support/Compiler.h"
58#include "llvm/Support/Debug.h"
59#include "llvm/Support/ErrorHandling.h"
60#include "llvm/Support/raw_ostream.h"
61#include <cassert>
62#include <optional>
63#include <utility>
64
65#define DEBUG_TYPE "static-analyzer-call-event"
66
67using namespace clang;
68using namespace ento;
69
70QualType CallEvent::getResultType() const {
71 ASTContext &Ctx = getState()->getStateManager().getContext();
72 const Expr *E = getOriginExpr();
73 if (!E)
74 return Ctx.VoidTy;
75 return Ctx.getReferenceQualifiedType(e: E);
76}
77
78static bool isCallback(QualType T) {
79 // If a parameter is a block or a callback, assume it can modify pointer.
80 if (T->isBlockPointerType() ||
81 T->isFunctionPointerType() ||
82 T->isObjCSelType())
83 return true;
84
85 // Check if a callback is passed inside a struct (for both, struct passed by
86 // reference and by value). Dig just one level into the struct for now.
87
88 if (T->isAnyPointerType() || T->isReferenceType())
89 T = T->getPointeeType();
90
91 if (const RecordType *RT = T->getAsStructureType()) {
92 const RecordDecl *RD = RT->getDecl()->getDefinitionOrSelf();
93 for (const auto *I : RD->fields()) {
94 QualType FieldT = I->getType();
95 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
96 return true;
97 }
98 }
99 return false;
100}
101
102static bool isVoidPointerToNonConst(QualType T) {
103 if (const auto *PT = T->getAs<PointerType>()) {
104 QualType PointeeTy = PT->getPointeeType();
105 if (PointeeTy.isConstQualified())
106 return false;
107 return PointeeTy->isVoidType();
108 } else
109 return false;
110}
111
112bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
113 unsigned NumOfArgs = getNumArgs();
114
115 // If calling using a function pointer, assume the function does not
116 // satisfy the callback.
117 // TODO: We could check the types of the arguments here.
118 if (!getDecl())
119 return false;
120
121 unsigned Idx = 0;
122 for (CallEvent::param_type_iterator I = param_type_begin(),
123 E = param_type_end();
124 I != E && Idx < NumOfArgs; ++I, ++Idx) {
125 // If the parameter is 0, it's harmless.
126 if (getArgSVal(Index: Idx).isZeroConstant())
127 continue;
128
129 if (Condition(*I))
130 return true;
131 }
132 return false;
133}
134
135bool CallEvent::hasNonZeroCallbackArg() const {
136 return hasNonNullArgumentsWithType(Condition: isCallback);
137}
138
139bool CallEvent::hasVoidPointerToNonConstArg() const {
140 return hasNonNullArgumentsWithType(Condition: isVoidPointerToNonConst);
141}
142
143bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
144 const auto *FD = dyn_cast_or_null<FunctionDecl>(Val: getDecl());
145 if (!FD)
146 return false;
147
148 return CheckerContext::isCLibraryFunction(FD, Name: FunctionName);
149}
150
151AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const {
152 const Decl *D = getDecl();
153 if (!D)
154 return nullptr;
155
156 AnalysisDeclContext *ADC =
157 SF->getAnalysisDeclContext()->getManager()->getContext(D);
158
159 return ADC;
160}
161
162const StackFrame *CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
163 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext();
164 if (!ADC)
165 return nullptr;
166
167 const Expr *E = getOriginExpr();
168 if (!E)
169 return nullptr;
170
171 // Recover CFG block via reverse lookup.
172 // TODO: If we were to keep CFG element information as part of the CallEvent
173 // instead of doing this reverse lookup, we would be able to build the stack
174 // frame for non-expression-based calls, and also we wouldn't need the reverse
175 // lookup.
176 const CFGStmtMap *Map = SF->getAnalysisDeclContext()->getCFGStmtMap();
177 const CFGBlock *B = Map->getBlock(S: E);
178 assert(B);
179
180 // Also recover CFG index by scanning the CFG block.
181 unsigned Idx = 0, Sz = B->size();
182 for (; Idx < Sz; ++Idx)
183 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
184 if (StmtElem->getStmt() == E)
185 break;
186 assert(Idx < Sz);
187
188 return ADC->getStackFrame(ParentSF: SF, Data: nullptr, E, Blk: B, BlockCount, Index: Idx);
189}
190
191const ParamVarRegion
192*CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
193 const StackFrame *SF = getCalleeStackFrame(BlockCount);
194 // We cannot construct a VarRegion without a stack frame.
195 if (!SF)
196 return nullptr;
197
198 const ParamVarRegion *PVR =
199 State->getStateManager().getRegionManager().getParamVarRegion(
200 OriginExpr: getOriginExpr(), Index, SF);
201 return PVR;
202}
203
204/// Returns true if a type is a pointer-to-const or reference-to-const
205/// with no further indirection.
206static bool isPointerToConst(QualType Ty) {
207 QualType PointeeTy = Ty->getPointeeType();
208 if (PointeeTy == QualType())
209 return false;
210 if (!PointeeTy.isConstQualified())
211 return false;
212 if (PointeeTy->isAnyPointerType())
213 return false;
214 return true;
215}
216
217// Try to retrieve the function declaration and find the function parameter
218// types which are pointers/references to a non-pointer const.
219// We will not invalidate the corresponding argument regions.
220static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
221 const CallEvent &Call) {
222 unsigned Idx = 0;
223 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
224 E = Call.param_type_end();
225 I != E; ++I, ++Idx) {
226 if (isPointerToConst(Ty: *I))
227 PreserveArgs.insert(V: Idx);
228 }
229}
230
231static const MemRegion *getThisRegionBaseOrNull(const CallEvent &Call) {
232 if (const auto *CtorCall = dyn_cast<CXXConstructorCall>(Val: &Call)) {
233 if (const MemRegion *R = CtorCall->getCXXThisVal().getAsRegion())
234 return R->getBaseRegion();
235 }
236 return nullptr;
237}
238
239ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
240 ProgramStateRef State) const {
241 // Don't invalidate anything if the callee is marked pure/const.
242 if (const Decl *Callee = getDecl())
243 if (Callee->hasAttr<PureAttr>() || Callee->hasAttr<ConstAttr>())
244 return State;
245
246 SmallVector<SVal, 8> ValuesToInvalidate;
247 RegionAndSymbolInvalidationTraits ETraits;
248
249 getExtraInvalidatedValues(Values&: ValuesToInvalidate, ETraits: &ETraits);
250
251 // Indexes of arguments whose values will be preserved by the call.
252 llvm::SmallSet<unsigned, 4> PreserveArgs;
253 if (!argumentsMayEscape())
254 findPtrToConstParams(PreserveArgs, Call: *this);
255
256 // We should not preserve the contents of the region pointed by "this" when
257 // constructing the object, even if an argument refers to it.
258 const auto *ThisRegionBaseOrNull = getThisRegionBaseOrNull(Call: *this);
259
260 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
261 // Mark this region for invalidation. We batch invalidate regions
262 // below for efficiency.
263 if (PreserveArgs.count(V: Idx)) {
264 if (const MemRegion *ArgBaseR = getArgSVal(Index: Idx).getAsRegion()) {
265 ArgBaseR = ArgBaseR->getBaseRegion();
266
267 // Preserve the contents of the pointee of the argument - except if it
268 // refers to the object under construction (ctor call).
269 if (ArgBaseR != ThisRegionBaseOrNull) {
270 ETraits.setTrait(
271 MR: ArgBaseR, IK: RegionAndSymbolInvalidationTraits::TK_PreserveContents);
272 // TODO: Factor this out + handle the lower level const pointers.
273 }
274 }
275 }
276
277 ValuesToInvalidate.push_back(Elt: getArgSVal(Index: Idx));
278
279 // If a function accepts an object by argument (which would of course be a
280 // temporary that isn't lifetime-extended), invalidate the object itself,
281 // not only other objects reachable from it. This is necessary because the
282 // destructor has access to the temporary object after the call.
283 // TODO: Support placement arguments once we start
284 // constructing them directly.
285 // TODO: This is unnecessary when there's no destructor, but that's
286 // currently hard to figure out.
287 if (getKind() != CE_CXXAllocator)
288 if (isArgumentConstructedDirectly(Index: Idx))
289 if (auto AdjIdx = getAdjustedParameterIndex(ASTArgumentIndex: Idx))
290 if (const TypedValueRegion *TVR =
291 getParameterLocation(Index: *AdjIdx, BlockCount))
292 ValuesToInvalidate.push_back(Elt: loc::MemRegionVal(TVR));
293 }
294
295 // Invalidate designated regions using the batch invalidation API.
296 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
297 // global variables.
298 return State->invalidateRegions(Values: ValuesToInvalidate, Elem: getCFGElementRef(),
299 BlockCount, SF: getStackFrame(),
300 /*CausedByPointerEscape*/ CausesPointerEscape: true,
301 /*Symbols=*/IS: nullptr, Call: this, ITraits: &ETraits);
302}
303
304ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
305 const ProgramPointTag *Tag) const {
306
307 if (const Expr *E = getOriginExpr()) {
308 if (IsPreVisit)
309 return PreStmt(E, getStackFrame(), Tag);
310 return PostStmt(E, getStackFrame(), Tag);
311 }
312
313 const Decl *D = getDecl();
314 assert(D && "Cannot get a program point without a statement or decl");
315 assert(ElemRef.getParent() &&
316 "Cannot get a program point without a CFGElementRef");
317
318 SourceLocation Loc = getSourceRange().getBegin();
319 if (IsPreVisit)
320 return PreImplicitCall(D, Loc, getStackFrame(), ElemRef, Tag);
321 return PostImplicitCall(D, Loc, getStackFrame(), ElemRef, Tag);
322}
323
324SVal CallEvent::getArgSVal(unsigned Index) const {
325 const Expr *ArgE = getArgExpr(Index);
326 if (!ArgE)
327 return UnknownVal();
328 return getSVal(E: ArgE);
329}
330
331SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
332 const Expr *ArgE = getArgExpr(Index);
333 if (!ArgE)
334 return {};
335 return ArgE->getSourceRange();
336}
337
338SVal CallEvent::getReturnValue() const {
339 const Expr *E = getOriginExpr();
340 if (!E)
341 return UndefinedVal();
342 return getSVal(E);
343}
344
345LLVM_DUMP_METHOD void CallEvent::dump() const { dump(Out&: llvm::errs()); }
346
347void CallEvent::dump(raw_ostream &Out) const {
348 ASTContext &Ctx = getState()->getStateManager().getContext();
349 if (const Expr *E = getOriginExpr()) {
350 E->printPretty(OS&: Out, Helper: nullptr, Policy: Ctx.getPrintingPolicy());
351 return;
352 }
353
354 if (const Decl *D = getDecl()) {
355 Out << "Call to ";
356 D->print(Out, Policy: Ctx.getPrintingPolicy());
357 return;
358 }
359
360 Out << "Unknown call (type " << getKindAsString() << ")";
361}
362
363bool CallEvent::isCallStmt(const Stmt *S) {
364 return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(Val: S);
365}
366
367QualType CallEvent::getDeclaredResultType(const Decl *D) {
368 assert(D);
369 if (const auto *FD = dyn_cast<FunctionDecl>(Val: D))
370 return FD->getReturnType();
371 if (const auto *MD = dyn_cast<ObjCMethodDecl>(Val: D))
372 return MD->getReturnType();
373 if (const auto *BD = dyn_cast<BlockDecl>(Val: D)) {
374 // Blocks are difficult because the return type may not be stored in the
375 // BlockDecl itself. The AST should probably be enhanced, but for now we
376 // just do what we can.
377 // If the block is declared without an explicit argument list, the
378 // signature-as-written just includes the return type, not the entire
379 // function type.
380 // FIXME: All blocks should have signatures-as-written, even if the return
381 // type is inferred. (That's signified with a dependent result type.)
382 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
383 QualType Ty = TSI->getType();
384 if (const FunctionType *FT = Ty->getAs<FunctionType>())
385 Ty = FT->getReturnType();
386 if (!Ty->isDependentType())
387 return Ty;
388 }
389
390 return {};
391 }
392
393 llvm_unreachable("unknown callable kind");
394}
395
396bool CallEvent::isVariadic(const Decl *D) {
397 assert(D);
398
399 if (const auto *FD = dyn_cast<FunctionDecl>(Val: D))
400 return FD->isVariadic();
401 if (const auto *MD = dyn_cast<ObjCMethodDecl>(Val: D))
402 return MD->isVariadic();
403 if (const auto *BD = dyn_cast<BlockDecl>(Val: D))
404 return BD->isVariadic();
405
406 llvm_unreachable("unknown callable kind");
407}
408
409static bool isTransparentUnion(QualType T) {
410 const RecordType *UT = T->getAsUnionType();
411 return UT &&
412 UT->getDecl()->getMostRecentDecl()->hasAttr<TransparentUnionAttr>();
413}
414
415// In some cases, symbolic cases should be transformed before we associate
416// them with parameters. This function incapsulates such cases.
417static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
418 const ParmVarDecl *Parameter, SValBuilder &SVB) {
419 QualType ParamType = Parameter->getType();
420 QualType ArgumentType = ArgumentExpr->getType();
421
422 // Transparent unions allow users to easily convert values of union field
423 // types into union-typed objects.
424 //
425 // Also, more importantly, they allow users to define functions with different
426 // different parameter types, substituting types matching transparent union
427 // field types with the union type itself.
428 //
429 // Here, we check specifically for latter cases and prevent binding
430 // field-typed values to union-typed regions.
431 if (isTransparentUnion(T: ParamType) &&
432 // Let's check that we indeed trying to bind different types.
433 !isTransparentUnion(T: ArgumentType)) {
434 BasicValueFactory &BVF = SVB.getBasicValueFactory();
435
436 llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
437 CompoundSVals = BVF.prependSVal(X: Value, L: CompoundSVals);
438
439 // Wrap it with compound value.
440 return SVB.makeCompoundVal(type: ParamType, vals: CompoundSVals);
441 }
442
443 return Value;
444}
445
446/// Cast the argument value to the type of the parameter at the function
447/// declaration.
448/// Returns the argument value if it didn't need a cast.
449/// Or returns the cast argument if it needed a cast.
450/// Or returns 'Unknown' if it would need a cast but the callsite and the
451/// runtime definition don't match in terms of argument and parameter count.
452static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx,
453 SVal ArgVal, SValBuilder &SVB) {
454 const auto *CallExprDecl = dyn_cast_or_null<FunctionDecl>(Val: Call.getDecl());
455 if (!CallExprDecl)
456 return ArgVal;
457
458 const FunctionDecl *Definition = CallExprDecl;
459 Definition->hasBody(Definition);
460
461 // The function decl of the Call (in the AST) will not have any parameter
462 // declarations, if it was 'only' declared without a prototype. However, the
463 // engine will find the appropriate runtime definition - basically a
464 // redeclaration, which has a function body (and a function prototype).
465 if (CallExprDecl->hasPrototype() || !Definition->hasPrototype())
466 return ArgVal;
467
468 // Only do this cast if the number arguments at the callsite matches with
469 // the parameters at the runtime definition.
470 if (Call.getNumArgs() != Definition->getNumParams())
471 return UnknownVal();
472
473 const Expr *ArgExpr = Call.getArgExpr(Index: ArgIdx);
474 const ParmVarDecl *Param = Definition->getParamDecl(i: ArgIdx);
475 return SVB.evalCast(V: ArgVal, CastTy: Param->getType(), OriginalTy: ArgExpr->getType());
476}
477
478static void addParameterValuesToBindings(const StackFrame *CalleeSF,
479 CallEvent::BindingsTy &Bindings,
480 SValBuilder &SVB,
481 const CallEvent &Call,
482 ArrayRef<ParmVarDecl *> parameters) {
483 MemRegionManager &MRMgr = SVB.getRegionManager();
484
485 // If the function has fewer parameters than the call has arguments, we simply
486 // do not bind any values to them.
487 unsigned NumArgs = Call.getNumArgs();
488 unsigned Idx = 0;
489 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
490 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
491 assert(*I && "Formal parameter has no decl?");
492
493 // TODO: Support allocator calls.
494 if (Call.getKind() != CE_CXXAllocator)
495 if (Call.isArgumentConstructedDirectly(Index: Call.getASTArgumentIndex(CallArgumentIndex: Idx)))
496 continue;
497
498 // TODO: Allocators should receive the correct size and possibly alignment,
499 // determined in compile-time but not represented as arg-expressions,
500 // which makes getArgSVal() fail and return UnknownVal.
501 SVal ArgVal = Call.getArgSVal(Index: Idx);
502 const Expr *ArgExpr = Call.getArgExpr(Index: Idx);
503
504 if (ArgVal.isUnknown())
505 continue;
506
507 // Cast the argument value to match the type of the parameter in some
508 // edge-cases.
509 ArgVal = castArgToParamTypeIfNeeded(Call, ArgIdx: Idx, ArgVal, SVB);
510
511 Loc ParamLoc = SVB.makeLoc(
512 region: MRMgr.getParamVarRegion(OriginExpr: Call.getOriginExpr(), Index: Idx, SF: CalleeSF));
513 Bindings.push_back(
514 Elt: std::make_pair(x&: ParamLoc, y: processArgument(Value: ArgVal, ArgumentExpr: ArgExpr, Parameter: *I, SVB)));
515 }
516
517 // FIXME: Variadic arguments are not handled at all right now.
518}
519
520const ConstructionContext *CallEvent::getConstructionContext() const {
521 const StackFrame *StackFrame = getCalleeStackFrame(BlockCount: 0);
522 if (!StackFrame)
523 return nullptr;
524
525 const CFGElement Element = StackFrame->getCallSiteCFGElement();
526 if (const auto Ctor = Element.getAs<CFGConstructor>()) {
527 return Ctor->getConstructionContext();
528 }
529
530 if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
531 return RecCall->getConstructionContext();
532 }
533
534 return nullptr;
535}
536
537const CallEventRef<> CallEvent::getCaller() const {
538 const auto *CallSF = this->getStackFrame();
539 if (!CallSF || CallSF->inTopFrame())
540 return nullptr;
541
542 CallEventManager &CEMgr = State->getStateManager().getCallEventManager();
543 return CEMgr.getCaller(CalleeSF: CallSF, State);
544}
545
546bool CallEvent::isCalledFromSystemHeader() const {
547 if (const CallEventRef<> Caller = getCaller())
548 return Caller->isInSystemHeader();
549
550 return false;
551}
552
553std::optional<SVal> CallEvent::getReturnValueUnderConstruction() const {
554 const auto *CC = getConstructionContext();
555 if (!CC)
556 return std::nullopt;
557
558 EvalCallOptions CallOpts;
559 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
560 unsigned NumVisitedCall =
561 Engine.getNumVisited(SF: getStackFrame(), Block: getCFGElementRef().getParent());
562 SVal RetVal = Engine.computeObjectUnderConstruction(
563 E: getOriginExpr(), State: getState(), NumVisitedCaller: NumVisitedCall, SF: getStackFrame(), CC,
564 CallOpts);
565 return RetVal;
566}
567
568ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
569 const FunctionDecl *D = getDecl();
570 if (!D)
571 return {};
572 return D->parameters();
573}
574
575RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
576 const FunctionDecl *FD = getDecl();
577 if (!FD)
578 return {};
579
580 // Note that the AnalysisDeclContext will have the FunctionDecl with
581 // the definition (if one exists).
582 AnalysisDeclContext *AD =
583 getStackFrame()->getAnalysisDeclContext()->getManager()->getContext(D: FD);
584 bool IsAutosynthesized;
585 Stmt* Body = AD->getBody(IsAutosynthesized);
586 LLVM_DEBUG({
587 if (IsAutosynthesized)
588 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
589 << "\n";
590 });
591
592 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
593 cross_tu::CrossTranslationUnitContext &CTUCtx =
594 *Engine.getCrossTranslationUnitContext();
595
596 AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
597
598 if (Body) {
599 const Decl* Decl = AD->getDecl();
600 if (Opts.IsNaiveCTUEnabled && CTUCtx.isImportedAsNew(ToDecl: Decl)) {
601 // A newly created definition, but we had error(s) during the import.
602 if (CTUCtx.hasError(ToDecl: Decl))
603 return {};
604 return RuntimeDefinition(Decl, /*Foreign=*/true);
605 }
606 return RuntimeDefinition(Decl, /*Foreign=*/false);
607 }
608
609 // Try to get CTU definition only if CTUDir is provided.
610 if (!Opts.IsNaiveCTUEnabled)
611 return {};
612
613 llvm::Expected<const FunctionDecl *> CTUDeclOrError =
614 CTUCtx.getCrossTUDefinition(FD, CrossTUDir: Opts.CTUDir, IndexName: Opts.CTUIndexName,
615 DisplayCTUProgress: Opts.DisplayCTUProgress);
616
617 if (!CTUDeclOrError) {
618 handleAllErrors(E: CTUDeclOrError.takeError(),
619 Handlers: [&](const cross_tu::IndexError &IE) {
620 auto Loc = getOriginExpr() ? getOriginExpr()->getExprLoc()
621 : FD->getLocation();
622 CTUCtx.emitCrossTUDiagnostics(IE, Loc);
623 });
624 return {};
625 }
626
627 return RuntimeDefinition(*CTUDeclOrError, /*Foreign=*/true);
628}
629
630void AnyFunctionCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
631 BindingsTy &Bindings) const {
632 const auto *D = cast<FunctionDecl>(Val: CalleeSF->getDecl());
633 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
634 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: D->parameters());
635}
636
637bool AnyFunctionCall::argumentsMayEscape() const {
638 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
639 return true;
640
641 const FunctionDecl *D = getDecl();
642 if (!D)
643 return true;
644
645 const IdentifierInfo *II = D->getIdentifier();
646 if (!II)
647 return false;
648
649 // This set of "escaping" APIs is
650
651 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
652 // value into thread local storage. The value can later be retrieved with
653 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
654 // parameter is 'const void *', the region escapes through the call.
655 if (II->isStr(Str: "pthread_setspecific"))
656 return true;
657
658 // - xpc_connection_set_context stores a value which can be retrieved later
659 // with xpc_connection_get_context.
660 if (II->isStr(Str: "xpc_connection_set_context"))
661 return true;
662
663 // - funopen - sets a buffer for future IO calls.
664 if (II->isStr(Str: "funopen"))
665 return true;
666
667 // - __cxa_demangle - can reallocate memory and can return the pointer to
668 // the input buffer.
669 if (II->isStr(Str: "__cxa_demangle"))
670 return true;
671
672 StringRef FName = II->getName();
673
674 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
675 // buffer even if it is const.
676 if (FName.ends_with(Suffix: "NoCopy"))
677 return true;
678
679 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
680 // be deallocated by NSMapRemove.
681 if (FName.starts_with(Prefix: "NS") && FName.contains(Other: "Insert"))
682 return true;
683
684 // - Many CF containers allow objects to escape through custom
685 // allocators/deallocators upon container construction. (PR12101)
686 if (FName.starts_with(Prefix: "CF") || FName.starts_with(Prefix: "CG")) {
687 return FName.contains_insensitive(Other: "InsertValue") ||
688 FName.contains_insensitive(Other: "AddValue") ||
689 FName.contains_insensitive(Other: "SetValue") ||
690 FName.contains_insensitive(Other: "WithData") ||
691 FName.contains_insensitive(Other: "AppendValue") ||
692 FName.contains_insensitive(Other: "SetAttribute");
693 }
694
695 return false;
696}
697
698const FunctionDecl *SimpleFunctionCall::getDecl() const {
699 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
700 if (D)
701 return D;
702
703 return getSVal(E: getOriginExpr()->getCallee()).getAsFunctionDecl();
704}
705
706RuntimeDefinition SimpleFunctionCall::getRuntimeDefinition() const {
707 // Clang converts lambdas to function pointers using an implicit conversion
708 // operator, which returns the lambda's '__invoke' method. However, Sema
709 // leaves the body of '__invoke' empty (it is generated later in CodeGen), so
710 // we need to skip '__invoke' and access the lambda's operator() directly.
711 if (const auto *CMD = dyn_cast_if_present<CXXMethodDecl>(Val: getDecl());
712 CMD && CMD->isLambdaStaticInvoker())
713 return RuntimeDefinition{CMD->getParent()->getLambdaCallOperator()};
714
715 return AnyFunctionCall::getRuntimeDefinition();
716}
717
718const FunctionDecl *CXXInstanceCall::getDecl() const {
719 const auto *CE = cast_or_null<CallExpr>(Val: getOriginExpr());
720 if (!CE)
721 return AnyFunctionCall::getDecl();
722
723 const FunctionDecl *D = CE->getDirectCallee();
724 if (D)
725 return D;
726
727 return getSVal(E: CE->getCallee()).getAsFunctionDecl();
728}
729
730void CXXInstanceCall::getExtraInvalidatedValues(
731 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
732 SVal ThisVal = getCXXThisVal();
733 Values.push_back(Elt: ThisVal);
734
735 // Don't invalidate if the method is const and there are no mutable fields.
736 if (const auto *D = cast_or_null<CXXMethodDecl>(Val: getDecl())) {
737 if (!D->isConst())
738 return;
739
740 // Get the record decl for the class of 'This'. D->getParent() may return
741 // a base class decl, rather than the class of the instance which needs to
742 // be checked for mutable fields.
743 const CXXRecordDecl *ParentRecord = getDeclForDynamicType().first;
744 if (!ParentRecord || !ParentRecord->hasDefinition())
745 return;
746
747 if (ParentRecord->hasMutableFields())
748 return;
749
750 // Preserve CXXThis.
751 const MemRegion *ThisRegion = ThisVal.getAsRegion();
752 if (!ThisRegion)
753 return;
754
755 ETraits->setTrait(MR: ThisRegion->getBaseRegion(),
756 IK: RegionAndSymbolInvalidationTraits::TK_PreserveContents);
757 }
758}
759
760SVal CXXInstanceCall::getCXXThisVal() const {
761 const Expr *Base = getCXXThisExpr();
762 // FIXME: This doesn't handle an overloaded ->* operator.
763 SVal ThisVal = Base ? getSVal(E: Base) : UnknownVal();
764
765 if (isa<NonLoc>(Val: ThisVal)) {
766 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
767 QualType OriginalTy = ThisVal.getType(SVB.getContext());
768 return SVB.evalCast(V: ThisVal, CastTy: Base->getType(), OriginalTy);
769 }
770
771 assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal));
772 return ThisVal;
773}
774
775std::pair<const CXXRecordDecl *, bool>
776CXXInstanceCall::getDeclForDynamicType() const {
777 const MemRegion *R = getCXXThisVal().getAsRegion();
778 if (!R)
779 return {};
780
781 DynamicTypeInfo DynType = getDynamicTypeInfo(State: getState(), MR: R);
782 if (!DynType.isValid())
783 return {};
784
785 assert(!DynType.getType()->getPointeeType().isNull());
786 return {DynType.getType()->getPointeeCXXRecordDecl(),
787 DynType.canBeASubClass()};
788}
789
790RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
791 // Do we have a decl at all?
792 const Decl *D = getDecl();
793 if (!D)
794 return {};
795
796 // If the method is non-virtual, we know we can inline it.
797 const auto *MD = cast<CXXMethodDecl>(Val: D);
798 if (!MD->isVirtual())
799 return AnyFunctionCall::getRuntimeDefinition();
800
801 auto [RD, CanBeSubClass] = getDeclForDynamicType();
802 if (!RD || !RD->hasDefinition())
803 return {};
804
805 // Find the decl for this method in that class.
806 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, MayBeBase: true);
807 if (!Result) {
808 // We might not even get the original statically-resolved method due to
809 // some particularly nasty casting (e.g. casts to sister classes).
810 // However, we should at least be able to search up and down our own class
811 // hierarchy, and some real bugs have been caught by checking this.
812 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
813
814 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
815 // the static type. However, because we currently don't update
816 // DynamicTypeInfo when an object is cast, we can't actually be sure the
817 // DynamicTypeInfo is up to date. This assert should be re-enabled once
818 // this is fixed.
819 //
820 // assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
821
822 return {};
823 }
824
825 // Does the decl that we found have an implementation?
826 const FunctionDecl *Definition;
827 if (!Result->hasBody(Definition)) {
828 if (!CanBeSubClass)
829 return AnyFunctionCall::getRuntimeDefinition();
830 return {};
831 }
832
833 // We found a definition. If we're not sure that this devirtualization is
834 // actually what will happen at runtime, make sure to provide the region so
835 // that ExprEngine can decide what to do with it.
836 if (CanBeSubClass)
837 return RuntimeDefinition(Definition,
838 getCXXThisVal().getAsRegion()->StripCasts());
839 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
840}
841
842void CXXInstanceCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
843 BindingsTy &Bindings) const {
844 AnyFunctionCall::getInitialStackFrameContents(CalleeSF, Bindings);
845
846 // Handle the binding of 'this' in the new stack frame.
847 SVal ThisVal = getCXXThisVal();
848 if (!ThisVal.isUnknown()) {
849 ProgramStateManager &StateMgr = getState()->getStateManager();
850 SValBuilder &SVB = StateMgr.getSValBuilder();
851
852 const auto *MD = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
853 Loc ThisLoc = SVB.getCXXThis(D: MD, SF: CalleeSF);
854
855 // If we devirtualized to a different member function, we need to make sure
856 // we have the proper layering of CXXBaseObjectRegions.
857 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
858 ASTContext &Ctx = SVB.getContext();
859 const CXXRecordDecl *Class = MD->getParent();
860 CanQualType Ty = Ctx.getPointerType(T: Ctx.getCanonicalTagType(TD: Class));
861
862 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
863 std::optional<SVal> V =
864 StateMgr.getStoreManager().evalBaseToDerived(Base: ThisVal, DerivedPtrType: Ty);
865 if (!V) {
866 // We might have suffered some sort of placement new earlier, so
867 // we're constructing in a completely unexpected storage.
868 // Fall back to a generic pointer cast for this-value.
869 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(Val: getDecl());
870 const CXXRecordDecl *StaticClass = StaticMD->getParent();
871 CanQualType StaticTy =
872 Ctx.getPointerType(T: Ctx.getCanonicalTagType(TD: StaticClass));
873 ThisVal = SVB.evalCast(V: ThisVal, CastTy: Ty, OriginalTy: StaticTy);
874 } else
875 ThisVal = *V;
876 }
877
878 if (!ThisVal.isUnknown())
879 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
880 }
881}
882
883const Expr *CXXMemberCall::getCXXThisExpr() const {
884 return getOriginExpr()->getImplicitObjectArgument();
885}
886
887RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
888 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
889 // id-expression in the class member access expression is a qualified-id,
890 // that function is called. Otherwise, its final overrider in the dynamic type
891 // of the object expression is called.
892 if (const auto *ME = dyn_cast<MemberExpr>(Val: getOriginExpr()->getCallee()))
893 if (ME->hasQualifier())
894 return AnyFunctionCall::getRuntimeDefinition();
895
896 return CXXInstanceCall::getRuntimeDefinition();
897}
898
899const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
900 return getOriginExpr()->getArg(Arg: 0);
901}
902
903const BlockDataRegion *BlockCall::getBlockRegion() const {
904 const Expr *Callee = getOriginExpr()->getCallee();
905 const MemRegion *DataReg = getSVal(E: Callee).getAsRegion();
906
907 return dyn_cast_or_null<BlockDataRegion>(Val: DataReg);
908}
909
910ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
911 const BlockDecl *D = getDecl();
912 if (!D)
913 return {};
914 return D->parameters();
915}
916
917void BlockCall::getExtraInvalidatedValues(ValueList &Values,
918 RegionAndSymbolInvalidationTraits *ETraits) const {
919 // FIXME: This also needs to invalidate captured globals.
920 if (const MemRegion *R = getBlockRegion())
921 Values.push_back(Elt: loc::MemRegionVal(R));
922}
923
924void BlockCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
925 BindingsTy &Bindings) const {
926 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
927 ArrayRef<ParmVarDecl*> Params;
928 if (isConversionFromLambda()) {
929 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
930 Params = LambdaOperatorDecl->parameters();
931
932 // For blocks converted from a C++ lambda, the callee declaration is the
933 // operator() method on the lambda so we bind "this" to
934 // the lambda captured by the block.
935 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
936 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
937 Loc ThisLoc = SVB.getCXXThis(D: LambdaOperatorDecl, SF: CalleeSF);
938 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
939 } else {
940 Params = cast<BlockDecl>(Val: CalleeSF->getDecl())->parameters();
941 }
942
943 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: Params);
944}
945
946SVal AnyCXXConstructorCall::getCXXThisVal() const {
947 if (Data)
948 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
949 return UnknownVal();
950}
951
952void AnyCXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
953 RegionAndSymbolInvalidationTraits *ETraits) const {
954 SVal V = getCXXThisVal();
955 if (SymbolRef Sym = V.getAsSymbol(IncludeBaseRegions: true))
956 ETraits->setTrait(Sym,
957 IK: RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
958
959 // Standard classes don't reinterpret-cast and modify super regions.
960 const bool IsStdClassCtor = isWithinStdNamespace(D: getDecl());
961 if (const MemRegion *Obj = V.getAsRegion(); Obj && IsStdClassCtor) {
962 ETraits->setTrait(
963 MR: Obj, IK: RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
964 }
965
966 Values.push_back(Elt: V);
967}
968
969void AnyCXXConstructorCall::getInitialStackFrameContents(
970 const StackFrame *CalleeSF, BindingsTy &Bindings) const {
971 AnyFunctionCall::getInitialStackFrameContents(CalleeSF, Bindings);
972
973 SVal ThisVal = getCXXThisVal();
974 if (!ThisVal.isUnknown()) {
975 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
976 const auto *MD = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
977 Loc ThisLoc = SVB.getCXXThis(D: MD, SF: CalleeSF);
978 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
979 }
980}
981
982const StackFrame *CXXInheritedConstructorCall::getInheritingStackFrame() const {
983 const StackFrame *SF = getStackFrame();
984 while (isa<CXXInheritedCtorInitExpr>(Val: SF->getCallSite()))
985 SF = SF->getParent();
986 return SF;
987}
988
989SVal CXXDestructorCall::getCXXThisVal() const {
990 if (Data)
991 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(V: Data).getPointer());
992 return UnknownVal();
993}
994
995RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
996 // Base destructors are always called non-virtually.
997 // Skip CXXInstanceCall's devirtualization logic in this case.
998 if (isBaseDestructor())
999 return AnyFunctionCall::getRuntimeDefinition();
1000
1001 return CXXInstanceCall::getRuntimeDefinition();
1002}
1003
1004ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
1005 const ObjCMethodDecl *D = getDecl();
1006 if (!D)
1007 return {};
1008 return D->parameters();
1009}
1010
1011void ObjCMethodCall::getExtraInvalidatedValues(
1012 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
1013
1014 // If the method call is a setter for property known to be backed by
1015 // an instance variable, don't invalidate the entire receiver, just
1016 // the storage for that instance variable.
1017 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
1018 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
1019 SVal IvarLVal = getState()->getLValue(D: PropIvar, Base: getReceiverSVal());
1020 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
1021 ETraits->setTrait(
1022 MR: IvarRegion,
1023 IK: RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
1024 ETraits->setTrait(
1025 MR: IvarRegion,
1026 IK: RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
1027 Values.push_back(Elt: IvarLVal);
1028 }
1029 return;
1030 }
1031 }
1032
1033 Values.push_back(Elt: getReceiverSVal());
1034}
1035
1036SVal ObjCMethodCall::getReceiverSVal() const {
1037 // FIXME: Is this the best way to handle class receivers?
1038 if (!isInstanceMessage())
1039 return UnknownVal();
1040
1041 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
1042 return getSVal(E: RecE);
1043
1044 // An instance message with no expression means we are sending to super.
1045 // In this case the object reference is the same as 'self'.
1046 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
1047 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1048 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
1049 return SelfVal;
1050}
1051
1052bool ObjCMethodCall::isReceiverSelfOrSuper() const {
1053 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
1054 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
1055 return true;
1056
1057 if (!isInstanceMessage())
1058 return false;
1059
1060 SVal RecVal = getSVal(E: getOriginExpr()->getInstanceReceiver());
1061 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1062
1063 return (RecVal == SelfVal);
1064}
1065
1066SourceRange ObjCMethodCall::getSourceRange() const {
1067 switch (getMessageKind()) {
1068 case OCM_Message:
1069 return getOriginExpr()->getSourceRange();
1070 case OCM_PropertyAccess:
1071 case OCM_Subscript:
1072 return getContainingPseudoObjectExpr()->getSourceRange();
1073 }
1074 llvm_unreachable("unknown message kind");
1075}
1076
1077using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1078
1079const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1080 assert(Data && "Lazy lookup not yet performed.");
1081 assert(getMessageKind() != OCM_Message && "Explicit message send.");
1082 return ObjCMessageDataTy::getFromOpaqueValue(V: Data).getPointer();
1083}
1084
1085static const Expr *
1086getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
1087 const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
1088
1089 // This handles the funny case of assigning to the result of a getter.
1090 // This can happen if the getter returns a non-const reference.
1091 if (const auto *BO = dyn_cast<BinaryOperator>(Val: Syntactic))
1092 Syntactic = BO->getLHS()->IgnoreParens();
1093
1094 return Syntactic;
1095}
1096
1097ObjCMessageKind ObjCMethodCall::getMessageKind() const {
1098 if (!Data) {
1099 // Find the parent, ignoring implicit casts.
1100 const ParentMap &PM = getStackFrame()->getParentMap();
1101 const Stmt *S = PM.getParentIgnoreParenCasts(S: getOriginExpr());
1102
1103 // Check if parent is a PseudoObjectExpr.
1104 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(Val: S)) {
1105 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1106
1107 ObjCMessageKind K;
1108 switch (Syntactic->getStmtClass()) {
1109 case Stmt::ObjCPropertyRefExprClass:
1110 K = OCM_PropertyAccess;
1111 break;
1112 case Stmt::ObjCSubscriptRefExprClass:
1113 K = OCM_Subscript;
1114 break;
1115 default:
1116 // FIXME: Can this ever happen?
1117 K = OCM_Message;
1118 break;
1119 }
1120
1121 if (K != OCM_Message) {
1122 const_cast<ObjCMethodCall *>(this)->Data
1123 = ObjCMessageDataTy(POE, K).getOpaqueValue();
1124 assert(getMessageKind() == K);
1125 return K;
1126 }
1127 }
1128
1129 const_cast<ObjCMethodCall *>(this)->Data
1130 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1131 assert(getMessageKind() == OCM_Message);
1132 return OCM_Message;
1133 }
1134
1135 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(V: Data);
1136 if (!Info.getPointer())
1137 return OCM_Message;
1138 return static_cast<ObjCMessageKind>(Info.getInt());
1139}
1140
1141const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
1142 // Look for properties accessed with property syntax (foo.bar = ...)
1143 if (getMessageKind() == OCM_PropertyAccess) {
1144 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1145 assert(POE && "Property access without PseudoObjectExpr?");
1146
1147 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1148 auto *RefExpr = cast<ObjCPropertyRefExpr>(Val: Syntactic);
1149
1150 if (RefExpr->isExplicitProperty())
1151 return RefExpr->getExplicitProperty();
1152 }
1153
1154 // Look for properties accessed with method syntax ([foo setBar:...]).
1155 const ObjCMethodDecl *MD = getDecl();
1156 if (!MD || !MD->isPropertyAccessor())
1157 return nullptr;
1158
1159 // Note: This is potentially quite slow.
1160 return MD->findPropertyDecl();
1161}
1162
1163bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1164 Selector Sel) const {
1165 assert(IDecl);
1166 AnalysisManager &AMgr =
1167 getState()->getStateManager().getOwningEngine().getAnalysisManager();
1168 // If the class interface is declared inside the main file, assume it is not
1169 // subcassed.
1170 // TODO: It could actually be subclassed if the subclass is private as well.
1171 // This is probably very rare.
1172 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1173 if (InterfLoc.isValid() && AMgr.isInCodeFile(SL: InterfLoc))
1174 return false;
1175
1176 // Assume that property accessors are not overridden.
1177 if (getMessageKind() == OCM_PropertyAccess)
1178 return false;
1179
1180 // We assume that if the method is public (declared outside of main file) or
1181 // has a parent which publicly declares the method, the method could be
1182 // overridden in a subclass.
1183
1184 // Find the first declaration in the class hierarchy that declares
1185 // the selector.
1186 ObjCMethodDecl *D = nullptr;
1187 while (true) {
1188 D = IDecl->lookupMethod(Sel, isInstance: true);
1189
1190 // Cannot find a public definition.
1191 if (!D)
1192 return false;
1193
1194 // If outside the main file,
1195 if (D->getLocation().isValid() && !AMgr.isInCodeFile(SL: D->getLocation()))
1196 return true;
1197
1198 if (D->isOverriding()) {
1199 // Search in the superclass on the next iteration.
1200 IDecl = D->getClassInterface();
1201 if (!IDecl)
1202 return false;
1203
1204 IDecl = IDecl->getSuperClass();
1205 if (!IDecl)
1206 return false;
1207
1208 continue;
1209 }
1210
1211 return false;
1212 };
1213
1214 llvm_unreachable("The while loop should always terminate.");
1215}
1216
1217static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
1218 if (!MD)
1219 return MD;
1220
1221 // Find the redeclaration that defines the method.
1222 if (!MD->hasBody()) {
1223 for (auto *I : MD->redecls())
1224 if (I->hasBody())
1225 MD = cast<ObjCMethodDecl>(Val: I);
1226 }
1227 return MD;
1228}
1229
1230struct PrivateMethodKey {
1231 const ObjCInterfaceDecl *Interface;
1232 Selector LookupSelector;
1233 bool IsClassMethod;
1234};
1235
1236namespace llvm {
1237template <> struct DenseMapInfo<PrivateMethodKey> {
1238 using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1239 using SelectorInfo = DenseMapInfo<Selector>;
1240
1241 static unsigned getHashValue(const PrivateMethodKey &Key) {
1242 return llvm::hash_combine(
1243 args: llvm::hash_code(InterfaceInfo::getHashValue(PtrVal: Key.Interface)),
1244 args: llvm::hash_code(SelectorInfo::getHashValue(S: Key.LookupSelector)),
1245 args: Key.IsClassMethod);
1246 }
1247
1248 static bool isEqual(const PrivateMethodKey &LHS,
1249 const PrivateMethodKey &RHS) {
1250 return InterfaceInfo::isEqual(LHS: LHS.Interface, RHS: RHS.Interface) &&
1251 SelectorInfo::isEqual(LHS: LHS.LookupSelector, RHS: RHS.LookupSelector) &&
1252 LHS.IsClassMethod == RHS.IsClassMethod;
1253 }
1254};
1255} // end namespace llvm
1256
1257// NOTE: This cache is a "global" variable, and it is cleared by
1258// CallEventManager's constructor so we do not keep old entries when
1259// loading/unloading ASTs. If we are worried about concurrency, we may need to
1260// revisit this someday. In terms of memory, this table stays around until clang
1261// quits, which also may be bad if we need to release memory.
1262using PrivateMethodCacheTy =
1263 llvm::DenseMap<PrivateMethodKey, std::optional<const ObjCMethodDecl *>>;
1264static PrivateMethodCacheTy PrivateMethodCache;
1265
1266static const ObjCMethodDecl *
1267lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface,
1268 Selector LookupSelector, bool InstanceMethod) {
1269 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1270 // when in many cases it returns null. We cache the results so
1271 // that repeated queries on the same ObjCIntefaceDecl and Selector
1272 // don't incur the same cost. On some test cases, we can see the
1273 // same query being issued thousands of times.
1274 std::optional<const ObjCMethodDecl *> &Val =
1275 PrivateMethodCache[{.Interface: Interface, .LookupSelector: LookupSelector, .IsClassMethod: InstanceMethod}];
1276
1277 // Query lookupPrivateMethod() if the cache does not hit.
1278 if (!Val) {
1279 Val = Interface->lookupPrivateMethod(Sel: LookupSelector, Instance: InstanceMethod);
1280
1281 if (!*Val) {
1282 // Query 'lookupMethod' as a backup.
1283 Val = Interface->lookupMethod(Sel: LookupSelector, isInstance: InstanceMethod);
1284 }
1285 }
1286
1287 return *Val;
1288}
1289
1290RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1291 const ObjCMessageExpr *E = getOriginExpr();
1292 assert(E);
1293 Selector Sel = E->getSelector();
1294
1295 if (E->isInstanceMessage()) {
1296 // Find the receiver type.
1297 const ObjCObjectType *ReceiverT = nullptr;
1298 bool CanBeSubClassed = false;
1299 bool LookingForInstanceMethod = true;
1300 QualType SupersType = E->getSuperType();
1301 const MemRegion *Receiver = nullptr;
1302
1303 if (!SupersType.isNull()) {
1304 // The receiver is guaranteed to be 'super' in this case.
1305 // Super always means the type of immediate predecessor to the method
1306 // where the call occurs.
1307 ReceiverT = cast<ObjCObjectPointerType>(Val&: SupersType)->getObjectType();
1308 } else {
1309 Receiver = getReceiverSVal().getAsRegion();
1310 if (!Receiver)
1311 return {};
1312
1313 DynamicTypeInfo DTI = getDynamicTypeInfo(State: getState(), MR: Receiver);
1314 if (!DTI.isValid()) {
1315 assert(isa<AllocaRegion>(Receiver) &&
1316 "Unhandled untyped region class!");
1317 return {};
1318 }
1319
1320 QualType DynType = DTI.getType();
1321 CanBeSubClassed = DTI.canBeASubClass();
1322
1323 const auto *ReceiverDynT =
1324 dyn_cast<ObjCObjectPointerType>(Val: DynType.getCanonicalType());
1325
1326 if (ReceiverDynT) {
1327 ReceiverT = ReceiverDynT->getObjectType();
1328
1329 // It can be actually class methods called with Class object as a
1330 // receiver. This type of messages is treated by the compiler as
1331 // instance (not class).
1332 if (ReceiverT->isObjCClass()) {
1333
1334 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1335 // For [self classMethod], return compiler visible declaration.
1336 if (Receiver == SelfVal.getAsRegion()) {
1337 return RuntimeDefinition(findDefiningRedecl(MD: E->getMethodDecl()));
1338 }
1339
1340 // Otherwise, let's check if we know something about the type
1341 // inside of this class object.
1342 if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1343 DynamicTypeInfo DTI =
1344 getClassObjectDynamicTypeInfo(State: getState(), Sym: ReceiverSym);
1345 if (DTI.isValid()) {
1346 // Let's use this type for lookup.
1347 ReceiverT =
1348 cast<ObjCObjectType>(Val: DTI.getType().getCanonicalType());
1349
1350 CanBeSubClassed = DTI.canBeASubClass();
1351 // And it should be a class method instead.
1352 LookingForInstanceMethod = false;
1353 }
1354 }
1355 }
1356
1357 if (CanBeSubClassed)
1358 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1359 // Even if `DynamicTypeInfo` told us that it can be
1360 // not necessarily this type, but its descendants, we still want
1361 // to check again if this selector can be actually overridden.
1362 CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1363 }
1364 }
1365
1366 // Lookup the instance method implementation.
1367 if (ReceiverT)
1368 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1369 const ObjCMethodDecl *MD =
1370 lookupRuntimeDefinition(Interface: IDecl, LookupSelector: Sel, InstanceMethod: LookingForInstanceMethod);
1371
1372 if (MD && !MD->hasBody())
1373 MD = MD->getCanonicalDecl();
1374
1375 if (CanBeSubClassed)
1376 return RuntimeDefinition(MD, Receiver);
1377 else
1378 return RuntimeDefinition(MD, nullptr);
1379 }
1380 } else {
1381 // This is a class method.
1382 // If we have type info for the receiver class, we are calling via
1383 // class name.
1384 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1385 // Find/Return the method implementation.
1386 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1387 }
1388 }
1389
1390 return {};
1391}
1392
1393bool ObjCMethodCall::argumentsMayEscape() const {
1394 if (isInSystemHeader() && !isInstanceMessage()) {
1395 Selector Sel = getSelector();
1396 if (Sel.getNumArgs() == 1 &&
1397 Sel.getIdentifierInfoForSlot(argIndex: 0)->isStr(Str: "valueWithPointer"))
1398 return true;
1399 }
1400
1401 return CallEvent::argumentsMayEscape();
1402}
1403
1404void ObjCMethodCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
1405 BindingsTy &Bindings) const {
1406 const auto *D = cast<ObjCMethodDecl>(Val: CalleeSF->getDecl());
1407 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1408 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: D->parameters());
1409
1410 SVal SelfVal = getReceiverSVal();
1411 if (!SelfVal.isUnknown()) {
1412 const VarDecl *SelfD = CalleeSF->getAnalysisDeclContext()->getSelfDecl();
1413 MemRegionManager &MRMgr = SVB.getRegionManager();
1414 Loc SelfLoc = SVB.makeLoc(region: MRMgr.getVarRegion(VD: SelfD, SF: CalleeSF));
1415 Bindings.push_back(Elt: std::make_pair(x&: SelfLoc, y&: SelfVal));
1416 }
1417}
1418
1419CallEventManager::CallEventManager(llvm::BumpPtrAllocator &alloc)
1420 : Alloc(alloc) {
1421 // Clear the method cache to avoid hits when multiple AST are loaded/unloaded
1422 // within a single process. This can happen with unit tests, for instance.
1423 PrivateMethodCache.clear();
1424}
1425
1426CallEventRef<>
1427CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
1428 const StackFrame *SF,
1429 CFGBlock::ConstCFGElementRef ElemRef) {
1430 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(Val: CE))
1431 return create<CXXMemberCall>(A: MCE, St: State, SF, ElemRef);
1432
1433 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(Val: CE)) {
1434 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1435 if (const auto *MD = dyn_cast<CXXMethodDecl>(Val: DirectCallee)) {
1436 if (MD->isImplicitObjectMemberFunction())
1437 return create<CXXMemberOperatorCall>(A: OpCE, St: State, SF, ElemRef);
1438 if (MD->isStatic())
1439 return create<CXXStaticOperatorCall>(A: OpCE, St: State, SF, ElemRef);
1440 }
1441
1442 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1443 return create<BlockCall>(A: CE, St: State, SF, ElemRef);
1444 }
1445
1446 // Otherwise, it's a normal function call, static member function call, or
1447 // something we can't reason about.
1448 return create<SimpleFunctionCall>(A: CE, St: State, SF, ElemRef);
1449}
1450
1451CallEventRef<> CallEventManager::getCaller(const StackFrame *CalleeSF,
1452 ProgramStateRef State) {
1453 const StackFrame *ParentSF = CalleeSF->getParent();
1454 const StackFrame *CallerSF = ParentSF;
1455 CFGBlock::ConstCFGElementRef ElemRef = {CalleeSF->getCallSiteBlock(),
1456 CalleeSF->getIndex()};
1457 assert(CallerSF && "This should not be used for top-level stack frames");
1458
1459 const Expr *CallSite = CalleeSF->getCallSite();
1460
1461 if (CallSite) {
1462 if (CallEventRef<> Out = getCall(S: CallSite, State, SF: CallerSF, ElemRef))
1463 return Out;
1464
1465 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1466 const auto *Ctor = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
1467 Loc ThisPtr = SVB.getCXXThis(D: Ctor, SF: CalleeSF);
1468 SVal ThisVal = State->getSVal(LV: ThisPtr);
1469
1470 if (const auto *CE = dyn_cast<CXXConstructExpr>(Val: CallSite))
1471 return getCXXConstructorCall(E: CE, Target: ThisVal.getAsRegion(), State, SF: CallerSF,
1472 ElemRef);
1473 if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(Val: CallSite))
1474 return getCXXInheritedConstructorCall(E: CIE, Target: ThisVal.getAsRegion(), State,
1475 SF: CallerSF, ElemRef);
1476 // All other cases are handled by getCall.
1477 llvm_unreachable("This is not an inlineable statement");
1478 }
1479
1480 // Fall back to the CFG. The only thing we haven't handled yet is
1481 // destructors, though this could change in the future.
1482 const CFGBlock *B = CalleeSF->getCallSiteBlock();
1483 CFGElement E = (*B)[CalleeSF->getIndex()];
1484 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1485 "All other CFG elements should have exprs");
1486
1487 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1488 const auto *Dtor = cast<CXXDestructorDecl>(Val: CalleeSF->getDecl());
1489 Loc ThisPtr = SVB.getCXXThis(D: Dtor, SF: CalleeSF);
1490 SVal ThisVal = State->getSVal(LV: ThisPtr);
1491
1492 const Stmt *Trigger;
1493 if (std::optional<CFGAutomaticObjDtor> AutoDtor =
1494 E.getAs<CFGAutomaticObjDtor>())
1495 Trigger = AutoDtor->getTriggerStmt();
1496 else if (std::optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1497 Trigger = DeleteDtor->getDeleteExpr();
1498 else
1499 Trigger = Dtor->getBody();
1500
1501 return getCXXDestructorCall(DD: Dtor, Trigger, Target: ThisVal.getAsRegion(),
1502 IsBase: E.getAs<CFGBaseDtor>().has_value(), State,
1503 SF: CallerSF, ElemRef);
1504}
1505
1506CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State,
1507 const StackFrame *SF,
1508 CFGBlock::ConstCFGElementRef ElemRef) {
1509 if (const auto *CE = dyn_cast<CallExpr>(Val: S)) {
1510 return getSimpleCall(CE, State, SF, ElemRef);
1511 } else if (const auto *NE = dyn_cast<CXXNewExpr>(Val: S)) {
1512 return getCXXAllocatorCall(E: NE, State, SF, ElemRef);
1513 } else if (const auto *DE = dyn_cast<CXXDeleteExpr>(Val: S)) {
1514 return getCXXDeallocatorCall(E: DE, State, SF, ElemRef);
1515 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(Val: S)) {
1516 return getObjCMethodCall(E: ME, State, SF, ElemRef);
1517 } else {
1518 return nullptr;
1519 }
1520}
1521