1//===- CallEvent.cpp - Wrapper for all function and method calls ----------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9/// \file This file defines CallEvent and its subclasses, which represent path-
10/// sensitive instances of different kinds of function and method calls
11/// (C, C++, and Objective-C).
12//
13//===----------------------------------------------------------------------===//
14
15#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
16#include "clang/AST/ASTContext.h"
17#include "clang/AST/Attr.h"
18#include "clang/AST/Decl.h"
19#include "clang/AST/DeclBase.h"
20#include "clang/AST/DeclCXX.h"
21#include "clang/AST/DeclObjC.h"
22#include "clang/AST/Expr.h"
23#include "clang/AST/ExprCXX.h"
24#include "clang/AST/ExprObjC.h"
25#include "clang/AST/ParentMap.h"
26#include "clang/AST/Stmt.h"
27#include "clang/AST/Type.h"
28#include "clang/Analysis/AnalysisDeclContext.h"
29#include "clang/Analysis/CFG.h"
30#include "clang/Analysis/CFGStmtMap.h"
31#include "clang/Analysis/PathDiagnostic.h"
32#include "clang/Analysis/ProgramPoint.h"
33#include "clang/Basic/IdentifierTable.h"
34#include "clang/Basic/LLVM.h"
35#include "clang/Basic/SourceLocation.h"
36#include "clang/Basic/Specifiers.h"
37#include "clang/CrossTU/CrossTranslationUnit.h"
38#include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h"
39#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
40#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerHelpers.h"
41#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"
42#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h"
43#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
44#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
45#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
46#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
47#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
48#include "clang/StaticAnalyzer/Core/PathSensitive/Store.h"
49#include "llvm/ADT/ArrayRef.h"
50#include "llvm/ADT/DenseMap.h"
51#include "llvm/ADT/ImmutableList.h"
52#include "llvm/ADT/PointerIntPair.h"
53#include "llvm/ADT/SmallSet.h"
54#include "llvm/ADT/SmallVector.h"
55#include "llvm/ADT/StringExtras.h"
56#include "llvm/ADT/StringRef.h"
57#include "llvm/Support/Compiler.h"
58#include "llvm/Support/Debug.h"
59#include "llvm/Support/ErrorHandling.h"
60#include "llvm/Support/raw_ostream.h"
61#include <cassert>
62#include <optional>
63#include <utility>
64
65#define DEBUG_TYPE "static-analyzer-call-event"
66
67using namespace clang;
68using namespace ento;
69
70QualType CallEvent::getResultType() const {
71 ASTContext &Ctx = getState()->getStateManager().getContext();
72 const Expr *E = getOriginExpr();
73 if (!E)
74 return Ctx.VoidTy;
75 return Ctx.getReferenceQualifiedType(e: E);
76}
77
78static bool isCallback(QualType T) {
79 // If a parameter is a block or a callback, assume it can modify pointer.
80 if (T->isBlockPointerType() ||
81 T->isFunctionPointerType() ||
82 T->isObjCSelType())
83 return true;
84
85 // Check if a callback is passed inside a struct (for both, struct passed by
86 // reference and by value). Dig just one level into the struct for now.
87
88 if (T->isAnyPointerType() || T->isReferenceType())
89 T = T->getPointeeType();
90
91 if (const RecordType *RT = T->getAsStructureType()) {
92 const RecordDecl *RD = RT->getDecl()->getDefinitionOrSelf();
93 for (const auto *I : RD->fields()) {
94 QualType FieldT = I->getType();
95 if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
96 return true;
97 }
98 }
99 return false;
100}
101
102static bool isVoidPointerToNonConst(QualType T) {
103 if (const auto *PT = T->getAs<PointerType>()) {
104 QualType PointeeTy = PT->getPointeeType();
105 if (PointeeTy.isConstQualified())
106 return false;
107 return PointeeTy->isVoidType();
108 } else
109 return false;
110}
111
112bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
113 unsigned NumOfArgs = getNumArgs();
114
115 // If calling using a function pointer, assume the function does not
116 // satisfy the callback.
117 // TODO: We could check the types of the arguments here.
118 if (!getDecl())
119 return false;
120
121 unsigned Idx = 0;
122 for (CallEvent::param_type_iterator I = param_type_begin(),
123 E = param_type_end();
124 I != E && Idx < NumOfArgs; ++I, ++Idx) {
125 // If the parameter is 0, it's harmless.
126 if (getArgSVal(Index: Idx).isZeroConstant())
127 continue;
128
129 if (Condition(*I))
130 return true;
131 }
132 return false;
133}
134
135bool CallEvent::hasNonZeroCallbackArg() const {
136 return hasNonNullArgumentsWithType(Condition: isCallback);
137}
138
139bool CallEvent::hasVoidPointerToNonConstArg() const {
140 return hasNonNullArgumentsWithType(Condition: isVoidPointerToNonConst);
141}
142
143bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
144 const auto *FD = dyn_cast_or_null<FunctionDecl>(Val: getDecl());
145 if (!FD)
146 return false;
147
148 return CheckerContext::isCLibraryFunction(FD, Name: FunctionName);
149}
150
151AnalysisDeclContext *CallEvent::getCalleeAnalysisDeclContext() const {
152 const Decl *D = getDecl();
153 if (!D)
154 return nullptr;
155
156 AnalysisDeclContext *ADC =
157 SF->getAnalysisDeclContext()->getManager()->getContext(D);
158
159 return ADC;
160}
161
162const StackFrame *CallEvent::getCalleeStackFrame(unsigned BlockCount) const {
163 AnalysisDeclContext *ADC = getCalleeAnalysisDeclContext();
164 if (!ADC)
165 return nullptr;
166
167 const Expr *E = getOriginExpr();
168 if (!E)
169 return nullptr;
170
171 // Recover CFG block via reverse lookup.
172 // TODO: If we were to keep CFG element information as part of the CallEvent
173 // instead of doing this reverse lookup, we would be able to build the stack
174 // frame for non-expression-based calls, and also we wouldn't need the reverse
175 // lookup.
176 const CFGStmtMap *Map = SF->getAnalysisDeclContext()->getCFGStmtMap();
177 const CFGBlock *B = Map->getBlock(S: E);
178 assert(B);
179
180 // Also recover CFG index by scanning the CFG block.
181 unsigned Idx = 0, Sz = B->size();
182 for (; Idx < Sz; ++Idx)
183 if (auto StmtElem = (*B)[Idx].getAs<CFGStmt>())
184 if (StmtElem->getStmt() == E)
185 break;
186 assert(Idx < Sz);
187
188 return ADC->getStackFrame(ParentSF: SF, Data: nullptr, E, Blk: B, BlockCount, Index: Idx);
189}
190
191const ParamVarRegion
192*CallEvent::getParameterLocation(unsigned Index, unsigned BlockCount) const {
193 const StackFrame *SF = getCalleeStackFrame(BlockCount);
194 // We cannot construct a VarRegion without a stack frame.
195 if (!SF)
196 return nullptr;
197
198 const ParamVarRegion *PVR =
199 State->getStateManager().getRegionManager().getParamVarRegion(
200 OriginExpr: getOriginExpr(), Index, SF);
201 return PVR;
202}
203
204/// Returns true if a type is a pointer-to-const or reference-to-const
205/// with no further indirection.
206static bool isPointerToConst(QualType Ty) {
207 QualType PointeeTy = Ty->getPointeeType();
208 if (PointeeTy == QualType())
209 return false;
210 if (!PointeeTy.isConstQualified())
211 return false;
212 if (PointeeTy->isAnyPointerType())
213 return false;
214 return true;
215}
216
217// Try to retrieve the function declaration and find the function parameter
218// types which are pointers/references to a non-pointer const.
219// We will not invalidate the corresponding argument regions.
220static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
221 const CallEvent &Call) {
222 unsigned Idx = 0;
223 for (CallEvent::param_type_iterator I = Call.param_type_begin(),
224 E = Call.param_type_end();
225 I != E; ++I, ++Idx) {
226 if (isPointerToConst(Ty: *I))
227 PreserveArgs.insert(V: Idx);
228 }
229}
230
231static const MemRegion *getThisRegionBaseOrNull(const CallEvent &Call) {
232 if (const auto *CtorCall = dyn_cast<CXXConstructorCall>(Val: &Call)) {
233 if (const MemRegion *R = CtorCall->getCXXThisVal().getAsRegion())
234 return R->getBaseRegion();
235 }
236 return nullptr;
237}
238
239ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
240 ProgramStateRef State) const {
241 // Don't invalidate anything if the callee is marked pure/const.
242 if (const Decl *Callee = getDecl())
243 if (Callee->hasAttr<PureAttr>() || Callee->hasAttr<ConstAttr>())
244 return State;
245
246 SmallVector<SVal, 8> ValuesToInvalidate;
247 RegionAndSymbolInvalidationTraits ETraits;
248
249 getExtraInvalidatedValues(Values&: ValuesToInvalidate, ETraits: &ETraits);
250
251 // Indexes of arguments whose values will be preserved by the call.
252 llvm::SmallSet<unsigned, 4> PreserveArgs;
253 if (!argumentsMayEscape())
254 findPtrToConstParams(PreserveArgs, Call: *this);
255
256 // We should not preserve the contents of the region pointed by "this" when
257 // constructing the object, even if an argument refers to it.
258 const auto *ThisRegionBaseOrNull = getThisRegionBaseOrNull(Call: *this);
259
260 for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
261 // Mark this region for invalidation. We batch invalidate regions
262 // below for efficiency.
263 if (PreserveArgs.count(V: Idx)) {
264 if (const MemRegion *ArgBaseR = getArgSVal(Index: Idx).getAsRegion()) {
265 ArgBaseR = ArgBaseR->getBaseRegion();
266
267 // Preserve the contents of the pointee of the argument - except if it
268 // refers to the object under construction (ctor call).
269 if (ArgBaseR != ThisRegionBaseOrNull) {
270 ETraits.setTrait(
271 MR: ArgBaseR, IK: RegionAndSymbolInvalidationTraits::TK_PreserveContents);
272 // TODO: Factor this out + handle the lower level const pointers.
273 }
274 }
275 }
276
277 ValuesToInvalidate.push_back(Elt: getArgSVal(Index: Idx));
278
279 // If a function accepts an object by argument (which would of course be a
280 // temporary that isn't lifetime-extended), invalidate the object itself,
281 // not only other objects reachable from it. This is necessary because the
282 // destructor has access to the temporary object after the call.
283 // TODO: Support placement arguments once we start
284 // constructing them directly.
285 // TODO: This is unnecessary when there's no destructor, but that's
286 // currently hard to figure out.
287 if (getKind() != CE_CXXAllocator)
288 if (isArgumentConstructedDirectly(Index: Idx))
289 if (auto AdjIdx = getAdjustedParameterIndex(ASTArgumentIndex: Idx))
290 if (const TypedValueRegion *TVR =
291 getParameterLocation(Index: *AdjIdx, BlockCount))
292 ValuesToInvalidate.push_back(Elt: loc::MemRegionVal(TVR));
293 }
294
295 // Invalidate designated regions using the batch invalidation API.
296 // NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
297 // global variables.
298 return State->invalidateRegions(Values: ValuesToInvalidate, Elem: getCFGElementRef(),
299 BlockCount, SF: getStackFrame(),
300 /*CausedByPointerEscape*/ CausesPointerEscape: true,
301 /*Symbols=*/IS: nullptr, Call: this, ITraits: &ETraits);
302}
303
304ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
305 const ProgramPointTag *Tag) const {
306
307 if (const Expr *E = getOriginExpr()) {
308 if (IsPreVisit)
309 return PreStmt(E, getStackFrame(), Tag);
310 return PostStmt(E, getStackFrame(), Tag);
311 }
312
313 const Decl *D = getDecl();
314 assert(D && "Cannot get a program point without a statement or decl");
315 assert(ElemRef.getParent() &&
316 "Cannot get a program point without a CFGElementRef");
317
318 SourceLocation Loc = getSourceRange().getBegin();
319 if (IsPreVisit)
320 return PreImplicitCall(D, Loc, getStackFrame(), ElemRef, Tag);
321 return PostImplicitCall(D, Loc, getStackFrame(), ElemRef, Tag);
322}
323
324SVal CallEvent::getArgSVal(unsigned Index) const {
325 const Expr *ArgE = getArgExpr(Index);
326 if (!ArgE)
327 return UnknownVal();
328 return getSVal(E: ArgE);
329}
330
331SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
332 const Expr *ArgE = getArgExpr(Index);
333 if (!ArgE)
334 return {};
335 return ArgE->getSourceRange();
336}
337
338SVal CallEvent::getReturnValue() const {
339 const Expr *E = getOriginExpr();
340 if (!E)
341 return UndefinedVal();
342 return getSVal(E);
343}
344
345LLVM_DUMP_METHOD void CallEvent::dump() const { dump(Out&: llvm::errs()); }
346
347void CallEvent::dump(raw_ostream &Out) const {
348 ASTContext &Ctx = getState()->getStateManager().getContext();
349 if (const Expr *E = getOriginExpr()) {
350 E->printPretty(OS&: Out, Helper: nullptr, Policy: Ctx.getPrintingPolicy());
351 return;
352 }
353
354 if (const Decl *D = getDecl()) {
355 Out << "Call to ";
356 D->print(Out, Policy: Ctx.getPrintingPolicy());
357 return;
358 }
359
360 Out << "Unknown call (type " << getKindAsString() << ")";
361}
362
363bool CallEvent::isCallStmt(const Stmt *S) {
364 return isa<CallExpr, ObjCMessageExpr, CXXConstructExpr, CXXNewExpr>(Val: S);
365}
366
367QualType CallEvent::getDeclaredResultType(const Decl *D) {
368 assert(D);
369 if (const auto *FD = dyn_cast<FunctionDecl>(Val: D))
370 return FD->getReturnType();
371 if (const auto *MD = dyn_cast<ObjCMethodDecl>(Val: D))
372 return MD->getReturnType();
373 if (const auto *BD = dyn_cast<BlockDecl>(Val: D)) {
374 // Blocks are difficult because the return type may not be stored in the
375 // BlockDecl itself. The AST should probably be enhanced, but for now we
376 // just do what we can.
377 // If the block is declared without an explicit argument list, the
378 // signature-as-written just includes the return type, not the entire
379 // function type.
380 // FIXME: All blocks should have signatures-as-written, even if the return
381 // type is inferred. (That's signified with a dependent result type.)
382 if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
383 QualType Ty = TSI->getType();
384 if (const FunctionType *FT = Ty->getAs<FunctionType>())
385 Ty = FT->getReturnType();
386 if (!Ty->isDependentType())
387 return Ty;
388 }
389
390 return {};
391 }
392
393 llvm_unreachable("unknown callable kind");
394}
395
396bool CallEvent::isVariadic(const Decl *D) {
397 assert(D);
398
399 if (const auto *FD = dyn_cast<FunctionDecl>(Val: D))
400 return FD->isVariadic();
401 if (const auto *MD = dyn_cast<ObjCMethodDecl>(Val: D))
402 return MD->isVariadic();
403 if (const auto *BD = dyn_cast<BlockDecl>(Val: D))
404 return BD->isVariadic();
405
406 llvm_unreachable("unknown callable kind");
407}
408
409static bool isTransparentUnion(QualType T) {
410 const RecordType *UT = T->getAsUnionType();
411 return UT &&
412 UT->getDecl()->getMostRecentDecl()->hasAttr<TransparentUnionAttr>();
413}
414
415// In some cases, symbolic cases should be transformed before we associate
416// them with parameters. This function incapsulates such cases.
417static SVal processArgument(SVal Value, const Expr *ArgumentExpr,
418 const ParmVarDecl *Parameter, SValBuilder &SVB) {
419 QualType ParamType = Parameter->getType();
420 QualType ArgumentType = ArgumentExpr->getType();
421
422 // Transparent unions allow users to easily convert values of union field
423 // types into union-typed objects.
424 //
425 // Also, more importantly, they allow users to define functions with different
426 // different parameter types, substituting types matching transparent union
427 // field types with the union type itself.
428 //
429 // Here, we check specifically for latter cases and prevent binding
430 // field-typed values to union-typed regions.
431 if (isTransparentUnion(T: ParamType) &&
432 // Let's check that we indeed trying to bind different types.
433 !isTransparentUnion(T: ArgumentType)) {
434 BasicValueFactory &BVF = SVB.getBasicValueFactory();
435
436 llvm::ImmutableList<SVal> CompoundSVals = BVF.getEmptySValList();
437 CompoundSVals = BVF.prependSVal(X: Value, L: CompoundSVals);
438
439 // Wrap it with compound value.
440 return SVB.makeCompoundVal(type: ParamType, vals: CompoundSVals);
441 }
442
443 return Value;
444}
445
446/// Cast the argument value to the type of the parameter at the function
447/// declaration.
448/// Returns the argument value if it didn't need a cast.
449/// Or returns the cast argument if it needed a cast.
450/// Or returns 'Unknown' if it would need a cast but the callsite and the
451/// runtime definition don't match in terms of argument and parameter count.
452static SVal castArgToParamTypeIfNeeded(const CallEvent &Call, unsigned ArgIdx,
453 SVal ArgVal, SValBuilder &SVB) {
454 const auto *CallExprDecl = dyn_cast_or_null<FunctionDecl>(Val: Call.getDecl());
455 if (!CallExprDecl)
456 return ArgVal;
457
458 const FunctionDecl *Definition = CallExprDecl;
459 Definition->hasBody(Definition);
460
461 // The function decl of the Call (in the AST) will not have any parameter
462 // declarations, if it was 'only' declared without a prototype. However, the
463 // engine will find the appropriate runtime definition - basically a
464 // redeclaration, which has a function body (and a function prototype).
465 if (CallExprDecl->hasPrototype() || !Definition->hasPrototype())
466 return ArgVal;
467
468 // Only do this cast if the number arguments at the callsite matches with
469 // the parameters at the runtime definition.
470 if (Call.getNumArgs() != Definition->getNumParams())
471 return UnknownVal();
472
473 const Expr *ArgExpr = Call.getArgExpr(Index: ArgIdx);
474 const ParmVarDecl *Param = Definition->getParamDecl(i: ArgIdx);
475 return SVB.evalCast(V: ArgVal, CastTy: Param->getType(), OriginalTy: ArgExpr->getType());
476}
477
478static void addParameterValuesToBindings(const StackFrame *CalleeSF,
479 CallEvent::BindingsTy &Bindings,
480 SValBuilder &SVB,
481 const CallEvent &Call,
482 ArrayRef<ParmVarDecl *> parameters) {
483 MemRegionManager &MRMgr = SVB.getRegionManager();
484
485 // If the function has fewer parameters than the call has arguments, we simply
486 // do not bind any values to them.
487 unsigned NumArgs = Call.getNumArgs();
488 unsigned Idx = 0;
489 ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
490 for (; I != E && Idx < NumArgs; ++I, ++Idx) {
491 assert(*I && "Formal parameter has no decl?");
492
493 // TODO: Support allocator calls.
494 if (Call.getKind() != CE_CXXAllocator)
495 if (Call.isArgumentConstructedDirectly(Index: Call.getASTArgumentIndex(CallArgumentIndex: Idx)))
496 continue;
497
498 // TODO: Allocators should receive the correct size and possibly alignment,
499 // determined in compile-time but not represented as arg-expressions,
500 // which makes getArgSVal() fail and return UnknownVal.
501 SVal ArgVal = Call.getArgSVal(Index: Idx);
502 const Expr *ArgExpr = Call.getArgExpr(Index: Idx);
503
504 if (ArgVal.isUnknown())
505 continue;
506
507 // Cast the argument value to match the type of the parameter in some
508 // edge-cases.
509 ArgVal = castArgToParamTypeIfNeeded(Call, ArgIdx: Idx, ArgVal, SVB);
510
511 Loc ParamLoc = SVB.makeLoc(
512 region: MRMgr.getParamVarRegion(OriginExpr: Call.getOriginExpr(), Index: Idx, SF: CalleeSF));
513 Bindings.push_back(
514 Elt: std::make_pair(x&: ParamLoc, y: processArgument(Value: ArgVal, ArgumentExpr: ArgExpr, Parameter: *I, SVB)));
515 }
516
517 // FIXME: Variadic arguments are not handled at all right now.
518}
519
520const ConstructionContext *CallEvent::getConstructionContext() const {
521 const StackFrame *StackFrame = getCalleeStackFrame(BlockCount: 0);
522 if (!StackFrame)
523 return nullptr;
524
525 const CFGElement Element = StackFrame->getCallSiteCFGElement();
526 if (const auto Ctor = Element.getAs<CFGConstructor>()) {
527 return Ctor->getConstructionContext();
528 }
529
530 if (const auto RecCall = Element.getAs<CFGCXXRecordTypedCall>()) {
531 return RecCall->getConstructionContext();
532 }
533
534 return nullptr;
535}
536
537const CallEventRef<> CallEvent::getCaller() const {
538 const auto *CallSF = this->getStackFrame();
539 if (!CallSF || CallSF->inTopFrame())
540 return nullptr;
541
542 CallEventManager &CEMgr = State->getStateManager().getCallEventManager();
543 return CEMgr.getCaller(CalleeSF: CallSF, State);
544}
545
546bool CallEvent::isCalledFromSystemHeader() const {
547 if (const CallEventRef<> Caller = getCaller())
548 return Caller->isInSystemHeader();
549
550 return false;
551}
552
553std::optional<SVal> CallEvent::getReturnValueUnderConstruction() const {
554 const auto *CC = getConstructionContext();
555 if (!CC)
556 return std::nullopt;
557
558 EvalCallOptions CallOpts;
559 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
560 unsigned NumVisitedCall =
561 Engine.getNumVisited(SF: getStackFrame(), Block: getCFGElementRef().getParent());
562 SVal RetVal = Engine.computeObjectUnderConstruction(
563 E: getOriginExpr(), State: getState(), NumVisitedCaller: NumVisitedCall, SF: getStackFrame(), CC,
564 CallOpts);
565 return RetVal;
566}
567
568ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
569 const FunctionDecl *D = getDecl();
570 if (!D)
571 return {};
572 return D->parameters();
573}
574
575RuntimeDefinition AnyFunctionCall::getRuntimeDefinition() const {
576 const FunctionDecl *FD = getDecl();
577 if (!FD)
578 return {};
579
580 // Note that the AnalysisDeclContext will have the FunctionDecl with
581 // the definition (if one exists).
582 AnalysisDeclContext *AD =
583 getStackFrame()->getAnalysisDeclContext()->getManager()->getContext(D: FD);
584 bool IsAutosynthesized;
585 Stmt* Body = AD->getBody(IsAutosynthesized);
586 LLVM_DEBUG({
587 if (IsAutosynthesized)
588 llvm::dbgs() << "Using autosynthesized body for " << FD->getName()
589 << "\n";
590 });
591
592 ExprEngine &Engine = getState()->getStateManager().getOwningEngine();
593 cross_tu::CrossTranslationUnitContext &CTUCtx =
594 *Engine.getCrossTranslationUnitContext();
595
596 AnalyzerOptions &Opts = Engine.getAnalysisManager().options;
597
598 if (Body) {
599 const Decl* Decl = AD->getDecl();
600 if (Opts.IsNaiveCTUEnabled && CTUCtx.isImportedAsNew(ToDecl: Decl)) {
601 // A newly created definition, but we had error(s) during the import.
602 if (CTUCtx.hasError(ToDecl: Decl))
603 return {};
604 return RuntimeDefinition(Decl, /*Foreign=*/true);
605 }
606 return RuntimeDefinition(Decl, /*Foreign=*/false);
607 }
608
609 // Try to get CTU definition only if CTUDir is provided.
610 if (!Opts.IsNaiveCTUEnabled)
611 return {};
612
613 llvm::Expected<const FunctionDecl *> CTUDeclOrError =
614 CTUCtx.getCrossTUDefinition(FD, CrossTUDir: Opts.CTUDir, IndexName: Opts.CTUIndexName,
615 DisplayCTUProgress: Opts.DisplayCTUProgress);
616
617 if (!CTUDeclOrError) {
618 handleAllErrors(E: CTUDeclOrError.takeError(),
619 Handlers: [&](const cross_tu::IndexError &IE) {
620 auto Loc = getOriginExpr() ? getOriginExpr()->getExprLoc()
621 : FD->getLocation();
622 CTUCtx.emitCrossTUDiagnostics(IE, Loc);
623 });
624 return {};
625 }
626
627 return RuntimeDefinition(*CTUDeclOrError, /*Foreign=*/true);
628}
629
630void AnyFunctionCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
631 BindingsTy &Bindings) const {
632 const auto *D = cast<FunctionDecl>(Val: CalleeSF->getDecl());
633 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
634 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: D->parameters());
635}
636
637bool AnyFunctionCall::argumentsMayEscape() const {
638 if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
639 return true;
640
641 const FunctionDecl *D = getDecl();
642 if (!D)
643 return true;
644
645 const IdentifierInfo *II = D->getIdentifier();
646 if (!II)
647 return false;
648
649 // This set of "escaping" APIs is
650
651 // - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
652 // value into thread local storage. The value can later be retrieved with
653 // 'void *ptheread_getspecific(pthread_key)'. So even thought the
654 // parameter is 'const void *', the region escapes through the call.
655 if (II->isStr(Str: "pthread_setspecific"))
656 return true;
657
658 // - xpc_connection_set_context stores a value which can be retrieved later
659 // with xpc_connection_get_context.
660 if (II->isStr(Str: "xpc_connection_set_context"))
661 return true;
662
663 // - funopen - sets a buffer for future IO calls.
664 if (II->isStr(Str: "funopen"))
665 return true;
666
667 // - __cxa_demangle - can reallocate memory and can return the pointer to
668 // the input buffer.
669 if (II->isStr(Str: "__cxa_demangle"))
670 return true;
671
672 StringRef FName = II->getName();
673
674 // - CoreFoundation functions that end with "NoCopy" can free a passed-in
675 // buffer even if it is const.
676 if (FName.ends_with(Suffix: "NoCopy"))
677 return true;
678
679 // - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
680 // be deallocated by NSMapRemove.
681 if (FName.starts_with(Prefix: "NS") && FName.contains(Other: "Insert"))
682 return true;
683
684 // - Many CF containers allow objects to escape through custom
685 // allocators/deallocators upon container construction. (PR12101)
686 if (FName.starts_with(Prefix: "CF") || FName.starts_with(Prefix: "CG")) {
687 return FName.contains_insensitive(Other: "InsertValue") ||
688 FName.contains_insensitive(Other: "AddValue") ||
689 FName.contains_insensitive(Other: "SetValue") ||
690 FName.contains_insensitive(Other: "WithData") ||
691 FName.contains_insensitive(Other: "AppendValue") ||
692 FName.contains_insensitive(Other: "SetAttribute");
693 }
694
695 return false;
696}
697
698const FunctionDecl *SimpleFunctionCall::getDecl() const {
699 const FunctionDecl *D = getOriginExpr()->getDirectCallee();
700 if (D)
701 return D;
702
703 return getSVal(E: getOriginExpr()->getCallee()).getAsFunctionDecl();
704}
705
706RuntimeDefinition SimpleFunctionCall::getRuntimeDefinition() const {
707 // Clang converts lambdas to function pointers using an implicit conversion
708 // operator, which returns the lambda's '__invoke' method. However, Sema
709 // leaves the body of '__invoke' empty (it is generated later in CodeGen), so
710 // we need to skip '__invoke' and access the lambda's operator() directly.
711 if (const auto *CMD = dyn_cast_if_present<CXXMethodDecl>(Val: getDecl());
712 CMD && CMD->isLambdaStaticInvoker())
713 return RuntimeDefinition{CMD->getParent()->getLambdaCallOperator()};
714
715 return AnyFunctionCall::getRuntimeDefinition();
716}
717
718const FunctionDecl *CXXInstanceCall::getDecl() const {
719 const auto *CE = cast_or_null<CallExpr>(Val: getOriginExpr());
720 if (!CE)
721 return AnyFunctionCall::getDecl();
722
723 const FunctionDecl *D = CE->getDirectCallee();
724 if (D)
725 return D;
726
727 return getSVal(E: CE->getCallee()).getAsFunctionDecl();
728}
729
730void CXXInstanceCall::getExtraInvalidatedValues(
731 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
732 SVal ThisVal = getCXXThisVal();
733 Values.push_back(Elt: ThisVal);
734
735 // Don't invalidate if the method is const and there are no mutable fields.
736 if (const auto *D = cast_or_null<CXXMethodDecl>(Val: getDecl())) {
737 if (!D->isConst())
738 return;
739
740 // Get the record decl for the class of 'This'. D->getParent() may return
741 // a base class decl, rather than the class of the instance which needs to
742 // be checked for mutable fields.
743 const CXXRecordDecl *ParentRecord = getDeclForDynamicType().first;
744 if (!ParentRecord || !ParentRecord->hasDefinition())
745 return;
746
747 if (ParentRecord->hasMutableFields())
748 return;
749
750 // Preserve CXXThis.
751 const MemRegion *ThisRegion = ThisVal.getAsRegion();
752 if (!ThisRegion)
753 return;
754
755 ETraits->setTrait(MR: ThisRegion->getBaseRegion(),
756 IK: RegionAndSymbolInvalidationTraits::TK_PreserveContents);
757 }
758}
759
760SVal CXXInstanceCall::getCXXThisVal() const {
761 const Expr *Base = getCXXThisExpr();
762 // FIXME: This doesn't handle an overloaded ->* operator.
763 SVal ThisVal = Base ? getSVal(E: Base) : UnknownVal();
764
765 if (isa<NonLoc>(Val: ThisVal)) {
766 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
767 QualType OriginalTy = ThisVal.getType(SVB.getContext());
768 return SVB.evalCast(V: ThisVal, CastTy: Base->getType(), OriginalTy);
769 }
770
771 assert(ThisVal.isUnknownOrUndef() || isa<Loc>(ThisVal));
772 return ThisVal;
773}
774
775std::pair<const CXXRecordDecl *, bool>
776CXXInstanceCall::getDeclForDynamicType() const {
777 const MemRegion *R = getCXXThisVal().getAsRegion();
778 if (!R)
779 return {};
780
781 DynamicTypeInfo DynType = getDynamicTypeInfo(State: getState(), MR: R);
782 if (!DynType.isValid())
783 return {};
784
785 assert(!DynType.getType()->getPointeeType().isNull());
786 return {DynType.getType()->getPointeeCXXRecordDecl(),
787 DynType.canBeASubClass()};
788}
789
790RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
791 // Do we have a decl at all?
792 const Decl *D = getDecl();
793 if (!D)
794 return {};
795
796 // If the method is non-virtual, we know we can inline it.
797 const auto *MD = cast<CXXMethodDecl>(Val: D);
798 if (!MD->isVirtual())
799 return AnyFunctionCall::getRuntimeDefinition();
800
801 // If the method is final or declared in a final class, we can inline it.
802 if (MD->hasAttr<FinalAttr>() || MD->getParent()->hasAttr<FinalAttr>())
803 return AnyFunctionCall::getRuntimeDefinition();
804
805 auto [RD, CanBeSubClass] = getDeclForDynamicType();
806 if (!RD || !RD->hasDefinition())
807 return {};
808
809 // We can confidently inline a method called on an object with final type.
810 if (RD->hasAttr<FinalAttr>())
811 CanBeSubClass = false;
812
813 // Find the decl for this method in that class.
814 const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, MayBeBase: true);
815 if (!Result) {
816 // We might not even get the original statically-resolved method due to
817 // some particularly nasty casting (e.g. casts to sister classes).
818 // However, we should at least be able to search up and down our own class
819 // hierarchy, and some real bugs have been caught by checking this.
820 assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
821
822 // FIXME: This is checking that our DynamicTypeInfo is at least as good as
823 // the static type. However, because we currently don't update
824 // DynamicTypeInfo when an object is cast, we can't actually be sure the
825 // DynamicTypeInfo is up to date. This assert should be re-enabled once
826 // this is fixed.
827 //
828 // assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
829
830 return {};
831 }
832
833 // A final method cannot be overriden in a subclass.
834 if (Result->hasAttr<FinalAttr>())
835 CanBeSubClass = false;
836
837 // Does the decl that we found have an implementation?
838 const FunctionDecl *Definition;
839 if (!Result->hasBody(Definition)) {
840 if (!CanBeSubClass)
841 return AnyFunctionCall::getRuntimeDefinition();
842 return {};
843 }
844
845 // We found a definition. If we're not sure that this devirtualization is
846 // actually what will happen at runtime, make sure to provide the region so
847 // that ExprEngine can decide what to do with it.
848 if (CanBeSubClass)
849 return RuntimeDefinition(Definition,
850 getCXXThisVal().getAsRegion()->StripCasts());
851 return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
852}
853
854void CXXInstanceCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
855 BindingsTy &Bindings) const {
856 AnyFunctionCall::getInitialStackFrameContents(CalleeSF, Bindings);
857
858 // Handle the binding of 'this' in the new stack frame.
859 SVal ThisVal = getCXXThisVal();
860 if (!ThisVal.isUnknown()) {
861 ProgramStateManager &StateMgr = getState()->getStateManager();
862 SValBuilder &SVB = StateMgr.getSValBuilder();
863
864 const auto *MD = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
865 Loc ThisLoc = SVB.getCXXThis(D: MD, SF: CalleeSF);
866
867 // If we devirtualized to a different member function, we need to make sure
868 // we have the proper layering of CXXBaseObjectRegions.
869 if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
870 ASTContext &Ctx = SVB.getContext();
871 const CXXRecordDecl *Class = MD->getParent();
872 CanQualType Ty = Ctx.getPointerType(T: Ctx.getCanonicalTagType(TD: Class));
873
874 // FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
875 std::optional<SVal> V =
876 StateMgr.getStoreManager().evalBaseToDerived(Base: ThisVal, DerivedPtrType: Ty);
877 if (!V) {
878 // We might have suffered some sort of placement new earlier, so
879 // we're constructing in a completely unexpected storage.
880 // Fall back to a generic pointer cast for this-value.
881 const CXXMethodDecl *StaticMD = cast<CXXMethodDecl>(Val: getDecl());
882 const CXXRecordDecl *StaticClass = StaticMD->getParent();
883 CanQualType StaticTy =
884 Ctx.getPointerType(T: Ctx.getCanonicalTagType(TD: StaticClass));
885 ThisVal = SVB.evalCast(V: ThisVal, CastTy: Ty, OriginalTy: StaticTy);
886 } else
887 ThisVal = *V;
888 }
889
890 if (!ThisVal.isUnknown())
891 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
892 }
893}
894
895const Expr *CXXMemberCall::getCXXThisExpr() const {
896 return getOriginExpr()->getImplicitObjectArgument();
897}
898
899RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
900 // C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
901 // id-expression in the class member access expression is a qualified-id,
902 // that function is called. Otherwise, its final overrider in the dynamic type
903 // of the object expression is called.
904 if (const auto *ME = dyn_cast<MemberExpr>(Val: getOriginExpr()->getCallee()))
905 if (ME->hasQualifier())
906 return AnyFunctionCall::getRuntimeDefinition();
907
908 return CXXInstanceCall::getRuntimeDefinition();
909}
910
911const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
912 return getOriginExpr()->getArg(Arg: 0);
913}
914
915const BlockDataRegion *BlockCall::getBlockRegion() const {
916 const Expr *Callee = getOriginExpr()->getCallee();
917 const MemRegion *DataReg = getSVal(E: Callee).getAsRegion();
918
919 return dyn_cast_or_null<BlockDataRegion>(Val: DataReg);
920}
921
922ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
923 const BlockDecl *D = getDecl();
924 if (!D)
925 return {};
926 return D->parameters();
927}
928
929void BlockCall::getExtraInvalidatedValues(ValueList &Values,
930 RegionAndSymbolInvalidationTraits *ETraits) const {
931 // FIXME: This also needs to invalidate captured globals.
932 if (const MemRegion *R = getBlockRegion())
933 Values.push_back(Elt: loc::MemRegionVal(R));
934}
935
936void BlockCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
937 BindingsTy &Bindings) const {
938 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
939 ArrayRef<ParmVarDecl*> Params;
940 if (isConversionFromLambda()) {
941 auto *LambdaOperatorDecl = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
942 Params = LambdaOperatorDecl->parameters();
943
944 // For blocks converted from a C++ lambda, the callee declaration is the
945 // operator() method on the lambda so we bind "this" to
946 // the lambda captured by the block.
947 const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
948 SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
949 Loc ThisLoc = SVB.getCXXThis(D: LambdaOperatorDecl, SF: CalleeSF);
950 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
951 } else {
952 Params = cast<BlockDecl>(Val: CalleeSF->getDecl())->parameters();
953 }
954
955 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: Params);
956}
957
958SVal AnyCXXConstructorCall::getCXXThisVal() const {
959 if (Data)
960 return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
961 return UnknownVal();
962}
963
964void AnyCXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
965 RegionAndSymbolInvalidationTraits *ETraits) const {
966 SVal V = getCXXThisVal();
967 if (SymbolRef Sym = V.getAsSymbol(IncludeBaseRegions: true))
968 ETraits->setTrait(Sym,
969 IK: RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
970
971 // Standard classes don't reinterpret-cast and modify super regions.
972 const bool IsStdClassCtor = isWithinStdNamespace(D: getDecl());
973 if (const MemRegion *Obj = V.getAsRegion(); Obj && IsStdClassCtor) {
974 ETraits->setTrait(
975 MR: Obj, IK: RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
976 }
977
978 Values.push_back(Elt: V);
979}
980
981void AnyCXXConstructorCall::getInitialStackFrameContents(
982 const StackFrame *CalleeSF, BindingsTy &Bindings) const {
983 AnyFunctionCall::getInitialStackFrameContents(CalleeSF, Bindings);
984
985 SVal ThisVal = getCXXThisVal();
986 if (!ThisVal.isUnknown()) {
987 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
988 const auto *MD = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
989 Loc ThisLoc = SVB.getCXXThis(D: MD, SF: CalleeSF);
990 Bindings.push_back(Elt: std::make_pair(x&: ThisLoc, y&: ThisVal));
991 }
992}
993
994const StackFrame *CXXInheritedConstructorCall::getInheritingStackFrame() const {
995 const StackFrame *SF = getStackFrame();
996 while (isa<CXXInheritedCtorInitExpr>(Val: SF->getCallSite()))
997 SF = SF->getParent();
998 return SF;
999}
1000
1001SVal CXXDestructorCall::getCXXThisVal() const {
1002 if (Data)
1003 return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(V: Data).getPointer());
1004 return UnknownVal();
1005}
1006
1007RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
1008 // Base destructors are always called non-virtually.
1009 // Skip CXXInstanceCall's devirtualization logic in this case.
1010 if (isBaseDestructor())
1011 return AnyFunctionCall::getRuntimeDefinition();
1012
1013 return CXXInstanceCall::getRuntimeDefinition();
1014}
1015
1016ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
1017 const ObjCMethodDecl *D = getDecl();
1018 if (!D)
1019 return {};
1020 return D->parameters();
1021}
1022
1023void ObjCMethodCall::getExtraInvalidatedValues(
1024 ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
1025
1026 // If the method call is a setter for property known to be backed by
1027 // an instance variable, don't invalidate the entire receiver, just
1028 // the storage for that instance variable.
1029 if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
1030 if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
1031 SVal IvarLVal = getState()->getLValue(D: PropIvar, Base: getReceiverSVal());
1032 if (const MemRegion *IvarRegion = IvarLVal.getAsRegion()) {
1033 ETraits->setTrait(
1034 MR: IvarRegion,
1035 IK: RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
1036 ETraits->setTrait(
1037 MR: IvarRegion,
1038 IK: RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
1039 Values.push_back(Elt: IvarLVal);
1040 }
1041 return;
1042 }
1043 }
1044
1045 Values.push_back(Elt: getReceiverSVal());
1046}
1047
1048SVal ObjCMethodCall::getReceiverSVal() const {
1049 // FIXME: Is this the best way to handle class receivers?
1050 if (!isInstanceMessage())
1051 return UnknownVal();
1052
1053 if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
1054 return getSVal(E: RecE);
1055
1056 // An instance message with no expression means we are sending to super.
1057 // In this case the object reference is the same as 'self'.
1058 assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
1059 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1060 assert(SelfVal.isValid() && "Calling super but not in ObjC method");
1061 return SelfVal;
1062}
1063
1064bool ObjCMethodCall::isReceiverSelfOrSuper() const {
1065 if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
1066 getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
1067 return true;
1068
1069 if (!isInstanceMessage())
1070 return false;
1071
1072 SVal RecVal = getSVal(E: getOriginExpr()->getInstanceReceiver());
1073 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1074
1075 return (RecVal == SelfVal);
1076}
1077
1078SourceRange ObjCMethodCall::getSourceRange() const {
1079 switch (getMessageKind()) {
1080 case OCM_Message:
1081 return getOriginExpr()->getSourceRange();
1082 case OCM_PropertyAccess:
1083 case OCM_Subscript:
1084 return getContainingPseudoObjectExpr()->getSourceRange();
1085 }
1086 llvm_unreachable("unknown message kind");
1087}
1088
1089using ObjCMessageDataTy = llvm::PointerIntPair<const PseudoObjectExpr *, 2>;
1090
1091const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
1092 assert(Data && "Lazy lookup not yet performed.");
1093 assert(getMessageKind() != OCM_Message && "Explicit message send.");
1094 return ObjCMessageDataTy::getFromOpaqueValue(V: Data).getPointer();
1095}
1096
1097static const Expr *
1098getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
1099 const Expr *Syntactic = POE->getSyntacticForm()->IgnoreParens();
1100
1101 // This handles the funny case of assigning to the result of a getter.
1102 // This can happen if the getter returns a non-const reference.
1103 if (const auto *BO = dyn_cast<BinaryOperator>(Val: Syntactic))
1104 Syntactic = BO->getLHS()->IgnoreParens();
1105
1106 return Syntactic;
1107}
1108
1109ObjCMessageKind ObjCMethodCall::getMessageKind() const {
1110 if (!Data) {
1111 // Find the parent, ignoring implicit casts.
1112 const ParentMap &PM = getStackFrame()->getParentMap();
1113 const Stmt *S = PM.getParentIgnoreParenCasts(S: getOriginExpr());
1114
1115 // Check if parent is a PseudoObjectExpr.
1116 if (const auto *POE = dyn_cast_or_null<PseudoObjectExpr>(Val: S)) {
1117 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1118
1119 ObjCMessageKind K;
1120 switch (Syntactic->getStmtClass()) {
1121 case Stmt::ObjCPropertyRefExprClass:
1122 K = OCM_PropertyAccess;
1123 break;
1124 case Stmt::ObjCSubscriptRefExprClass:
1125 K = OCM_Subscript;
1126 break;
1127 default:
1128 // FIXME: Can this ever happen?
1129 K = OCM_Message;
1130 break;
1131 }
1132
1133 if (K != OCM_Message) {
1134 const_cast<ObjCMethodCall *>(this)->Data
1135 = ObjCMessageDataTy(POE, K).getOpaqueValue();
1136 assert(getMessageKind() == K);
1137 return K;
1138 }
1139 }
1140
1141 const_cast<ObjCMethodCall *>(this)->Data
1142 = ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
1143 assert(getMessageKind() == OCM_Message);
1144 return OCM_Message;
1145 }
1146
1147 ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(V: Data);
1148 if (!Info.getPointer())
1149 return OCM_Message;
1150 return static_cast<ObjCMessageKind>(Info.getInt());
1151}
1152
1153const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
1154 // Look for properties accessed with property syntax (foo.bar = ...)
1155 if (getMessageKind() == OCM_PropertyAccess) {
1156 const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
1157 assert(POE && "Property access without PseudoObjectExpr?");
1158
1159 const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
1160 auto *RefExpr = cast<ObjCPropertyRefExpr>(Val: Syntactic);
1161
1162 if (RefExpr->isExplicitProperty())
1163 return RefExpr->getExplicitProperty();
1164 }
1165
1166 // Look for properties accessed with method syntax ([foo setBar:...]).
1167 const ObjCMethodDecl *MD = getDecl();
1168 if (!MD || !MD->isPropertyAccessor())
1169 return nullptr;
1170
1171 // Note: This is potentially quite slow.
1172 return MD->findPropertyDecl();
1173}
1174
1175bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1176 Selector Sel) const {
1177 assert(IDecl);
1178 AnalysisManager &AMgr =
1179 getState()->getStateManager().getOwningEngine().getAnalysisManager();
1180 // If the class interface is declared inside the main file, assume it is not
1181 // subcassed.
1182 // TODO: It could actually be subclassed if the subclass is private as well.
1183 // This is probably very rare.
1184 SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
1185 if (InterfLoc.isValid() && AMgr.isInCodeFile(SL: InterfLoc))
1186 return false;
1187
1188 // Assume that property accessors are not overridden.
1189 if (getMessageKind() == OCM_PropertyAccess)
1190 return false;
1191
1192 // We assume that if the method is public (declared outside of main file) or
1193 // has a parent which publicly declares the method, the method could be
1194 // overridden in a subclass.
1195
1196 // Find the first declaration in the class hierarchy that declares
1197 // the selector.
1198 ObjCMethodDecl *D = nullptr;
1199 while (true) {
1200 D = IDecl->lookupMethod(Sel, isInstance: true);
1201
1202 // Cannot find a public definition.
1203 if (!D)
1204 return false;
1205
1206 // If outside the main file,
1207 if (D->getLocation().isValid() && !AMgr.isInCodeFile(SL: D->getLocation()))
1208 return true;
1209
1210 if (D->isOverriding()) {
1211 // Search in the superclass on the next iteration.
1212 IDecl = D->getClassInterface();
1213 if (!IDecl)
1214 return false;
1215
1216 IDecl = IDecl->getSuperClass();
1217 if (!IDecl)
1218 return false;
1219
1220 continue;
1221 }
1222
1223 return false;
1224 };
1225
1226 llvm_unreachable("The while loop should always terminate.");
1227}
1228
1229static const ObjCMethodDecl *findDefiningRedecl(const ObjCMethodDecl *MD) {
1230 if (!MD)
1231 return MD;
1232
1233 // Find the redeclaration that defines the method.
1234 if (!MD->hasBody()) {
1235 for (auto *I : MD->redecls())
1236 if (I->hasBody())
1237 MD = cast<ObjCMethodDecl>(Val: I);
1238 }
1239 return MD;
1240}
1241
1242struct PrivateMethodKey {
1243 const ObjCInterfaceDecl *Interface;
1244 Selector LookupSelector;
1245 bool IsClassMethod;
1246};
1247
1248namespace llvm {
1249template <> struct DenseMapInfo<PrivateMethodKey> {
1250 using InterfaceInfo = DenseMapInfo<const ObjCInterfaceDecl *>;
1251 using SelectorInfo = DenseMapInfo<Selector>;
1252
1253 static unsigned getHashValue(const PrivateMethodKey &Key) {
1254 return llvm::hash_combine(
1255 args: llvm::hash_code(InterfaceInfo::getHashValue(PtrVal: Key.Interface)),
1256 args: llvm::hash_code(SelectorInfo::getHashValue(S: Key.LookupSelector)),
1257 args: Key.IsClassMethod);
1258 }
1259
1260 static bool isEqual(const PrivateMethodKey &LHS,
1261 const PrivateMethodKey &RHS) {
1262 return InterfaceInfo::isEqual(LHS: LHS.Interface, RHS: RHS.Interface) &&
1263 SelectorInfo::isEqual(LHS: LHS.LookupSelector, RHS: RHS.LookupSelector) &&
1264 LHS.IsClassMethod == RHS.IsClassMethod;
1265 }
1266};
1267} // end namespace llvm
1268
1269// NOTE: This cache is a "global" variable, and it is cleared by
1270// CallEventManager's constructor so we do not keep old entries when
1271// loading/unloading ASTs. If we are worried about concurrency, we may need to
1272// revisit this someday. In terms of memory, this table stays around until clang
1273// quits, which also may be bad if we need to release memory.
1274using PrivateMethodCacheTy =
1275 llvm::DenseMap<PrivateMethodKey, std::optional<const ObjCMethodDecl *>>;
1276static PrivateMethodCacheTy PrivateMethodCache;
1277
1278static const ObjCMethodDecl *
1279lookupRuntimeDefinition(const ObjCInterfaceDecl *Interface,
1280 Selector LookupSelector, bool InstanceMethod) {
1281 // Repeatedly calling lookupPrivateMethod() is expensive, especially
1282 // when in many cases it returns null. We cache the results so
1283 // that repeated queries on the same ObjCIntefaceDecl and Selector
1284 // don't incur the same cost. On some test cases, we can see the
1285 // same query being issued thousands of times.
1286 std::optional<const ObjCMethodDecl *> &Val =
1287 PrivateMethodCache[{.Interface: Interface, .LookupSelector: LookupSelector, .IsClassMethod: InstanceMethod}];
1288
1289 // Query lookupPrivateMethod() if the cache does not hit.
1290 if (!Val) {
1291 Val = Interface->lookupPrivateMethod(Sel: LookupSelector, Instance: InstanceMethod);
1292
1293 if (!*Val) {
1294 // Query 'lookupMethod' as a backup.
1295 Val = Interface->lookupMethod(Sel: LookupSelector, isInstance: InstanceMethod);
1296 }
1297 }
1298
1299 return *Val;
1300}
1301
1302RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
1303 const ObjCMessageExpr *E = getOriginExpr();
1304 assert(E);
1305 Selector Sel = E->getSelector();
1306
1307 if (E->isInstanceMessage()) {
1308 // Find the receiver type.
1309 const ObjCObjectType *ReceiverT = nullptr;
1310 bool CanBeSubClassed = false;
1311 bool LookingForInstanceMethod = true;
1312 QualType SupersType = E->getSuperType();
1313 const MemRegion *Receiver = nullptr;
1314
1315 if (!SupersType.isNull()) {
1316 // The receiver is guaranteed to be 'super' in this case.
1317 // Super always means the type of immediate predecessor to the method
1318 // where the call occurs.
1319 ReceiverT = cast<ObjCObjectPointerType>(Val&: SupersType)->getObjectType();
1320 } else {
1321 Receiver = getReceiverSVal().getAsRegion();
1322 if (!Receiver)
1323 return {};
1324
1325 DynamicTypeInfo DTI = getDynamicTypeInfo(State: getState(), MR: Receiver);
1326 if (!DTI.isValid()) {
1327 assert(isa<AllocaRegion>(Receiver) &&
1328 "Unhandled untyped region class!");
1329 return {};
1330 }
1331
1332 QualType DynType = DTI.getType();
1333 CanBeSubClassed = DTI.canBeASubClass();
1334
1335 const auto *ReceiverDynT =
1336 dyn_cast<ObjCObjectPointerType>(Val: DynType.getCanonicalType());
1337
1338 if (ReceiverDynT) {
1339 ReceiverT = ReceiverDynT->getObjectType();
1340
1341 // It can be actually class methods called with Class object as a
1342 // receiver. This type of messages is treated by the compiler as
1343 // instance (not class).
1344 if (ReceiverT->isObjCClass()) {
1345
1346 SVal SelfVal = getState()->getSelfSVal(SF: getStackFrame());
1347 // For [self classMethod], return compiler visible declaration.
1348 if (Receiver == SelfVal.getAsRegion()) {
1349 return RuntimeDefinition(findDefiningRedecl(MD: E->getMethodDecl()));
1350 }
1351
1352 // Otherwise, let's check if we know something about the type
1353 // inside of this class object.
1354 if (SymbolRef ReceiverSym = getReceiverSVal().getAsSymbol()) {
1355 DynamicTypeInfo DTI =
1356 getClassObjectDynamicTypeInfo(State: getState(), Sym: ReceiverSym);
1357 if (DTI.isValid()) {
1358 // Let's use this type for lookup.
1359 ReceiverT =
1360 cast<ObjCObjectType>(Val: DTI.getType().getCanonicalType());
1361
1362 CanBeSubClassed = DTI.canBeASubClass();
1363 // And it should be a class method instead.
1364 LookingForInstanceMethod = false;
1365 }
1366 }
1367 }
1368
1369 if (CanBeSubClassed)
1370 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface())
1371 // Even if `DynamicTypeInfo` told us that it can be
1372 // not necessarily this type, but its descendants, we still want
1373 // to check again if this selector can be actually overridden.
1374 CanBeSubClassed = canBeOverridenInSubclass(IDecl, Sel);
1375 }
1376 }
1377
1378 // Lookup the instance method implementation.
1379 if (ReceiverT)
1380 if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterface()) {
1381 const ObjCMethodDecl *MD =
1382 lookupRuntimeDefinition(Interface: IDecl, LookupSelector: Sel, InstanceMethod: LookingForInstanceMethod);
1383
1384 if (MD && !MD->hasBody())
1385 MD = MD->getCanonicalDecl();
1386
1387 if (CanBeSubClassed)
1388 return RuntimeDefinition(MD, Receiver);
1389 else
1390 return RuntimeDefinition(MD, nullptr);
1391 }
1392 } else {
1393 // This is a class method.
1394 // If we have type info for the receiver class, we are calling via
1395 // class name.
1396 if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
1397 // Find/Return the method implementation.
1398 return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
1399 }
1400 }
1401
1402 return {};
1403}
1404
1405bool ObjCMethodCall::argumentsMayEscape() const {
1406 if (isInSystemHeader() && !isInstanceMessage()) {
1407 Selector Sel = getSelector();
1408 if (Sel.getNumArgs() == 1 &&
1409 Sel.getIdentifierInfoForSlot(argIndex: 0)->isStr(Str: "valueWithPointer"))
1410 return true;
1411 }
1412
1413 return CallEvent::argumentsMayEscape();
1414}
1415
1416void ObjCMethodCall::getInitialStackFrameContents(const StackFrame *CalleeSF,
1417 BindingsTy &Bindings) const {
1418 const auto *D = cast<ObjCMethodDecl>(Val: CalleeSF->getDecl());
1419 SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
1420 addParameterValuesToBindings(CalleeSF, Bindings, SVB, Call: *this, parameters: D->parameters());
1421
1422 SVal SelfVal = getReceiverSVal();
1423 if (!SelfVal.isUnknown()) {
1424 const VarDecl *SelfD = CalleeSF->getAnalysisDeclContext()->getSelfDecl();
1425 MemRegionManager &MRMgr = SVB.getRegionManager();
1426 Loc SelfLoc = SVB.makeLoc(region: MRMgr.getVarRegion(VD: SelfD, SF: CalleeSF));
1427 Bindings.push_back(Elt: std::make_pair(x&: SelfLoc, y&: SelfVal));
1428 }
1429}
1430
1431CallEventManager::CallEventManager(llvm::BumpPtrAllocator &alloc)
1432 : Alloc(alloc) {
1433 // Clear the method cache to avoid hits when multiple AST are loaded/unloaded
1434 // within a single process. This can happen with unit tests, for instance.
1435 PrivateMethodCache.clear();
1436}
1437
1438CallEventRef<>
1439CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
1440 const StackFrame *SF,
1441 CFGBlock::ConstCFGElementRef ElemRef) {
1442 if (const auto *MCE = dyn_cast<CXXMemberCallExpr>(Val: CE))
1443 return create<CXXMemberCall>(A: MCE, St: State, SF, ElemRef);
1444
1445 if (const auto *OpCE = dyn_cast<CXXOperatorCallExpr>(Val: CE)) {
1446 const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
1447 if (const auto *MD = dyn_cast<CXXMethodDecl>(Val: DirectCallee)) {
1448 if (MD->isImplicitObjectMemberFunction())
1449 return create<CXXMemberOperatorCall>(A: OpCE, St: State, SF, ElemRef);
1450 if (MD->isStatic())
1451 return create<CXXStaticOperatorCall>(A: OpCE, St: State, SF, ElemRef);
1452 }
1453
1454 } else if (CE->getCallee()->getType()->isBlockPointerType()) {
1455 return create<BlockCall>(A: CE, St: State, SF, ElemRef);
1456 }
1457
1458 // Otherwise, it's a normal function call, static member function call, or
1459 // something we can't reason about.
1460 return create<SimpleFunctionCall>(A: CE, St: State, SF, ElemRef);
1461}
1462
1463CallEventRef<> CallEventManager::getCaller(const StackFrame *CalleeSF,
1464 ProgramStateRef State) {
1465 const StackFrame *ParentSF = CalleeSF->getParent();
1466 const StackFrame *CallerSF = ParentSF;
1467 CFGBlock::ConstCFGElementRef ElemRef = {CalleeSF->getCallSiteBlock(),
1468 CalleeSF->getIndex()};
1469 assert(CallerSF && "This should not be used for top-level stack frames");
1470
1471 const Expr *CallSite = CalleeSF->getCallSite();
1472
1473 if (CallSite) {
1474 if (CallEventRef<> Out = getCall(S: CallSite, State, SF: CallerSF, ElemRef))
1475 return Out;
1476
1477 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1478 const auto *Ctor = cast<CXXMethodDecl>(Val: CalleeSF->getDecl());
1479 Loc ThisPtr = SVB.getCXXThis(D: Ctor, SF: CalleeSF);
1480 SVal ThisVal = State->getSVal(LV: ThisPtr);
1481
1482 if (const auto *CE = dyn_cast<CXXConstructExpr>(Val: CallSite))
1483 return getCXXConstructorCall(E: CE, Target: ThisVal.getAsRegion(), State, SF: CallerSF,
1484 ElemRef);
1485 if (const auto *CIE = dyn_cast<CXXInheritedCtorInitExpr>(Val: CallSite))
1486 return getCXXInheritedConstructorCall(E: CIE, Target: ThisVal.getAsRegion(), State,
1487 SF: CallerSF, ElemRef);
1488 // All other cases are handled by getCall.
1489 llvm_unreachable("This is not an inlineable statement");
1490 }
1491
1492 // Fall back to the CFG. The only thing we haven't handled yet is
1493 // destructors, though this could change in the future.
1494 const CFGBlock *B = CalleeSF->getCallSiteBlock();
1495 CFGElement E = (*B)[CalleeSF->getIndex()];
1496 assert((E.getAs<CFGImplicitDtor>() || E.getAs<CFGTemporaryDtor>()) &&
1497 "All other CFG elements should have exprs");
1498
1499 SValBuilder &SVB = State->getStateManager().getSValBuilder();
1500 const auto *Dtor = cast<CXXDestructorDecl>(Val: CalleeSF->getDecl());
1501 Loc ThisPtr = SVB.getCXXThis(D: Dtor, SF: CalleeSF);
1502 SVal ThisVal = State->getSVal(LV: ThisPtr);
1503
1504 const Stmt *Trigger;
1505 if (std::optional<CFGAutomaticObjDtor> AutoDtor =
1506 E.getAs<CFGAutomaticObjDtor>())
1507 Trigger = AutoDtor->getTriggerStmt();
1508 else if (std::optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
1509 Trigger = DeleteDtor->getDeleteExpr();
1510 else
1511 Trigger = Dtor->getBody();
1512
1513 return getCXXDestructorCall(DD: Dtor, Trigger, Target: ThisVal.getAsRegion(),
1514 IsBase: E.getAs<CFGBaseDtor>().has_value(), State,
1515 SF: CallerSF, ElemRef);
1516}
1517
1518CallEventRef<> CallEventManager::getCall(const Stmt *S, ProgramStateRef State,
1519 const StackFrame *SF,
1520 CFGBlock::ConstCFGElementRef ElemRef) {
1521 if (const auto *CE = dyn_cast<CallExpr>(Val: S)) {
1522 return getSimpleCall(CE, State, SF, ElemRef);
1523 } else if (const auto *NE = dyn_cast<CXXNewExpr>(Val: S)) {
1524 return getCXXAllocatorCall(E: NE, State, SF, ElemRef);
1525 } else if (const auto *DE = dyn_cast<CXXDeleteExpr>(Val: S)) {
1526 return getCXXDeallocatorCall(E: DE, State, SF, ElemRef);
1527 } else if (const auto *ME = dyn_cast<ObjCMessageExpr>(Val: S)) {
1528 return getObjCMethodCall(E: ME, State, SF, ElemRef);
1529 } else {
1530 return nullptr;
1531 }
1532}
1533