Coverage Report

Created: 2018-09-19 20:53

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
Line
Count
Source (jump to first uncovered line)
1
//===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
2
//
3
//                     The LLVM Compiler Infrastructure
4
//
5
// This file is distributed under the University of Illinois Open Source
6
// License. See LICENSE.TXT for details.
7
//
8
//===----------------------------------------------------------------------===//
9
//
10
/// \file This file defines CallEvent and its subclasses, which represent path-
11
/// sensitive instances of different kinds of function and method calls
12
/// (C, C++, and Objective-C).
13
//
14
//===----------------------------------------------------------------------===//
15
16
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
17
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
18
19
#include "clang/AST/Decl.h"
20
#include "clang/AST/DeclBase.h"
21
#include "clang/AST/DeclCXX.h"
22
#include "clang/AST/DeclObjC.h"
23
#include "clang/AST/Expr.h"
24
#include "clang/AST/ExprCXX.h"
25
#include "clang/AST/ExprObjC.h"
26
#include "clang/AST/Stmt.h"
27
#include "clang/AST/Type.h"
28
#include "clang/Basic/IdentifierTable.h"
29
#include "clang/Basic/LLVM.h"
30
#include "clang/Basic/SourceLocation.h"
31
#include "clang/Basic/SourceManager.h"
32
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
33
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
34
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
35
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
36
#include "llvm/ADT/ArrayRef.h"
37
#include "llvm/ADT/IntrusiveRefCntPtr.h"
38
#include "llvm/ADT/PointerIntPair.h"
39
#include "llvm/ADT/PointerUnion.h"
40
#include "llvm/ADT/STLExtras.h"
41
#include "llvm/ADT/SmallVector.h"
42
#include "llvm/ADT/StringRef.h"
43
#include "llvm/Support/Allocator.h"
44
#include "llvm/Support/Casting.h"
45
#include "llvm/Support/ErrorHandling.h"
46
#include <cassert>
47
#include <limits>
48
#include <utility>
49
50
namespace clang {
51
52
class LocationContext;
53
class ProgramPoint;
54
class ProgramPointTag;
55
class StackFrameContext;
56
57
namespace ento {
58
59
enum CallEventKind {
60
  CE_Function,
61
  CE_CXXMember,
62
  CE_CXXMemberOperator,
63
  CE_CXXDestructor,
64
  CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
65
  CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
66
  CE_CXXConstructor,
67
  CE_CXXAllocator,
68
  CE_BEG_FUNCTION_CALLS = CE_Function,
69
  CE_END_FUNCTION_CALLS = CE_CXXAllocator,
70
  CE_Block,
71
  CE_ObjCMessage
72
};
73
74
class CallEvent;
75
76
/// This class represents a description of a function call using the number of
77
/// arguments and the name of the function.
78
class CallDescription {
79
  friend CallEvent;
80
81
  mutable IdentifierInfo *II = nullptr;
82
  mutable bool IsLookupDone = false;
83
  // The list of the qualified names used to identify the specified CallEvent,
84
  // e.g. "{a, b}" represent the qualified names, like "a::b".
85
  std::vector<StringRef> QualifiedName;
86
  unsigned RequiredArgs;
87
88
public:
89
  const static unsigned NoArgRequirement = std::numeric_limits<unsigned>::max();
90
91
  /// Constructs a CallDescription object.
92
  ///
93
  /// @param QualifiedName The list of the qualified names of the function that
94
  /// will be matched. It does not require the user to provide the full list of
95
  /// the qualified name. The more details provided, the more accurate the
96
  /// matching.
97
  ///
98
  /// @param RequiredArgs The number of arguments that is expected to match a
99
  /// call. Omit this parameter to match every occurrence of call with a given
100
  /// name regardless the number of arguments.
101
  CallDescription(std::vector<StringRef> QualifiedName,
102
                  unsigned RequiredArgs = NoArgRequirement)
103
435k
      : QualifiedName(QualifiedName), RequiredArgs(RequiredArgs) {}
104
105
  /// Constructs a CallDescription object.
106
  ///
107
  /// @param FuncName The name of the function that will be matched.
108
  ///
109
  /// @param RequiredArgs The number of arguments that is expected to match a
110
  /// call. Omit this parameter to match every occurrence of call with a given
111
  /// name regardless the number of arguments.
112
  CallDescription(StringRef FuncName, unsigned RequiredArgs = NoArgRequirement)
113
435k
      : CallDescription(std::vector<StringRef>({FuncName}), NoArgRequirement) {
114
435k
  }
115
116
  /// Get the name of the function that this object matches.
117
0
  StringRef getFunctionName() const { return QualifiedName.back(); }
118
};
119
120
template<typename T = CallEvent>
121
class CallEventRef : public IntrusiveRefCntPtr<const T> {
122
public:
123
0
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::CallEventRef(clang::ento::ObjCMethodCall const*)
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CallEvent>::CallEventRef(clang::ento::CallEvent const*)
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::CallEventRef(clang::ento::CXXConstructorCall const*)
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::CallEventRef(clang::ento::CXXAllocatorCall const*)
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::CallEventRef(clang::ento::CXXDestructorCall const*)
124
0
  CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
125
126
0
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
127
0
    return this->get()->template cloneWithState<T>(State);
128
0
  }
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CallEvent>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
129
130
  // Allow implicit conversions to a superclass type, since CallEventRef
131
  // behaves like a pointer-to-const.
132
  template <typename SuperT>
133
0
  operator CallEventRef<SuperT> () const {
134
0
    return this->get();
135
0
  }
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
136
};
137
138
/// \class RuntimeDefinition
139
/// Defines the runtime definition of the called function.
140
///
141
/// Encapsulates the information we have about which Decl will be used
142
/// when the call is executed on the given path. When dealing with dynamic
143
/// dispatch, the information is based on DynamicTypeInfo and might not be
144
/// precise.
145
class RuntimeDefinition {
146
  /// The Declaration of the function which could be called at runtime.
147
  /// NULL if not available.
148
  const Decl *D = nullptr;
149
150
  /// The region representing an object (ObjC/C++) on which the method is
151
  /// called. With dynamic dispatch, the method definition depends on the
152
  /// runtime type of this object. NULL when the DynamicTypeInfo is
153
  /// precise.
154
  const MemRegion *R = nullptr;
155
156
public:
157
0
  RuntimeDefinition() = default;
158
0
  RuntimeDefinition(const Decl *InD): D(InD) {}
159
0
  RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
160
161
0
  const Decl *getDecl() { return D; }
162
163
  /// Check if the definition we have is precise.
164
  /// If not, it is possible that the call dispatches to another definition at
165
  /// execution time.
166
0
  bool mayHaveOtherDefinitions() { return R != nullptr; }
167
168
  /// When other definitions are possible, returns the region whose runtime type
169
  /// determines the method definition.
170
0
  const MemRegion *getDispatchRegion() { return R; }
171
};
172
173
/// Represents an abstract call to a function or method along a
174
/// particular path.
175
///
176
/// CallEvents are created through the factory methods of CallEventManager.
177
///
178
/// CallEvents should always be cheap to create and destroy. In order for
179
/// CallEventManager to be able to re-use CallEvent-sized memory blocks,
180
/// subclasses of CallEvent may not add any data members to the base class.
181
/// Use the "Data" and "Location" fields instead.
182
class CallEvent {
183
public:
184
  using Kind = CallEventKind;
185
186
private:
187
  ProgramStateRef State;
188
  const LocationContext *LCtx;
189
  llvm::PointerUnion<const Expr *, const Decl *> Origin;
190
191
protected:
192
  // This is user data for subclasses.
193
  const void *Data;
194
195
  // This is user data for subclasses.
196
  // This should come right before RefCount, so that the two fields can be
197
  // packed together on LP64 platforms.
198
  SourceLocation Location;
199
200
private:
201
  template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
202
203
  mutable unsigned RefCount = 0;
204
205
0
  void Retain() const { ++RefCount; }
206
  void Release() const;
207
208
protected:
209
  friend class CallEventManager;
210
211
  CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
212
0
      : State(std::move(state)), LCtx(lctx), Origin(E) {}
213
214
  CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
215
0
      : State(std::move(state)), LCtx(lctx), Origin(D) {}
216
217
  // DO NOT MAKE PUBLIC
218
  CallEvent(const CallEvent &Original)
219
      : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
220
0
        Data(Original.Data), Location(Original.Location) {}
221
222
  /// Copies this CallEvent, with vtable intact, into a new block of memory.
223
  virtual void cloneTo(void *Dest) const = 0;
224
225
  /// Get the value of arbitrary expressions at this point in the path.
226
0
  SVal getSVal(const Stmt *S) const {
227
0
    return getState()->getSVal(S, getLocationContext());
228
0
  }
229
230
  using ValueList = SmallVectorImpl<SVal>;
231
232
  /// Used to specify non-argument regions that will be invalidated as a
233
  /// result of this call.
234
  virtual void getExtraInvalidatedValues(ValueList &Values,
235
0
                 RegionAndSymbolInvalidationTraits *ETraits) const {}
236
237
public:
238
  CallEvent &operator=(const CallEvent &) = delete;
239
0
  virtual ~CallEvent() = default;
240
241
  /// Returns the kind of call this is.
242
  virtual Kind getKind() const = 0;
243
244
  /// Returns the declaration of the function or method that will be
245
  /// called. May be null.
246
0
  virtual const Decl *getDecl() const {
247
0
    return Origin.dyn_cast<const Decl *>();
248
0
  }
249
250
  /// The state in which the call is being evaluated.
251
0
  const ProgramStateRef &getState() const {
252
0
    return State;
253
0
  }
254
255
  /// The context in which the call is being evaluated.
256
0
  const LocationContext *getLocationContext() const {
257
0
    return LCtx;
258
0
  }
259
260
  /// Returns the definition of the function or method that will be
261
  /// called.
262
  virtual RuntimeDefinition getRuntimeDefinition() const = 0;
263
264
  /// Returns the expression whose value will be the result of this call.
265
  /// May be null.
266
0
  const Expr *getOriginExpr() const {
267
0
    return Origin.dyn_cast<const Expr *>();
268
0
  }
269
270
  /// Returns the number of arguments (explicit and implicit).
271
  ///
272
  /// Note that this may be greater than the number of parameters in the
273
  /// callee's declaration, and that it may include arguments not written in
274
  /// the source.
275
  virtual unsigned getNumArgs() const = 0;
276
277
  /// Returns true if the callee is known to be from a system header.
278
0
  bool isInSystemHeader() const {
279
0
    const Decl *D = getDecl();
280
0
    if (!D)
281
0
      return false;
282
0
283
0
    SourceLocation Loc = D->getLocation();
284
0
    if (Loc.isValid()) {
285
0
      const SourceManager &SM =
286
0
        getState()->getStateManager().getContext().getSourceManager();
287
0
      return SM.isInSystemHeader(D->getLocation());
288
0
    }
289
0
290
0
    // Special case for implicitly-declared global operator new/delete.
291
0
    // These should be considered system functions.
292
0
    if (const auto *FD = dyn_cast<FunctionDecl>(D))
293
0
      return FD->isOverloadedOperator() && FD->isImplicit() && FD->isGlobal();
294
0
295
0
    return false;
296
0
  }
297
298
  /// Returns true if the CallEvent is a call to a function that matches
299
  /// the CallDescription.
300
  ///
301
  /// Note that this function is not intended to be used to match Obj-C method
302
  /// calls.
303
  bool isCalled(const CallDescription &CD) const;
304
305
  /// Returns a source range for the entire call, suitable for
306
  /// outputting in diagnostics.
307
0
  virtual SourceRange getSourceRange() const {
308
0
    return getOriginExpr()->getSourceRange();
309
0
  }
310
311
  /// Returns the value of a given argument at the time of the call.
312
  virtual SVal getArgSVal(unsigned Index) const;
313
314
  /// Returns the expression associated with a given argument.
315
  /// May be null if this expression does not appear in the source.
316
0
  virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }
317
318
  /// Returns the source range for errors associated with this argument.
319
  ///
320
  /// May be invalid if the argument is not written in the source.
321
  virtual SourceRange getArgSourceRange(unsigned Index) const;
322
323
  /// Returns the result type, adjusted for references.
324
  QualType getResultType() const;
325
326
  /// Returns the return value of the call.
327
  ///
328
  /// This should only be called if the CallEvent was created using a state in
329
  /// which the return value has already been bound to the origin expression.
330
  SVal getReturnValue() const;
331
332
  /// Returns true if the type of any of the non-null arguments satisfies
333
  /// the condition.
334
  bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;
335
336
  /// Returns true if any of the arguments appear to represent callbacks.
337
  bool hasNonZeroCallbackArg() const;
338
339
  /// Returns true if any of the arguments is void*.
340
  bool hasVoidPointerToNonConstArg() const;
341
342
  /// Returns true if any of the arguments are known to escape to long-
343
  /// term storage, even if this method will not modify them.
344
  // NOTE: The exact semantics of this are still being defined!
345
  // We don't really want a list of hardcoded exceptions in the long run,
346
  // but we don't want duplicated lists of known APIs in the short term either.
347
0
  virtual bool argumentsMayEscape() const {
348
0
    return hasNonZeroCallbackArg();
349
0
  }
350
351
  /// Returns true if the callee is an externally-visible function in the
352
  /// top-level namespace, such as \c malloc.
353
  ///
354
  /// You can use this call to determine that a particular function really is
355
  /// a library function and not, say, a C++ member function with the same name.
356
  ///
357
  /// If a name is provided, the function must additionally match the given
358
  /// name.
359
  ///
360
  /// Note that this deliberately excludes C++ library functions in the \c std
361
  /// namespace, but will include C library functions accessed through the
362
  /// \c std namespace. This also does not check if the function is declared
363
  /// as 'extern "C"', or if it uses C++ name mangling.
364
  // FIXME: Add a helper for checking namespaces.
365
  // FIXME: Move this down to AnyFunctionCall once checkers have more
366
  // precise callbacks.
367
  bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
368
369
  /// Returns the name of the callee, if its name is a simple identifier.
370
  ///
371
  /// Note that this will fail for Objective-C methods, blocks, and C++
372
  /// overloaded operators. The former is named by a Selector rather than a
373
  /// simple identifier, and the latter two do not have names.
374
  // FIXME: Move this down to AnyFunctionCall once checkers have more
375
  // precise callbacks.
376
0
  const IdentifierInfo *getCalleeIdentifier() const {
377
0
    const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
378
0
    if (!ND)
379
0
      return nullptr;
380
0
    return ND->getIdentifier();
381
0
  }
382
383
  /// Returns an appropriate ProgramPoint for this call.
384
  ProgramPoint getProgramPoint(bool IsPreVisit = false,
385
                               const ProgramPointTag *Tag = nullptr) const;
386
387
  /// Returns a new state with all argument regions invalidated.
388
  ///
389
  /// This accepts an alternate state in case some processing has already
390
  /// occurred.
391
  ProgramStateRef invalidateRegions(unsigned BlockCount,
392
                                    ProgramStateRef Orig = nullptr) const;
393
394
  using FrameBindingTy = std::pair<Loc, SVal>;
395
  using BindingsTy = SmallVectorImpl<FrameBindingTy>;
396
397
  /// Populates the given SmallVector with the bindings in the callee's stack
398
  /// frame at the start of this call.
399
  virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
400
                                            BindingsTy &Bindings) const = 0;
401
402
  /// Returns a copy of this CallEvent, but using the given state.
403
  template <typename T>
404
  CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;
405
406
  /// Returns a copy of this CallEvent, but using the given state.
407
0
  CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
408
0
    return cloneWithState<CallEvent>(NewState);
409
0
  }
410
411
  /// Returns true if this is a statement is a function or method call
412
  /// of some kind.
413
  static bool isCallStmt(const Stmt *S);
414
415
  /// Returns the result type of a function or method declaration.
416
  ///
417
  /// This will return a null QualType if the result type cannot be determined.
418
  static QualType getDeclaredResultType(const Decl *D);
419
420
  /// Returns true if the given decl is known to be variadic.
421
  ///
422
  /// \p D must not be null.
423
  static bool isVariadic(const Decl *D);
424
425
  /// Returns AnalysisDeclContext for the callee stack frame.
426
  /// Currently may fail; returns null on failure.
427
  AnalysisDeclContext *getCalleeAnalysisDeclContext() const;
428
429
  /// Returns the callee stack frame. That stack frame will only be entered
430
  /// during analysis if the call is inlined, but it may still be useful
431
  /// in intermediate calculations even if the call isn't inlined.
432
  /// May fail; returns null on failure.
433
  const StackFrameContext *getCalleeStackFrame() const;
434
435
  /// Returns memory location for a parameter variable within the callee stack
436
  /// frame. May fail; returns null on failure.
437
  const VarRegion *getParameterLocation(unsigned Index) const;
438
439
  /// Returns true if on the current path, the argument was constructed by
440
  /// calling a C++ constructor over it. This is an internal detail of the
441
  /// analysis which doesn't necessarily represent the program semantics:
442
  /// if we are supposed to construct an argument directly, we may still
443
  /// not do that because we don't know how (i.e., construction context is
444
  /// unavailable in the CFG or not supported by the analyzer).
445
0
  bool isArgumentConstructedDirectly(unsigned Index) const {
446
0
    // This assumes that the object was not yet removed from the state.
447
0
    return ExprEngine::getObjectUnderConstruction(
448
0
        getState(), {getOriginExpr(), Index}, getLocationContext()).hasValue();
449
0
  }
450
451
  /// Some calls have parameter numbering mismatched from argument numbering.
452
  /// This function converts an argument index to the corresponding
453
  /// parameter index. Returns None is the argument doesn't correspond
454
  /// to any parameter variable.
455
  virtual Optional<unsigned>
456
0
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const {
457
0
    return ASTArgumentIndex;
458
0
  }
459
460
  /// Some call event sub-classes conveniently adjust mismatching AST indices
461
  /// to match parameter indices. This function converts an argument index
462
  /// as understood by CallEvent to the argument index as understood by the AST.
463
0
  virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const {
464
0
    return CallArgumentIndex;
465
0
  }
466
467
  // Iterator access to formal parameters and their types.
468
private:
469
  struct GetTypeFn {
470
0
    QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
471
  };
472
473
public:
474
  /// Return call's formal parameters.
475
  ///
476
  /// Remember that the number of formal parameters may not match the number
477
  /// of arguments for all calls. However, the first parameter will always
478
  /// correspond with the argument value returned by \c getArgSVal(0).
479
  virtual ArrayRef<ParmVarDecl *> parameters() const = 0;
480
481
  using param_type_iterator =
482
      llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;
483
484
  /// Returns an iterator over the types of the call's formal parameters.
485
  ///
486
  /// This uses the callee decl found by default name lookup rather than the
487
  /// definition because it represents a public interface, and probably has
488
  /// more annotations.
489
0
  param_type_iterator param_type_begin() const {
490
0
    return llvm::map_iterator(parameters().begin(), GetTypeFn());
491
0
  }
492
  /// \sa param_type_begin()
493
0
  param_type_iterator param_type_end() const {
494
0
    return llvm::map_iterator(parameters().end(), GetTypeFn());
495
0
  }
496
497
  // For debugging purposes only
498
  void dump(raw_ostream &Out) const;
499
  void dump() const;
500
};
501
502
/// Represents a call to any sort of function that might have a
503
/// FunctionDecl.
504
class AnyFunctionCall : public CallEvent {
505
protected:
506
  AnyFunctionCall(const Expr *E, ProgramStateRef St,
507
                  const LocationContext *LCtx)
508
0
      : CallEvent(E, St, LCtx) {}
509
  AnyFunctionCall(const Decl *D, ProgramStateRef St,
510
                  const LocationContext *LCtx)
511
0
      : CallEvent(D, St, LCtx) {}
512
0
  AnyFunctionCall(const AnyFunctionCall &Other) = default;
513
514
public:
515
  // This function is overridden by subclasses, but they must return
516
  // a FunctionDecl.
517
0
  const FunctionDecl *getDecl() const override {
518
0
    return cast<FunctionDecl>(CallEvent::getDecl());
519
0
  }
520
521
  RuntimeDefinition getRuntimeDefinition() const override;
522
523
  bool argumentsMayEscape() const override;
524
525
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
526
                                    BindingsTy &Bindings) const override;
527
528
  ArrayRef<ParmVarDecl *> parameters() const override;
529
530
0
  static bool classof(const CallEvent *CA) {
531
0
    return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
532
0
           CA->getKind() <= CE_END_FUNCTION_CALLS;
533
0
  }
534
};
535
536
/// Represents a C function or static C++ member function call.
537
///
538
/// Example: \c fun()
539
class SimpleFunctionCall : public AnyFunctionCall {
540
  friend class CallEventManager;
541
542
protected:
543
  SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St,
544
                     const LocationContext *LCtx)
545
0
      : AnyFunctionCall(CE, St, LCtx) {}
546
0
  SimpleFunctionCall(const SimpleFunctionCall &Other) = default;
547
548
0
  void cloneTo(void *Dest) const override {
549
0
    new (Dest) SimpleFunctionCall(*this);
550
0
  }
551
552
public:
553
0
  virtual const CallExpr *getOriginExpr() const {
554
0
    return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
555
0
  }
556
557
  const FunctionDecl *getDecl() const override;
558
559
0
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
560
561
0
  const Expr *getArgExpr(unsigned Index) const override {
562
0
    return getOriginExpr()->getArg(Index);
563
0
  }
564
565
0
  Kind getKind() const override { return CE_Function; }
566
567
0
  static bool classof(const CallEvent *CA) {
568
0
    return CA->getKind() == CE_Function;
569
0
  }
570
};
571
572
/// Represents a call to a block.
573
///
574
/// Example: <tt>^{ /* ... */ }()</tt>
575
class BlockCall : public CallEvent {
576
  friend class CallEventManager;
577
578
protected:
579
  BlockCall(const CallExpr *CE, ProgramStateRef St,
580
            const LocationContext *LCtx)
581
0
      : CallEvent(CE, St, LCtx) {}
582
0
  BlockCall(const BlockCall &Other) = default;
583
584
0
  void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }
585
586
  void getExtraInvalidatedValues(ValueList &Values,
587
         RegionAndSymbolInvalidationTraits *ETraits) const override;
588
589
public:
590
0
  virtual const CallExpr *getOriginExpr() const {
591
0
    return cast<CallExpr>(CallEvent::getOriginExpr());
592
0
  }
593
594
0
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
595
596
0
  const Expr *getArgExpr(unsigned Index) const override {
597
0
    return getOriginExpr()->getArg(Index);
598
0
  }
599
600
  /// Returns the region associated with this instance of the block.
601
  ///
602
  /// This may be NULL if the block's origin is unknown.
603
  const BlockDataRegion *getBlockRegion() const;
604
605
0
  const BlockDecl *getDecl() const override {
606
0
    const BlockDataRegion *BR = getBlockRegion();
607
0
    if (!BR)
608
0
      return nullptr;
609
0
    return BR->getDecl();
610
0
  }
611
612
0
  bool isConversionFromLambda() const {
613
0
    const BlockDecl *BD = getDecl();
614
0
    if (!BD)
615
0
      return false;
616
0
617
0
    return BD->isConversionFromLambda();
618
0
  }
619
620
  /// For a block converted from a C++ lambda, returns the block
621
  /// VarRegion for the variable holding the captured C++ lambda record.
622
0
  const VarRegion *getRegionStoringCapturedLambda() const {
623
0
    assert(isConversionFromLambda());
624
0
    const BlockDataRegion *BR = getBlockRegion();
625
0
    assert(BR && "Block converted from lambda must have a block region");
626
0
627
0
    auto I = BR->referenced_vars_begin();
628
0
    assert(I != BR->referenced_vars_end());
629
0
630
0
    return I.getCapturedRegion();
631
0
  }
632
633
0
  RuntimeDefinition getRuntimeDefinition() const override {
634
0
    if (!isConversionFromLambda())
635
0
      return RuntimeDefinition(getDecl());
636
0
637
0
    // Clang converts lambdas to blocks with an implicit user-defined
638
0
    // conversion operator method on the lambda record that looks (roughly)
639
0
    // like:
640
0
    //
641
0
    // typedef R(^block_type)(P1, P2, ...);
642
0
    // operator block_type() const {
643
0
    //   auto Lambda = *this;
644
0
    //   return ^(P1 p1, P2 p2, ...){
645
0
    //     /* return Lambda(p1, p2, ...); */
646
0
    //   };
647
0
    // }
648
0
    //
649
0
    // Here R is the return type of the lambda and P1, P2, ... are
650
0
    // its parameter types. 'Lambda' is a fake VarDecl captured by the block
651
0
    // that is initialized to a copy of the lambda.
652
0
    //
653
0
    // Sema leaves the body of a lambda-converted block empty (it is
654
0
    // produced by CodeGen), so we can't analyze it directly. Instead, we skip
655
0
    // the block body and analyze the operator() method on the captured lambda.
656
0
    const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
657
0
    const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
658
0
    CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();
659
0
660
0
    return RuntimeDefinition(LambdaCallOperator);
661
0
  }
662
663
0
  bool argumentsMayEscape() const override {
664
0
    return true;
665
0
  }
666
667
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
668
                                    BindingsTy &Bindings) const override;
669
670
  ArrayRef<ParmVarDecl*> parameters() const override;
671
672
0
  Kind getKind() const override { return CE_Block; }
673
674
0
  static bool classof(const CallEvent *CA) {
675
0
    return CA->getKind() == CE_Block;
676
0
  }
677
};
678
679
/// Represents a non-static C++ member function call, no matter how
680
/// it is written.
681
class CXXInstanceCall : public AnyFunctionCall {
682
protected:
683
  CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
684
                  const LocationContext *LCtx)
685
0
      : AnyFunctionCall(CE, St, LCtx) {}
686
  CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
687
                  const LocationContext *LCtx)
688
0
      : AnyFunctionCall(D, St, LCtx) {}
689
0
  CXXInstanceCall(const CXXInstanceCall &Other) = default;
690
691
  void getExtraInvalidatedValues(ValueList &Values,
692
         RegionAndSymbolInvalidationTraits *ETraits) const override;
693
694
public:
695
  /// Returns the expression representing the implicit 'this' object.
696
0
  virtual const Expr *getCXXThisExpr() const { return nullptr; }
697
698
  /// Returns the value of the implicit 'this' object.
699
  virtual SVal getCXXThisVal() const;
700
701
  const FunctionDecl *getDecl() const override;
702
703
  RuntimeDefinition getRuntimeDefinition() const override;
704
705
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
706
                                    BindingsTy &Bindings) const override;
707
708
0
  static bool classof(const CallEvent *CA) {
709
0
    return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
710
0
           CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
711
0
  }
712
};
713
714
/// Represents a non-static C++ member function call.
715
///
716
/// Example: \c obj.fun()
717
class CXXMemberCall : public CXXInstanceCall {
718
  friend class CallEventManager;
719
720
protected:
721
  CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
722
                const LocationContext *LCtx)
723
0
      : CXXInstanceCall(CE, St, LCtx) {}
724
0
  CXXMemberCall(const CXXMemberCall &Other) = default;
725
726
0
  void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }
727
728
public:
729
0
  virtual const CXXMemberCallExpr *getOriginExpr() const {
730
0
    return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
731
0
  }
732
733
0
  unsigned getNumArgs() const override {
734
0
    if (const CallExpr *CE = getOriginExpr())
735
0
      return CE->getNumArgs();
736
0
    return 0;
737
0
  }
738
739
0
  const Expr *getArgExpr(unsigned Index) const override {
740
0
    return getOriginExpr()->getArg(Index);
741
0
  }
742
743
  const Expr *getCXXThisExpr() const override;
744
745
  RuntimeDefinition getRuntimeDefinition() const override;
746
747
0
  Kind getKind() const override { return CE_CXXMember; }
748
749
0
  static bool classof(const CallEvent *CA) {
750
0
    return CA->getKind() == CE_CXXMember;
751
0
  }
752
};
753
754
/// Represents a C++ overloaded operator call where the operator is
755
/// implemented as a non-static member function.
756
///
757
/// Example: <tt>iter + 1</tt>
758
class CXXMemberOperatorCall : public CXXInstanceCall {
759
  friend class CallEventManager;
760
761
protected:
762
  CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
763
                        const LocationContext *LCtx)
764
0
      : CXXInstanceCall(CE, St, LCtx) {}
765
0
  CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;
766
767
0
  void cloneTo(void *Dest) const override {
768
0
    new (Dest) CXXMemberOperatorCall(*this);
769
0
  }
770
771
public:
772
0
  virtual const CXXOperatorCallExpr *getOriginExpr() const {
773
0
    return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
774
0
  }
775
776
0
  unsigned getNumArgs() const override {
777
0
    return getOriginExpr()->getNumArgs() - 1;
778
0
  }
779
780
0
  const Expr *getArgExpr(unsigned Index) const override {
781
0
    return getOriginExpr()->getArg(Index + 1);
782
0
  }
783
784
  const Expr *getCXXThisExpr() const override;
785
786
0
  Kind getKind() const override { return CE_CXXMemberOperator; }
787
788
0
  static bool classof(const CallEvent *CA) {
789
0
    return CA->getKind() == CE_CXXMemberOperator;
790
0
  }
791
792
  Optional<unsigned>
793
0
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override {
794
0
    // For member operator calls argument 0 on the expression corresponds
795
0
    // to implicit this-parameter on the declaration.
796
0
    return (ASTArgumentIndex > 0) ? Optional<unsigned>(ASTArgumentIndex - 1)
797
0
                                  : None;
798
0
  }
799
800
0
  unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override {
801
0
    // For member operator calls argument 0 on the expression corresponds
802
0
    // to implicit this-parameter on the declaration.
803
0
    return CallArgumentIndex + 1;
804
0
  }
805
};
806
807
/// Represents an implicit call to a C++ destructor.
808
///
809
/// This can occur at the end of a scope (for automatic objects), at the end
810
/// of a full-expression (for temporaries), or as part of a delete.
811
class CXXDestructorCall : public CXXInstanceCall {
812
  friend class CallEventManager;
813
814
protected:
815
  using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;
816
817
  /// Creates an implicit destructor.
818
  ///
819
  /// \param DD The destructor that will be called.
820
  /// \param Trigger The statement whose completion causes this destructor call.
821
  /// \param Target The object region to be destructed.
822
  /// \param St The path-sensitive state at this point in the program.
823
  /// \param LCtx The location context at this point in the program.
824
  CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
825
                    const MemRegion *Target, bool IsBaseDestructor,
826
                    ProgramStateRef St, const LocationContext *LCtx)
827
0
      : CXXInstanceCall(DD, St, LCtx) {
828
0
    Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
829
0
    Location = Trigger->getEndLoc();
830
0
  }
831
832
0
  CXXDestructorCall(const CXXDestructorCall &Other) = default;
833
834
0
  void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}
835
836
public:
837
0
  SourceRange getSourceRange() const override { return Location; }
838
0
  unsigned getNumArgs() const override { return 0; }
839
840
  RuntimeDefinition getRuntimeDefinition() const override;
841
842
  /// Returns the value of the implicit 'this' object.
843
  SVal getCXXThisVal() const override;
844
845
  /// Returns true if this is a call to a base class destructor.
846
0
  bool isBaseDestructor() const {
847
0
    return DtorDataTy::getFromOpaqueValue(Data).getInt();
848
0
  }
849
850
0
  Kind getKind() const override { return CE_CXXDestructor; }
851
852
0
  static bool classof(const CallEvent *CA) {
853
0
    return CA->getKind() == CE_CXXDestructor;
854
0
  }
855
};
856
857
/// Represents a call to a C++ constructor.
858
///
859
/// Example: \c T(1)
860
class CXXConstructorCall : public AnyFunctionCall {
861
  friend class CallEventManager;
862
863
protected:
864
  /// Creates a constructor call.
865
  ///
866
  /// \param CE The constructor expression as written in the source.
867
  /// \param Target The region where the object should be constructed. If NULL,
868
  ///               a new symbolic region will be used.
869
  /// \param St The path-sensitive state at this point in the program.
870
  /// \param LCtx The location context at this point in the program.
871
  CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
872
                     ProgramStateRef St, const LocationContext *LCtx)
873
0
      : AnyFunctionCall(CE, St, LCtx) {
874
0
    Data = Target;
875
0
  }
876
877
0
  CXXConstructorCall(const CXXConstructorCall &Other) = default;
878
879
0
  void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }
880
881
  void getExtraInvalidatedValues(ValueList &Values,
882
         RegionAndSymbolInvalidationTraits *ETraits) const override;
883
884
public:
885
0
  virtual const CXXConstructExpr *getOriginExpr() const {
886
0
    return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
887
0
  }
888
889
0
  const CXXConstructorDecl *getDecl() const override {
890
0
    return getOriginExpr()->getConstructor();
891
0
  }
892
893
0
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
894
895
0
  const Expr *getArgExpr(unsigned Index) const override {
896
0
    return getOriginExpr()->getArg(Index);
897
0
  }
898
899
  /// Returns the value of the implicit 'this' object.
900
  SVal getCXXThisVal() const;
901
902
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
903
                                    BindingsTy &Bindings) const override;
904
905
0
  Kind getKind() const override { return CE_CXXConstructor; }
906
907
0
  static bool classof(const CallEvent *CA) {
908
0
    return CA->getKind() == CE_CXXConstructor;
909
0
  }
910
};
911
912
/// Represents the memory allocation call in a C++ new-expression.
913
///
914
/// This is a call to "operator new".
915
class CXXAllocatorCall : public AnyFunctionCall {
916
  friend class CallEventManager;
917
918
protected:
919
  CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
920
                   const LocationContext *LCtx)
921
0
      : AnyFunctionCall(E, St, LCtx) {}
922
0
  CXXAllocatorCall(const CXXAllocatorCall &Other) = default;
923
924
0
  void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }
925
926
public:
927
0
  virtual const CXXNewExpr *getOriginExpr() const {
928
0
    return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
929
0
  }
930
931
0
  const FunctionDecl *getDecl() const override {
932
0
    return getOriginExpr()->getOperatorNew();
933
0
  }
934
935
0
  unsigned getNumArgs() const override {
936
0
    return getOriginExpr()->getNumPlacementArgs() + 1;
937
0
  }
938
939
0
  const Expr *getArgExpr(unsigned Index) const override {
940
0
    // The first argument of an allocator call is the size of the allocation.
941
0
    if (Index == 0)
942
0
      return nullptr;
943
0
    return getOriginExpr()->getPlacementArg(Index - 1);
944
0
  }
945
946
0
  Kind getKind() const override { return CE_CXXAllocator; }
947
948
0
  static bool classof(const CallEvent *CE) {
949
0
    return CE->getKind() == CE_CXXAllocator;
950
0
  }
951
};
952
953
/// Represents the ways an Objective-C message send can occur.
954
//
955
// Note to maintainers: OCM_Message should always be last, since it does not
956
// need to fit in the Data field's low bits.
957
enum ObjCMessageKind {
958
  OCM_PropertyAccess,
959
  OCM_Subscript,
960
  OCM_Message
961
};
962
963
/// Represents any expression that calls an Objective-C method.
964
///
965
/// This includes all of the kinds listed in ObjCMessageKind.
966
class ObjCMethodCall : public CallEvent {
967
  friend class CallEventManager;
968
969
  const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
970
971
protected:
972
  ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
973
                 const LocationContext *LCtx)
974
0
      : CallEvent(Msg, St, LCtx) {
975
0
    Data = nullptr;
976
0
  }
977
978
0
  ObjCMethodCall(const ObjCMethodCall &Other) = default;
979
980
0
  void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }
981
982
  void getExtraInvalidatedValues(ValueList &Values,
983
         RegionAndSymbolInvalidationTraits *ETraits) const override;
984
985
  /// Check if the selector may have multiple definitions (may have overrides).
986
  virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
987
                                        Selector Sel) const;
988
989
public:
990
0
  virtual const ObjCMessageExpr *getOriginExpr() const {
991
0
    return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
992
0
  }
993
994
0
  const ObjCMethodDecl *getDecl() const override {
995
0
    return getOriginExpr()->getMethodDecl();
996
0
  }
997
998
0
  unsigned getNumArgs() const override {
999
0
    return getOriginExpr()->getNumArgs();
1000
0
  }
1001
1002
0
  const Expr *getArgExpr(unsigned Index) const override {
1003
0
    return getOriginExpr()->getArg(Index);
1004
0
  }
1005
1006
0
  bool isInstanceMessage() const {
1007
0
    return getOriginExpr()->isInstanceMessage();
1008
0
  }
1009
1010
0
  ObjCMethodFamily getMethodFamily() const {
1011
0
    return getOriginExpr()->getMethodFamily();
1012
0
  }
1013
1014
0
  Selector getSelector() const {
1015
0
    return getOriginExpr()->getSelector();
1016
0
  }
1017
1018
  SourceRange getSourceRange() const override;
1019
1020
  /// Returns the value of the receiver at the time of this call.
1021
  SVal getReceiverSVal() const;
1022
1023
  /// Return the value of 'self' if available.
1024
  SVal getSelfSVal() const;
1025
1026
  /// Get the interface for the receiver.
1027
  ///
1028
  /// This works whether this is an instance message or a class message.
1029
  /// However, it currently just uses the static type of the receiver.
1030
0
  const ObjCInterfaceDecl *getReceiverInterface() const {
1031
0
    return getOriginExpr()->getReceiverInterface();
1032
0
  }
1033
1034
  /// Checks if the receiver refers to 'self' or 'super'.
1035
  bool isReceiverSelfOrSuper() const;
1036
1037
  /// Returns how the message was written in the source (property access,
1038
  /// subscript, or explicit message send).
1039
  ObjCMessageKind getMessageKind() const;
1040
1041
  /// Returns true if this property access or subscript is a setter (has the
1042
  /// form of an assignment).
1043
0
  bool isSetter() const {
1044
0
    switch (getMessageKind()) {
1045
0
    case OCM_Message:
1046
0
      llvm_unreachable("This is not a pseudo-object access!");
1047
0
    case OCM_PropertyAccess:
1048
0
      return getNumArgs() > 0;
1049
0
    case OCM_Subscript:
1050
0
      return getNumArgs() > 1;
1051
0
    }
1052
0
    llvm_unreachable("Unknown message kind");
1053
0
  }
1054
1055
  // Returns the property accessed by this method, either explicitly via
1056
  // property syntax or implicitly via a getter or setter method. Returns
1057
  // nullptr if the call is not a prooperty access.
1058
  const ObjCPropertyDecl *getAccessedProperty() const;
1059
1060
  RuntimeDefinition getRuntimeDefinition() const override;
1061
1062
  bool argumentsMayEscape() const override;
1063
1064
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
1065
                                    BindingsTy &Bindings) const override;
1066
1067
  ArrayRef<ParmVarDecl*> parameters() const override;
1068
1069
0
  Kind getKind() const override { return CE_ObjCMessage; }
1070
1071
0
  static bool classof(const CallEvent *CA) {
1072
0
    return CA->getKind() == CE_ObjCMessage;
1073
0
  }
1074
};
1075
1076
/// Manages the lifetime of CallEvent objects.
1077
///
1078
/// CallEventManager provides a way to create arbitrary CallEvents "on the
1079
/// stack" as if they were value objects by keeping a cache of CallEvent-sized
1080
/// memory blocks. The CallEvents created by CallEventManager are only valid
1081
/// for the lifetime of the OwnedCallEvent that holds them; right now these
1082
/// objects cannot be copied and ownership cannot be transferred.
1083
class CallEventManager {
1084
  friend class CallEvent;
1085
1086
  llvm::BumpPtrAllocator &Alloc;
1087
  SmallVector<void *, 8> Cache;
1088
1089
  using CallEventTemplateTy = SimpleFunctionCall;
1090
1091
0
  void reclaim(const void *Memory) {
1092
0
    Cache.push_back(const_cast<void *>(Memory));
1093
0
  }
1094
1095
  /// Returns memory that can be initialized as a CallEvent.
1096
0
  void *allocate() {
1097
0
    if (Cache.empty())
1098
0
      return Alloc.Allocate<CallEventTemplateTy>();
1099
0
    else
1100
0
      return Cache.pop_back_val();
1101
0
  }
1102
1103
  template <typename T, typename Arg>
1104
0
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1105
0
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1106
0
                  "CallEvent subclasses are not all the same size");
1107
0
    return new (allocate()) T(A, St, LCtx);
1108
0
  }
Unexecuted instantiation: clang::ento::ObjCMethodCall* clang::ento::CallEventManager::create<clang::ento::ObjCMethodCall, clang::ObjCMessageExpr const*>(clang::ObjCMessageExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Unexecuted instantiation: clang::ento::CXXAllocatorCall* clang::ento::CallEventManager::create<clang::ento::CXXAllocatorCall, clang::CXXNewExpr const*>(clang::CXXNewExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Unexecuted instantiation: clang::ento::CXXMemberCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberCall, clang::CXXMemberCallExpr const*>(clang::CXXMemberCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Unexecuted instantiation: clang::ento::CXXMemberOperatorCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberOperatorCall, clang::CXXOperatorCallExpr const*>(clang::CXXOperatorCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Unexecuted instantiation: clang::ento::BlockCall* clang::ento::CallEventManager::create<clang::ento::BlockCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Unexecuted instantiation: clang::ento::SimpleFunctionCall* clang::ento::CallEventManager::create<clang::ento::SimpleFunctionCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
1109
1110
  template <typename T, typename Arg1, typename Arg2>
1111
0
  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1112
0
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1113
0
                  "CallEvent subclasses are not all the same size");
1114
0
    return new (allocate()) T(A1, A2, St, LCtx);
1115
0
  }
1116
1117
  template <typename T, typename Arg1, typename Arg2, typename Arg3>
1118
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
1119
            const LocationContext *LCtx) {
1120
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1121
                  "CallEvent subclasses are not all the same size");
1122
    return new (allocate()) T(A1, A2, A3, St, LCtx);
1123
  }
1124
1125
  template <typename T, typename Arg1, typename Arg2, typename Arg3,
1126
            typename Arg4>
1127
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
1128
0
            const LocationContext *LCtx) {
1129
0
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1130
0
                  "CallEvent subclasses are not all the same size");
1131
0
    return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
1132
0
  }
1133
1134
public:
1135
0
  CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
1136
1137
  CallEventRef<>
1138
  getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
1139
1140
  CallEventRef<>
1141
  getSimpleCall(const CallExpr *E, ProgramStateRef State,
1142
                const LocationContext *LCtx);
1143
1144
  CallEventRef<ObjCMethodCall>
1145
  getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
1146
0
                    const LocationContext *LCtx) {
1147
0
    return create<ObjCMethodCall>(E, State, LCtx);
1148
0
  }
1149
1150
  CallEventRef<CXXConstructorCall>
1151
  getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
1152
0
                        ProgramStateRef State, const LocationContext *LCtx) {
1153
0
    return create<CXXConstructorCall>(E, Target, State, LCtx);
1154
0
  }
1155
1156
  CallEventRef<CXXDestructorCall>
1157
  getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
1158
                       const MemRegion *Target, bool IsBase,
1159
0
                       ProgramStateRef State, const LocationContext *LCtx) {
1160
0
    return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
1161
0
  }
1162
1163
  CallEventRef<CXXAllocatorCall>
1164
  getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
1165
0
                      const LocationContext *LCtx) {
1166
0
    return create<CXXAllocatorCall>(E, State, LCtx);
1167
0
  }
1168
};
1169
1170
template <typename T>
1171
0
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1172
0
  assert(isa<T>(*this) && "Cloning to unrelated type");
1173
0
  static_assert(sizeof(T) == sizeof(CallEvent),
1174
0
                "Subclasses may not add fields");
1175
0
1176
0
  if (NewState == State)
1177
0
    return cast<T>(this);
1178
0
1179
0
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1180
0
  T *Copy = static_cast<T *>(Mgr.allocate());
1181
0
  cloneTo(Copy);
1182
0
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1183
0
1184
0
  Copy->State = NewState;
1185
0
  return Copy;
1186
0
}
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::ObjCMethodCall> clang::ento::CallEvent::cloneWithState<clang::ento::ObjCMethodCall>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Unexecuted instantiation: clang::ento::CallEventRef<clang::ento::CallEvent> clang::ento::CallEvent::cloneWithState<clang::ento::CallEvent>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
1187
1188
0
inline void CallEvent::Release() const {
1189
0
  assert(RefCount > 0 && "Reference count is already zero.");
1190
0
  --RefCount;
1191
0
1192
0
  if (RefCount > 0)
1193
0
    return;
1194
0
1195
0
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1196
0
  Mgr.reclaim(this);
1197
0
1198
0
  this->~CallEvent();
1199
0
}
1200
1201
} // namespace ento
1202
1203
} // namespace clang
1204
1205
namespace llvm {
1206
1207
// Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1208
template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
1209
  using SimpleType = const T *;
1210
1211
  static SimpleType
1212
0
  getSimplifiedValue(clang::ento::CallEventRef<T> Val) {
1213
0
    return Val.get();
1214
0
  }
1215
};
1216
1217
} // namespace llvm
1218
1219
#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H