Coverage Report

Created: 2019-07-24 05:18

/Users/buildslave/jenkins/workspace/clang-stage2-coverage-R/llvm/tools/clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- DynamicTypePropagation.cpp ------------------------------*- C++ -*--===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
// This file contains two checkers. One helps the static analyzer core to track
10
// types, the other does type inference on Obj-C generics and report type
11
// errors.
12
//
13
// Dynamic Type Propagation:
14
// This checker defines the rules for dynamic type gathering and propagation.
15
//
16
// Generics Checker for Objective-C:
17
// This checker tries to find type errors that the compiler is not able to catch
18
// due to the implicit conversions that were introduced for backward
19
// compatibility.
20
//
21
//===----------------------------------------------------------------------===//
22
23
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
24
#include "clang/AST/ParentMap.h"
25
#include "clang/AST/RecursiveASTVisitor.h"
26
#include "clang/Basic/Builtins.h"
27
#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
28
#include "clang/StaticAnalyzer/Core/Checker.h"
29
#include "clang/StaticAnalyzer/Core/CheckerManager.h"
30
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
31
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h"
32
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
33
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
34
35
using namespace clang;
36
using namespace ento;
37
38
// ProgramState trait - The type inflation is tracked by DynamicTypeMap. This is
39
// an auxiliary map that tracks more information about generic types, because in
40
// some cases the most derived type is not the most informative one about the
41
// type parameters. This types that are stored for each symbol in this map must
42
// be specialized.
43
// TODO: In some case the type stored in this map is exactly the same that is
44
// stored in DynamicTypeMap. We should no store duplicated information in those
45
// cases.
46
REGISTER_MAP_WITH_PROGRAMSTATE(MostSpecializedTypeArgsMap, SymbolRef,
47
                               const ObjCObjectPointerType *)
48
49
namespace {
50
class DynamicTypePropagation:
51
    public Checker< check::PreCall,
52
                    check::PostCall,
53
                    check::DeadSymbols,
54
                    check::PostStmt<CastExpr>,
55
                    check::PostStmt<CXXNewExpr>,
56
                    check::PreObjCMessage,
57
                    check::PostObjCMessage > {
58
  const ObjCObjectType *getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
59
                                                    CheckerContext &C) const;
60
61
  /// Return a better dynamic type if one can be derived from the cast.
62
  const ObjCObjectPointerType *getBetterObjCType(const Expr *CastE,
63
                                                 CheckerContext &C) const;
64
65
  ExplodedNode *dynamicTypePropagationOnCasts(const CastExpr *CE,
66
                                              ProgramStateRef &State,
67
                                              CheckerContext &C) const;
68
69
  mutable std::unique_ptr<BugType> ObjCGenericsBugType;
70
72
  void initBugType() const {
71
72
    if (!ObjCGenericsBugType)
72
2
      ObjCGenericsBugType.reset(
73
2
          new BugType(this, "Generics", categories::CoreFoundationObjectiveC));
74
72
  }
75
76
  class GenericsBugVisitor : public BugReporterVisitor {
77
  public:
78
72
    GenericsBugVisitor(SymbolRef S) : Sym(S) {}
79
80
72
    void Profile(llvm::FoldingSetNodeID &ID) const override {
81
72
      static int X = 0;
82
72
      ID.AddPointer(&X);
83
72
      ID.AddPointer(Sym);
84
72
    }
85
86
    std::shared_ptr<PathDiagnosticPiece> VisitNode(const ExplodedNode *N,
87
                                                   BugReporterContext &BRC,
88
                                                   BugReport &BR) override;
89
90
  private:
91
    // The tracked symbol.
92
    SymbolRef Sym;
93
  };
94
95
  void reportGenericsBug(const ObjCObjectPointerType *From,
96
                         const ObjCObjectPointerType *To, ExplodedNode *N,
97
                         SymbolRef Sym, CheckerContext &C,
98
                         const Stmt *ReportedNode = nullptr) const;
99
100
public:
101
  void checkPreCall(const CallEvent &Call, CheckerContext &C) const;
102
  void checkPostCall(const CallEvent &Call, CheckerContext &C) const;
103
  void checkPostStmt(const CastExpr *CastE, CheckerContext &C) const;
104
  void checkPostStmt(const CXXNewExpr *NewE, CheckerContext &C) const;
105
  void checkDeadSymbols(SymbolReaper &SR, CheckerContext &C) const;
106
  void checkPreObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
107
  void checkPostObjCMessage(const ObjCMethodCall &M, CheckerContext &C) const;
108
109
  /// This value is set to true, when the Generics checker is turned on.
110
  DefaultBool CheckGenerics;
111
};
112
} // end anonymous namespace
113
114
void DynamicTypePropagation::checkDeadSymbols(SymbolReaper &SR,
115
308k
                                              CheckerContext &C) const {
116
308k
  ProgramStateRef State = C.getState();
117
308k
  DynamicTypeMapTy TypeMap = State->get<DynamicTypeMap>();
118
308k
  for (DynamicTypeMapTy::iterator I = TypeMap.begin(), E = TypeMap.end();
119
333k
       I != E; 
++I24.6k
) {
120
24.6k
    if (!SR.isLiveRegion(I->first)) {
121
2.56k
      State = State->remove<DynamicTypeMap>(I->first);
122
2.56k
    }
123
24.6k
  }
124
308k
125
308k
  MostSpecializedTypeArgsMapTy TyArgMap =
126
308k
      State->get<MostSpecializedTypeArgsMap>();
127
308k
  for (MostSpecializedTypeArgsMapTy::iterator I = TyArgMap.begin(),
128
308k
                                              E = TyArgMap.end();
129
309k
       I != E; 
++I552
) {
130
552
    if (SR.isDead(I->first)) {
131
100
      State = State->remove<MostSpecializedTypeArgsMap>(I->first);
132
100
    }
133
552
  }
134
308k
135
308k
  C.addTransition(State);
136
308k
}
137
138
static void recordFixedType(const MemRegion *Region, const CXXMethodDecl *MD,
139
1.41k
                            CheckerContext &C) {
140
1.41k
  assert(Region);
141
1.41k
  assert(MD);
142
1.41k
143
1.41k
  ASTContext &Ctx = C.getASTContext();
144
1.41k
  QualType Ty = Ctx.getPointerType(Ctx.getRecordType(MD->getParent()));
145
1.41k
146
1.41k
  ProgramStateRef State = C.getState();
147
1.41k
  State = setDynamicTypeInfo(State, Region, Ty, /*CanBeSubClassed=*/false);
148
1.41k
  C.addTransition(State);
149
1.41k
}
150
151
void DynamicTypePropagation::checkPreCall(const CallEvent &Call,
152
75.6k
                                          CheckerContext &C) const {
153
75.6k
  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
154
19.6k
    // C++11 [class.cdtor]p4: When a virtual function is called directly or
155
19.6k
    //   indirectly from a constructor or from a destructor, including during
156
19.6k
    //   the construction or destruction of the class's non-static data members,
157
19.6k
    //   and the object to which the call applies is the object under
158
19.6k
    //   construction or destruction, the function called is the final overrider
159
19.6k
    //   in the constructor's or destructor's class and not one overriding it in
160
19.6k
    //   a more-derived class.
161
19.6k
162
19.6k
    switch (Ctor->getOriginExpr()->getConstructionKind()) {
163
19.6k
    case CXXConstructExpr::CK_Complete:
164
19.0k
    case CXXConstructExpr::CK_Delegating:
165
19.0k
      // No additional type info necessary.
166
19.0k
      return;
167
19.0k
    case CXXConstructExpr::CK_NonVirtualBase:
168
679
    case CXXConstructExpr::CK_VirtualBase:
169
679
      if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion())
170
679
        recordFixedType(Target, Ctor->getDecl(), C);
171
679
      return;
172
0
    }
173
0
174
0
    return;
175
0
  }
176
55.9k
177
55.9k
  if (const CXXDestructorCall *Dtor = dyn_cast<CXXDestructorCall>(&Call)) {
178
1.24k
    // C++11 [class.cdtor]p4 (see above)
179
1.24k
    if (!Dtor->isBaseDestructor())
180
1.15k
      return;
181
86
182
86
    const MemRegion *Target = Dtor->getCXXThisVal().getAsRegion();
183
86
    if (!Target)
184
0
      return;
185
86
186
86
    const Decl *D = Dtor->getDecl();
187
86
    if (!D)
188
0
      return;
189
86
190
86
    recordFixedType(Target, cast<CXXDestructorDecl>(D), C);
191
86
    return;
192
86
  }
193
55.9k
}
194
195
void DynamicTypePropagation::checkPostCall(const CallEvent &Call,
196
81.4k
                                           CheckerContext &C) const {
197
81.4k
  // We can obtain perfect type info for return values from some calls.
198
81.4k
  if (const ObjCMethodCall *Msg = dyn_cast<ObjCMethodCall>(&Call)) {
199
3.38k
200
3.38k
    // Get the returned value if it's a region.
201
3.38k
    const MemRegion *RetReg = Call.getReturnValue().getAsRegion();
202
3.38k
    if (!RetReg)
203
1.14k
      return;
204
2.24k
205
2.24k
    ProgramStateRef State = C.getState();
206
2.24k
    const ObjCMethodDecl *D = Msg->getDecl();
207
2.24k
208
2.24k
    if (D && 
D->hasRelatedResultType()2.22k
) {
209
1.62k
      switch (Msg->getMethodFamily()) {
210
1.62k
      default:
211
318
        break;
212
1.62k
213
1.62k
      // We assume that the type of the object returned by alloc and new are the
214
1.62k
      // pointer to the object of the class specified in the receiver of the
215
1.62k
      // message.
216
1.62k
      case OMF_alloc:
217
627
      case OMF_new: {
218
627
        // Get the type of object that will get created.
219
627
        const ObjCMessageExpr *MsgE = Msg->getOriginExpr();
220
627
        const ObjCObjectType *ObjTy = getObjectTypeForAllocAndNew(MsgE, C);
221
627
        if (!ObjTy)
222
2
          return;
223
625
        QualType DynResTy =
224
625
                 C.getASTContext().getObjCObjectPointerType(QualType(ObjTy, 0));
225
625
        C.addTransition(setDynamicTypeInfo(State, RetReg, DynResTy, false));
226
625
        break;
227
625
      }
228
684
      case OMF_init: {
229
684
        // Assume, the result of the init method has the same dynamic type as
230
684
        // the receiver and propagate the dynamic type info.
231
684
        const MemRegion *RecReg = Msg->getReceiverSVal().getAsRegion();
232
684
        if (!RecReg)
233
0
          return;
234
684
        DynamicTypeInfo RecDynType = getDynamicTypeInfo(State, RecReg);
235
684
        C.addTransition(setDynamicTypeInfo(State, RetReg, RecDynType));
236
684
        break;
237
684
      }
238
1.62k
      }
239
1.62k
    }
240
2.24k
    return;
241
2.24k
  }
242
78.0k
243
78.0k
  if (const CXXConstructorCall *Ctor = dyn_cast<CXXConstructorCall>(&Call)) {
244
19.7k
    // We may need to undo the effects of our pre-call check.
245
19.7k
    switch (Ctor->getOriginExpr()->getConstructionKind()) {
246
19.7k
    case CXXConstructExpr::CK_Complete:
247
19.0k
    case CXXConstructExpr::CK_Delegating:
248
19.0k
      // No additional work necessary.
249
19.0k
      // Note: This will leave behind the actual type of the object for
250
19.0k
      // complete constructors, but arguably that's a good thing, since it
251
19.0k
      // means the dynamic type info will be correct even for objects
252
19.0k
      // constructed with operator new.
253
19.0k
      return;
254
19.0k
    case CXXConstructExpr::CK_NonVirtualBase:
255
677
    case CXXConstructExpr::CK_VirtualBase:
256
677
      if (const MemRegion *Target = Ctor->getCXXThisVal().getAsRegion()) {
257
677
        // We just finished a base constructor. Now we can use the subclass's
258
677
        // type when resolving virtual calls.
259
677
        const LocationContext *LCtx = C.getLocationContext();
260
677
261
677
        // FIXME: In C++17 classes with non-virtual bases may be treated as
262
677
        // aggregates, and in such case no top-frame constructor will be called.
263
677
        // Figure out if we need to do anything in this case.
264
677
        // FIXME: Instead of relying on the ParentMap, we should have the
265
677
        // trigger-statement (InitListExpr in this case) available in this
266
677
        // callback, ideally as part of CallEvent.
267
677
        if (dyn_cast_or_null<InitListExpr>(
268
677
                LCtx->getParentMap().getParent(Ctor->getOriginExpr())))
269
24
          return;
270
653
271
653
        recordFixedType(Target, cast<CXXConstructorDecl>(LCtx->getDecl()), C);
272
653
      }
273
677
      
return653
;
274
19.7k
    }
275
19.7k
  }
276
78.0k
}
277
278
/// TODO: Handle explicit casts.
279
///       Handle C++ casts.
280
///
281
/// Precondition: the cast is between ObjCObjectPointers.
282
ExplodedNode *DynamicTypePropagation::dynamicTypePropagationOnCasts(
283
1.08k
    const CastExpr *CE, ProgramStateRef &State, CheckerContext &C) const {
284
1.08k
  // We only track type info for regions.
285
1.08k
  const MemRegion *ToR = C.getSVal(CE).getAsRegion();
286
1.08k
  if (!ToR)
287
127
    return C.getPredecessor();
288
960
289
960
  if (isa<ExplicitCastExpr>(CE))
290
18
    return C.getPredecessor();
291
942
292
942
  if (const Type *NewTy = getBetterObjCType(CE, C)) {
293
218
    State = setDynamicTypeInfo(State, ToR, QualType(NewTy, 0));
294
218
    return C.addTransition(State);
295
218
  }
296
724
  return C.getPredecessor();
297
724
}
298
299
void DynamicTypePropagation::checkPostStmt(const CXXNewExpr *NewE,
300
998
                                           CheckerContext &C) const {
301
998
  if (NewE->isArray())
302
125
    return;
303
873
304
873
  // We only track dynamic type info for regions.
305
873
  const MemRegion *MR = C.getSVal(NewE).getAsRegion();
306
873
  if (!MR)
307
6
    return;
308
867
309
867
  C.addTransition(setDynamicTypeInfo(C.getState(), MR, NewE->getType(),
310
867
                                     /*CanBeSubClassed=*/false));
311
867
}
312
313
const ObjCObjectType *
314
DynamicTypePropagation::getObjectTypeForAllocAndNew(const ObjCMessageExpr *MsgE,
315
627
                                                    CheckerContext &C) const {
316
627
  if (MsgE->getReceiverKind() == ObjCMessageExpr::Class) {
317
611
    if (const ObjCObjectType *ObjTy
318
611
          = MsgE->getClassReceiver()->getAs<ObjCObjectType>())
319
611
    return ObjTy;
320
16
  }
321
16
322
16
  if (MsgE->getReceiverKind() == ObjCMessageExpr::SuperClass) {
323
5
    if (const ObjCObjectType *ObjTy
324
5
          = MsgE->getSuperType()->getAs<ObjCObjectType>())
325
5
      return ObjTy;
326
11
  }
327
11
328
11
  const Expr *RecE = MsgE->getInstanceReceiver();
329
11
  if (!RecE)
330
0
    return nullptr;
331
11
332
11
  RecE= RecE->IgnoreParenImpCasts();
333
11
  if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(RecE)) {
334
11
    const StackFrameContext *SFCtx = C.getStackFrame();
335
11
    // Are we calling [self alloc]? If this is self, get the type of the
336
11
    // enclosing ObjC class.
337
11
    if (DRE->getDecl() == SFCtx->getSelfDecl()) {
338
9
      if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(SFCtx->getDecl()))
339
9
        if (const ObjCObjectType *ObjTy =
340
9
            dyn_cast<ObjCObjectType>(MD->getClassInterface()->getTypeForDecl()))
341
9
          return ObjTy;
342
2
    }
343
11
  }
344
2
  return nullptr;
345
2
}
346
347
// Return a better dynamic type if one can be derived from the cast.
348
// Compare the current dynamic type of the region and the new type to which we
349
// are casting. If the new type is lower in the inheritance hierarchy, pick it.
350
const ObjCObjectPointerType *
351
DynamicTypePropagation::getBetterObjCType(const Expr *CastE,
352
942
                                          CheckerContext &C) const {
353
942
  const MemRegion *ToR = C.getSVal(CastE).getAsRegion();
354
942
  assert(ToR);
355
942
356
942
  // Get the old and new types.
357
942
  const ObjCObjectPointerType *NewTy =
358
942
      CastE->getType()->getAs<ObjCObjectPointerType>();
359
942
  if (!NewTy)
360
0
    return nullptr;
361
942
  QualType OldDTy = getDynamicTypeInfo(C.getState(), ToR).getType();
362
942
  if (OldDTy.isNull()) {
363
0
    return NewTy;
364
0
  }
365
942
  const ObjCObjectPointerType *OldTy =
366
942
    OldDTy->getAs<ObjCObjectPointerType>();
367
942
  if (!OldTy)
368
114
    return nullptr;
369
828
370
828
  // Id the old type is 'id', the new one is more precise.
371
828
  if (OldTy->isObjCIdType() && 
!NewTy->isObjCIdType()129
)
372
129
    return NewTy;
373
699
374
699
  // Return new if it's a subclass of old.
375
699
  const ObjCInterfaceDecl *ToI = NewTy->getInterfaceDecl();
376
699
  const ObjCInterfaceDecl *FromI = OldTy->getInterfaceDecl();
377
699
  if (ToI && 
FromI187
&&
FromI->isSuperClassOf(ToI)187
)
378
89
    return NewTy;
379
610
380
610
  return nullptr;
381
610
}
382
383
static const ObjCObjectPointerType *getMostInformativeDerivedClassImpl(
384
    const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
385
120
    const ObjCObjectPointerType *MostInformativeCandidate, ASTContext &C) {
386
120
  // Checking if from and to are the same classes modulo specialization.
387
120
  if (From->getInterfaceDecl()->getCanonicalDecl() ==
388
120
      To->getInterfaceDecl()->getCanonicalDecl()) {
389
80
    if (To->isSpecialized()) {
390
38
      assert(MostInformativeCandidate->isSpecialized());
391
38
      return MostInformativeCandidate;
392
38
    }
393
42
    return From;
394
42
  }
395
40
396
40
  if (To->getObjectType()->getSuperClassType().isNull()) {
397
2
    // If To has no super class and From and To aren't the same then
398
2
    // To was not actually a descendent of From. In this case the best we can
399
2
    // do is 'From'.
400
2
    return From;
401
2
  }
402
38
403
38
  const auto *SuperOfTo =
404
38
      To->getObjectType()->getSuperClassType()->getAs<ObjCObjectType>();
405
38
  assert(SuperOfTo);
406
38
  QualType SuperPtrOfToQual =
407
38
      C.getObjCObjectPointerType(QualType(SuperOfTo, 0));
408
38
  const auto *SuperPtrOfTo = SuperPtrOfToQual->getAs<ObjCObjectPointerType>();
409
38
  if (To->isUnspecialized())
410
14
    return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo, SuperPtrOfTo,
411
14
                                              C);
412
24
  else
413
24
    return getMostInformativeDerivedClassImpl(From, SuperPtrOfTo,
414
24
                                              MostInformativeCandidate, C);
415
38
}
416
417
/// A downcast may loose specialization information. E. g.:
418
///   MutableMap<T, U> : Map
419
/// The downcast to MutableMap looses the information about the types of the
420
/// Map (due to the type parameters are not being forwarded to Map), and in
421
/// general there is no way to recover that information from the
422
/// declaration. In order to have to most information, lets find the most
423
/// derived type that has all the type parameters forwarded.
424
///
425
/// Get the a subclass of \p From (which has a lower bound \p To) that do not
426
/// loose information about type parameters. \p To has to be a subclass of
427
/// \p From. From has to be specialized.
428
static const ObjCObjectPointerType *
429
getMostInformativeDerivedClass(const ObjCObjectPointerType *From,
430
82
                               const ObjCObjectPointerType *To, ASTContext &C) {
431
82
  return getMostInformativeDerivedClassImpl(From, To, To, C);
432
82
}
433
434
/// Inputs:
435
///   \param StaticLowerBound Static lower bound for a symbol. The dynamic lower
436
///   bound might be the subclass of this type.
437
///   \param StaticUpperBound A static upper bound for a symbol.
438
///   \p StaticLowerBound expected to be the subclass of \p StaticUpperBound.
439
///   \param Current The type that was inferred for a symbol in a previous
440
///   context. Might be null when this is the first time that inference happens.
441
/// Precondition:
442
///   \p StaticLowerBound or \p StaticUpperBound is specialized. If \p Current
443
///   is not null, it is specialized.
444
/// Possible cases:
445
///   (1) The \p Current is null and \p StaticLowerBound <: \p StaticUpperBound
446
///   (2) \p StaticLowerBound <: \p Current <: \p StaticUpperBound
447
///   (3) \p Current <: \p StaticLowerBound <: \p StaticUpperBound
448
///   (4) \p StaticLowerBound <: \p StaticUpperBound <: \p Current
449
/// Effect:
450
///   Use getMostInformativeDerivedClass with the upper and lower bound of the
451
///   set {\p StaticLowerBound, \p Current, \p StaticUpperBound}. The computed
452
///   lower bound must be specialized. If the result differs from \p Current or
453
///   \p Current is null, store the result.
454
static bool
455
storeWhenMoreInformative(ProgramStateRef &State, SymbolRef Sym,
456
                         const ObjCObjectPointerType *const *Current,
457
                         const ObjCObjectPointerType *StaticLowerBound,
458
                         const ObjCObjectPointerType *StaticUpperBound,
459
104
                         ASTContext &C) {
460
104
  // TODO: The above 4 cases are not exhaustive. In particular, it is possible
461
104
  // for Current to be incomparable with StaticLowerBound, StaticUpperBound,
462
104
  // or both.
463
104
  //
464
104
  // For example, suppose Foo<T> and Bar<T> are unrelated types.
465
104
  //
466
104
  //  Foo<T> *f = ...
467
104
  //  Bar<T> *b = ...
468
104
  //
469
104
  //  id t1 = b;
470
104
  //  f = t1;
471
104
  //  id t2 = f; // StaticLowerBound is Foo<T>, Current is Bar<T>
472
104
  //
473
104
  // We should either constrain the callers of this function so that the stated
474
104
  // preconditions hold (and assert it) or rewrite the function to expicitly
475
104
  // handle the additional cases.
476
104
477
104
  // Precondition
478
104
  assert(StaticUpperBound->isSpecialized() ||
479
104
         StaticLowerBound->isSpecialized());
480
104
  assert(!Current || (*Current)->isSpecialized());
481
104
482
104
  // Case (1)
483
104
  if (!Current) {
484
82
    if (StaticUpperBound->isUnspecialized()) {
485
10
      State = State->set<MostSpecializedTypeArgsMap>(Sym, StaticLowerBound);
486
10
      return true;
487
10
    }
488
72
    // Upper bound is specialized.
489
72
    const ObjCObjectPointerType *WithMostInfo =
490
72
        getMostInformativeDerivedClass(StaticUpperBound, StaticLowerBound, C);
491
72
    State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
492
72
    return true;
493
72
  }
494
22
495
22
  // Case (3)
496
22
  if (C.canAssignObjCInterfaces(StaticLowerBound, *Current)) {
497
16
    return false;
498
16
  }
499
6
500
6
  // Case (4)
501
6
  if (C.canAssignObjCInterfaces(*Current, StaticUpperBound)) {
502
4
    // The type arguments might not be forwarded at any point of inheritance.
503
4
    const ObjCObjectPointerType *WithMostInfo =
504
4
        getMostInformativeDerivedClass(*Current, StaticUpperBound, C);
505
4
    WithMostInfo =
506
4
        getMostInformativeDerivedClass(WithMostInfo, StaticLowerBound, C);
507
4
    if (WithMostInfo == *Current)
508
0
      return false;
509
4
    State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
510
4
    return true;
511
4
  }
512
2
513
2
  // Case (2)
514
2
  const ObjCObjectPointerType *WithMostInfo =
515
2
      getMostInformativeDerivedClass(*Current, StaticLowerBound, C);
516
2
  if (WithMostInfo != *Current) {
517
0
    State = State->set<MostSpecializedTypeArgsMap>(Sym, WithMostInfo);
518
0
    return true;
519
0
  }
520
2
521
2
  return false;
522
2
}
523
524
/// Type inference based on static type information that is available for the
525
/// cast and the tracked type information for the given symbol. When the tracked
526
/// symbol and the destination type of the cast are unrelated, report an error.
527
void DynamicTypePropagation::checkPostStmt(const CastExpr *CE,
528
283k
                                           CheckerContext &C) const {
529
283k
  if (CE->getCastKind() != CK_BitCast)
530
273k
    return;
531
10.1k
532
10.1k
  QualType OriginType = CE->getSubExpr()->getType();
533
10.1k
  QualType DestType = CE->getType();
534
10.1k
535
10.1k
  const auto *OrigObjectPtrType = OriginType->getAs<ObjCObjectPointerType>();
536
10.1k
  const auto *DestObjectPtrType = DestType->getAs<ObjCObjectPointerType>();
537
10.1k
538
10.1k
  if (!OrigObjectPtrType || 
!DestObjectPtrType1.28k
)
539
9.02k
    return;
540
1.08k
541
1.08k
  ProgramStateRef State = C.getState();
542
1.08k
  ExplodedNode *AfterTypeProp = dynamicTypePropagationOnCasts(CE, State, C);
543
1.08k
544
1.08k
  ASTContext &ASTCtxt = C.getASTContext();
545
1.08k
546
1.08k
  // This checker detects the subtyping relationships using the assignment
547
1.08k
  // rules. In order to be able to do this the kindofness must be stripped
548
1.08k
  // first. The checker treats every type as kindof type anyways: when the
549
1.08k
  // tracked type is the subtype of the static type it tries to look up the
550
1.08k
  // methods in the tracked type first.
551
1.08k
  OrigObjectPtrType = OrigObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
552
1.08k
  DestObjectPtrType = DestObjectPtrType->stripObjCKindOfTypeAndQuals(ASTCtxt);
553
1.08k
554
1.08k
  if (OrigObjectPtrType->isUnspecialized() &&
555
1.08k
      
DestObjectPtrType->isUnspecialized()1.00k
)
556
919
    return;
557
168
558
168
  SymbolRef Sym = C.getSVal(CE).getAsSymbol();
559
168
  if (!Sym)
560
0
    return;
561
168
562
168
  const ObjCObjectPointerType *const *TrackedType =
563
168
      State->get<MostSpecializedTypeArgsMap>(Sym);
564
168
565
168
  if (isa<ExplicitCastExpr>(CE)) {
566
12
    // Treat explicit casts as an indication from the programmer that the
567
12
    // Objective-C type system is not rich enough to express the needed
568
12
    // invariant. In such cases, forget any existing information inferred
569
12
    // about the type arguments. We don't assume the casted-to specialized
570
12
    // type here because the invariant the programmer specifies in the cast
571
12
    // may only hold at this particular program point and not later ones.
572
12
    // We don't want a suppressing cast to require a cascade of casts down the
573
12
    // line.
574
12
    if (TrackedType) {
575
6
      State = State->remove<MostSpecializedTypeArgsMap>(Sym);
576
6
      C.addTransition(State, AfterTypeProp);
577
6
    }
578
12
    return;
579
12
  }
580
156
581
156
  // Check which assignments are legal.
582
156
  bool OrigToDest =
583
156
      ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, OrigObjectPtrType);
584
156
  bool DestToOrig =
585
156
      ASTCtxt.canAssignObjCInterfaces(OrigObjectPtrType, DestObjectPtrType);
586
156
587
156
  // The tracked type should be the sub or super class of the static destination
588
156
  // type. When an (implicit) upcast or a downcast happens according to static
589
156
  // types, and there is no subtyping relationship between the tracked and the
590
156
  // static destination types, it indicates an error.
591
156
  if (TrackedType &&
592
156
      
!ASTCtxt.canAssignObjCInterfaces(DestObjectPtrType, *TrackedType)74
&&
593
156
      
!ASTCtxt.canAssignObjCInterfaces(*TrackedType, DestObjectPtrType)56
) {
594
52
    static CheckerProgramPointTag IllegalConv(this, "IllegalConversion");
595
52
    ExplodedNode *N = C.addTransition(State, AfterTypeProp, &IllegalConv);
596
52
    reportGenericsBug(*TrackedType, DestObjectPtrType, N, Sym, C);
597
52
    return;
598
52
  }
599
104
600
104
  // Handle downcasts and upcasts.
601
104
602
104
  const ObjCObjectPointerType *LowerBound = DestObjectPtrType;
603
104
  const ObjCObjectPointerType *UpperBound = OrigObjectPtrType;
604
104
  if (OrigToDest && 
!DestToOrig100
)
605
26
    std::swap(LowerBound, UpperBound);
606
104
607
104
  // The id type is not a real bound. Eliminate it.
608
104
  LowerBound = LowerBound->isObjCIdType() ? 
UpperBound18
:
LowerBound86
;
609
104
  UpperBound = UpperBound->isObjCIdType() ? 
LowerBound16
:
UpperBound88
;
610
104
611
104
  if (storeWhenMoreInformative(State, Sym, TrackedType, LowerBound, UpperBound,
612
104
                               ASTCtxt)) {
613
86
    C.addTransition(State, AfterTypeProp);
614
86
  }
615
104
}
616
617
33
static const Expr *stripCastsAndSugar(const Expr *E) {
618
33
  E = E->IgnoreParenImpCasts();
619
33
  if (const PseudoObjectExpr *POE = dyn_cast<PseudoObjectExpr>(E))
620
0
    E = POE->getSyntacticForm()->IgnoreParenImpCasts();
621
33
  if (const OpaqueValueExpr *OVE = dyn_cast<OpaqueValueExpr>(E))
622
0
    E = OVE->getSourceExpr()->IgnoreParenImpCasts();
623
33
  return E;
624
33
}
625
626
101
static bool isObjCTypeParamDependent(QualType Type) {
627
101
  // It is illegal to typedef parameterized types inside an interface. Therefore
628
101
  // an Objective-C type can only be dependent on a type parameter when the type
629
101
  // parameter structurally present in the type itself.
630
101
  class IsObjCTypeParamDependentTypeVisitor
631
101
      : public RecursiveASTVisitor<IsObjCTypeParamDependentTypeVisitor> {
632
101
  public:
633
101
    IsObjCTypeParamDependentTypeVisitor() : Result(false) {}
634
101
    bool VisitObjCTypeParamType(const ObjCTypeParamType *Type) {
635
68
      if (isa<ObjCTypeParamDecl>(Type->getDecl())) {
636
68
        Result = true;
637
68
        return false;
638
68
      }
639
0
      return true;
640
0
    }
641
101
642
101
    bool Result;
643
101
  };
644
101
645
101
  IsObjCTypeParamDependentTypeVisitor Visitor;
646
101
  Visitor.TraverseType(Type);
647
101
  return Visitor.Result;
648
101
}
649
650
/// A method might not be available in the interface indicated by the static
651
/// type. However it might be available in the tracked type. In order to
652
/// properly substitute the type parameters we need the declaration context of
653
/// the method. The more specialized the enclosing class of the method is, the
654
/// more likely that the parameter substitution will be successful.
655
static const ObjCMethodDecl *
656
findMethodDecl(const ObjCMessageExpr *MessageExpr,
657
176
               const ObjCObjectPointerType *TrackedType, ASTContext &ASTCtxt) {
658
176
  const ObjCMethodDecl *Method = nullptr;
659
176
660
176
  QualType ReceiverType = MessageExpr->getReceiverType();
661
176
  const auto *ReceiverObjectPtrType =
662
176
      ReceiverType->getAs<ObjCObjectPointerType>();
663
176
664
176
  // Do this "devirtualization" on instance and class methods only. Trust the
665
176
  // static type on super and super class calls.
666
176
  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Instance ||
667
176
      
MessageExpr->getReceiverKind() == ObjCMessageExpr::Class0
) {
668
176
    // When the receiver type is id, Class, or some super class of the tracked
669
176
    // type, look up the method in the tracked type, not in the receiver type.
670
176
    // This way we preserve more information.
671
176
    if (ReceiverType->isObjCIdType() || 
ReceiverType->isObjCClassType()126
||
672
176
        
ASTCtxt.canAssignObjCInterfaces(ReceiverObjectPtrType, TrackedType)118
) {
673
176
      const ObjCInterfaceDecl *InterfaceDecl = TrackedType->getInterfaceDecl();
674
176
      // The method might not be found.
675
176
      Selector Sel = MessageExpr->getSelector();
676
176
      Method = InterfaceDecl->lookupInstanceMethod(Sel);
677
176
      if (!Method)
678
12
        Method = InterfaceDecl->lookupClassMethod(Sel);
679
176
    }
680
176
  }
681
176
682
176
  // Fallback to statick method lookup when the one based on the tracked type
683
176
  // failed.
684
176
  return Method ? 
Method172
:
MessageExpr->getMethodDecl()4
;
685
176
}
686
687
/// Get the returned ObjCObjectPointerType by a method based on the tracked type
688
/// information, or null pointer when the returned type is not an
689
/// ObjCObjectPointerType.
690
static QualType getReturnTypeForMethod(
691
    const ObjCMethodDecl *Method, ArrayRef<QualType> TypeArgs,
692
70
    const ObjCObjectPointerType *SelfType, ASTContext &C) {
693
70
  QualType StaticResultType = Method->getReturnType();
694
70
695
70
  // Is the return type declared as instance type?
696
70
  if (StaticResultType == C.getObjCInstanceType())
697
2
    return QualType(SelfType, 0);
698
68
699
68
  // Check whether the result type depends on a type parameter.
700
68
  if (!isObjCTypeParamDependent(StaticResultType))
701
33
    return QualType();
702
35
703
35
  QualType ResultType = StaticResultType.substObjCTypeArgs(
704
35
      C, TypeArgs, ObjCSubstitutionContext::Result);
705
35
706
35
  return ResultType;
707
35
}
708
709
/// When the receiver has a tracked type, use that type to validate the
710
/// argumments of the message expression and the return value.
711
void DynamicTypePropagation::checkPreObjCMessage(const ObjCMethodCall &M,
712
3.43k
                                                 CheckerContext &C) const {
713
3.43k
  ProgramStateRef State = C.getState();
714
3.43k
  SymbolRef Sym = M.getReceiverSVal().getAsSymbol();
715
3.43k
  if (!Sym)
716
919
    return;
717
2.51k
718
2.51k
  const ObjCObjectPointerType *const *TrackedType =
719
2.51k
      State->get<MostSpecializedTypeArgsMap>(Sym);
720
2.51k
  if (!TrackedType)
721
2.40k
    return;
722
104
723
104
  // Get the type arguments from tracked type and substitute type arguments
724
104
  // before do the semantic check.
725
104
726
104
  ASTContext &ASTCtxt = C.getASTContext();
727
104
  const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
728
104
  const ObjCMethodDecl *Method =
729
104
      findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
730
104
731
104
  // It is possible to call non-existent methods in Obj-C.
732
104
  if (!Method)
733
2
    return;
734
102
735
102
  // If the method is declared on a class that has a non-invariant
736
102
  // type parameter, don't warn about parameter mismatches after performing
737
102
  // substitution. This prevents warning when the programmer has purposely
738
102
  // casted the receiver to a super type or unspecialized type but the analyzer
739
102
  // has a more precise tracked type than the programmer intends at the call
740
102
  // site.
741
102
  //
742
102
  // For example, consider NSArray (which has a covariant type parameter)
743
102
  // and NSMutableArray (a subclass of NSArray where the type parameter is
744
102
  // invariant):
745
102
  // NSMutableArray *a = [[NSMutableArray<NSString *> alloc] init;
746
102
  //
747
102
  // [a containsObject:number]; // Safe: -containsObject is defined on NSArray.
748
102
  // NSArray<NSObject *> *other = [a arrayByAddingObject:number]  // Safe
749
102
  //
750
102
  // [a addObject:number] // Unsafe: -addObject: is defined on NSMutableArray
751
102
  //
752
102
753
102
  const ObjCInterfaceDecl *Interface = Method->getClassInterface();
754
102
  if (!Interface)
755
0
    return;
756
102
757
102
  ObjCTypeParamList *TypeParams = Interface->getTypeParamList();
758
102
  if (!TypeParams)
759
0
    return;
760
102
761
102
  for (ObjCTypeParamDecl *TypeParam : *TypeParams) {
762
102
    if (TypeParam->getVariance() != ObjCTypeParamVariance::Invariant)
763
68
      return;
764
102
  }
765
102
766
102
  Optional<ArrayRef<QualType>> TypeArgs =
767
34
      (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
768
34
  // This case might happen when there is an unspecialized override of a
769
34
  // specialized method.
770
34
  if (!TypeArgs)
771
0
    return;
772
34
773
47
  
for (unsigned i = 0; 34
i < Method->param_size();
i++13
) {
774
33
    const Expr *Arg = MessageExpr->getArg(i);
775
33
    const ParmVarDecl *Param = Method->parameters()[i];
776
33
777
33
    QualType OrigParamType = Param->getType();
778
33
    if (!isObjCTypeParamDependent(OrigParamType))
779
0
      continue;
780
33
781
33
    QualType ParamType = OrigParamType.substObjCTypeArgs(
782
33
        ASTCtxt, *TypeArgs, ObjCSubstitutionContext::Parameter);
783
33
    // Check if it can be assigned
784
33
    const auto *ParamObjectPtrType = ParamType->getAs<ObjCObjectPointerType>();
785
33
    const auto *ArgObjectPtrType =
786
33
        stripCastsAndSugar(Arg)->getType()->getAs<ObjCObjectPointerType>();
787
33
    if (!ParamObjectPtrType || !ArgObjectPtrType)
788
0
      continue;
789
33
790
33
    // Check if we have more concrete tracked type that is not a super type of
791
33
    // the static argument type.
792
33
    SVal ArgSVal = M.getArgSVal(i);
793
33
    SymbolRef ArgSym = ArgSVal.getAsSymbol();
794
33
    if (ArgSym) {
795
33
      const ObjCObjectPointerType *const *TrackedArgType =
796
33
          State->get<MostSpecializedTypeArgsMap>(ArgSym);
797
33
      if (TrackedArgType &&
798
33
          
ASTCtxt.canAssignObjCInterfaces(ArgObjectPtrType, *TrackedArgType)0
) {
799
0
        ArgObjectPtrType = *TrackedArgType;
800
0
      }
801
33
    }
802
33
803
33
    // Warn when argument is incompatible with the parameter.
804
33
    if (!ASTCtxt.canAssignObjCInterfaces(ParamObjectPtrType,
805
33
                                         ArgObjectPtrType)) {
806
20
      static CheckerProgramPointTag Tag(this, "ArgTypeMismatch");
807
20
      ExplodedNode *N = C.addTransition(State, &Tag);
808
20
      reportGenericsBug(ArgObjectPtrType, ParamObjectPtrType, N, Sym, C, Arg);
809
20
      return;
810
20
    }
811
33
  }
812
34
}
813
814
/// This callback is used to infer the types for Class variables. This info is
815
/// used later to validate messages that sent to classes. Class variables are
816
/// initialized with by invoking the 'class' method on a class.
817
/// This method is also used to infer the type information for the return
818
/// types.
819
// TODO: right now it only tracks generic types. Extend this to track every
820
// type in the DynamicTypeMap and diagnose type errors!
821
void DynamicTypePropagation::checkPostObjCMessage(const ObjCMethodCall &M,
822
3.33k
                                                  CheckerContext &C) const {
823
3.33k
  const ObjCMessageExpr *MessageExpr = M.getOriginExpr();
824
3.33k
825
3.33k
  SymbolRef RetSym = M.getReturnValue().getAsSymbol();
826
3.33k
  if (!RetSym)
827
937
    return;
828
2.40k
829
2.40k
  Selector Sel = MessageExpr->getSelector();
830
2.40k
  ProgramStateRef State = C.getState();
831
2.40k
  // Inference for class variables.
832
2.40k
  // We are only interested in cases where the class method is invoked on a
833
2.40k
  // class. This method is provided by the runtime and available on all classes.
834
2.40k
  if (MessageExpr->getReceiverKind() == ObjCMessageExpr::Class &&
835
2.40k
      
Sel.getAsString() == "class"789
) {
836
8
    QualType ReceiverType = MessageExpr->getClassReceiver();
837
8
    const auto *ReceiverClassType = ReceiverType->getAs<ObjCObjectType>();
838
8
    QualType ReceiverClassPointerType =
839
8
        C.getASTContext().getObjCObjectPointerType(
840
8
            QualType(ReceiverClassType, 0));
841
8
842
8
    if (!ReceiverClassType->isSpecialized())
843
6
      return;
844
2
    const auto *InferredType =
845
2
        ReceiverClassPointerType->getAs<ObjCObjectPointerType>();
846
2
    assert(InferredType);
847
2
848
2
    State = State->set<MostSpecializedTypeArgsMap>(RetSym, InferredType);
849
2
    C.addTransition(State);
850
2
    return;
851
2
  }
852
2.39k
853
2.39k
  // Tracking for return types.
854
2.39k
  SymbolRef RecSym = M.getReceiverSVal().getAsSymbol();
855
2.39k
  if (!RecSym)
856
832
    return;
857
1.56k
858
1.56k
  const ObjCObjectPointerType *const *TrackedType =
859
1.56k
      State->get<MostSpecializedTypeArgsMap>(RecSym);
860
1.56k
  if (!TrackedType)
861
1.49k
    return;
862
72
863
72
  ASTContext &ASTCtxt = C.getASTContext();
864
72
  const ObjCMethodDecl *Method =
865
72
      findMethodDecl(MessageExpr, *TrackedType, ASTCtxt);
866
72
  if (!Method)
867
2
    return;
868
70
869
70
  Optional<ArrayRef<QualType>> TypeArgs =
870
70
      (*TrackedType)->getObjCSubstitutions(Method->getDeclContext());
871
70
  if (!TypeArgs)
872
0
    return;
873
70
874
70
  QualType ResultType =
875
70
      getReturnTypeForMethod(Method, *TypeArgs, *TrackedType, ASTCtxt);
876
70
  // The static type is the same as the deduced type.
877
70
  if (ResultType.isNull())
878
33
    return;
879
37
880
37
  const MemRegion *RetRegion = M.getReturnValue().getAsRegion();
881
37
  ExplodedNode *Pred = C.getPredecessor();
882
37
  // When there is an entry available for the return symbol in DynamicTypeMap,
883
37
  // the call was inlined, and the information in the DynamicTypeMap is should
884
37
  // be precise.
885
37
  if (RetRegion && !State->get<DynamicTypeMap>(RetRegion)) {
886
37
    // TODO: we have duplicated information in DynamicTypeMap and
887
37
    // MostSpecializedTypeArgsMap. We should only store anything in the later if
888
37
    // the stored data differs from the one stored in the former.
889
37
    State = setDynamicTypeInfo(State, RetRegion, ResultType,
890
37
                               /*CanBeSubClassed=*/true);
891
37
    Pred = C.addTransition(State);
892
37
  }
893
37
894
37
  const auto *ResultPtrType = ResultType->getAs<ObjCObjectPointerType>();
895
37
896
37
  if (!ResultPtrType || ResultPtrType->isUnspecialized())
897
19
    return;
898
18
899
18
  // When the result is a specialized type and it is not tracked yet, track it
900
18
  // for the result symbol.
901
18
  if (!State->get<MostSpecializedTypeArgsMap>(RetSym)) {
902
18
    State = State->set<MostSpecializedTypeArgsMap>(RetSym, ResultPtrType);
903
18
    C.addTransition(State, Pred);
904
18
  }
905
18
}
906
907
void DynamicTypePropagation::reportGenericsBug(
908
    const ObjCObjectPointerType *From, const ObjCObjectPointerType *To,
909
    ExplodedNode *N, SymbolRef Sym, CheckerContext &C,
910
72
    const Stmt *ReportedNode) const {
911
72
  if (!CheckGenerics)
912
0
    return;
913
72
914
72
  initBugType();
915
72
  SmallString<192> Buf;
916
72
  llvm::raw_svector_ostream OS(Buf);
917
72
  OS << "Conversion from value of type '";
918
72
  QualType::print(From, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
919
72
  OS << "' to incompatible type '";
920
72
  QualType::print(To, Qualifiers(), OS, C.getLangOpts(), llvm::Twine());
921
72
  OS << "'";
922
72
  std::unique_ptr<BugReport> R(
923
72
      new BugReport(*ObjCGenericsBugType, OS.str(), N));
924
72
  R->markInteresting(Sym);
925
72
  R->addVisitor(llvm::make_unique<GenericsBugVisitor>(Sym));
926
72
  if (ReportedNode)
927
20
    R->addRange(ReportedNode->getSourceRange());
928
72
  C.emitReport(std::move(R));
929
72
}
930
931
std::shared_ptr<PathDiagnosticPiece>
932
DynamicTypePropagation::GenericsBugVisitor::VisitNode(const ExplodedNode *N,
933
                                                      BugReporterContext &BRC,
934
3.13k
                                                      BugReport &BR) {
935
3.13k
  ProgramStateRef state = N->getState();
936
3.13k
  ProgramStateRef statePrev = N->getFirstPred()->getState();
937
3.13k
938
3.13k
  const ObjCObjectPointerType *const *TrackedType =
939
3.13k
      state->get<MostSpecializedTypeArgsMap>(Sym);
940
3.13k
  const ObjCObjectPointerType *const *TrackedTypePrev =
941
3.13k
      statePrev->get<MostSpecializedTypeArgsMap>(Sym);
942
3.13k
  if (!TrackedType)
943
754
    return nullptr;
944
2.38k
945
2.38k
  if (TrackedTypePrev && 
*TrackedTypePrev == *TrackedType2.31k
)
946
2.30k
    return nullptr;
947
78
948
78
  // Retrieve the associated statement.
949
78
  const Stmt *S = PathDiagnosticLocation::getStmt(N);
950
78
  if (!S)
951
0
    return nullptr;
952
78
953
78
  const LangOptions &LangOpts = BRC.getASTContext().getLangOpts();
954
78
955
78
  SmallString<256> Buf;
956
78
  llvm::raw_svector_ostream OS(Buf);
957
78
  OS << "Type '";
958
78
  QualType::print(*TrackedType, Qualifiers(), OS, LangOpts, llvm::Twine());
959
78
  OS << "' is inferred from ";
960
78
961
78
  if (const auto *ExplicitCast = dyn_cast<ExplicitCastExpr>(S)) {
962
0
    OS << "explicit cast (from '";
963
0
    QualType::print(ExplicitCast->getSubExpr()->getType().getTypePtr(),
964
0
                    Qualifiers(), OS, LangOpts, llvm::Twine());
965
0
    OS << "' to '";
966
0
    QualType::print(ExplicitCast->getType().getTypePtr(), Qualifiers(), OS,
967
0
                    LangOpts, llvm::Twine());
968
0
    OS << "')";
969
78
  } else if (const auto *ImplicitCast = dyn_cast<ImplicitCastExpr>(S)) {
970
70
    OS << "implicit cast (from '";
971
70
    QualType::print(ImplicitCast->getSubExpr()->getType().getTypePtr(),
972
70
                    Qualifiers(), OS, LangOpts, llvm::Twine());
973
70
    OS << "' to '";
974
70
    QualType::print(ImplicitCast->getType().getTypePtr(), Qualifiers(), OS,
975
70
                    LangOpts, llvm::Twine());
976
70
    OS << "')";
977
70
  } else {
978
8
    OS << "this context";
979
8
  }
980
78
981
78
  // Generate the extra diagnostic.
982
78
  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
983
78
                             N->getLocationContext());
984
78
  return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true,
985
78
                                                    nullptr);
986
78
}
987
988
/// Register checkers.
989
26
void ento::registerObjCGenericsChecker(CheckerManager &mgr) {
990
26
  DynamicTypePropagation *checker = mgr.getChecker<DynamicTypePropagation>();
991
26
  checker->CheckGenerics = true;
992
26
}
993
994
26
bool ento::shouldRegisterObjCGenericsChecker(const LangOptions &LO) {
995
26
  return true;
996
26
}
997
998
676
void ento::registerDynamicTypePropagation(CheckerManager &mgr) {
999
676
  mgr.registerChecker<DynamicTypePropagation>();
1000
676
}
1001
1002
677
bool ento::shouldRegisterDynamicTypePropagation(const LangOptions &LO) {
1003
677
  return true;
1004
677
}