Coverage Report

Created: 2020-02-15 09:57

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
Line
Count
Source (jump to first uncovered line)
1
//===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
/// \file This file defines CallEvent and its subclasses, which represent path-
10
/// sensitive instances of different kinds of function and method calls
11
/// (C, C++, and Objective-C).
12
//
13
//===----------------------------------------------------------------------===//
14
15
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
16
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
17
18
#include "clang/AST/Decl.h"
19
#include "clang/AST/DeclBase.h"
20
#include "clang/AST/DeclCXX.h"
21
#include "clang/AST/DeclObjC.h"
22
#include "clang/AST/Expr.h"
23
#include "clang/AST/ExprCXX.h"
24
#include "clang/AST/ExprObjC.h"
25
#include "clang/AST/Stmt.h"
26
#include "clang/AST/Type.h"
27
#include "clang/Basic/IdentifierTable.h"
28
#include "clang/Basic/LLVM.h"
29
#include "clang/Basic/SourceLocation.h"
30
#include "clang/Basic/SourceManager.h"
31
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
32
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
33
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
34
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
35
#include "llvm/ADT/ArrayRef.h"
36
#include "llvm/ADT/IntrusiveRefCntPtr.h"
37
#include "llvm/ADT/PointerIntPair.h"
38
#include "llvm/ADT/PointerUnion.h"
39
#include "llvm/ADT/STLExtras.h"
40
#include "llvm/ADT/SmallVector.h"
41
#include "llvm/ADT/StringRef.h"
42
#include "llvm/Support/Allocator.h"
43
#include "llvm/Support/Casting.h"
44
#include "llvm/Support/ErrorHandling.h"
45
#include <cassert>
46
#include <limits>
47
#include <utility>
48
49
namespace clang {
50
51
class LocationContext;
52
class ProgramPoint;
53
class ProgramPointTag;
54
class StackFrameContext;
55
56
namespace ento {
57
58
enum CallEventKind {
59
  CE_Function,
60
  CE_CXXMember,
61
  CE_CXXMemberOperator,
62
  CE_CXXDestructor,
63
  CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
64
  CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
65
  CE_CXXConstructor,
66
  CE_CXXAllocator,
67
  CE_BEG_FUNCTION_CALLS = CE_Function,
68
  CE_END_FUNCTION_CALLS = CE_CXXAllocator,
69
  CE_Block,
70
  CE_ObjCMessage
71
};
72
73
class CallEvent;
74
class CallDescription;
75
76
template<typename T = CallEvent>
77
class CallEventRef : public IntrusiveRefCntPtr<const T> {
78
public:
79
1.58M
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::CallEventRef(clang::ento::ObjCMethodCall const*)
Line
Count
Source
79
27.9k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::CallEventRef(clang::ento::CXXConstructorCall const*)
Line
Count
Source
79
76.3k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::CallEventRef(clang::ento::CXXDestructorCall const*)
Line
Count
Source
79
3.20k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::CallEventRef(clang::ento::CXXAllocatorCall const*)
Line
Count
Source
79
24.3k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CallEvent>::CallEventRef(clang::ento::CallEvent const*)
Line
Count
Source
79
1.45M
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
80
120k
  CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
81
82
79.3k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
83
79.3k
    return this->get()->template cloneWithState<T>(State);
84
79.3k
  }
clang::ento::CallEventRef<clang::ento::CallEvent>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
82
75.4k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
83
75.4k
    return this->get()->template cloneWithState<T>(State);
84
75.4k
  }
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
82
3.95k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
83
3.95k
    return this->get()->template cloneWithState<T>(State);
84
3.95k
  }
85
86
  // Allow implicit conversions to a superclass type, since CallEventRef
87
  // behaves like a pointer-to-const.
88
  template <typename SuperT>
89
52.7k
  operator CallEventRef<SuperT> () const {
90
52.7k
    return this->get();
91
52.7k
  }
clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
89
38.1k
  operator CallEventRef<SuperT> () const {
90
38.1k
    return this->get();
91
38.1k
  }
clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
89
1.42k
  operator CallEventRef<SuperT> () const {
90
1.42k
    return this->get();
91
1.42k
  }
clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
89
11.4k
  operator CallEventRef<SuperT> () const {
90
11.4k
    return this->get();
91
11.4k
  }
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
89
1.73k
  operator CallEventRef<SuperT> () const {
90
1.73k
    return this->get();
91
1.73k
  }
92
};
93
94
/// \class RuntimeDefinition
95
/// Defines the runtime definition of the called function.
96
///
97
/// Encapsulates the information we have about which Decl will be used
98
/// when the call is executed on the given path. When dealing with dynamic
99
/// dispatch, the information is based on DynamicTypeInfo and might not be
100
/// precise.
101
class RuntimeDefinition {
102
  /// The Declaration of the function which could be called at runtime.
103
  /// NULL if not available.
104
  const Decl *D = nullptr;
105
106
  /// The region representing an object (ObjC/C++) on which the method is
107
  /// called. With dynamic dispatch, the method definition depends on the
108
  /// runtime type of this object. NULL when the DynamicTypeInfo is
109
  /// precise.
110
  const MemRegion *R = nullptr;
111
112
public:
113
38.1k
  RuntimeDefinition() = default;
114
84.5k
  RuntimeDefinition(const Decl *InD): D(InD) {}
115
2.81k
  RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
116
117
142k
  const Decl *getDecl() { return D; }
118
119
  /// Check if the definition we have is precise.
120
  /// If not, it is possible that the call dispatches to another definition at
121
  /// execution time.
122
80.9k
  bool mayHaveOtherDefinitions() { return R != nullptr; }
123
124
  /// When other definitions are possible, returns the region whose runtime type
125
  /// determines the method definition.
126
15
  const MemRegion *getDispatchRegion() { return R; }
127
};
128
129
/// Represents an abstract call to a function or method along a
130
/// particular path.
131
///
132
/// CallEvents are created through the factory methods of CallEventManager.
133
///
134
/// CallEvents should always be cheap to create and destroy. In order for
135
/// CallEventManager to be able to re-use CallEvent-sized memory blocks,
136
/// subclasses of CallEvent may not add any data members to the base class.
137
/// Use the "Data" and "Location" fields instead.
138
class CallEvent {
139
public:
140
  using Kind = CallEventKind;
141
142
private:
143
  ProgramStateRef State;
144
  const LocationContext *LCtx;
145
  llvm::PointerUnion<const Expr *, const Decl *> Origin;
146
147
protected:
148
  // This is user data for subclasses.
149
  const void *Data;
150
151
  // This is user data for subclasses.
152
  // This should come right before RefCount, so that the two fields can be
153
  // packed together on LP64 platforms.
154
  SourceLocation Location;
155
156
private:
157
  template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
158
159
  mutable unsigned RefCount = 0;
160
161
1.66M
  void Retain() const { ++RefCount; }
162
  void Release() const;
163
164
protected:
165
  friend class CallEventManager;
166
167
  CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
168
314k
      : State(std::move(state)), LCtx(lctx), Origin(E) {}
169
170
  CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
171
3.20k
      : State(std::move(state)), LCtx(lctx), Origin(D) {}
172
173
  // DO NOT MAKE PUBLIC
174
  CallEvent(const CallEvent &Original)
175
      : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
176
254k
        Data(Original.Data), Location(Original.Location) {}
177
178
  /// Copies this CallEvent, with vtable intact, into a new block of memory.
179
  virtual void cloneTo(void *Dest) const = 0;
180
181
  /// Get the value of arbitrary expressions at this point in the path.
182
504k
  SVal getSVal(const Stmt *S) const {
183
504k
    return getState()->getSVal(S, getLocationContext());
184
504k
  }
185
186
  using ValueList = SmallVectorImpl<SVal>;
187
188
  /// Used to specify non-argument regions that will be invalidated as a
189
  /// result of this call.
190
  virtual void getExtraInvalidatedValues(ValueList &Values,
191
20.8k
                 RegionAndSymbolInvalidationTraits *ETraits) const {}
192
193
public:
194
  CallEvent &operator=(const CallEvent &) = delete;
195
572k
  virtual ~CallEvent() = default;
196
197
  /// Returns the kind of call this is.
198
  virtual Kind getKind() const = 0;
199
200
  /// Returns the declaration of the function or method that will be
201
  /// called. May be null.
202
46.7k
  virtual const Decl *getDecl() const {
203
46.7k
    return Origin.dyn_cast<const Decl *>();
204
46.7k
  }
205
206
  /// The state in which the call is being evaluated.
207
810k
  const ProgramStateRef &getState() const {
208
810k
    return State;
209
810k
  }
210
211
  /// The context in which the call is being evaluated.
212
1.90M
  const LocationContext *getLocationContext() const {
213
1.90M
    return LCtx;
214
1.90M
  }
215
216
  /// Returns the definition of the function or method that will be
217
  /// called.
218
  virtual RuntimeDefinition getRuntimeDefinition() const = 0;
219
220
  /// Returns the expression whose value will be the result of this call.
221
  /// May be null.
222
7.21M
  const Expr *getOriginExpr() const {
223
7.21M
    return Origin.dyn_cast<const Expr *>();
224
7.21M
  }
225
226
  /// Returns the number of arguments (explicit and implicit).
227
  ///
228
  /// Note that this may be greater than the number of parameters in the
229
  /// callee's declaration, and that it may include arguments not written in
230
  /// the source.
231
  virtual unsigned getNumArgs() const = 0;
232
233
  /// Returns true if the callee is known to be from a system header.
234
40.1k
  bool isInSystemHeader() const {
235
40.1k
    const Decl *D = getDecl();
236
40.1k
    if (!D)
237
75
      return false;
238
40.1k
239
40.1k
    SourceLocation Loc = D->getLocation();
240
40.1k
    if (Loc.isValid()) {
241
39.4k
      const SourceManager &SM =
242
39.4k
        getState()->getStateManager().getContext().getSourceManager();
243
39.4k
      return SM.isInSystemHeader(D->getLocation());
244
39.4k
    }
245
707
246
707
    // Special case for implicitly-declared global operator new/delete.
247
707
    // These should be considered system functions.
248
707
    if (const auto *FD = dyn_cast<FunctionDecl>(D))
249
707
      return FD->isOverloadedOperator() && 
FD->isImplicit()706
&&
FD->isGlobal()706
;
250
0
251
0
    return false;
252
0
  }
253
254
  /// Returns true if the CallEvent is a call to a function that matches
255
  /// the CallDescription.
256
  ///
257
  /// Note that this function is not intended to be used to match Obj-C method
258
  /// calls.
259
  bool isCalled(const CallDescription &CD) const;
260
261
  /// Returns a source range for the entire call, suitable for
262
  /// outputting in diagnostics.
263
68
  virtual SourceRange getSourceRange() const {
264
68
    return getOriginExpr()->getSourceRange();
265
68
  }
266
267
  /// Returns the value of a given argument at the time of the call.
268
  virtual SVal getArgSVal(unsigned Index) const;
269
270
  /// Returns the expression associated with a given argument.
271
  /// May be null if this expression does not appear in the source.
272
0
  virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }
273
274
  /// Returns the source range for errors associated with this argument.
275
  ///
276
  /// May be invalid if the argument is not written in the source.
277
  virtual SourceRange getArgSourceRange(unsigned Index) const;
278
279
  /// Returns the result type, adjusted for references.
280
  QualType getResultType() const;
281
282
  /// Returns the return value of the call.
283
  ///
284
  /// This should only be called if the CallEvent was created using a state in
285
  /// which the return value has already been bound to the origin expression.
286
  SVal getReturnValue() const;
287
288
  /// Returns true if the type of any of the non-null arguments satisfies
289
  /// the condition.
290
  bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;
291
292
  /// Returns true if any of the arguments appear to represent callbacks.
293
  bool hasNonZeroCallbackArg() const;
294
295
  /// Returns true if any of the arguments is void*.
296
  bool hasVoidPointerToNonConstArg() const;
297
298
  /// Returns true if any of the arguments are known to escape to long-
299
  /// term storage, even if this method will not modify them.
300
  // NOTE: The exact semantics of this are still being defined!
301
  // We don't really want a list of hardcoded exceptions in the long run,
302
  // but we don't want duplicated lists of known APIs in the short term either.
303
33.5k
  virtual bool argumentsMayEscape() const {
304
33.5k
    return hasNonZeroCallbackArg();
305
33.5k
  }
306
307
  /// Returns true if the callee is an externally-visible function in the
308
  /// top-level namespace, such as \c malloc.
309
  ///
310
  /// You can use this call to determine that a particular function really is
311
  /// a library function and not, say, a C++ member function with the same name.
312
  ///
313
  /// If a name is provided, the function must additionally match the given
314
  /// name.
315
  ///
316
  /// Note that this deliberately excludes C++ library functions in the \c std
317
  /// namespace, but will include C library functions accessed through the
318
  /// \c std namespace. This also does not check if the function is declared
319
  /// as 'extern "C"', or if it uses C++ name mangling.
320
  // FIXME: Add a helper for checking namespaces.
321
  // FIXME: Move this down to AnyFunctionCall once checkers have more
322
  // precise callbacks.
323
  bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
324
325
  /// Returns the name of the callee, if its name is a simple identifier.
326
  ///
327
  /// Note that this will fail for Objective-C methods, blocks, and C++
328
  /// overloaded operators. The former is named by a Selector rather than a
329
  /// simple identifier, and the latter two do not have names.
330
  // FIXME: Move this down to AnyFunctionCall once checkers have more
331
  // precise callbacks.
332
632k
  const IdentifierInfo *getCalleeIdentifier() const {
333
632k
    const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
334
632k
    if (!ND)
335
3
      return nullptr;
336
632k
    return ND->getIdentifier();
337
632k
  }
338
339
  /// Returns an appropriate ProgramPoint for this call.
340
  ProgramPoint getProgramPoint(bool IsPreVisit = false,
341
                               const ProgramPointTag *Tag = nullptr) const;
342
343
  /// Returns a new state with all argument regions invalidated.
344
  ///
345
  /// This accepts an alternate state in case some processing has already
346
  /// occurred.
347
  ProgramStateRef invalidateRegions(unsigned BlockCount,
348
                                    ProgramStateRef Orig = nullptr) const;
349
350
  using FrameBindingTy = std::pair<SVal, SVal>;
351
  using BindingsTy = SmallVectorImpl<FrameBindingTy>;
352
353
  /// Populates the given SmallVector with the bindings in the callee's stack
354
  /// frame at the start of this call.
355
  virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
356
                                            BindingsTy &Bindings) const = 0;
357
358
  /// Returns a copy of this CallEvent, but using the given state.
359
  template <typename T>
360
  CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;
361
362
  /// Returns a copy of this CallEvent, but using the given state.
363
1.08M
  CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
364
1.08M
    return cloneWithState<CallEvent>(NewState);
365
1.08M
  }
366
367
  /// Returns true if this is a statement is a function or method call
368
  /// of some kind.
369
  static bool isCallStmt(const Stmt *S);
370
371
  /// Returns the result type of a function or method declaration.
372
  ///
373
  /// This will return a null QualType if the result type cannot be determined.
374
  static QualType getDeclaredResultType(const Decl *D);
375
376
  /// Returns true if the given decl is known to be variadic.
377
  ///
378
  /// \p D must not be null.
379
  static bool isVariadic(const Decl *D);
380
381
  /// Returns AnalysisDeclContext for the callee stack frame.
382
  /// Currently may fail; returns null on failure.
383
  AnalysisDeclContext *getCalleeAnalysisDeclContext() const;
384
385
  /// Returns the callee stack frame. That stack frame will only be entered
386
  /// during analysis if the call is inlined, but it may still be useful
387
  /// in intermediate calculations even if the call isn't inlined.
388
  /// May fail; returns null on failure.
389
  const StackFrameContext *getCalleeStackFrame(unsigned BlockCount) const;
390
391
  /// Returns memory location for a parameter variable within the callee stack
392
  /// frame. May fail; returns null on failure.
393
  const VarRegion *getParameterLocation(unsigned Index,
394
                                        unsigned BlockCount) const;
395
396
  /// Returns true if on the current path, the argument was constructed by
397
  /// calling a C++ constructor over it. This is an internal detail of the
398
  /// analysis which doesn't necessarily represent the program semantics:
399
  /// if we are supposed to construct an argument directly, we may still
400
  /// not do that because we don't know how (i.e., construction context is
401
  /// unavailable in the CFG or not supported by the analyzer).
402
69.8k
  bool isArgumentConstructedDirectly(unsigned Index) const {
403
69.8k
    // This assumes that the object was not yet removed from the state.
404
69.8k
    return ExprEngine::getObjectUnderConstruction(
405
69.8k
        getState(), {getOriginExpr(), Index}, getLocationContext()).hasValue();
406
69.8k
  }
407
408
  /// Some calls have parameter numbering mismatched from argument numbering.
409
  /// This function converts an argument index to the corresponding
410
  /// parameter index. Returns None is the argument doesn't correspond
411
  /// to any parameter variable.
412
  virtual Optional<unsigned>
413
8.57k
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const {
414
8.57k
    return ASTArgumentIndex;
415
8.57k
  }
416
417
  /// Some call event sub-classes conveniently adjust mismatching AST indices
418
  /// to match parameter indices. This function converts an argument index
419
  /// as understood by CallEvent to the argument index as understood by the AST.
420
153k
  virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const {
421
153k
    return CallArgumentIndex;
422
153k
  }
423
424
  // Iterator access to formal parameters and their types.
425
private:
426
  struct GetTypeFn {
427
79.7k
    QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
428
  };
429
430
public:
431
  /// Return call's formal parameters.
432
  ///
433
  /// Remember that the number of formal parameters may not match the number
434
  /// of arguments for all calls. However, the first parameter will always
435
  /// correspond with the argument value returned by \c getArgSVal(0).
436
  virtual ArrayRef<ParmVarDecl *> parameters() const = 0;
437
438
  using param_type_iterator =
439
      llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;
440
441
  /// Returns an iterator over the types of the call's formal parameters.
442
  ///
443
  /// This uses the callee decl found by default name lookup rather than the
444
  /// definition because it represents a public interface, and probably has
445
  /// more annotations.
446
100k
  param_type_iterator param_type_begin() const {
447
100k
    return llvm::map_iterator(parameters().begin(), GetTypeFn());
448
100k
  }
449
  /// \sa param_type_begin()
450
100k
  param_type_iterator param_type_end() const {
451
100k
    return llvm::map_iterator(parameters().end(), GetTypeFn());
452
100k
  }
453
454
  // For debugging purposes only
455
  void dump(raw_ostream &Out) const;
456
  void dump() const;
457
};
458
459
/// Represents a call to any sort of function that might have a
460
/// FunctionDecl.
461
class AnyFunctionCall : public CallEvent {
462
protected:
463
  AnyFunctionCall(const Expr *E, ProgramStateRef St,
464
                  const LocationContext *LCtx)
465
307k
      : CallEvent(E, St, LCtx) {}
466
  AnyFunctionCall(const Decl *D, ProgramStateRef St,
467
                  const LocationContext *LCtx)
468
3.20k
      : CallEvent(D, St, LCtx) {}
469
223k
  AnyFunctionCall(const AnyFunctionCall &Other) = default;
470
471
public:
472
  // This function is overridden by subclasses, but they must return
473
  // a FunctionDecl.
474
46.7k
  const FunctionDecl *getDecl() const override {
475
46.7k
    return cast<FunctionDecl>(CallEvent::getDecl());
476
46.7k
  }
477
478
  RuntimeDefinition getRuntimeDefinition() const override;
479
480
  bool argumentsMayEscape() const override;
481
482
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
483
                                    BindingsTy &Bindings) const override;
484
485
  ArrayRef<ParmVarDecl *> parameters() const override;
486
487
188k
  static bool classof(const CallEvent *CA) {
488
188k
    return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
489
188k
           CA->getKind() <= CE_END_FUNCTION_CALLS;
490
188k
  }
491
};
492
493
/// Represents a C function or static C++ member function call.
494
///
495
/// Example: \c fun()
496
class SimpleFunctionCall : public AnyFunctionCall {
497
  friend class CallEventManager;
498
499
protected:
500
  SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St,
501
                     const LocationContext *LCtx)
502
116k
      : AnyFunctionCall(CE, St, LCtx) {}
503
95.6k
  SimpleFunctionCall(const SimpleFunctionCall &Other) = default;
504
505
95.6k
  void cloneTo(void *Dest) const override {
506
95.6k
    new (Dest) SimpleFunctionCall(*this);
507
95.6k
  }
508
509
public:
510
2.53M
  virtual const CallExpr *getOriginExpr() const {
511
2.53M
    return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
512
2.53M
  }
513
514
  const FunctionDecl *getDecl() const override;
515
516
365k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
517
518
286k
  const Expr *getArgExpr(unsigned Index) const override {
519
286k
    return getOriginExpr()->getArg(Index);
520
286k
  }
521
522
1.51M
  Kind getKind() const override { return CE_Function; }
523
524
2.95k
  static bool classof(const CallEvent *CA) {
525
2.95k
    return CA->getKind() == CE_Function;
526
2.95k
  }
527
};
528
529
/// Represents a call to a block.
530
///
531
/// Example: <tt>^{ /* ... */ }()</tt>
532
class BlockCall : public CallEvent {
533
  friend class CallEventManager;
534
535
protected:
536
  BlockCall(const CallExpr *CE, ProgramStateRef St,
537
            const LocationContext *LCtx)
538
576
      : CallEvent(CE, St, LCtx) {}
539
243
  BlockCall(const BlockCall &Other) = default;
540
541
243
  void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }
542
543
  void getExtraInvalidatedValues(ValueList &Values,
544
         RegionAndSymbolInvalidationTraits *ETraits) const override;
545
546
public:
547
4.21k
  virtual const CallExpr *getOriginExpr() const {
548
4.21k
    return cast<CallExpr>(CallEvent::getOriginExpr());
549
4.21k
  }
550
551
1.18k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
552
553
341
  const Expr *getArgExpr(unsigned Index) const override {
554
341
    return getOriginExpr()->getArg(Index);
555
341
  }
556
557
  /// Returns the region associated with this instance of the block.
558
  ///
559
  /// This may be NULL if the block's origin is unknown.
560
  const BlockDataRegion *getBlockRegion() const;
561
562
2.49k
  const BlockDecl *getDecl() const override {
563
2.49k
    const BlockDataRegion *BR = getBlockRegion();
564
2.49k
    if (!BR)
565
114
      return nullptr;
566
2.37k
    return BR->getDecl();
567
2.37k
  }
568
569
557
  bool isConversionFromLambda() const {
570
557
    const BlockDecl *BD = getDecl();
571
557
    if (!BD)
572
10
      return false;
573
547
574
547
    return BD->isConversionFromLambda();
575
547
  }
576
577
  /// For a block converted from a C++ lambda, returns the block
578
  /// VarRegion for the variable holding the captured C++ lambda record.
579
14
  const VarRegion *getRegionStoringCapturedLambda() const {
580
14
    assert(isConversionFromLambda());
581
14
    const BlockDataRegion *BR = getBlockRegion();
582
14
    assert(BR && "Block converted from lambda must have a block region");
583
14
584
14
    auto I = BR->referenced_vars_begin();
585
14
    assert(I != BR->referenced_vars_end());
586
14
587
14
    return I.getCapturedRegion();
588
14
  }
589
590
195
  RuntimeDefinition getRuntimeDefinition() const override {
591
195
    if (!isConversionFromLambda())
592
188
      return RuntimeDefinition(getDecl());
593
7
594
7
    // Clang converts lambdas to blocks with an implicit user-defined
595
7
    // conversion operator method on the lambda record that looks (roughly)
596
7
    // like:
597
7
    //
598
7
    // typedef R(^block_type)(P1, P2, ...);
599
7
    // operator block_type() const {
600
7
    //   auto Lambda = *this;
601
7
    //   return ^(P1 p1, P2 p2, ...){
602
7
    //     /* return Lambda(p1, p2, ...); */
603
7
    //   };
604
7
    // }
605
7
    //
606
7
    // Here R is the return type of the lambda and P1, P2, ... are
607
7
    // its parameter types. 'Lambda' is a fake VarDecl captured by the block
608
7
    // that is initialized to a copy of the lambda.
609
7
    //
610
7
    // Sema leaves the body of a lambda-converted block empty (it is
611
7
    // produced by CodeGen), so we can't analyze it directly. Instead, we skip
612
7
    // the block body and analyze the operator() method on the captured lambda.
613
7
    const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
614
7
    const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
615
7
    CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();
616
7
617
7
    return RuntimeDefinition(LambdaCallOperator);
618
7
  }
619
620
18
  bool argumentsMayEscape() const override {
621
18
    return true;
622
18
  }
623
624
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
625
                                    BindingsTy &Bindings) const override;
626
627
  ArrayRef<ParmVarDecl*> parameters() const override;
628
629
3.25k
  Kind getKind() const override { return CE_Block; }
630
631
341
  static bool classof(const CallEvent *CA) {
632
341
    return CA->getKind() == CE_Block;
633
341
  }
634
};
635
636
/// Represents a non-static C++ member function call, no matter how
637
/// it is written.
638
class CXXInstanceCall : public AnyFunctionCall {
639
protected:
640
  CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
641
                  const LocationContext *LCtx)
642
90.7k
      : AnyFunctionCall(CE, St, LCtx) {}
643
  CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
644
                  const LocationContext *LCtx)
645
3.20k
      : AnyFunctionCall(D, St, LCtx) {}
646
47.3k
  CXXInstanceCall(const CXXInstanceCall &Other) = default;
647
648
  void getExtraInvalidatedValues(ValueList &Values,
649
         RegionAndSymbolInvalidationTraits *ETraits) const override;
650
651
public:
652
  /// Returns the expression representing the implicit 'this' object.
653
60
  virtual const Expr *getCXXThisExpr() const { return nullptr; }
654
655
  /// Returns the value of the implicit 'this' object.
656
  virtual SVal getCXXThisVal() const;
657
658
  const FunctionDecl *getDecl() const override;
659
660
  RuntimeDefinition getRuntimeDefinition() const override;
661
662
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
663
                                    BindingsTy &Bindings) const override;
664
665
420k
  static bool classof(const CallEvent *CA) {
666
420k
    return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
667
420k
           
CA->getKind() <= CE_END_CXX_INSTANCE_CALLS268k
;
668
420k
  }
669
};
670
671
/// Represents a non-static C++ member function call.
672
///
673
/// Example: \c obj.fun()
674
class CXXMemberCall : public CXXInstanceCall {
675
  friend class CallEventManager;
676
677
protected:
678
  CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
679
                const LocationContext *LCtx)
680
84.0k
      : CXXInstanceCall(CE, St, LCtx) {}
681
37.6k
  CXXMemberCall(const CXXMemberCall &Other) = default;
682
683
37.6k
  void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }
684
685
public:
686
392k
  virtual const CXXMemberCallExpr *getOriginExpr() const {
687
392k
    return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
688
392k
  }
689
690
180k
  unsigned getNumArgs() const override {
691
180k
    if (const CallExpr *CE = getOriginExpr())
692
180k
      return CE->getNumArgs();
693
0
    return 0;
694
0
  }
695
696
95.8k
  const Expr *getArgExpr(unsigned Index) const override {
697
95.8k
    return getOriginExpr()->getArg(Index);
698
95.8k
  }
699
700
  const Expr *getCXXThisExpr() const override;
701
702
  RuntimeDefinition getRuntimeDefinition() const override;
703
704
721k
  Kind getKind() const override { return CE_CXXMember; }
705
706
26.1k
  static bool classof(const CallEvent *CA) {
707
26.1k
    return CA->getKind() == CE_CXXMember;
708
26.1k
  }
709
};
710
711
/// Represents a C++ overloaded operator call where the operator is
712
/// implemented as a non-static member function.
713
///
714
/// Example: <tt>iter + 1</tt>
715
class CXXMemberOperatorCall : public CXXInstanceCall {
716
  friend class CallEventManager;
717
718
protected:
719
  CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
720
                        const LocationContext *LCtx)
721
6.74k
      : CXXInstanceCall(CE, St, LCtx) {}
722
6.33k
  CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;
723
724
6.33k
  void cloneTo(void *Dest) const override {
725
6.33k
    new (Dest) CXXMemberOperatorCall(*this);
726
6.33k
  }
727
728
public:
729
48.0k
  virtual const CXXOperatorCallExpr *getOriginExpr() const {
730
48.0k
    return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
731
48.0k
  }
732
733
17.9k
  unsigned getNumArgs() const override {
734
17.9k
    return getOriginExpr()->getNumArgs() - 1;
735
17.9k
  }
736
737
17.2k
  const Expr *getArgExpr(unsigned Index) const override {
738
17.2k
    return getOriginExpr()->getArg(Index + 1);
739
17.2k
  }
740
741
  const Expr *getCXXThisExpr() const override;
742
743
113k
  Kind getKind() const override { return CE_CXXMemberOperator; }
744
745
2.37k
  static bool classof(const CallEvent *CA) {
746
2.37k
    return CA->getKind() == CE_CXXMemberOperator;
747
2.37k
  }
748
749
  Optional<unsigned>
750
37
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override {
751
37
    // For member operator calls argument 0 on the expression corresponds
752
37
    // to implicit this-parameter on the declaration.
753
37
    return (ASTArgumentIndex > 0) ? Optional<unsigned>(ASTArgumentIndex - 1)
754
37
                                  : 
None0
;
755
37
  }
756
757
3.63k
  unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override {
758
3.63k
    // For member operator calls argument 0 on the expression corresponds
759
3.63k
    // to implicit this-parameter on the declaration.
760
3.63k
    return CallArgumentIndex + 1;
761
3.63k
  }
762
};
763
764
/// Represents an implicit call to a C++ destructor.
765
///
766
/// This can occur at the end of a scope (for automatic objects), at the end
767
/// of a full-expression (for temporaries), or as part of a delete.
768
class CXXDestructorCall : public CXXInstanceCall {
769
  friend class CallEventManager;
770
771
protected:
772
  using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;
773
774
  /// Creates an implicit destructor.
775
  ///
776
  /// \param DD The destructor that will be called.
777
  /// \param Trigger The statement whose completion causes this destructor call.
778
  /// \param Target The object region to be destructed.
779
  /// \param St The path-sensitive state at this point in the program.
780
  /// \param LCtx The location context at this point in the program.
781
  CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
782
                    const MemRegion *Target, bool IsBaseDestructor,
783
                    ProgramStateRef St, const LocationContext *LCtx)
784
3.20k
      : CXXInstanceCall(DD, St, LCtx) {
785
3.20k
    Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
786
3.20k
    Location = Trigger->getEndLoc();
787
3.20k
  }
788
789
3.37k
  CXXDestructorCall(const CXXDestructorCall &Other) = default;
790
791
3.37k
  void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}
792
793
public:
794
15.9k
  SourceRange getSourceRange() const override { return Location; }
795
10.9k
  unsigned getNumArgs() const override { return 0; }
796
797
  RuntimeDefinition getRuntimeDefinition() const override;
798
799
  /// Returns the value of the implicit 'this' object.
800
  SVal getCXXThisVal() const override;
801
802
  /// Returns true if this is a call to a base class destructor.
803
3.50k
  bool isBaseDestructor() const {
804
3.50k
    return DtorDataTy::getFromOpaqueValue(Data).getInt();
805
3.50k
  }
806
807
45.0k
  Kind getKind() const override { return CE_CXXDestructor; }
808
809
133k
  static bool classof(const CallEvent *CA) {
810
133k
    return CA->getKind() == CE_CXXDestructor;
811
133k
  }
812
};
813
814
/// Represents a call to a C++ constructor.
815
///
816
/// Example: \c T(1)
817
class CXXConstructorCall : public AnyFunctionCall {
818
  friend class CallEventManager;
819
820
protected:
821
  /// Creates a constructor call.
822
  ///
823
  /// \param CE The constructor expression as written in the source.
824
  /// \param Target The region where the object should be constructed. If NULL,
825
  ///               a new symbolic region will be used.
826
  /// \param St The path-sensitive state at this point in the program.
827
  /// \param LCtx The location context at this point in the program.
828
  CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
829
                     ProgramStateRef St, const LocationContext *LCtx)
830
76.3k
      : AnyFunctionCall(CE, St, LCtx) {
831
76.3k
    Data = Target;
832
76.3k
  }
833
834
73.3k
  CXXConstructorCall(const CXXConstructorCall &Other) = default;
835
836
73.3k
  void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }
837
838
  void getExtraInvalidatedValues(ValueList &Values,
839
         RegionAndSymbolInvalidationTraits *ETraits) const override;
840
841
public:
842
941k
  virtual const CXXConstructExpr *getOriginExpr() const {
843
941k
    return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
844
941k
  }
845
846
422k
  const CXXConstructorDecl *getDecl() const override {
847
422k
    return getOriginExpr()->getConstructor();
848
422k
  }
849
850
223k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
851
852
199k
  const Expr *getArgExpr(unsigned Index) const override {
853
199k
    return getOriginExpr()->getArg(Index);
854
199k
  }
855
856
  /// Returns the value of the implicit 'this' object.
857
  SVal getCXXThisVal() const;
858
859
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
860
                                    BindingsTy &Bindings) const override;
861
862
853k
  Kind getKind() const override { return CE_CXXConstructor; }
863
864
516k
  static bool classof(const CallEvent *CA) {
865
516k
    return CA->getKind() == CE_CXXConstructor;
866
516k
  }
867
};
868
869
/// Represents the memory allocation call in a C++ new-expression.
870
///
871
/// This is a call to "operator new".
872
class CXXAllocatorCall : public AnyFunctionCall {
873
  friend class CallEventManager;
874
875
protected:
876
  CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
877
                   const LocationContext *LCtx)
878
24.3k
      : AnyFunctionCall(E, St, LCtx) {}
879
7.32k
  CXXAllocatorCall(const CXXAllocatorCall &Other) = default;
880
881
7.32k
  void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }
882
883
public:
884
231k
  virtual const CXXNewExpr *getOriginExpr() const {
885
231k
    return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
886
231k
  }
887
888
65.7k
  const FunctionDecl *getDecl() const override {
889
65.7k
    return getOriginExpr()->getOperatorNew();
890
65.7k
  }
891
892
  /// Number of non-placement arguments to the call. It is equal to 2 for
893
  /// C++17 aligned operator new() calls that have alignment implicitly
894
  /// passed as the second argument, and to 1 for other operator new() calls.
895
108k
  unsigned getNumImplicitArgs() const {
896
108k
    return getOriginExpr()->passAlignment() ? 
219
:
1108k
;
897
108k
  }
898
899
34.2k
  unsigned getNumArgs() const override {
900
34.2k
    return getOriginExpr()->getNumPlacementArgs() + getNumImplicitArgs();
901
34.2k
  }
902
903
51.1k
  const Expr *getArgExpr(unsigned Index) const override {
904
51.1k
    // The first argument of an allocator call is the size of the allocation.
905
51.1k
    if (Index < getNumImplicitArgs())
906
27.8k
      return nullptr;
907
23.2k
    return getOriginExpr()->getPlacementArg(Index - getNumImplicitArgs());
908
23.2k
  }
909
910
  /// Number of placement arguments to the operator new() call. For example,
911
  /// standard std::nothrow operator new and standard placement new both have
912
  /// 1 implicit argument (size) and 1 placement argument, while regular
913
  /// operator new() has 1 implicit argument and 0 placement arguments.
914
0
  const Expr *getPlacementArgExpr(unsigned Index) const {
915
0
    return getOriginExpr()->getPlacementArg(Index);
916
0
  }
917
918
108k
  Kind getKind() const override { return CE_CXXAllocator; }
919
920
0
  static bool classof(const CallEvent *CE) {
921
0
    return CE->getKind() == CE_CXXAllocator;
922
0
  }
923
};
924
925
/// Represents the ways an Objective-C message send can occur.
926
//
927
// Note to maintainers: OCM_Message should always be last, since it does not
928
// need to fit in the Data field's low bits.
929
enum ObjCMessageKind {
930
  OCM_PropertyAccess,
931
  OCM_Subscript,
932
  OCM_Message
933
};
934
935
/// Represents any expression that calls an Objective-C method.
936
///
937
/// This includes all of the kinds listed in ObjCMessageKind.
938
class ObjCMethodCall : public CallEvent {
939
  friend class CallEventManager;
940
941
  const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
942
943
protected:
944
  ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
945
                 const LocationContext *LCtx)
946
6.08k
      : CallEvent(Msg, St, LCtx) {
947
6.08k
    Data = nullptr;
948
6.08k
  }
949
950
30.7k
  ObjCMethodCall(const ObjCMethodCall &Other) = default;
951
952
30.7k
  void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }
953
954
  void getExtraInvalidatedValues(ValueList &Values,
955
         RegionAndSymbolInvalidationTraits *ETraits) const override;
956
957
  /// Check if the selector may have multiple definitions (may have overrides).
958
  virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
959
                                        Selector Sel) const;
960
961
public:
962
204k
  virtual const ObjCMessageExpr *getOriginExpr() const {
963
204k
    return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
964
204k
  }
965
966
70.3k
  const ObjCMethodDecl *getDecl() const override {
967
70.3k
    return getOriginExpr()->getMethodDecl();
968
70.3k
  }
969
970
29.3k
  unsigned getNumArgs() const override {
971
29.3k
    return getOriginExpr()->getNumArgs();
972
29.3k
  }
973
974
7.32k
  const Expr *getArgExpr(unsigned Index) const override {
975
7.32k
    return getOriginExpr()->getArg(Index);
976
7.32k
  }
977
978
43.8k
  bool isInstanceMessage() const {
979
43.8k
    return getOriginExpr()->isInstanceMessage();
980
43.8k
  }
981
982
7.42k
  ObjCMethodFamily getMethodFamily() const {
983
7.42k
    return getOriginExpr()->getMethodFamily();
984
7.42k
  }
985
986
2.13k
  Selector getSelector() const {
987
2.13k
    return getOriginExpr()->getSelector();
988
2.13k
  }
989
990
  SourceRange getSourceRange() const override;
991
992
  /// Returns the value of the receiver at the time of this call.
993
  SVal getReceiverSVal() const;
994
995
  /// Return the value of 'self' if available.
996
  SVal getSelfSVal() const;
997
998
  /// Get the interface for the receiver.
999
  ///
1000
  /// This works whether this is an instance message or a class message.
1001
  /// However, it currently just uses the static type of the receiver.
1002
3.83k
  const ObjCInterfaceDecl *getReceiverInterface() const {
1003
3.83k
    return getOriginExpr()->getReceiverInterface();
1004
3.83k
  }
1005
1006
  /// Checks if the receiver refers to 'self' or 'super'.
1007
  bool isReceiverSelfOrSuper() const;
1008
1009
  /// Returns how the message was written in the source (property access,
1010
  /// subscript, or explicit message send).
1011
  ObjCMessageKind getMessageKind() const;
1012
1013
  /// Returns true if this property access or subscript is a setter (has the
1014
  /// form of an assignment).
1015
7
  bool isSetter() const {
1016
7
    switch (getMessageKind()) {
1017
0
    case OCM_Message:
1018
0
      llvm_unreachable("This is not a pseudo-object access!");
1019
1
    case OCM_PropertyAccess:
1020
1
      return getNumArgs() > 0;
1021
6
    case OCM_Subscript:
1022
6
      return getNumArgs() > 1;
1023
0
    }
1024
0
    llvm_unreachable("Unknown message kind");
1025
0
  }
1026
1027
  // Returns the property accessed by this method, either explicitly via
1028
  // property syntax or implicitly via a getter or setter method. Returns
1029
  // nullptr if the call is not a prooperty access.
1030
  const ObjCPropertyDecl *getAccessedProperty() const;
1031
1032
  RuntimeDefinition getRuntimeDefinition() const override;
1033
1034
  bool argumentsMayEscape() const override;
1035
1036
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
1037
                                    BindingsTy &Bindings) const override;
1038
1039
  ArrayRef<ParmVarDecl*> parameters() const override;
1040
1041
148k
  Kind getKind() const override { return CE_ObjCMessage; }
1042
1043
449k
  static bool classof(const CallEvent *CA) {
1044
449k
    return CA->getKind() == CE_ObjCMessage;
1045
449k
  }
1046
};
1047
1048
enum CallDescriptionFlags : int {
1049
  /// Describes a C standard function that is sometimes implemented as a macro
1050
  /// that expands to a compiler builtin with some __builtin prefix.
1051
  /// The builtin may as well have a few extra arguments on top of the requested
1052
  /// number of arguments.
1053
  CDF_MaybeBuiltin = 1 << 0,
1054
};
1055
1056
/// This class represents a description of a function call using the number of
1057
/// arguments and the name of the function.
1058
class CallDescription {
1059
  friend CallEvent;
1060
1061
  mutable IdentifierInfo *II = nullptr;
1062
  mutable bool IsLookupDone = false;
1063
  // The list of the qualified names used to identify the specified CallEvent,
1064
  // e.g. "{a, b}" represent the qualified names, like "a::b".
1065
  std::vector<const char *> QualifiedName;
1066
  Optional<unsigned> RequiredArgs;
1067
  Optional<size_t> RequiredParams;
1068
  int Flags;
1069
1070
  // A constructor helper.
1071
  static Optional<size_t> readRequiredParams(Optional<unsigned> RequiredArgs,
1072
726k
                                             Optional<size_t> RequiredParams) {
1073
726k
    if (RequiredParams)
1074
44.6k
      return RequiredParams;
1075
682k
    if (RequiredArgs)
1076
680k
      return static_cast<size_t>(*RequiredArgs);
1077
1.20k
    return None;
1078
1.20k
  }
1079
1080
public:
1081
  /// Constructs a CallDescription object.
1082
  ///
1083
  /// @param QualifiedName The list of the name qualifiers of the function that
1084
  /// will be matched. The user is allowed to skip any of the qualifiers.
1085
  /// For example, {"std", "basic_string", "c_str"} would match both
1086
  /// std::basic_string<...>::c_str() and std::__1::basic_string<...>::c_str().
1087
  ///
1088
  /// @param RequiredArgs The number of arguments that is expected to match a
1089
  /// call. Omit this parameter to match every occurrence of call with a given
1090
  /// name regardless the number of arguments.
1091
  CallDescription(int Flags, ArrayRef<const char *> QualifiedName,
1092
                  Optional<unsigned> RequiredArgs = None,
1093
                  Optional<size_t> RequiredParams = None)
1094
      : QualifiedName(QualifiedName), RequiredArgs(RequiredArgs),
1095
        RequiredParams(readRequiredParams(RequiredArgs, RequiredParams)),
1096
726k
        Flags(Flags) {}
1097
1098
  /// Construct a CallDescription with default flags.
1099
  CallDescription(ArrayRef<const char *> QualifiedName,
1100
                  Optional<unsigned> RequiredArgs = None,
1101
                  Optional<size_t> RequiredParams = None)
1102
721k
      : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {}
Unexecuted instantiation: clang::ento::CallDescription::CallDescription(llvm::ArrayRef<char const*>, llvm::Optional<unsigned int>, llvm::Optional<unsigned long>)
clang::ento::CallDescription::CallDescription(llvm::ArrayRef<char const*>, llvm::Optional<unsigned int>, llvm::Optional<unsigned long>)
Line
Count
Source
1102
721k
      : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {}
1103
1104
  /// Get the name of the function that this object matches.
1105
374k
  StringRef getFunctionName() const { return QualifiedName.back(); }
1106
};
1107
1108
/// An immutable map from CallDescriptions to arbitrary data. Provides a unified
1109
/// way for checkers to react on function calls.
1110
template <typename T> class CallDescriptionMap {
1111
  // Some call descriptions aren't easily hashable (eg., the ones with qualified
1112
  // names in which some sections are omitted), so let's put them
1113
  // in a simple vector and use linear lookup.
1114
  // TODO: Implement an actual map for fast lookup for "hashable" call
1115
  // descriptions (eg., the ones for C functions that just match the name).
1116
  std::vector<std::pair<CallDescription, T>> LinearMap;
1117
1118
public:
1119
  CallDescriptionMap(
1120
      std::initializer_list<std::pair<CallDescription, T>> &&List)
1121
586
      : LinearMap(List) {}
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const> >&&)
Line
Count
Source
1121
227
      : LinearMap(List) {}
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> > >&&)
Line
Count
Source
1121
23
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&) const> >&&)
Line
Count
Source
1121
20
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&) const> >&&)
Line
Count
Source
1121
20
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&, clang::ento::SVal const&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&, clang::ento::SVal const&) const> >&&)
Line
Count
Source
1121
20
      : LinearMap(List) {}
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const> >&&)
Line
Count
Source
1121
10
      : LinearMap(List) {}
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const> >&&)
Line
Count
Source
1121
8
      : LinearMap(List) {}
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const> >&&)
Line
Count
Source
1121
222
      : LinearMap(List) {}
clang::ento::CallDescriptionMap<bool>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, bool> >&&)
Line
Count
Source
1121
27
      : LinearMap(List) {}
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const> >&&)
Line
Count
Source
1121
3
      : LinearMap(List) {}
StreamChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::StreamChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, std::__1::function<void ((anonymous namespace)::StreamChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> > >&&)
Line
Count
Source
1121
6
      : LinearMap(List) {}
1122
1123
586
  ~CallDescriptionMap() = default;
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::~CallDescriptionMap()
Line
Count
Source
1123
227
  ~CallDescriptionMap() = default;
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::~CallDescriptionMap()
Line
Count
Source
1123
23
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&, clang::ento::SVal const&) const>::~CallDescriptionMap()
Line
Count
Source
1123
20
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&) const>::~CallDescriptionMap()
Line
Count
Source
1123
20
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&) const>::~CallDescriptionMap()
Line
Count
Source
1123
20
  ~CallDescriptionMap() = default;
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::~CallDescriptionMap()
Line
Count
Source
1123
10
  ~CallDescriptionMap() = default;
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::~CallDescriptionMap()
Line
Count
Source
1123
8
  ~CallDescriptionMap() = default;
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::~CallDescriptionMap()
Line
Count
Source
1123
222
  ~CallDescriptionMap() = default;
clang::ento::CallDescriptionMap<bool>::~CallDescriptionMap()
Line
Count
Source
1123
27
  ~CallDescriptionMap() = default;
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::~CallDescriptionMap()
Line
Count
Source
1123
3
  ~CallDescriptionMap() = default;
StreamChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::StreamChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::~CallDescriptionMap()
Line
Count
Source
1123
6
  ~CallDescriptionMap() = default;
1124
1125
  // These maps are usually stored once per checker, so let's make sure
1126
  // we don't do redundant copies.
1127
  CallDescriptionMap(const CallDescriptionMap &) = delete;
1128
  CallDescriptionMap &operator=(const CallDescription &) = delete;
1129
1130
38.2k
  const T *lookup(const CallEvent &Call) const {
1131
38.2k
    // Slow path: linear lookup.
1132
38.2k
    // TODO: Implement some sort of fast path.
1133
38.2k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
521k
      if (Call.isCalled(I.first))
1135
4.72k
        return &I.second;
1136
38.2k
1137
38.2k
    
return nullptr33.4k
;
1138
38.2k
  }
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
16.6k
  const T *lookup(const CallEvent &Call) const {
1131
16.6k
    // Slow path: linear lookup.
1132
16.6k
    // TODO: Implement some sort of fast path.
1133
16.6k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
374k
      if (Call.isCalled(I.first))
1135
2.06k
        return &I.second;
1136
16.6k
1137
16.6k
    
return nullptr14.5k
;
1138
16.6k
  }
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
219
  const T *lookup(const CallEvent &Call) const {
1131
219
    // Slow path: linear lookup.
1132
219
    // TODO: Implement some sort of fast path.
1133
219
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
1.60k
      if (Call.isCalled(I.first))
1135
39
        return &I.second;
1136
219
1137
219
    
return nullptr180
;
1138
219
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
1.72k
  const T *lookup(const CallEvent &Call) const {
1131
1.72k
    // Slow path: linear lookup.
1132
1.72k
    // TODO: Implement some sort of fast path.
1133
1.72k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
13.4k
      if (Call.isCalled(I.first))
1135
98
        return &I.second;
1136
1.72k
1137
1.72k
    
return nullptr1.62k
;
1138
1.72k
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
1.62k
  const T *lookup(const CallEvent &Call) const {
1131
1.62k
    // Slow path: linear lookup.
1132
1.62k
    // TODO: Implement some sort of fast path.
1133
1.62k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
6.16k
      if (Call.isCalled(I.first))
1135
174
        return &I.second;
1136
1.62k
1137
1.62k
    
return nullptr1.44k
;
1138
1.62k
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal const&, clang::ento::SVal const&, clang::ento::SVal const&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
1.44k
  const T *lookup(const CallEvent &Call) const {
1131
1.44k
    // Slow path: linear lookup.
1132
1.44k
    // TODO: Implement some sort of fast path.
1133
1.44k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
2.89k
      if (Call.isCalled(I.first))
1135
8
        return &I.second;
1136
1.44k
1137
1.44k
    
return nullptr1.44k
;
1138
1.44k
  }
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
4.75k
  const T *lookup(const CallEvent &Call) const {
1131
4.75k
    // Slow path: linear lookup.
1132
4.75k
    // TODO: Implement some sort of fast path.
1133
4.75k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
9.30k
      if (Call.isCalled(I.first))
1135
430
        return &I.second;
1136
4.75k
1137
4.75k
    
return nullptr4.32k
;
1138
4.75k
  }
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
4.73k
  const T *lookup(const CallEvent &Call) const {
1131
4.73k
    // Slow path: linear lookup.
1132
4.73k
    // TODO: Implement some sort of fast path.
1133
4.73k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
12.6k
      if (Call.isCalled(I.first))
1135
1.25k
        return &I.second;
1136
4.73k
1137
4.73k
    
return nullptr3.47k
;
1138
4.73k
  }
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
5.58k
  const T *lookup(const CallEvent &Call) const {
1131
5.58k
    // Slow path: linear lookup.
1132
5.58k
    // TODO: Implement some sort of fast path.
1133
5.58k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
69.7k
      if (Call.isCalled(I.first))
1135
507
        return &I.second;
1136
5.58k
1137
5.58k
    
return nullptr5.07k
;
1138
5.58k
  }
clang::ento::CallDescriptionMap<bool>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
175
  const T *lookup(const CallEvent &Call) const {
1131
175
    // Slow path: linear lookup.
1132
175
    // TODO: Implement some sort of fast path.
1133
175
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
2.64k
      if (Call.isCalled(I.first))
1135
12
        return &I.second;
1136
175
1137
175
    
return nullptr163
;
1138
175
  }
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
1.23k
  const T *lookup(const CallEvent &Call) const {
1131
1.23k
    // Slow path: linear lookup.
1132
1.23k
    // TODO: Implement some sort of fast path.
1133
1.23k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
27.9k
      if (Call.isCalled(I.first))
1135
54
        return &I.second;
1136
1.23k
1137
1.23k
    
return nullptr1.18k
;
1138
1.23k
  }
StreamChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::StreamChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1130
102
  const T *lookup(const CallEvent &Call) const {
1131
102
    // Slow path: linear lookup.
1132
102
    // TODO: Implement some sort of fast path.
1133
102
    for (const std::pair<CallDescription, T> &I : LinearMap)
1134
747
      if (Call.isCalled(I.first))
1135
82
        return &I.second;
1136
102
1137
102
    
return nullptr20
;
1138
102
  }
1139
};
1140
1141
/// Manages the lifetime of CallEvent objects.
1142
///
1143
/// CallEventManager provides a way to create arbitrary CallEvents "on the
1144
/// stack" as if they were value objects by keeping a cache of CallEvent-sized
1145
/// memory blocks. The CallEvents created by CallEventManager are only valid
1146
/// for the lifetime of the OwnedCallEvent that holds them; right now these
1147
/// objects cannot be copied and ownership cannot be transferred.
1148
class CallEventManager {
1149
  friend class CallEvent;
1150
1151
  llvm::BumpPtrAllocator &Alloc;
1152
  SmallVector<void *, 8> Cache;
1153
1154
  using CallEventTemplateTy = SimpleFunctionCall;
1155
1156
572k
  void reclaim(const void *Memory) {
1157
572k
    Cache.push_back(const_cast<void *>(Memory));
1158
572k
  }
1159
1160
  /// Returns memory that can be initialized as a CallEvent.
1161
572k
  void *allocate() {
1162
572k
    if (Cache.empty())
1163
19.2k
      return Alloc.Allocate<CallEventTemplateTy>();
1164
552k
    else
1165
552k
      return Cache.pop_back_val();
1166
572k
  }
1167
1168
  template <typename T, typename Arg>
1169
237k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
237k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
237k
                  "CallEvent subclasses are not all the same size");
1172
237k
    return new (allocate()) T(A, St, LCtx);
1173
237k
  }
clang::ento::ObjCMethodCall* clang::ento::CallEventManager::create<clang::ento::ObjCMethodCall, clang::ObjCMessageExpr const*>(clang::ObjCMessageExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
6.08k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
6.08k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
6.08k
                  "CallEvent subclasses are not all the same size");
1172
6.08k
    return new (allocate()) T(A, St, LCtx);
1173
6.08k
  }
clang::ento::CXXAllocatorCall* clang::ento::CallEventManager::create<clang::ento::CXXAllocatorCall, clang::CXXNewExpr const*>(clang::CXXNewExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
24.3k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
24.3k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
24.3k
                  "CallEvent subclasses are not all the same size");
1172
24.3k
    return new (allocate()) T(A, St, LCtx);
1173
24.3k
  }
clang::ento::CXXMemberCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberCall, clang::CXXMemberCallExpr const*>(clang::CXXMemberCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
84.0k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
84.0k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
84.0k
                  "CallEvent subclasses are not all the same size");
1172
84.0k
    return new (allocate()) T(A, St, LCtx);
1173
84.0k
  }
clang::ento::CXXMemberOperatorCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberOperatorCall, clang::CXXOperatorCallExpr const*>(clang::CXXOperatorCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
6.74k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
6.74k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
6.74k
                  "CallEvent subclasses are not all the same size");
1172
6.74k
    return new (allocate()) T(A, St, LCtx);
1173
6.74k
  }
clang::ento::BlockCall* clang::ento::CallEventManager::create<clang::ento::BlockCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
576
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
576
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
576
                  "CallEvent subclasses are not all the same size");
1172
576
    return new (allocate()) T(A, St, LCtx);
1173
576
  }
clang::ento::SimpleFunctionCall* clang::ento::CallEventManager::create<clang::ento::SimpleFunctionCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1169
116k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1170
116k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1171
116k
                  "CallEvent subclasses are not all the same size");
1172
116k
    return new (allocate()) T(A, St, LCtx);
1173
116k
  }
1174
1175
  template <typename T, typename Arg1, typename Arg2>
1176
76.3k
  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1177
76.3k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1178
76.3k
                  "CallEvent subclasses are not all the same size");
1179
76.3k
    return new (allocate()) T(A1, A2, St, LCtx);
1180
76.3k
  }
1181
1182
  template <typename T, typename Arg1, typename Arg2, typename Arg3>
1183
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
1184
            const LocationContext *LCtx) {
1185
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1186
                  "CallEvent subclasses are not all the same size");
1187
    return new (allocate()) T(A1, A2, A3, St, LCtx);
1188
  }
1189
1190
  template <typename T, typename Arg1, typename Arg2, typename Arg3,
1191
            typename Arg4>
1192
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
1193
3.20k
            const LocationContext *LCtx) {
1194
3.20k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1195
3.20k
                  "CallEvent subclasses are not all the same size");
1196
3.20k
    return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
1197
3.20k
  }
1198
1199
public:
1200
12.6k
  CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
1201
1202
  /// Gets an outside caller given a callee context.
1203
  CallEventRef<>
1204
  getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
1205
1206
  /// Gets a call event for a function call, Objective-C method call,
1207
  /// or a 'new' call.
1208
  CallEventRef<>
1209
  getCall(const Stmt *S, ProgramStateRef State,
1210
          const LocationContext *LC);
1211
1212
  CallEventRef<>
1213
  getSimpleCall(const CallExpr *E, ProgramStateRef State,
1214
                const LocationContext *LCtx);
1215
1216
  CallEventRef<ObjCMethodCall>
1217
  getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
1218
6.08k
                    const LocationContext *LCtx) {
1219
6.08k
    return create<ObjCMethodCall>(E, State, LCtx);
1220
6.08k
  }
1221
1222
  CallEventRef<CXXConstructorCall>
1223
  getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
1224
76.3k
                        ProgramStateRef State, const LocationContext *LCtx) {
1225
76.3k
    return create<CXXConstructorCall>(E, Target, State, LCtx);
1226
76.3k
  }
1227
1228
  CallEventRef<CXXDestructorCall>
1229
  getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
1230
                       const MemRegion *Target, bool IsBase,
1231
3.20k
                       ProgramStateRef State, const LocationContext *LCtx) {
1232
3.20k
    return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
1233
3.20k
  }
1234
1235
  CallEventRef<CXXAllocatorCall>
1236
  getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
1237
24.3k
                      const LocationContext *LCtx) {
1238
24.3k
    return create<CXXAllocatorCall>(E, State, LCtx);
1239
24.3k
  }
1240
};
1241
1242
template <typename T>
1243
1.17M
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1244
1.17M
  assert(isa<T>(*this) && "Cloning to unrelated type");
1245
1.17M
  static_assert(sizeof(T) == sizeof(CallEvent),
1246
1.17M
                "Subclasses may not add fields");
1247
1.17M
1248
1.17M
  if (NewState == State)
1249
923k
    return cast<T>(this);
1250
254k
1251
254k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1252
254k
  T *Copy = static_cast<T *>(Mgr.allocate());
1253
254k
  cloneTo(Copy);
1254
254k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1255
254k
1256
254k
  Copy->State = NewState;
1257
254k
  return Copy;
1258
254k
}
clang::ento::CallEventRef<clang::ento::CallEvent> clang::ento::CallEvent::cloneWithState<clang::ento::CallEvent>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
1243
1.15M
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1244
1.15M
  assert(isa<T>(*this) && "Cloning to unrelated type");
1245
1.15M
  static_assert(sizeof(T) == sizeof(CallEvent),
1246
1.15M
                "Subclasses may not add fields");
1247
1.15M
1248
1.15M
  if (NewState == State)
1249
916k
    return cast<T>(this);
1250
240k
1251
240k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1252
240k
  T *Copy = static_cast<T *>(Mgr.allocate());
1253
240k
  cloneTo(Copy);
1254
240k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1255
240k
1256
240k
  Copy->State = NewState;
1257
240k
  return Copy;
1258
240k
}
clang::ento::CallEventRef<clang::ento::ObjCMethodCall> clang::ento::CallEvent::cloneWithState<clang::ento::ObjCMethodCall>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
1243
21.8k
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1244
21.8k
  assert(isa<T>(*this) && "Cloning to unrelated type");
1245
21.8k
  static_assert(sizeof(T) == sizeof(CallEvent),
1246
21.8k
                "Subclasses may not add fields");
1247
21.8k
1248
21.8k
  if (NewState == State)
1249
7.55k
    return cast<T>(this);
1250
14.3k
1251
14.3k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1252
14.3k
  T *Copy = static_cast<T *>(Mgr.allocate());
1253
14.3k
  cloneTo(Copy);
1254
14.3k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1255
14.3k
1256
14.3k
  Copy->State = NewState;
1257
14.3k
  return Copy;
1258
14.3k
}
1259
1260
1.66M
inline void CallEvent::Release() const {
1261
1.66M
  assert(RefCount > 0 && "Reference count is already zero.");
1262
1.66M
  --RefCount;
1263
1.66M
1264
1.66M
  if (RefCount > 0)
1265
1.09M
    return;
1266
572k
1267
572k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1268
572k
  Mgr.reclaim(this);
1269
572k
1270
572k
  this->~CallEvent();
1271
572k
}
1272
1273
} // namespace ento
1274
1275
} // namespace clang
1276
1277
namespace llvm {
1278
1279
// Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1280
template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
1281
  using SimpleType = const T *;
1282
1283
  static SimpleType
1284
78.9k
  getSimplifiedValue(clang::ento::CallEventRef<T> Val) {
1285
78.9k
    return Val.get();
1286
78.9k
  }
1287
};
1288
1289
} // namespace llvm
1290
1291
#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H