Coverage Report

Created: 2020-09-19 12:23

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h
Line
Count
Source (jump to first uncovered line)
1
//===- CallEvent.h - Wrapper for all function and method calls --*- C++ -*-===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
/// \file This file defines CallEvent and its subclasses, which represent path-
10
/// sensitive instances of different kinds of function and method calls
11
/// (C, C++, and Objective-C).
12
//
13
//===----------------------------------------------------------------------===//
14
15
#ifndef LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
16
#define LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H
17
18
#include "clang/AST/Decl.h"
19
#include "clang/AST/DeclBase.h"
20
#include "clang/AST/DeclCXX.h"
21
#include "clang/AST/DeclObjC.h"
22
#include "clang/AST/Expr.h"
23
#include "clang/AST/ExprCXX.h"
24
#include "clang/AST/ExprObjC.h"
25
#include "clang/AST/Stmt.h"
26
#include "clang/AST/Type.h"
27
#include "clang/Basic/IdentifierTable.h"
28
#include "clang/Basic/LLVM.h"
29
#include "clang/Basic/SourceLocation.h"
30
#include "clang/Basic/SourceManager.h"
31
#include "clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h"
32
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState.h"
33
#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramState_Fwd.h"
34
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
35
#include "llvm/ADT/ArrayRef.h"
36
#include "llvm/ADT/IntrusiveRefCntPtr.h"
37
#include "llvm/ADT/PointerIntPair.h"
38
#include "llvm/ADT/PointerUnion.h"
39
#include "llvm/ADT/STLExtras.h"
40
#include "llvm/ADT/SmallVector.h"
41
#include "llvm/ADT/StringRef.h"
42
#include "llvm/ADT/iterator_range.h"
43
#include "llvm/Support/Allocator.h"
44
#include "llvm/Support/Casting.h"
45
#include "llvm/Support/ErrorHandling.h"
46
#include <cassert>
47
#include <limits>
48
#include <utility>
49
50
namespace clang {
51
52
class LocationContext;
53
class ProgramPoint;
54
class ProgramPointTag;
55
class StackFrameContext;
56
57
namespace ento {
58
59
enum CallEventKind {
60
  CE_Function,
61
  CE_CXXMember,
62
  CE_CXXMemberOperator,
63
  CE_CXXDestructor,
64
  CE_BEG_CXX_INSTANCE_CALLS = CE_CXXMember,
65
  CE_END_CXX_INSTANCE_CALLS = CE_CXXDestructor,
66
  CE_CXXConstructor,
67
  CE_CXXInheritedConstructor,
68
  CE_BEG_CXX_CONSTRUCTOR_CALLS = CE_CXXConstructor,
69
  CE_END_CXX_CONSTRUCTOR_CALLS = CE_CXXInheritedConstructor,
70
  CE_CXXAllocator,
71
  CE_CXXDeallocator,
72
  CE_BEG_FUNCTION_CALLS = CE_Function,
73
  CE_END_FUNCTION_CALLS = CE_CXXDeallocator,
74
  CE_Block,
75
  CE_ObjCMessage
76
};
77
78
class CallEvent;
79
class CallDescription;
80
81
template<typename T = CallEvent>
82
class CallEventRef : public IntrusiveRefCntPtr<const T> {
83
public:
84
1.27M
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::CallEventRef(clang::ento::ObjCMethodCall const*)
Line
Count
Source
84
28.3k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CallEvent>::CallEventRef(clang::ento::CallEvent const*)
Line
Count
Source
84
1.19M
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::CallEventRef(clang::ento::CXXConstructorCall const*)
Line
Count
Source
84
41.0k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXInheritedConstructorCall>::CallEventRef(clang::ento::CXXInheritedConstructorCall const*)
Line
Count
Source
84
13
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::CallEventRef(clang::ento::CXXDestructorCall const*)
Line
Count
Source
84
2.95k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::CallEventRef(clang::ento::CXXAllocatorCall const*)
Line
Count
Source
84
2.83k
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
clang::ento::CallEventRef<clang::ento::CXXDeallocatorCall>::CallEventRef(clang::ento::CXXDeallocatorCall const*)
Line
Count
Source
84
436
  CallEventRef(const T *Call) : IntrusiveRefCntPtr<const T>(Call) {}
85
72.0k
  CallEventRef(const CallEventRef &Orig) : IntrusiveRefCntPtr<const T>(Orig) {}
86
87
43.4k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
88
43.4k
    return this->get()->template cloneWithState<T>(State);
89
43.4k
  }
clang::ento::CallEventRef<clang::ento::CallEvent>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
87
39.4k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
88
39.4k
    return this->get()->template cloneWithState<T>(State);
89
39.4k
  }
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::cloneWithState(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
87
4.00k
  CallEventRef<T> cloneWithState(ProgramStateRef State) const {
88
4.00k
    return this->get()->template cloneWithState<T>(State);
89
4.00k
  }
90
91
  // Allow implicit conversions to a superclass type, since CallEventRef
92
  // behaves like a pointer-to-const.
93
  template <typename SuperT>
94
45.0k
  operator CallEventRef<SuperT> () const {
95
45.0k
    return this->get();
96
45.0k
  }
clang::ento::CallEventRef<clang::ento::CXXDestructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
94
1.45k
  operator CallEventRef<SuperT> () const {
95
1.45k
    return this->get();
96
1.45k
  }
clang::ento::CallEventRef<clang::ento::CXXAllocatorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
94
817
  operator CallEventRef<SuperT> () const {
95
817
    return this->get();
96
817
  }
clang::ento::CallEventRef<clang::ento::CXXConstructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
94
41.0k
  operator CallEventRef<SuperT> () const {
95
41.0k
    return this->get();
96
41.0k
  }
clang::ento::CallEventRef<clang::ento::ObjCMethodCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
94
1.77k
  operator CallEventRef<SuperT> () const {
95
1.77k
    return this->get();
96
1.77k
  }
clang::ento::CallEventRef<clang::ento::CXXInheritedConstructorCall>::operator clang::ento::CallEventRef<clang::ento::CallEvent><clang::ento::CallEvent>() const
Line
Count
Source
94
13
  operator CallEventRef<SuperT> () const {
95
13
    return this->get();
96
13
  }
97
};
98
99
/// \class RuntimeDefinition
100
/// Defines the runtime definition of the called function.
101
///
102
/// Encapsulates the information we have about which Decl will be used
103
/// when the call is executed on the given path. When dealing with dynamic
104
/// dispatch, the information is based on DynamicTypeInfo and might not be
105
/// precise.
106
class RuntimeDefinition {
107
  /// The Declaration of the function which could be called at runtime.
108
  /// NULL if not available.
109
  const Decl *D = nullptr;
110
111
  /// The region representing an object (ObjC/C++) on which the method is
112
  /// called. With dynamic dispatch, the method definition depends on the
113
  /// runtime type of this object. NULL when the DynamicTypeInfo is
114
  /// precise.
115
  const MemRegion *R = nullptr;
116
117
public:
118
25.3k
  RuntimeDefinition() = default;
119
37.7k
  RuntimeDefinition(const Decl *InD): D(InD) {}
120
2.84k
  RuntimeDefinition(const Decl *InD, const MemRegion *InR): D(InD), R(InR) {}
121
122
66.0k
  const Decl *getDecl() { return D; }
123
124
  /// Check if the definition we have is precise.
125
  /// If not, it is possible that the call dispatches to another definition at
126
  /// execution time.
127
33.8k
  bool mayHaveOtherDefinitions() { return R != nullptr; }
128
129
  /// When other definitions are possible, returns the region whose runtime type
130
  /// determines the method definition.
131
15
  const MemRegion *getDispatchRegion() { return R; }
132
};
133
134
/// Represents an abstract call to a function or method along a
135
/// particular path.
136
///
137
/// CallEvents are created through the factory methods of CallEventManager.
138
///
139
/// CallEvents should always be cheap to create and destroy. In order for
140
/// CallEventManager to be able to re-use CallEvent-sized memory blocks,
141
/// subclasses of CallEvent may not add any data members to the base class.
142
/// Use the "Data" and "Location" fields instead.
143
class CallEvent {
144
public:
145
  using Kind = CallEventKind;
146
147
private:
148
  ProgramStateRef State;
149
  const LocationContext *LCtx;
150
  llvm::PointerUnion<const Expr *, const Decl *> Origin;
151
152
protected:
153
  // This is user data for subclasses.
154
  const void *Data;
155
156
  // This is user data for subclasses.
157
  // This should come right before RefCount, so that the two fields can be
158
  // packed together on LP64 platforms.
159
  SourceLocation Location;
160
161
private:
162
  template <typename T> friend struct llvm::IntrusiveRefCntPtrInfo;
163
164
  mutable unsigned RefCount = 0;
165
166
1.32M
  void Retain() const { ++RefCount; }
167
  void Release() const;
168
169
protected:
170
  friend class CallEventManager;
171
172
  CallEvent(const Expr *E, ProgramStateRef state, const LocationContext *lctx)
173
194k
      : State(std::move(state)), LCtx(lctx), Origin(E) {}
174
175
  CallEvent(const Decl *D, ProgramStateRef state, const LocationContext *lctx)
176
2.95k
      : State(std::move(state)), LCtx(lctx), Origin(D) {}
177
178
  // DO NOT MAKE PUBLIC
179
  CallEvent(const CallEvent &Original)
180
      : State(Original.State), LCtx(Original.LCtx), Origin(Original.Origin),
181
272k
        Data(Original.Data), Location(Original.Location) {}
182
183
  /// Copies this CallEvent, with vtable intact, into a new block of memory.
184
  virtual void cloneTo(void *Dest) const = 0;
185
186
  /// Get the value of arbitrary expressions at this point in the path.
187
431k
  SVal getSVal(const Stmt *S) const {
188
431k
    return getState()->getSVal(S, getLocationContext());
189
431k
  }
190
191
  using ValueList = SmallVectorImpl<SVal>;
192
193
  /// Used to specify non-argument regions that will be invalidated as a
194
  /// result of this call.
195
  virtual void getExtraInvalidatedValues(ValueList &Values,
196
20.5k
                 RegionAndSymbolInvalidationTraits *ETraits) const {}
197
198
public:
199
  CallEvent &operator=(const CallEvent &) = delete;
200
469k
  virtual ~CallEvent() = default;
201
202
  /// Returns the kind of call this is.
203
  virtual Kind getKind() const = 0;
204
  virtual StringRef getKindAsString() const = 0;
205
206
  /// Returns the declaration of the function or method that will be
207
  /// called. May be null.
208
42.4k
  virtual const Decl *getDecl() const {
209
42.4k
    return Origin.dyn_cast<const Decl *>();
210
42.4k
  }
211
212
  /// The state in which the call is being evaluated.
213
661k
  const ProgramStateRef &getState() const {
214
661k
    return State;
215
661k
  }
216
217
  /// The context in which the call is being evaluated.
218
1.62M
  const LocationContext *getLocationContext() const {
219
1.62M
    return LCtx;
220
1.62M
  }
221
222
  /// Returns the definition of the function or method that will be
223
  /// called.
224
  virtual RuntimeDefinition getRuntimeDefinition() const = 0;
225
226
  /// Returns the expression whose value will be the result of this call.
227
  /// May be null.
228
8.89M
  const Expr *getOriginExpr() const {
229
8.89M
    return Origin.dyn_cast<const Expr *>();
230
8.89M
  }
231
232
  /// Returns the number of arguments (explicit and implicit).
233
  ///
234
  /// Note that this may be greater than the number of parameters in the
235
  /// callee's declaration, and that it may include arguments not written in
236
  /// the source.
237
  virtual unsigned getNumArgs() const = 0;
238
239
  /// Returns true if the callee is known to be from a system header.
240
38.6k
  bool isInSystemHeader() const {
241
38.6k
    const Decl *D = getDecl();
242
38.6k
    if (!D)
243
78
      return false;
244
38.5k
245
38.5k
    SourceLocation Loc = D->getLocation();
246
38.5k
    if (Loc.isValid()) {
247
38.2k
      const SourceManager &SM =
248
38.2k
        getState()->getStateManager().getContext().getSourceManager();
249
38.2k
      return SM.isInSystemHeader(D->getLocation());
250
38.2k
    }
251
289
252
    // Special case for implicitly-declared global operator new/delete.
253
    // These should be considered system functions.
254
289
    if (const auto *FD = dyn_cast<FunctionDecl>(D))
255
289
      return FD->isOverloadedOperator() && 
FD->isImplicit()288
&&
FD->isGlobal()288
;
256
0
257
0
    return false;
258
0
  }
259
260
  /// Returns true if the CallEvent is a call to a function that matches
261
  /// the CallDescription.
262
  ///
263
  /// Note that this function is not intended to be used to match Obj-C method
264
  /// calls.
265
  bool isCalled(const CallDescription &CD) const;
266
267
  /// Returns true whether the CallEvent is any of the CallDescriptions supplied
268
  /// as a parameter.
269
  template <typename FirstCallDesc, typename... CallDescs>
270
  bool isCalled(const FirstCallDesc &First, const CallDescs &... Rest) const {
271
    return isCalled(First) || isCalled(Rest...);
272
  }
273
274
  /// Returns a source range for the entire call, suitable for
275
  /// outputting in diagnostics.
276
68
  virtual SourceRange getSourceRange() const {
277
68
    return getOriginExpr()->getSourceRange();
278
68
  }
279
280
  /// Returns the value of a given argument at the time of the call.
281
  virtual SVal getArgSVal(unsigned Index) const;
282
283
  /// Returns the expression associated with a given argument.
284
  /// May be null if this expression does not appear in the source.
285
0
  virtual const Expr *getArgExpr(unsigned Index) const { return nullptr; }
286
287
  /// Returns the source range for errors associated with this argument.
288
  ///
289
  /// May be invalid if the argument is not written in the source.
290
  virtual SourceRange getArgSourceRange(unsigned Index) const;
291
292
  /// Returns the result type, adjusted for references.
293
  QualType getResultType() const;
294
295
  /// Returns the return value of the call.
296
  ///
297
  /// This should only be called if the CallEvent was created using a state in
298
  /// which the return value has already been bound to the origin expression.
299
  SVal getReturnValue() const;
300
301
  /// Returns true if the type of any of the non-null arguments satisfies
302
  /// the condition.
303
  bool hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const;
304
305
  /// Returns true if any of the arguments appear to represent callbacks.
306
  bool hasNonZeroCallbackArg() const;
307
308
  /// Returns true if any of the arguments is void*.
309
  bool hasVoidPointerToNonConstArg() const;
310
311
  /// Returns true if any of the arguments are known to escape to long-
312
  /// term storage, even if this method will not modify them.
313
  // NOTE: The exact semantics of this are still being defined!
314
  // We don't really want a list of hardcoded exceptions in the long run,
315
  // but we don't want duplicated lists of known APIs in the short term either.
316
31.4k
  virtual bool argumentsMayEscape() const {
317
31.4k
    return hasNonZeroCallbackArg();
318
31.4k
  }
319
320
  /// Returns true if the callee is an externally-visible function in the
321
  /// top-level namespace, such as \c malloc.
322
  ///
323
  /// You can use this call to determine that a particular function really is
324
  /// a library function and not, say, a C++ member function with the same name.
325
  ///
326
  /// If a name is provided, the function must additionally match the given
327
  /// name.
328
  ///
329
  /// Note that this deliberately excludes C++ library functions in the \c std
330
  /// namespace, but will include C library functions accessed through the
331
  /// \c std namespace. This also does not check if the function is declared
332
  /// as 'extern "C"', or if it uses C++ name mangling.
333
  // FIXME: Add a helper for checking namespaces.
334
  // FIXME: Move this down to AnyFunctionCall once checkers have more
335
  // precise callbacks.
336
  bool isGlobalCFunction(StringRef SpecificName = StringRef()) const;
337
338
  /// Returns the name of the callee, if its name is a simple identifier.
339
  ///
340
  /// Note that this will fail for Objective-C methods, blocks, and C++
341
  /// overloaded operators. The former is named by a Selector rather than a
342
  /// simple identifier, and the latter two do not have names.
343
  // FIXME: Move this down to AnyFunctionCall once checkers have more
344
  // precise callbacks.
345
1.84M
  const IdentifierInfo *getCalleeIdentifier() const {
346
1.84M
    const auto *ND = dyn_cast_or_null<NamedDecl>(getDecl());
347
1.84M
    if (!ND)
348
343
      return nullptr;
349
1.84M
    return ND->getIdentifier();
350
1.84M
  }
351
352
  /// Returns an appropriate ProgramPoint for this call.
353
  ProgramPoint getProgramPoint(bool IsPreVisit = false,
354
                               const ProgramPointTag *Tag = nullptr) const;
355
356
  /// Returns a new state with all argument regions invalidated.
357
  ///
358
  /// This accepts an alternate state in case some processing has already
359
  /// occurred.
360
  ProgramStateRef invalidateRegions(unsigned BlockCount,
361
                                    ProgramStateRef Orig = nullptr) const;
362
363
  using FrameBindingTy = std::pair<SVal, SVal>;
364
  using BindingsTy = SmallVectorImpl<FrameBindingTy>;
365
366
  /// Populates the given SmallVector with the bindings in the callee's stack
367
  /// frame at the start of this call.
368
  virtual void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
369
                                            BindingsTy &Bindings) const = 0;
370
371
  /// Returns a copy of this CallEvent, but using the given state.
372
  template <typename T>
373
  CallEventRef<T> cloneWithState(ProgramStateRef NewState) const;
374
375
  /// Returns a copy of this CallEvent, but using the given state.
376
950k
  CallEventRef<> cloneWithState(ProgramStateRef NewState) const {
377
950k
    return cloneWithState<CallEvent>(NewState);
378
950k
  }
379
380
  /// Returns true if this is a statement is a function or method call
381
  /// of some kind.
382
  static bool isCallStmt(const Stmt *S);
383
384
  /// Returns the result type of a function or method declaration.
385
  ///
386
  /// This will return a null QualType if the result type cannot be determined.
387
  static QualType getDeclaredResultType(const Decl *D);
388
389
  /// Returns true if the given decl is known to be variadic.
390
  ///
391
  /// \p D must not be null.
392
  static bool isVariadic(const Decl *D);
393
394
  /// Returns AnalysisDeclContext for the callee stack frame.
395
  /// Currently may fail; returns null on failure.
396
  AnalysisDeclContext *getCalleeAnalysisDeclContext() const;
397
398
  /// Returns the callee stack frame. That stack frame will only be entered
399
  /// during analysis if the call is inlined, but it may still be useful
400
  /// in intermediate calculations even if the call isn't inlined.
401
  /// May fail; returns null on failure.
402
  const StackFrameContext *getCalleeStackFrame(unsigned BlockCount) const;
403
404
  /// Returns memory location for a parameter variable within the callee stack
405
  /// frame. The behavior is undefined if the block count is different from the
406
  /// one that is there when call happens. May fail; returns null on failure.
407
  const ParamVarRegion *getParameterLocation(unsigned Index,
408
                                             unsigned BlockCount) const;
409
410
  /// Returns true if on the current path, the argument was constructed by
411
  /// calling a C++ constructor over it. This is an internal detail of the
412
  /// analysis which doesn't necessarily represent the program semantics:
413
  /// if we are supposed to construct an argument directly, we may still
414
  /// not do that because we don't know how (i.e., construction context is
415
  /// unavailable in the CFG or not supported by the analyzer).
416
50.1k
  bool isArgumentConstructedDirectly(unsigned Index) const {
417
    // This assumes that the object was not yet removed from the state.
418
50.1k
    return ExprEngine::getObjectUnderConstruction(
419
50.1k
        getState(), {getOriginExpr(), Index}, getLocationContext()).hasValue();
420
50.1k
  }
421
422
  /// Some calls have parameter numbering mismatched from argument numbering.
423
  /// This function converts an argument index to the corresponding
424
  /// parameter index. Returns None is the argument doesn't correspond
425
  /// to any parameter variable.
426
  virtual Optional<unsigned>
427
21.0k
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const {
428
21.0k
    return ASTArgumentIndex;
429
21.0k
  }
430
431
  /// Some call event sub-classes conveniently adjust mismatching AST indices
432
  /// to match parameter indices. This function converts an argument index
433
  /// as understood by CallEvent to the argument index as understood by the AST.
434
109k
  virtual unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const {
435
109k
    return CallArgumentIndex;
436
109k
  }
437
438
  /// Returns the construction context of the call, if it is a C++ constructor
439
  /// call or a call of a function returning a C++ class instance. Otherwise
440
  /// return nullptr.
441
  const ConstructionContext *getConstructionContext() const;
442
443
  /// If the call returns a C++ record type then the region of its return value
444
  /// can be retrieved from its construction context.
445
  Optional<SVal> getReturnValueUnderConstruction() const;
446
447
  // Iterator access to formal parameters and their types.
448
private:
449
  struct GetTypeFn {
450
72.9k
    QualType operator()(ParmVarDecl *PD) const { return PD->getType(); }
451
  };
452
453
public:
454
  /// Return call's formal parameters.
455
  ///
456
  /// Remember that the number of formal parameters may not match the number
457
  /// of arguments for all calls. However, the first parameter will always
458
  /// correspond with the argument value returned by \c getArgSVal(0).
459
  virtual ArrayRef<ParmVarDecl *> parameters() const = 0;
460
461
  using param_type_iterator =
462
      llvm::mapped_iterator<ArrayRef<ParmVarDecl *>::iterator, GetTypeFn>;
463
464
  /// Returns an iterator over the types of the call's formal parameters.
465
  ///
466
  /// This uses the callee decl found by default name lookup rather than the
467
  /// definition because it represents a public interface, and probably has
468
  /// more annotations.
469
93.8k
  param_type_iterator param_type_begin() const {
470
93.8k
    return llvm::map_iterator(parameters().begin(), GetTypeFn());
471
93.8k
  }
472
  /// \sa param_type_begin()
473
93.8k
  param_type_iterator param_type_end() const {
474
93.8k
    return llvm::map_iterator(parameters().end(), GetTypeFn());
475
93.8k
  }
476
477
  // For debugging purposes only
478
  void dump(raw_ostream &Out) const;
479
  void dump() const;
480
};
481
482
/// Represents a call to any sort of function that might have a
483
/// FunctionDecl.
484
class AnyFunctionCall : public CallEvent {
485
protected:
486
  AnyFunctionCall(const Expr *E, ProgramStateRef St,
487
                  const LocationContext *LCtx)
488
187k
      : CallEvent(E, St, LCtx) {}
489
  AnyFunctionCall(const Decl *D, ProgramStateRef St,
490
                  const LocationContext *LCtx)
491
2.95k
      : CallEvent(D, St, LCtx) {}
492
241k
  AnyFunctionCall(const AnyFunctionCall &Other) = default;
493
494
public:
495
  // This function is overridden by subclasses, but they must return
496
  // a FunctionDecl.
497
42.4k
  const FunctionDecl *getDecl() const override {
498
42.4k
    return cast<FunctionDecl>(CallEvent::getDecl());
499
42.4k
  }
500
501
  RuntimeDefinition getRuntimeDefinition() const override;
502
503
  bool argumentsMayEscape() const override;
504
505
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
506
                                    BindingsTy &Bindings) const override;
507
508
  ArrayRef<ParmVarDecl *> parameters() const override;
509
510
236k
  static bool classof(const CallEvent *CA) {
511
236k
    return CA->getKind() >= CE_BEG_FUNCTION_CALLS &&
512
236k
           CA->getKind() <= CE_END_FUNCTION_CALLS;
513
236k
  }
514
};
515
516
/// Represents a C function or static C++ member function call.
517
///
518
/// Example: \c fun()
519
class SimpleFunctionCall : public AnyFunctionCall {
520
  friend class CallEventManager;
521
522
protected:
523
  SimpleFunctionCall(const CallExpr *CE, ProgramStateRef St,
524
                     const LocationContext *LCtx)
525
115k
      : AnyFunctionCall(CE, St, LCtx) {}
526
128k
  SimpleFunctionCall(const SimpleFunctionCall &Other) = default;
527
528
128k
  void cloneTo(void *Dest) const override {
529
128k
    new (Dest) SimpleFunctionCall(*this);
530
128k
  }
531
532
public:
533
4.45M
  virtual const CallExpr *getOriginExpr() const {
534
4.45M
    return cast<CallExpr>(AnyFunctionCall::getOriginExpr());
535
4.45M
  }
536
537
  const FunctionDecl *getDecl() const override;
538
539
398k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
540
541
321k
  const Expr *getArgExpr(unsigned Index) const override {
542
321k
    return getOriginExpr()->getArg(Index);
543
321k
  }
544
545
2.55M
  Kind getKind() const override { return CE_Function; }
546
46
  virtual StringRef getKindAsString() const override {
547
46
    return "SimpleFunctionCall";
548
46
  }
549
550
3.65k
  static bool classof(const CallEvent *CA) {
551
3.65k
    return CA->getKind() == CE_Function;
552
3.65k
  }
553
};
554
555
/// Represents a call to a block.
556
///
557
/// Example: <tt>^{ statement-body }()</tt>
558
class BlockCall : public CallEvent {
559
  friend class CallEventManager;
560
561
protected:
562
  BlockCall(const CallExpr *CE, ProgramStateRef St,
563
            const LocationContext *LCtx)
564
585
      : CallEvent(CE, St, LCtx) {}
565
231
  BlockCall(const BlockCall &Other) = default;
566
567
231
  void cloneTo(void *Dest) const override { new (Dest) BlockCall(*this); }
568
569
  void getExtraInvalidatedValues(ValueList &Values,
570
         RegionAndSymbolInvalidationTraits *ETraits) const override;
571
572
public:
573
4.70k
  virtual const CallExpr *getOriginExpr() const {
574
4.70k
    return cast<CallExpr>(CallEvent::getOriginExpr());
575
4.70k
  }
576
577
1.20k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
578
579
339
  const Expr *getArgExpr(unsigned Index) const override {
580
339
    return getOriginExpr()->getArg(Index);
581
339
  }
582
583
  /// Returns the region associated with this instance of the block.
584
  ///
585
  /// This may be NULL if the block's origin is unknown.
586
  const BlockDataRegion *getBlockRegion() const;
587
588
2.96k
  const BlockDecl *getDecl() const override {
589
2.96k
    const BlockDataRegion *BR = getBlockRegion();
590
2.96k
    if (!BR)
591
124
      return nullptr;
592
2.83k
    return BR->getDecl();
593
2.83k
  }
594
595
566
  bool isConversionFromLambda() const {
596
566
    const BlockDecl *BD = getDecl();
597
566
    if (!BD)
598
10
      return false;
599
556
600
556
    return BD->isConversionFromLambda();
601
556
  }
602
603
  /// For a block converted from a C++ lambda, returns the block
604
  /// VarRegion for the variable holding the captured C++ lambda record.
605
14
  const VarRegion *getRegionStoringCapturedLambda() const {
606
14
    assert(isConversionFromLambda());
607
14
    const BlockDataRegion *BR = getBlockRegion();
608
14
    assert(BR && "Block converted from lambda must have a block region");
609
14
610
14
    auto I = BR->referenced_vars_begin();
611
14
    assert(I != BR->referenced_vars_end());
612
14
613
14
    return I.getCapturedRegion();
614
14
  }
615
616
198
  RuntimeDefinition getRuntimeDefinition() const override {
617
198
    if (!isConversionFromLambda())
618
191
      return RuntimeDefinition(getDecl());
619
7
620
    // Clang converts lambdas to blocks with an implicit user-defined
621
    // conversion operator method on the lambda record that looks (roughly)
622
    // like:
623
    //
624
    // typedef R(^block_type)(P1, P2, ...);
625
    // operator block_type() const {
626
    //   auto Lambda = *this;
627
    //   return ^(P1 p1, P2 p2, ...){
628
    //     /* return Lambda(p1, p2, ...); */
629
    //   };
630
    // }
631
    //
632
    // Here R is the return type of the lambda and P1, P2, ... are
633
    // its parameter types. 'Lambda' is a fake VarDecl captured by the block
634
    // that is initialized to a copy of the lambda.
635
    //
636
    // Sema leaves the body of a lambda-converted block empty (it is
637
    // produced by CodeGen), so we can't analyze it directly. Instead, we skip
638
    // the block body and analyze the operator() method on the captured lambda.
639
7
    const VarDecl *LambdaVD = getRegionStoringCapturedLambda()->getDecl();
640
7
    const CXXRecordDecl *LambdaDecl = LambdaVD->getType()->getAsCXXRecordDecl();
641
7
    CXXMethodDecl* LambdaCallOperator = LambdaDecl->getLambdaCallOperator();
642
7
643
7
    return RuntimeDefinition(LambdaCallOperator);
644
7
  }
645
646
18
  bool argumentsMayEscape() const override {
647
18
    return true;
648
18
  }
649
650
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
651
                                    BindingsTy &Bindings) const override;
652
653
  ArrayRef<ParmVarDecl *> parameters() const override;
654
655
3.55k
  Kind getKind() const override { return CE_Block; }
656
0
  virtual StringRef getKindAsString() const override { return "BlockCall"; }
657
658
349
  static bool classof(const CallEvent *CA) { return CA->getKind() == CE_Block; }
659
};
660
661
/// Represents a non-static C++ member function call, no matter how
662
/// it is written.
663
class CXXInstanceCall : public AnyFunctionCall {
664
protected:
665
  CXXInstanceCall(const CallExpr *CE, ProgramStateRef St,
666
                  const LocationContext *LCtx)
667
27.4k
      : AnyFunctionCall(CE, St, LCtx) {}
668
  CXXInstanceCall(const FunctionDecl *D, ProgramStateRef St,
669
                  const LocationContext *LCtx)
670
2.95k
      : AnyFunctionCall(D, St, LCtx) {}
671
38.6k
  CXXInstanceCall(const CXXInstanceCall &Other) = default;
672
673
  void getExtraInvalidatedValues(ValueList &Values,
674
         RegionAndSymbolInvalidationTraits *ETraits) const override;
675
676
public:
677
  /// Returns the expression representing the implicit 'this' object.
678
48
  virtual const Expr *getCXXThisExpr() const { return nullptr; }
679
680
  /// Returns the value of the implicit 'this' object.
681
  virtual SVal getCXXThisVal() const;
682
683
  const FunctionDecl *getDecl() const override;
684
685
  RuntimeDefinition getRuntimeDefinition() const override;
686
687
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
688
                                    BindingsTy &Bindings) const override;
689
690
364k
  static bool classof(const CallEvent *CA) {
691
364k
    return CA->getKind() >= CE_BEG_CXX_INSTANCE_CALLS &&
692
188k
           CA->getKind() <= CE_END_CXX_INSTANCE_CALLS;
693
364k
  }
694
};
695
696
/// Represents a non-static C++ member function call.
697
///
698
/// Example: \c obj.fun()
699
class CXXMemberCall : public CXXInstanceCall {
700
  friend class CallEventManager;
701
702
protected:
703
  CXXMemberCall(const CXXMemberCallExpr *CE, ProgramStateRef St,
704
                const LocationContext *LCtx)
705
19.2k
      : CXXInstanceCall(CE, St, LCtx) {}
706
26.5k
  CXXMemberCall(const CXXMemberCall &Other) = default;
707
708
26.5k
  void cloneTo(void *Dest) const override { new (Dest) CXXMemberCall(*this); }
709
710
public:
711
140k
  virtual const CXXMemberCallExpr *getOriginExpr() const {
712
140k
    return cast<CXXMemberCallExpr>(CXXInstanceCall::getOriginExpr());
713
140k
  }
714
715
64.9k
  unsigned getNumArgs() const override {
716
64.9k
    if (const CallExpr *CE = getOriginExpr())
717
64.9k
      return CE->getNumArgs();
718
0
    return 0;
719
0
  }
720
721
22.7k
  const Expr *getArgExpr(unsigned Index) const override {
722
22.7k
    return getOriginExpr()->getArg(Index);
723
22.7k
  }
724
725
  const Expr *getCXXThisExpr() const override;
726
727
  RuntimeDefinition getRuntimeDefinition() const override;
728
729
590k
  Kind getKind() const override { return CE_CXXMember; }
730
0
  virtual StringRef getKindAsString() const override { return "CXXMemberCall"; }
731
732
36.7k
  static bool classof(const CallEvent *CA) {
733
36.7k
    return CA->getKind() == CE_CXXMember;
734
36.7k
  }
735
};
736
737
/// Represents a C++ overloaded operator call where the operator is
738
/// implemented as a non-static member function.
739
///
740
/// Example: <tt>iter + 1</tt>
741
class CXXMemberOperatorCall : public CXXInstanceCall {
742
  friend class CallEventManager;
743
744
protected:
745
  CXXMemberOperatorCall(const CXXOperatorCallExpr *CE, ProgramStateRef St,
746
                        const LocationContext *LCtx)
747
8.22k
      : CXXInstanceCall(CE, St, LCtx) {}
748
9.02k
  CXXMemberOperatorCall(const CXXMemberOperatorCall &Other) = default;
749
750
9.02k
  void cloneTo(void *Dest) const override {
751
9.02k
    new (Dest) CXXMemberOperatorCall(*this);
752
9.02k
  }
753
754
public:
755
60.0k
  virtual const CXXOperatorCallExpr *getOriginExpr() const {
756
60.0k
    return cast<CXXOperatorCallExpr>(CXXInstanceCall::getOriginExpr());
757
60.0k
  }
758
759
22.4k
  unsigned getNumArgs() const override {
760
22.4k
    return getOriginExpr()->getNumArgs() - 1;
761
22.4k
  }
762
763
19.8k
  const Expr *getArgExpr(unsigned Index) const override {
764
19.8k
    return getOriginExpr()->getArg(Index + 1);
765
19.8k
  }
766
767
  const Expr *getCXXThisExpr() const override;
768
769
180k
  Kind getKind() const override { return CE_CXXMemberOperator; }
770
0
  virtual StringRef getKindAsString() const override {
771
0
    return "CXXMemberOperatorCall";
772
0
  }
773
774
4.27k
  static bool classof(const CallEvent *CA) {
775
4.27k
    return CA->getKind() == CE_CXXMemberOperator;
776
4.27k
  }
777
778
  Optional<unsigned>
779
41
  getAdjustedParameterIndex(unsigned ASTArgumentIndex) const override {
780
    // For member operator calls argument 0 on the expression corresponds
781
    // to implicit this-parameter on the declaration.
782
41
    return (ASTArgumentIndex > 0) ? Optional<unsigned>(ASTArgumentIndex - 1)
783
0
                                  : None;
784
41
  }
785
786
4.13k
  unsigned getASTArgumentIndex(unsigned CallArgumentIndex) const override {
787
    // For member operator calls argument 0 on the expression corresponds
788
    // to implicit this-parameter on the declaration.
789
4.13k
    return CallArgumentIndex + 1;
790
4.13k
  }
791
792
146
  OverloadedOperatorKind getOverloadedOperator() const {
793
146
    return getOriginExpr()->getOperator();
794
146
  }
795
};
796
797
/// Represents an implicit call to a C++ destructor.
798
///
799
/// This can occur at the end of a scope (for automatic objects), at the end
800
/// of a full-expression (for temporaries), or as part of a delete.
801
class CXXDestructorCall : public CXXInstanceCall {
802
  friend class CallEventManager;
803
804
protected:
805
  using DtorDataTy = llvm::PointerIntPair<const MemRegion *, 1, bool>;
806
807
  /// Creates an implicit destructor.
808
  ///
809
  /// \param DD The destructor that will be called.
810
  /// \param Trigger The statement whose completion causes this destructor call.
811
  /// \param Target The object region to be destructed.
812
  /// \param St The path-sensitive state at this point in the program.
813
  /// \param LCtx The location context at this point in the program.
814
  CXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
815
                    const MemRegion *Target, bool IsBaseDestructor,
816
                    ProgramStateRef St, const LocationContext *LCtx)
817
2.95k
      : CXXInstanceCall(DD, St, LCtx) {
818
2.95k
    Data = DtorDataTy(Target, IsBaseDestructor).getOpaqueValue();
819
2.95k
    Location = Trigger->getEndLoc();
820
2.95k
  }
821
822
3.10k
  CXXDestructorCall(const CXXDestructorCall &Other) = default;
823
824
3.10k
  void cloneTo(void *Dest) const override {new (Dest) CXXDestructorCall(*this);}
825
826
public:
827
14.3k
  SourceRange getSourceRange() const override { return Location; }
828
8.90k
  unsigned getNumArgs() const override { return 0; }
829
830
  RuntimeDefinition getRuntimeDefinition() const override;
831
832
  /// Returns the value of the implicit 'this' object.
833
  SVal getCXXThisVal() const override;
834
835
  /// Returns true if this is a call to a base class destructor.
836
2.93k
  bool isBaseDestructor() const {
837
2.93k
    return DtorDataTy::getFromOpaqueValue(Data).getInt();
838
2.93k
  }
839
840
43.2k
  Kind getKind() const override { return CE_CXXDestructor; }
841
0
  virtual StringRef getKindAsString() const override {
842
0
    return "CXXDestructorCall";
843
0
  }
844
845
124k
  static bool classof(const CallEvent *CA) {
846
124k
    return CA->getKind() == CE_CXXDestructor;
847
124k
  }
848
};
849
850
/// Represents any constructor invocation. This includes regular constructors
851
/// and inherited constructors.
852
class AnyCXXConstructorCall : public AnyFunctionCall {
853
protected:
854
  AnyCXXConstructorCall(const Expr *E, const MemRegion *Target,
855
                        ProgramStateRef St, const LocationContext *LCtx)
856
41.0k
      : AnyFunctionCall(E, St, LCtx) {
857
41.0k
    assert(E && (isa<CXXConstructExpr>(E) || isa<CXXInheritedCtorInitExpr>(E)));
858
    // Target may be null when the region is unknown.
859
41.0k
    Data = Target;
860
41.0k
  }
861
862
  void getExtraInvalidatedValues(ValueList &Values,
863
         RegionAndSymbolInvalidationTraits *ETraits) const override;
864
865
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
866
                                    BindingsTy &Bindings) const override;
867
868
public:
869
  /// Returns the value of the implicit 'this' object.
870
  SVal getCXXThisVal() const;
871
872
0
  static bool classof(const CallEvent *Call) {
873
0
    return Call->getKind() >= CE_BEG_CXX_CONSTRUCTOR_CALLS &&
874
0
           Call->getKind() <= CE_END_CXX_CONSTRUCTOR_CALLS;
875
0
  }
876
};
877
878
/// Represents a call to a C++ constructor.
879
///
880
/// Example: \c T(1)
881
class CXXConstructorCall : public AnyCXXConstructorCall {
882
  friend class CallEventManager;
883
884
protected:
885
  /// Creates a constructor call.
886
  ///
887
  /// \param CE The constructor expression as written in the source.
888
  /// \param Target The region where the object should be constructed. If NULL,
889
  ///               a new symbolic region will be used.
890
  /// \param St The path-sensitive state at this point in the program.
891
  /// \param LCtx The location context at this point in the program.
892
  CXXConstructorCall(const CXXConstructExpr *CE, const MemRegion *Target,
893
                     ProgramStateRef St, const LocationContext *LCtx)
894
41.0k
      : AnyCXXConstructorCall(CE, Target, St, LCtx) {}
895
896
70.0k
  CXXConstructorCall(const CXXConstructorCall &Other) = default;
897
898
70.0k
  void cloneTo(void *Dest) const override { new (Dest) CXXConstructorCall(*this); }
899
900
public:
901
933k
  virtual const CXXConstructExpr *getOriginExpr() const {
902
933k
    return cast<CXXConstructExpr>(AnyFunctionCall::getOriginExpr());
903
933k
  }
904
905
596k
  const CXXConstructorDecl *getDecl() const override {
906
596k
    return getOriginExpr()->getConstructor();
907
596k
  }
908
909
142k
  unsigned getNumArgs() const override { return getOriginExpr()->getNumArgs(); }
910
911
138k
  const Expr *getArgExpr(unsigned Index) const override {
912
138k
    return getOriginExpr()->getArg(Index);
913
138k
  }
914
915
939k
  Kind getKind() const override { return CE_CXXConstructor; }
916
13
  virtual StringRef getKindAsString() const override {
917
13
    return "CXXConstructorCall";
918
13
  }
919
920
393k
  static bool classof(const CallEvent *CA) {
921
393k
    return CA->getKind() == CE_CXXConstructor;
922
393k
  }
923
};
924
925
/// Represents a call to a C++ inherited constructor.
926
///
927
/// Example: \c class T : public S { using S::S; }; T(1);
928
///
929
// Note, it is difficult to model the parameters. This is one of the reasons
930
// why we skip analysis of inheriting constructors as top-level functions.
931
// CXXInheritedCtorInitExpr doesn't take arguments and doesn't model parameter
932
// initialization because there is none: the arguments in the outer
933
// CXXConstructExpr directly initialize the parameters of the base class
934
// constructor, and no copies are made. (Making a copy of the parameter is
935
// incorrect, at least if it's done in an observable way.) The derived class
936
// constructor doesn't even exist in the formal model.
937
/// E.g., in:
938
///
939
/// struct X { X *p = this; ~X() {} };
940
/// struct A { A(X x) : b(x.p == &x) {} bool b; };
941
/// struct B : A { using A::A; };
942
/// B b = X{};
943
///
944
/// ... b.b is initialized to true.
945
class CXXInheritedConstructorCall : public AnyCXXConstructorCall {
946
  friend class CallEventManager;
947
948
protected:
949
  CXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *CE,
950
                              const MemRegion *Target, ProgramStateRef St,
951
                              const LocationContext *LCtx)
952
13
      : AnyCXXConstructorCall(CE, Target, St, LCtx) {}
953
954
  CXXInheritedConstructorCall(const CXXInheritedConstructorCall &Other) =
955
9
      default;
956
957
9
  void cloneTo(void *Dest) const override {
958
9
    new (Dest) CXXInheritedConstructorCall(*this);
959
9
  }
960
961
public:
962
73
  virtual const CXXInheritedCtorInitExpr *getOriginExpr() const {
963
73
    return cast<CXXInheritedCtorInitExpr>(AnyFunctionCall::getOriginExpr());
964
73
  }
965
966
73
  const CXXConstructorDecl *getDecl() const override {
967
73
    return getOriginExpr()->getConstructor();
968
73
  }
969
970
  /// Obtain the stack frame of the inheriting constructor. Argument expressions
971
  /// can be found on the call site of that stack frame.
972
  const StackFrameContext *getInheritingStackFrame() const;
973
974
  /// Obtain the CXXConstructExpr for the sub-class that inherited the current
975
  /// constructor (possibly indirectly). It's the statement that contains
976
  /// argument expressions.
977
66
  const CXXConstructExpr *getInheritingConstructor() const {
978
66
    return cast<CXXConstructExpr>(getInheritingStackFrame()->getCallSite());
979
66
  }
980
981
36
  unsigned getNumArgs() const override {
982
36
    return getInheritingConstructor()->getNumArgs();
983
36
  }
984
985
30
  const Expr *getArgExpr(unsigned Index) const override {
986
30
    return getInheritingConstructor()->getArg(Index);
987
30
  }
988
989
18
  virtual SVal getArgSVal(unsigned Index) const override {
990
18
    return getState()->getSVal(
991
18
        getArgExpr(Index),
992
18
        getInheritingStackFrame()->getParent()->getStackFrame());
993
18
  }
994
995
93
  Kind getKind() const override { return CE_CXXInheritedConstructor; }
996
0
  virtual StringRef getKindAsString() const override {
997
0
    return "CXXInheritedConstructorCall";
998
0
  }
999
1000
0
  static bool classof(const CallEvent *CA) {
1001
0
    return CA->getKind() == CE_CXXInheritedConstructor;
1002
0
  }
1003
};
1004
1005
/// Represents the memory allocation call in a C++ new-expression.
1006
///
1007
/// This is a call to "operator new".
1008
class CXXAllocatorCall : public AnyFunctionCall {
1009
  friend class CallEventManager;
1010
1011
protected:
1012
  CXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef St,
1013
                   const LocationContext *LCtx)
1014
2.83k
      : AnyFunctionCall(E, St, LCtx) {}
1015
2.80k
  CXXAllocatorCall(const CXXAllocatorCall &Other) = default;
1016
1017
2.80k
  void cloneTo(void *Dest) const override { new (Dest) CXXAllocatorCall(*this); }
1018
1019
public:
1020
64.9k
  virtual const CXXNewExpr *getOriginExpr() const {
1021
64.9k
    return cast<CXXNewExpr>(AnyFunctionCall::getOriginExpr());
1022
64.9k
  }
1023
1024
37.1k
  const FunctionDecl *getDecl() const override {
1025
37.1k
    return getOriginExpr()->getOperatorNew();
1026
37.1k
  }
1027
1028
429
  SVal getObjectUnderConstruction() const {
1029
429
    return ExprEngine::getObjectUnderConstruction(getState(), getOriginExpr(),
1030
429
                                                  getLocationContext())
1031
429
        .getValue();
1032
429
  }
1033
1034
  /// Number of non-placement arguments to the call. It is equal to 2 for
1035
  /// C++17 aligned operator new() calls that have alignment implicitly
1036
  /// passed as the second argument, and to 1 for other operator new() calls.
1037
16.9k
  unsigned getNumImplicitArgs() const {
1038
16.9k
    return getOriginExpr()->passAlignment() ? 
219
: 1;
1039
16.9k
  }
1040
1041
7.03k
  unsigned getNumArgs() const override {
1042
7.03k
    return getOriginExpr()->getNumPlacementArgs() + getNumImplicitArgs();
1043
7.03k
  }
1044
1045
7.97k
  const Expr *getArgExpr(unsigned Index) const override {
1046
    // The first argument of an allocator call is the size of the allocation.
1047
7.97k
    if (Index < getNumImplicitArgs())
1048
6.06k
      return nullptr;
1049
1.91k
    return getOriginExpr()->getPlacementArg(Index - getNumImplicitArgs());
1050
1.91k
  }
1051
1052
  /// Number of placement arguments to the operator new() call. For example,
1053
  /// standard std::nothrow operator new and standard placement new both have
1054
  /// 1 implicit argument (size) and 1 placement argument, while regular
1055
  /// operator new() has 1 implicit argument and 0 placement arguments.
1056
0
  const Expr *getPlacementArgExpr(unsigned Index) const {
1057
0
    return getOriginExpr()->getPlacementArg(Index);
1058
0
  }
1059
1060
42.2k
  Kind getKind() const override { return CE_CXXAllocator; }
1061
16
  virtual StringRef getKindAsString() const override {
1062
16
    return "CXXAllocatorCall";
1063
16
  }
1064
1065
920
  static bool classof(const CallEvent *CE) {
1066
920
    return CE->getKind() == CE_CXXAllocator;
1067
920
  }
1068
};
1069
1070
/// Represents the memory deallocation call in a C++ delete-expression.
1071
///
1072
/// This is a call to "operator delete".
1073
// FIXME: CXXDeleteExpr isn't present for custom delete operators, or even for
1074
// some those that are in the standard library, like the no-throw or align_val
1075
// versions.
1076
// Some pointers:
1077
// http://lists.llvm.org/pipermail/cfe-dev/2020-April/065080.html
1078
// clang/test/Analysis/cxx-dynamic-memory-analysis-order.cpp
1079
// clang/unittests/StaticAnalyzer/CallEventTest.cpp
1080
class CXXDeallocatorCall : public AnyFunctionCall {
1081
  friend class CallEventManager;
1082
1083
protected:
1084
  CXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef St,
1085
                     const LocationContext *LCtx)
1086
436
      : AnyFunctionCall(E, St, LCtx) {}
1087
805
  CXXDeallocatorCall(const CXXDeallocatorCall &Other) = default;
1088
1089
805
  void cloneTo(void *Dest) const override {
1090
805
    new (Dest) CXXDeallocatorCall(*this);
1091
805
  }
1092
1093
public:
1094
16.2k
  virtual const CXXDeleteExpr *getOriginExpr() const {
1095
16.2k
    return cast<CXXDeleteExpr>(AnyFunctionCall::getOriginExpr());
1096
16.2k
  }
1097
1098
14.3k
  const FunctionDecl *getDecl() const override {
1099
14.3k
    return getOriginExpr()->getOperatorDelete();
1100
14.3k
  }
1101
1102
1.51k
  unsigned getNumArgs() const override { return getDecl()->getNumParams(); }
1103
1104
1.14k
  const Expr *getArgExpr(unsigned Index) const override {
1105
    // CXXDeleteExpr's only have a single argument.
1106
1.14k
    return getOriginExpr()->getArgument();
1107
1.14k
  }
1108
1109
14.5k
  Kind getKind() const override { return CE_CXXDeallocator; }
1110
4
  virtual StringRef getKindAsString() const override {
1111
4
    return "CXXDeallocatorCall";
1112
4
  }
1113
1114
136k
  static bool classof(const CallEvent *CE) {
1115
136k
    return CE->getKind() == CE_CXXDeallocator;
1116
136k
  }
1117
};
1118
1119
/// Represents the ways an Objective-C message send can occur.
1120
//
1121
// Note to maintainers: OCM_Message should always be last, since it does not
1122
// need to fit in the Data field's low bits.
1123
enum ObjCMessageKind {
1124
  OCM_PropertyAccess,
1125
  OCM_Subscript,
1126
  OCM_Message
1127
};
1128
1129
/// Represents any expression that calls an Objective-C method.
1130
///
1131
/// This includes all of the kinds listed in ObjCMessageKind.
1132
class ObjCMethodCall : public CallEvent {
1133
  friend class CallEventManager;
1134
1135
  const PseudoObjectExpr *getContainingPseudoObjectExpr() const;
1136
1137
protected:
1138
  ObjCMethodCall(const ObjCMessageExpr *Msg, ProgramStateRef St,
1139
                 const LocationContext *LCtx)
1140
6.18k
      : CallEvent(Msg, St, LCtx) {
1141
6.18k
    Data = nullptr;
1142
6.18k
  }
1143
1144
31.1k
  ObjCMethodCall(const ObjCMethodCall &Other) = default;
1145
1146
31.1k
  void cloneTo(void *Dest) const override { new (Dest) ObjCMethodCall(*this); }
1147
1148
  void getExtraInvalidatedValues(ValueList &Values,
1149
         RegionAndSymbolInvalidationTraits *ETraits) const override;
1150
1151
  /// Check if the selector may have multiple definitions (may have overrides).
1152
  virtual bool canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
1153
                                        Selector Sel) const;
1154
1155
public:
1156
220k
  virtual const ObjCMessageExpr *getOriginExpr() const {
1157
220k
    return cast<ObjCMessageExpr>(CallEvent::getOriginExpr());
1158
220k
  }
1159
1160
81.6k
  const ObjCMethodDecl *getDecl() const override {
1161
81.6k
    return getOriginExpr()->getMethodDecl();
1162
81.6k
  }
1163
1164
33.0k
  unsigned getNumArgs() const override {
1165
33.0k
    return getOriginExpr()->getNumArgs();
1166
33.0k
  }
1167
1168
7.44k
  const Expr *getArgExpr(unsigned Index) const override {
1169
7.44k
    return getOriginExpr()->getArg(Index);
1170
7.44k
  }
1171
1172
44.3k
  bool isInstanceMessage() const {
1173
44.3k
    return getOriginExpr()->isInstanceMessage();
1174
44.3k
  }
1175
1176
7.47k
  ObjCMethodFamily getMethodFamily() const {
1177
7.47k
    return getOriginExpr()->getMethodFamily();
1178
7.47k
  }
1179
1180
2.13k
  Selector getSelector() const {
1181
2.13k
    return getOriginExpr()->getSelector();
1182
2.13k
  }
1183
1184
  SourceRange getSourceRange() const override;
1185
1186
  /// Returns the value of the receiver at the time of this call.
1187
  SVal getReceiverSVal() const;
1188
1189
  /// Get the interface for the receiver.
1190
  ///
1191
  /// This works whether this is an instance message or a class message.
1192
  /// However, it currently just uses the static type of the receiver.
1193
3.86k
  const ObjCInterfaceDecl *getReceiverInterface() const {
1194
3.86k
    return getOriginExpr()->getReceiverInterface();
1195
3.86k
  }
1196
1197
  /// Checks if the receiver refers to 'self' or 'super'.
1198
  bool isReceiverSelfOrSuper() const;
1199
1200
  /// Returns how the message was written in the source (property access,
1201
  /// subscript, or explicit message send).
1202
  ObjCMessageKind getMessageKind() const;
1203
1204
  /// Returns true if this property access or subscript is a setter (has the
1205
  /// form of an assignment).
1206
7
  bool isSetter() const {
1207
7
    switch (getMessageKind()) {
1208
0
    case OCM_Message:
1209
0
      llvm_unreachable("This is not a pseudo-object access!");
1210
1
    case OCM_PropertyAccess:
1211
1
      return getNumArgs() > 0;
1212
6
    case OCM_Subscript:
1213
6
      return getNumArgs() > 1;
1214
0
    }
1215
0
    llvm_unreachable("Unknown message kind");
1216
0
  }
1217
1218
  // Returns the property accessed by this method, either explicitly via
1219
  // property syntax or implicitly via a getter or setter method. Returns
1220
  // nullptr if the call is not a prooperty access.
1221
  const ObjCPropertyDecl *getAccessedProperty() const;
1222
1223
  RuntimeDefinition getRuntimeDefinition() const override;
1224
1225
  bool argumentsMayEscape() const override;
1226
1227
  void getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
1228
                                    BindingsTy &Bindings) const override;
1229
1230
  ArrayRef<ParmVarDecl*> parameters() const override;
1231
1232
156k
  Kind getKind() const override { return CE_ObjCMessage; }
1233
0
  virtual StringRef getKindAsString() const override {
1234
0
    return "ObjCMethodCall";
1235
0
  }
1236
1237
336k
  static bool classof(const CallEvent *CA) {
1238
336k
    return CA->getKind() == CE_ObjCMessage;
1239
336k
  }
1240
};
1241
1242
enum CallDescriptionFlags : int {
1243
  /// Describes a C standard function that is sometimes implemented as a macro
1244
  /// that expands to a compiler builtin with some __builtin prefix.
1245
  /// The builtin may as well have a few extra arguments on top of the requested
1246
  /// number of arguments.
1247
  CDF_MaybeBuiltin = 1 << 0,
1248
};
1249
1250
/// This class represents a description of a function call using the number of
1251
/// arguments and the name of the function.
1252
class CallDescription {
1253
  friend CallEvent;
1254
1255
  mutable IdentifierInfo *II = nullptr;
1256
  mutable bool IsLookupDone = false;
1257
  // The list of the qualified names used to identify the specified CallEvent,
1258
  // e.g. "{a, b}" represent the qualified names, like "a::b".
1259
  std::vector<const char *> QualifiedName;
1260
  Optional<unsigned> RequiredArgs;
1261
  Optional<size_t> RequiredParams;
1262
  int Flags;
1263
1264
  // A constructor helper.
1265
  static Optional<size_t> readRequiredParams(Optional<unsigned> RequiredArgs,
1266
840k
                                             Optional<size_t> RequiredParams) {
1267
840k
    if (RequiredParams)
1268
51.3k
      return RequiredParams;
1269
788k
    if (RequiredArgs)
1270
787k
      return static_cast<size_t>(*RequiredArgs);
1271
1.59k
    return None;
1272
1.59k
  }
1273
1274
public:
1275
  /// Constructs a CallDescription object.
1276
  ///
1277
  /// @param QualifiedName The list of the name qualifiers of the function that
1278
  /// will be matched. The user is allowed to skip any of the qualifiers.
1279
  /// For example, {"std", "basic_string", "c_str"} would match both
1280
  /// std::basic_string<...>::c_str() and std::__1::basic_string<...>::c_str().
1281
  ///
1282
  /// @param RequiredArgs The number of arguments that is expected to match a
1283
  /// call. Omit this parameter to match every occurrence of call with a given
1284
  /// name regardless the number of arguments.
1285
  CallDescription(int Flags, ArrayRef<const char *> QualifiedName,
1286
                  Optional<unsigned> RequiredArgs = None,
1287
                  Optional<size_t> RequiredParams = None)
1288
      : QualifiedName(QualifiedName), RequiredArgs(RequiredArgs),
1289
        RequiredParams(readRequiredParams(RequiredArgs, RequiredParams)),
1290
840k
        Flags(Flags) {}
1291
1292
  /// Construct a CallDescription with default flags.
1293
  CallDescription(ArrayRef<const char *> QualifiedName,
1294
                  Optional<unsigned> RequiredArgs = None,
1295
                  Optional<size_t> RequiredParams = None)
1296
833k
      : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {}
clang::ento::CallDescription::CallDescription(llvm::ArrayRef<char const*>, llvm::Optional<unsigned int>, llvm::Optional<unsigned long>)
Line
Count
Source
1296
833k
      : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {}
Unexecuted instantiation: clang::ento::CallDescription::CallDescription(llvm::ArrayRef<char const*>, llvm::Optional<unsigned int>, llvm::Optional<unsigned long>)
1297
1298
  /// Get the name of the function that this object matches.
1299
523k
  StringRef getFunctionName() const { return QualifiedName.back(); }
1300
};
1301
1302
/// An immutable map from CallDescriptions to arbitrary data. Provides a unified
1303
/// way for checkers to react on function calls.
1304
template <typename T> class CallDescriptionMap {
1305
  // Some call descriptions aren't easily hashable (eg., the ones with qualified
1306
  // names in which some sections are omitted), so let's put them
1307
  // in a simple vector and use linear lookup.
1308
  // TODO: Implement an actual map for fast lookup for "hashable" call
1309
  // descriptions (eg., the ones for C functions that just match the name).
1310
  std::vector<std::pair<CallDescription, T>> LinearMap;
1311
1312
public:
1313
  CallDescriptionMap(
1314
      std::initializer_list<std::pair<CallDescription, T>> &&List)
1315
1.35k
      : LinearMap(List) {}
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const> >&&)
Line
Count
Source
1315
233
      : LinearMap(List) {}
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> > >&&)
Line
Count
Source
1315
30
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::Expr const*) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::Expr const*) const> >&&)
Line
Count
Source
1315
21
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const> >&&)
Line
Count
Source
1315
21
      : LinearMap(List) {}
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const> >&&)
Line
Count
Source
1315
21
      : LinearMap(List) {}
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const> >&&)
Line
Count
Source
1315
13
      : LinearMap(List) {}
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const> >&&)
Line
Count
Source
1315
11
      : LinearMap(List) {}
IteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorModeling::*)(clang::ento::CheckerContext&, clang::Expr const*, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::IteratorModeling::*)(clang::ento::CheckerContext&, clang::Expr const*, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const> >&&)
Line
Count
Source
1315
19
      : LinearMap(List) {}
IteratorRangeChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorRangeChecker::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::IteratorRangeChecker::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const> >&&)
Line
Count
Source
1315
2
      : LinearMap(List) {}
MallocChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::MallocChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, std::__1::function<void ((anonymous namespace)::MallocChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> > >&&)
Line
Count
Source
1315
636
      : LinearMap(List) {}
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const> >&&)
Line
Count
Source
1315
219
      : LinearMap(List) {}
clang::ento::CallDescriptionMap<bool>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, bool> >&&)
Line
Count
Source
1315
34
      : LinearMap(List) {}
SmartPtrModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::SmartPtrModeling::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, void ((anonymous namespace)::SmartPtrModeling::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&) const> >&&)
Line
Count
Source
1315
69
      : LinearMap(List) {}
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const> >&&)
Line
Count
Source
1315
2
      : LinearMap(List) {}
StreamChecker.cpp:clang::ento::CallDescriptionMap<(anonymous namespace)::FnDescription>::CallDescriptionMap(std::initializer_list<std::__1::pair<clang::ento::CallDescription, (anonymous namespace)::FnDescription> >&&)
Line
Count
Source
1315
22
      : LinearMap(List) {}
1316
1317
1.35k
  ~CallDescriptionMap() = default;
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::~CallDescriptionMap()
Line
Count
Source
1317
233
  ~CallDescriptionMap() = default;
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::~CallDescriptionMap()
Line
Count
Source
1317
30
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::~CallDescriptionMap()
Line
Count
Source
1317
21
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::~CallDescriptionMap()
Line
Count
Source
1317
21
  ~CallDescriptionMap() = default;
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::Expr const*) const>::~CallDescriptionMap()
Line
Count
Source
1317
21
  ~CallDescriptionMap() = default;
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::~CallDescriptionMap()
Line
Count
Source
1317
13
  ~CallDescriptionMap() = default;
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::~CallDescriptionMap()
Line
Count
Source
1317
11
  ~CallDescriptionMap() = default;
IteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorModeling::*)(clang::ento::CheckerContext&, clang::Expr const*, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::~CallDescriptionMap()
Line
Count
Source
1317
19
  ~CallDescriptionMap() = default;
IteratorRangeChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorRangeChecker::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::~CallDescriptionMap()
Line
Count
Source
1317
2
  ~CallDescriptionMap() = default;
MallocChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::MallocChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::~CallDescriptionMap()
Line
Count
Source
1317
636
  ~CallDescriptionMap() = default;
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::~CallDescriptionMap()
Line
Count
Source
1317
219
  ~CallDescriptionMap() = default;
clang::ento::CallDescriptionMap<bool>::~CallDescriptionMap()
Line
Count
Source
1317
34
  ~CallDescriptionMap() = default;
SmartPtrModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::SmartPtrModeling::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&) const>::~CallDescriptionMap()
Line
Count
Source
1317
69
  ~CallDescriptionMap() = default;
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::~CallDescriptionMap()
Line
Count
Source
1317
2
  ~CallDescriptionMap() = default;
StreamChecker.cpp:clang::ento::CallDescriptionMap<(anonymous namespace)::FnDescription>::~CallDescriptionMap()
Line
Count
Source
1317
22
  ~CallDescriptionMap() = default;
1318
1319
  // These maps are usually stored once per checker, so let's make sure
1320
  // we don't do redundant copies.
1321
  CallDescriptionMap(const CallDescriptionMap &) = delete;
1322
  CallDescriptionMap &operator=(const CallDescription &) = delete;
1323
1324
182k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
182k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
1.72M
      if (Call.isCalled(I.first))
1329
10.2k
        return &I.second;
1330
182k
1331
172k
    return nullptr;
1332
182k
  }
CStringChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::CStringChecker::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
19.0k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
19.0k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
431k
      if (Call.isCalled(I.first))
1329
2.06k
        return &I.second;
1330
19.0k
1331
16.9k
    return nullptr;
1332
19.0k
  }
CastValueChecker.cpp:clang::ento::CallDescriptionMap<std::__1::pair<std::__1::function<void ((anonymous namespace)::CastValueChecker const*, clang::ento::CallEvent const&, clang::ento::DefinedOrUnknownSVal, clang::ento::CheckerContext&)>, (anonymous namespace)::CastValueChecker::CallKind> >::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
245
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
245
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
1.77k
      if (Call.isCalled(I.first))
1329
55
        return &I.second;
1330
245
1331
190
    return nullptr;
1332
245
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::Expr const*) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
3.29k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
3.29k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
25.6k
      if (Call.isCalled(I.first))
1329
187
        return &I.second;
1330
3.29k
1331
3.11k
    return nullptr;
1332
3.29k
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
3.11k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
3.11k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
11.8k
      if (Call.isCalled(I.first))
1329
326
        return &I.second;
1330
3.11k
1331
2.78k
    return nullptr;
1332
3.11k
  }
ContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::ContainerModeling::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
2.78k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
2.78k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
5.56k
      if (Call.isCalled(I.first))
1329
8
        return &I.second;
1330
2.78k
1331
2.77k
    return nullptr;
1332
2.78k
  }
DebugContainerModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugContainerModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
10.6k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
10.6k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
20.7k
      if (Call.isCalled(I.first))
1329
1.08k
        return &I.second;
1330
10.6k
1331
9.54k
    return nullptr;
1332
10.6k
  }
DebugIteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::DebugIteratorModeling::*)(clang::CallExpr const*, clang::ento::CheckerContext&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
10.6k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
10.6k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
28.8k
      if (Call.isCalled(I.first))
1329
2.68k
        return &I.second;
1330
10.6k
1331
7.91k
    return nullptr;
1332
10.6k
  }
IteratorModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorModeling::*)(clang::ento::CheckerContext&, clang::Expr const*, clang::ento::SVal, clang::ento::SVal, clang::ento::SVal) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
16.0k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
16.0k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
47.8k
      if (Call.isCalled(I.first))
1329
248
        return &I.second;
1330
16.0k
1331
15.8k
    return nullptr;
1332
16.0k
  }
IteratorRangeChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::IteratorRangeChecker::*)(clang::ento::CheckerContext&, clang::ento::SVal, clang::ento::SVal) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
1.37k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
1.37k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
3.82k
      if (Call.isCalled(I.first))
1329
228
        return &I.second;
1330
1.37k
1331
1.14k
    return nullptr;
1332
1.37k
  }
MallocChecker.cpp:clang::ento::CallDescriptionMap<std::__1::function<void ((anonymous namespace)::MallocChecker const*, clang::ento::CallEvent const&, clang::ento::CheckerContext&)> >::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
107k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
107k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
1.03M
      if (Call.isCalled(I.first))
1329
2.20k
        return &I.second;
1330
107k
1331
105k
    return nullptr;
1332
107k
  }
PthreadLockChecker.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::PthreadLockChecker::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&, (anonymous namespace)::PthreadLockChecker::CheckerKind) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
5.57k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
5.57k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
69.6k
      if (Call.isCalled(I.first))
1329
507
        return &I.second;
1330
5.57k
1331
5.07k
    return nullptr;
1332
5.57k
  }
clang::ento::CallDescriptionMap<bool>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
182
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
182
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
2.76k
      if (Call.isCalled(I.first))
1329
12
        return &I.second;
1330
182
1331
170
    return nullptr;
1332
182
  }
SmartPtrModeling.cpp:clang::ento::CallDescriptionMap<void ((anonymous namespace)::SmartPtrModeling::*)(clang::ento::CallEvent const&, clang::ento::CheckerContext&) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
77
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
77
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
241
      if (Call.isCalled(I.first))
1329
49
        return &I.second;
1330
77
1331
28
    return nullptr;
1332
77
  }
STLAlgorithmModeling.cpp:clang::ento::CallDescriptionMap<bool ((anonymous namespace)::STLAlgorithmModeling::*)(clang::ento::CheckerContext&, clang::CallExpr const*) const>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
1.23k
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
1.23k
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
27.9k
      if (Call.isCalled(I.first))
1329
54
        return &I.second;
1330
1.23k
1331
1.18k
    return nullptr;
1332
1.23k
  }
StreamChecker.cpp:clang::ento::CallDescriptionMap<(anonymous namespace)::FnDescription>::lookup(clang::ento::CallEvent const&) const
Line
Count
Source
1324
716
  const T *lookup(const CallEvent &Call) const {
1325
    // Slow path: linear lookup.
1326
    // TODO: Implement some sort of fast path.
1327
716
    for (const std::pair<CallDescription, T> &I : LinearMap)
1328
5.91k
      if (Call.isCalled(I.first))
1329
497
        return &I.second;
1330
716
1331
219
    return nullptr;
1332
716
  }
1333
};
1334
1335
/// Manages the lifetime of CallEvent objects.
1336
///
1337
/// CallEventManager provides a way to create arbitrary CallEvents "on the
1338
/// stack" as if they were value objects by keeping a cache of CallEvent-sized
1339
/// memory blocks. The CallEvents created by CallEventManager are only valid
1340
/// for the lifetime of the OwnedCallEvent that holds them; right now these
1341
/// objects cannot be copied and ownership cannot be transferred.
1342
class CallEventManager {
1343
  friend class CallEvent;
1344
1345
  llvm::BumpPtrAllocator &Alloc;
1346
  SmallVector<void *, 8> Cache;
1347
1348
  using CallEventTemplateTy = SimpleFunctionCall;
1349
1350
469k
  void reclaim(const void *Memory) {
1351
469k
    Cache.push_back(const_cast<void *>(Memory));
1352
469k
  }
1353
1354
  /// Returns memory that can be initialized as a CallEvent.
1355
469k
  void *allocate() {
1356
469k
    if (Cache.empty())
1357
21.6k
      return Alloc.Allocate<CallEventTemplateTy>();
1358
448k
    else
1359
448k
      return Cache.pop_back_val();
1360
469k
  }
1361
1362
  template <typename T, typename Arg>
1363
153k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
153k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
153k
                  "CallEvent subclasses are not all the same size");
1366
153k
    return new (allocate()) T(A, St, LCtx);
1367
153k
  }
clang::ento::CXXMemberCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberCall, clang::CXXMemberCallExpr const*>(clang::CXXMemberCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
19.2k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
19.2k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
19.2k
                  "CallEvent subclasses are not all the same size");
1366
19.2k
    return new (allocate()) T(A, St, LCtx);
1367
19.2k
  }
clang::ento::CXXMemberOperatorCall* clang::ento::CallEventManager::create<clang::ento::CXXMemberOperatorCall, clang::CXXOperatorCallExpr const*>(clang::CXXOperatorCallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
8.22k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
8.22k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
8.22k
                  "CallEvent subclasses are not all the same size");
1366
8.22k
    return new (allocate()) T(A, St, LCtx);
1367
8.22k
  }
clang::ento::BlockCall* clang::ento::CallEventManager::create<clang::ento::BlockCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
585
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
585
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
585
                  "CallEvent subclasses are not all the same size");
1366
585
    return new (allocate()) T(A, St, LCtx);
1367
585
  }
clang::ento::SimpleFunctionCall* clang::ento::CallEventManager::create<clang::ento::SimpleFunctionCall, clang::CallExpr const*>(clang::CallExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
115k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
115k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
115k
                  "CallEvent subclasses are not all the same size");
1366
115k
    return new (allocate()) T(A, St, LCtx);
1367
115k
  }
clang::ento::ObjCMethodCall* clang::ento::CallEventManager::create<clang::ento::ObjCMethodCall, clang::ObjCMessageExpr const*>(clang::ObjCMessageExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
6.18k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
6.18k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
6.18k
                  "CallEvent subclasses are not all the same size");
1366
6.18k
    return new (allocate()) T(A, St, LCtx);
1367
6.18k
  }
clang::ento::CXXAllocatorCall* clang::ento::CallEventManager::create<clang::ento::CXXAllocatorCall, clang::CXXNewExpr const*>(clang::CXXNewExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
2.83k
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
2.83k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
2.83k
                  "CallEvent subclasses are not all the same size");
1366
2.83k
    return new (allocate()) T(A, St, LCtx);
1367
2.83k
  }
clang::ento::CXXDeallocatorCall* clang::ento::CallEventManager::create<clang::ento::CXXDeallocatorCall, clang::CXXDeleteExpr const*>(clang::CXXDeleteExpr const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1363
436
  T *create(Arg A, ProgramStateRef St, const LocationContext *LCtx) {
1364
436
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1365
436
                  "CallEvent subclasses are not all the same size");
1366
436
    return new (allocate()) T(A, St, LCtx);
1367
436
  }
1368
1369
  template <typename T, typename Arg1, typename Arg2>
1370
41.0k
  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1371
41.0k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1372
41.0k
                  "CallEvent subclasses are not all the same size");
1373
41.0k
    return new (allocate()) T(A1, A2, St, LCtx);
1374
41.0k
  }
clang::ento::CXXConstructorCall* clang::ento::CallEventManager::create<clang::ento::CXXConstructorCall, clang::CXXConstructExpr const*, clang::ento::MemRegion const*>(clang::CXXConstructExpr const*, clang::ento::MemRegion const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1370
41.0k
  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1371
41.0k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1372
41.0k
                  "CallEvent subclasses are not all the same size");
1373
41.0k
    return new (allocate()) T(A1, A2, St, LCtx);
1374
41.0k
  }
clang::ento::CXXInheritedConstructorCall* clang::ento::CallEventManager::create<clang::ento::CXXInheritedConstructorCall, clang::CXXInheritedCtorInitExpr const*, clang::ento::MemRegion const*>(clang::CXXInheritedCtorInitExpr const*, clang::ento::MemRegion const*, llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>, clang::LocationContext const*)
Line
Count
Source
1370
13
  T *create(Arg1 A1, Arg2 A2, ProgramStateRef St, const LocationContext *LCtx) {
1371
13
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1372
13
                  "CallEvent subclasses are not all the same size");
1373
13
    return new (allocate()) T(A1, A2, St, LCtx);
1374
13
  }
1375
1376
  template <typename T, typename Arg1, typename Arg2, typename Arg3>
1377
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, ProgramStateRef St,
1378
            const LocationContext *LCtx) {
1379
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1380
                  "CallEvent subclasses are not all the same size");
1381
    return new (allocate()) T(A1, A2, A3, St, LCtx);
1382
  }
1383
1384
  template <typename T, typename Arg1, typename Arg2, typename Arg3,
1385
            typename Arg4>
1386
  T *create(Arg1 A1, Arg2 A2, Arg3 A3, Arg4 A4, ProgramStateRef St,
1387
2.95k
            const LocationContext *LCtx) {
1388
2.95k
    static_assert(sizeof(T) == sizeof(CallEventTemplateTy),
1389
2.95k
                  "CallEvent subclasses are not all the same size");
1390
2.95k
    return new (allocate()) T(A1, A2, A3, A4, St, LCtx);
1391
2.95k
  }
1392
1393
public:
1394
13.6k
  CallEventManager(llvm::BumpPtrAllocator &alloc) : Alloc(alloc) {}
1395
1396
  /// Gets an outside caller given a callee context.
1397
  CallEventRef<>
1398
  getCaller(const StackFrameContext *CalleeCtx, ProgramStateRef State);
1399
1400
  /// Gets a call event for a function call, Objective-C method call,
1401
  /// or a 'new' call.
1402
  CallEventRef<>
1403
  getCall(const Stmt *S, ProgramStateRef State,
1404
          const LocationContext *LC);
1405
1406
  CallEventRef<>
1407
  getSimpleCall(const CallExpr *E, ProgramStateRef State,
1408
                const LocationContext *LCtx);
1409
1410
  CallEventRef<ObjCMethodCall>
1411
  getObjCMethodCall(const ObjCMessageExpr *E, ProgramStateRef State,
1412
6.18k
                    const LocationContext *LCtx) {
1413
6.18k
    return create<ObjCMethodCall>(E, State, LCtx);
1414
6.18k
  }
1415
1416
  CallEventRef<CXXConstructorCall>
1417
  getCXXConstructorCall(const CXXConstructExpr *E, const MemRegion *Target,
1418
41.0k
                        ProgramStateRef State, const LocationContext *LCtx) {
1419
41.0k
    return create<CXXConstructorCall>(E, Target, State, LCtx);
1420
41.0k
  }
1421
1422
  CallEventRef<CXXInheritedConstructorCall>
1423
  getCXXInheritedConstructorCall(const CXXInheritedCtorInitExpr *E,
1424
                                 const MemRegion *Target, ProgramStateRef State,
1425
13
                                 const LocationContext *LCtx) {
1426
13
    return create<CXXInheritedConstructorCall>(E, Target, State, LCtx);
1427
13
  }
1428
1429
  CallEventRef<CXXDestructorCall>
1430
  getCXXDestructorCall(const CXXDestructorDecl *DD, const Stmt *Trigger,
1431
                       const MemRegion *Target, bool IsBase,
1432
2.95k
                       ProgramStateRef State, const LocationContext *LCtx) {
1433
2.95k
    return create<CXXDestructorCall>(DD, Trigger, Target, IsBase, State, LCtx);
1434
2.95k
  }
1435
1436
  CallEventRef<CXXAllocatorCall>
1437
  getCXXAllocatorCall(const CXXNewExpr *E, ProgramStateRef State,
1438
2.83k
                      const LocationContext *LCtx) {
1439
2.83k
    return create<CXXAllocatorCall>(E, State, LCtx);
1440
2.83k
  }
1441
1442
  CallEventRef<CXXDeallocatorCall>
1443
  getCXXDeallocatorCall(const CXXDeleteExpr *E, ProgramStateRef State,
1444
436
                        const LocationContext *LCtx) {
1445
436
    return create<CXXDeallocatorCall>(E, State, LCtx);
1446
436
  }
1447
};
1448
1449
template <typename T>
1450
1.01M
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1451
1.01M
  assert(isa<T>(*this) && "Cloning to unrelated type");
1452
1.01M
  static_assert(sizeof(T) == sizeof(CallEvent),
1453
1.01M
                "Subclasses may not add fields");
1454
1.01M
1455
1.01M
  if (NewState == State)
1456
739k
    return cast<T>(this);
1457
272k
1458
272k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1459
272k
  T *Copy = static_cast<T *>(Mgr.allocate());
1460
272k
  cloneTo(Copy);
1461
272k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1462
272k
1463
272k
  Copy->State = NewState;
1464
272k
  return Copy;
1465
272k
}
clang::ento::CallEventRef<clang::ento::ObjCMethodCall> clang::ento::CallEvent::cloneWithState<clang::ento::ObjCMethodCall>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
1450
22.1k
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1451
22.1k
  assert(isa<T>(*this) && "Cloning to unrelated type");
1452
22.1k
  static_assert(sizeof(T) == sizeof(CallEvent),
1453
22.1k
                "Subclasses may not add fields");
1454
22.1k
1455
22.1k
  if (NewState == State)
1456
7.64k
    return cast<T>(this);
1457
14.5k
1458
14.5k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1459
14.5k
  T *Copy = static_cast<T *>(Mgr.allocate());
1460
14.5k
  cloneTo(Copy);
1461
14.5k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1462
14.5k
1463
14.5k
  Copy->State = NewState;
1464
14.5k
  return Copy;
1465
14.5k
}
clang::ento::CallEventRef<clang::ento::CallEvent> clang::ento::CallEvent::cloneWithState<clang::ento::CallEvent>(llvm::IntrusiveRefCntPtr<clang::ento::ProgramState const>) const
Line
Count
Source
1450
989k
CallEventRef<T> CallEvent::cloneWithState(ProgramStateRef NewState) const {
1451
989k
  assert(isa<T>(*this) && "Cloning to unrelated type");
1452
989k
  static_assert(sizeof(T) == sizeof(CallEvent),
1453
989k
                "Subclasses may not add fields");
1454
989k
1455
989k
  if (NewState == State)
1456
731k
    return cast<T>(this);
1457
258k
1458
258k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1459
258k
  T *Copy = static_cast<T *>(Mgr.allocate());
1460
258k
  cloneTo(Copy);
1461
258k
  assert(Copy->getKind() == this->getKind() && "Bad copy");
1462
258k
1463
258k
  Copy->State = NewState;
1464
258k
  return Copy;
1465
258k
}
1466
1467
1.32M
inline void CallEvent::Release() const {
1468
1.32M
  assert(RefCount > 0 && "Reference count is already zero.");
1469
1.32M
  --RefCount;
1470
1.32M
1471
1.32M
  if (RefCount > 0)
1472
856k
    return;
1473
469k
1474
469k
  CallEventManager &Mgr = State->getStateManager().getCallEventManager();
1475
469k
  Mgr.reclaim(this);
1476
469k
1477
469k
  this->~CallEvent();
1478
469k
}
1479
1480
} // namespace ento
1481
1482
} // namespace clang
1483
1484
namespace llvm {
1485
1486
// Support isa<>, cast<>, and dyn_cast<> for CallEventRef.
1487
template<class T> struct simplify_type< clang::ento::CallEventRef<T>> {
1488
  using SimpleType = const T *;
1489
1490
  static SimpleType
1491
43.0k
  getSimplifiedValue(clang::ento::CallEventRef<T> Val) {
1492
43.0k
    return Val.get();
1493
43.0k
  }
1494
};
1495
1496
} // namespace llvm
1497
1498
#endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_CALLEVENT_H