Coverage Report

Created: 2020-02-15 09:57

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/lib/StaticAnalyzer/Core/MemRegion.cpp
Line
Count
Source (jump to first uncovered line)
1
//===- MemRegion.cpp - Abstract memory regions for static analysis --------===//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  This file defines MemRegion and its subclasses.  MemRegion defines a
10
//  partially-typed abstraction of memory useful for path-sensitive dataflow
11
//  analyses.
12
//
13
//===----------------------------------------------------------------------===//
14
15
#include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
16
#include "clang/AST/ASTContext.h"
17
#include "clang/AST/Attr.h"
18
#include "clang/AST/CharUnits.h"
19
#include "clang/AST/Decl.h"
20
#include "clang/AST/DeclCXX.h"
21
#include "clang/AST/DeclObjC.h"
22
#include "clang/AST/Expr.h"
23
#include "clang/AST/PrettyPrinter.h"
24
#include "clang/AST/RecordLayout.h"
25
#include "clang/AST/Type.h"
26
#include "clang/Analysis/AnalysisDeclContext.h"
27
#include "clang/Analysis/Support/BumpVector.h"
28
#include "clang/Basic/IdentifierTable.h"
29
#include "clang/Basic/LLVM.h"
30
#include "clang/Basic/SourceManager.h"
31
#include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
32
#include "clang/StaticAnalyzer/Core/PathSensitive/SVals.h"
33
#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
34
#include "llvm/ADT/APInt.h"
35
#include "llvm/ADT/FoldingSet.h"
36
#include "llvm/ADT/Optional.h"
37
#include "llvm/ADT/PointerUnion.h"
38
#include "llvm/ADT/SmallString.h"
39
#include "llvm/ADT/StringRef.h"
40
#include "llvm/ADT/Twine.h"
41
#include "llvm/Support/Allocator.h"
42
#include "llvm/Support/Casting.h"
43
#include "llvm/Support/CheckedArithmetic.h"
44
#include "llvm/Support/Compiler.h"
45
#include "llvm/Support/Debug.h"
46
#include "llvm/Support/ErrorHandling.h"
47
#include "llvm/Support/raw_ostream.h"
48
#include <cassert>
49
#include <cstdint>
50
#include <functional>
51
#include <iterator>
52
#include <string>
53
#include <tuple>
54
#include <utility>
55
56
using namespace clang;
57
using namespace ento;
58
59
#define DEBUG_TYPE "MemRegion"
60
61
//===----------------------------------------------------------------------===//
62
// MemRegion Construction.
63
//===----------------------------------------------------------------------===//
64
65
template <typename RegionTy, typename SuperTy, typename Arg1Ty>
66
RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1,
67
760k
                                         const SuperTy *superRegion) {
68
760k
  llvm::FoldingSetNodeID ID;
69
760k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
760k
  void *InsertPos;
71
760k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
760k
73
760k
  if (!R) {
74
109k
    R = A.Allocate<RegionTy>();
75
109k
    new (R) RegionTy(arg1, superRegion);
76
109k
    Regions.InsertNode(R, InsertPos);
77
109k
  }
78
760k
79
760k
  return R;
80
760k
}
clang::ento::StringRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::StringRegion, clang::ento::GlobalInternalSpaceRegion, clang::StringLiteral const*>(clang::StringLiteral const*, clang::ento::GlobalInternalSpaceRegion const*)
Line
Count
Source
67
6.39k
                                         const SuperTy *superRegion) {
68
6.39k
  llvm::FoldingSetNodeID ID;
69
6.39k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
6.39k
  void *InsertPos;
71
6.39k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
6.39k
73
6.39k
  if (!R) {
74
2.81k
    R = A.Allocate<RegionTy>();
75
2.81k
    new (R) RegionTy(arg1, superRegion);
76
2.81k
    Regions.InsertNode(R, InsertPos);
77
2.81k
  }
78
6.39k
79
6.39k
  return R;
80
6.39k
}
clang::ento::ObjCStringRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::ObjCStringRegion, clang::ento::GlobalInternalSpaceRegion, clang::ObjCStringLiteral const*>(clang::ObjCStringLiteral const*, clang::ento::GlobalInternalSpaceRegion const*)
Line
Count
Source
67
1.09k
                                         const SuperTy *superRegion) {
68
1.09k
  llvm::FoldingSetNodeID ID;
69
1.09k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
1.09k
  void *InsertPos;
71
1.09k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
1.09k
73
1.09k
  if (!R) {
74
282
    R = A.Allocate<RegionTy>();
75
282
    new (R) RegionTy(arg1, superRegion);
76
282
    Regions.InsertNode(R, InsertPos);
77
282
  }
78
1.09k
79
1.09k
  return R;
80
1.09k
}
clang::ento::VarRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::VarRegion, clang::ento::MemRegion, clang::VarDecl const*>(clang::VarDecl const*, clang::ento::MemRegion const*)
Line
Count
Source
67
302k
                                         const SuperTy *superRegion) {
68
302k
  llvm::FoldingSetNodeID ID;
69
302k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
302k
  void *InsertPos;
71
302k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
302k
73
302k
  if (!R) {
74
41.0k
    R = A.Allocate<RegionTy>();
75
41.0k
    new (R) RegionTy(arg1, superRegion);
76
41.0k
    Regions.InsertNode(R, InsertPos);
77
41.0k
  }
78
302k
79
302k
  return R;
80
302k
}
clang::ento::CXXTempObjectRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CXXTempObjectRegion, clang::ento::GlobalsSpaceRegion, clang::Expr const*>(clang::Expr const*, clang::ento::GlobalsSpaceRegion const*)
Line
Count
Source
67
15
                                         const SuperTy *superRegion) {
68
15
  llvm::FoldingSetNodeID ID;
69
15
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
15
  void *InsertPos;
71
15
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
15
73
15
  if (!R) {
74
15
    R = A.Allocate<RegionTy>();
75
15
    new (R) RegionTy(arg1, superRegion);
76
15
    Regions.InsertNode(R, InsertPos);
77
15
  }
78
15
79
15
  return R;
80
15
}
clang::ento::CompoundLiteralRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CompoundLiteralRegion, clang::ento::MemSpaceRegion, clang::CompoundLiteralExpr const*>(clang::CompoundLiteralExpr const*, clang::ento::MemSpaceRegion const*)
Line
Count
Source
67
52
                                         const SuperTy *superRegion) {
68
52
  llvm::FoldingSetNodeID ID;
69
52
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
52
  void *InsertPos;
71
52
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
52
73
52
  if (!R) {
74
48
    R = A.Allocate<RegionTy>();
75
48
    new (R) RegionTy(arg1, superRegion);
76
48
    Regions.InsertNode(R, InsertPos);
77
48
  }
78
52
79
52
  return R;
80
52
}
clang::ento::FunctionCodeRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::FunctionCodeRegion, clang::ento::CodeSpaceRegion, clang::NamedDecl const*>(clang::NamedDecl const*, clang::ento::CodeSpaceRegion const*)
Line
Count
Source
67
82.6k
                                         const SuperTy *superRegion) {
68
82.6k
  llvm::FoldingSetNodeID ID;
69
82.6k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
82.6k
  void *InsertPos;
71
82.6k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
82.6k
73
82.6k
  if (!R) {
74
19.8k
    R = A.Allocate<RegionTy>();
75
19.8k
    new (R) RegionTy(arg1, superRegion);
76
19.8k
    Regions.InsertNode(R, InsertPos);
77
19.8k
  }
78
82.6k
79
82.6k
  return R;
80
82.6k
}
clang::ento::SymbolicRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::SymbolicRegion, clang::ento::UnknownSpaceRegion, clang::ento::SymExpr const*>(clang::ento::SymExpr const*, clang::ento::UnknownSpaceRegion const*)
Line
Count
Source
67
65.8k
                                         const SuperTy *superRegion) {
68
65.8k
  llvm::FoldingSetNodeID ID;
69
65.8k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
65.8k
  void *InsertPos;
71
65.8k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
65.8k
73
65.8k
  if (!R) {
74
13.6k
    R = A.Allocate<RegionTy>();
75
13.6k
    new (R) RegionTy(arg1, superRegion);
76
13.6k
    Regions.InsertNode(R, InsertPos);
77
13.6k
  }
78
65.8k
79
65.8k
  return R;
80
65.8k
}
clang::ento::SymbolicRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::SymbolicRegion, clang::ento::HeapSpaceRegion, clang::ento::SymExpr const*>(clang::ento::SymExpr const*, clang::ento::HeapSpaceRegion const*)
Line
Count
Source
67
1.43k
                                         const SuperTy *superRegion) {
68
1.43k
  llvm::FoldingSetNodeID ID;
69
1.43k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
1.43k
  void *InsertPos;
71
1.43k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
1.43k
73
1.43k
  if (!R) {
74
1.42k
    R = A.Allocate<RegionTy>();
75
1.42k
    new (R) RegionTy(arg1, superRegion);
76
1.42k
    Regions.InsertNode(R, InsertPos);
77
1.42k
  }
78
1.43k
79
1.43k
  return R;
80
1.43k
}
clang::ento::FieldRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::FieldRegion, clang::ento::SubRegion, clang::FieldDecl const*>(clang::FieldDecl const*, clang::ento::SubRegion const*)
Line
Count
Source
67
135k
                                         const SuperTy *superRegion) {
68
135k
  llvm::FoldingSetNodeID ID;
69
135k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
135k
  void *InsertPos;
71
135k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
135k
73
135k
  if (!R) {
74
14.0k
    R = A.Allocate<RegionTy>();
75
14.0k
    new (R) RegionTy(arg1, superRegion);
76
14.0k
    Regions.InsertNode(R, InsertPos);
77
14.0k
  }
78
135k
79
135k
  return R;
80
135k
}
clang::ento::ObjCIvarRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::ObjCIvarRegion, clang::ento::SubRegion, clang::ObjCIvarDecl const*>(clang::ObjCIvarDecl const*, clang::ento::SubRegion const*)
Line
Count
Source
67
1.44k
                                         const SuperTy *superRegion) {
68
1.44k
  llvm::FoldingSetNodeID ID;
69
1.44k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
1.44k
  void *InsertPos;
71
1.44k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
1.44k
73
1.44k
  if (!R) {
74
645
    R = A.Allocate<RegionTy>();
75
645
    new (R) RegionTy(arg1, superRegion);
76
645
    Regions.InsertNode(R, InsertPos);
77
645
  }
78
1.44k
79
1.44k
  return R;
80
1.44k
}
clang::ento::CXXTempObjectRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CXXTempObjectRegion, clang::ento::StackLocalsSpaceRegion, clang::Expr const*>(clang::Expr const*, clang::ento::StackLocalsSpaceRegion const*)
Line
Count
Source
67
16.2k
                                         const SuperTy *superRegion) {
68
16.2k
  llvm::FoldingSetNodeID ID;
69
16.2k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
16.2k
  void *InsertPos;
71
16.2k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
16.2k
73
16.2k
  if (!R) {
74
3.86k
    R = A.Allocate<RegionTy>();
75
3.86k
    new (R) RegionTy(arg1, superRegion);
76
3.86k
    Regions.InsertNode(R, InsertPos);
77
3.86k
  }
78
16.2k
79
16.2k
  return R;
80
16.2k
}
clang::ento::CXXDerivedObjectRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CXXDerivedObjectRegion, clang::ento::SubRegion, clang::CXXRecordDecl const*>(clang::CXXRecordDecl const*, clang::ento::SubRegion const*)
Line
Count
Source
67
21
                                         const SuperTy *superRegion) {
68
21
  llvm::FoldingSetNodeID ID;
69
21
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
21
  void *InsertPos;
71
21
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
21
73
21
  if (!R) {
74
20
    R = A.Allocate<RegionTy>();
75
20
    new (R) RegionTy(arg1, superRegion);
76
20
    Regions.InsertNode(R, InsertPos);
77
20
  }
78
21
79
21
  return R;
80
21
}
clang::ento::CXXThisRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CXXThisRegion, clang::ento::StackArgumentsSpaceRegion, clang::PointerType const*>(clang::PointerType const*, clang::ento::StackArgumentsSpaceRegion const*)
Line
Count
Source
67
147k
                                         const SuperTy *superRegion) {
68
147k
  llvm::FoldingSetNodeID ID;
69
147k
  RegionTy::ProfileRegion(ID, arg1, superRegion);
70
147k
  void *InsertPos;
71
147k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
72
147k
73
147k
  if (!R) {
74
11.5k
    R = A.Allocate<RegionTy>();
75
11.5k
    new (R) RegionTy(arg1, superRegion);
76
11.5k
    Regions.InsertNode(R, InsertPos);
77
11.5k
  }
78
147k
79
147k
  return R;
80
147k
}
81
82
template <typename RegionTy, typename SuperTy, typename Arg1Ty, typename Arg2Ty>
83
RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
84
2.05k
                                         const SuperTy *superRegion) {
85
2.05k
  llvm::FoldingSetNodeID ID;
86
2.05k
  RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
87
2.05k
  void *InsertPos;
88
2.05k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
89
2.05k
90
2.05k
  if (!R) {
91
1.14k
    R = A.Allocate<RegionTy>();
92
1.14k
    new (R) RegionTy(arg1, arg2, superRegion);
93
1.14k
    Regions.InsertNode(R, InsertPos);
94
1.14k
  }
95
2.05k
96
2.05k
  return R;
97
2.05k
}
clang::ento::CXXBaseObjectRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::CXXBaseObjectRegion, clang::ento::SubRegion, clang::CXXRecordDecl const*, bool>(clang::CXXRecordDecl const*, bool, clang::ento::SubRegion const*)
Line
Count
Source
84
1.96k
                                         const SuperTy *superRegion) {
85
1.96k
  llvm::FoldingSetNodeID ID;
86
1.96k
  RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
87
1.96k
  void *InsertPos;
88
1.96k
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
89
1.96k
90
1.96k
  if (!R) {
91
1.05k
    R = A.Allocate<RegionTy>();
92
1.05k
    new (R) RegionTy(arg1, arg2, superRegion);
93
1.05k
    Regions.InsertNode(R, InsertPos);
94
1.05k
  }
95
1.96k
96
1.96k
  return R;
97
1.96k
}
clang::ento::AllocaRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::AllocaRegion, clang::ento::StackLocalsSpaceRegion, clang::Expr const*, unsigned int>(clang::Expr const*, unsigned int, clang::ento::StackLocalsSpaceRegion const*)
Line
Count
Source
84
91
                                         const SuperTy *superRegion) {
85
91
  llvm::FoldingSetNodeID ID;
86
91
  RegionTy::ProfileRegion(ID, arg1, arg2, superRegion);
87
91
  void *InsertPos;
88
91
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
89
91
90
91
  if (!R) {
91
91
    R = A.Allocate<RegionTy>();
92
91
    new (R) RegionTy(arg1, arg2, superRegion);
93
91
    Regions.InsertNode(R, InsertPos);
94
91
  }
95
91
96
91
  return R;
97
91
}
98
99
template <typename RegionTy, typename SuperTy,
100
          typename Arg1Ty, typename Arg2Ty, typename Arg3Ty>
101
RegionTy* MemRegionManager::getSubRegion(const Arg1Ty arg1, const Arg2Ty arg2,
102
                                         const Arg3Ty arg3,
103
765
                                         const SuperTy *superRegion) {
104
765
  llvm::FoldingSetNodeID ID;
105
765
  RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
106
765
  void *InsertPos;
107
765
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
108
765
109
765
  if (!R) {
110
717
    R = A.Allocate<RegionTy>();
111
717
    new (R) RegionTy(arg1, arg2, arg3, superRegion);
112
717
    Regions.InsertNode(R, InsertPos);
113
717
  }
114
765
115
765
  return R;
116
765
}
clang::ento::BlockDataRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::BlockDataRegion, clang::ento::MemSpaceRegion, clang::ento::BlockCodeRegion const*, clang::LocationContext const*, unsigned int>(clang::ento::BlockCodeRegion const*, clang::LocationContext const*, unsigned int, clang::ento::MemSpaceRegion const*)
Line
Count
Source
103
376
                                         const SuperTy *superRegion) {
104
376
  llvm::FoldingSetNodeID ID;
105
376
  RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
106
376
  void *InsertPos;
107
376
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
108
376
109
376
  if (!R) {
110
362
    R = A.Allocate<RegionTy>();
111
362
    new (R) RegionTy(arg1, arg2, arg3, superRegion);
112
362
    Regions.InsertNode(R, InsertPos);
113
362
  }
114
376
115
376
  return R;
116
376
}
clang::ento::BlockCodeRegion* clang::ento::MemRegionManager::getSubRegion<clang::ento::BlockCodeRegion, clang::ento::CodeSpaceRegion, clang::BlockDecl const*, clang::CanQual<clang::Type>, clang::AnalysisDeclContext*>(clang::BlockDecl const*, clang::CanQual<clang::Type>, clang::AnalysisDeclContext*, clang::ento::CodeSpaceRegion const*)
Line
Count
Source
103
389
                                         const SuperTy *superRegion) {
104
389
  llvm::FoldingSetNodeID ID;
105
389
  RegionTy::ProfileRegion(ID, arg1, arg2, arg3, superRegion);
106
389
  void *InsertPos;
107
389
  auto *R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID, InsertPos));
108
389
109
389
  if (!R) {
110
355
    R = A.Allocate<RegionTy>();
111
355
    new (R) RegionTy(arg1, arg2, arg3, superRegion);
112
355
    Regions.InsertNode(R, InsertPos);
113
355
  }
114
389
115
389
  return R;
116
389
}
117
118
//===----------------------------------------------------------------------===//
119
// Object destruction.
120
//===----------------------------------------------------------------------===//
121
122
0
MemRegion::~MemRegion() = default;
123
124
// All regions and their data are BumpPtrAllocated.  No need to call their
125
// destructors.
126
12.6k
MemRegionManager::~MemRegionManager() = default;
127
128
//===----------------------------------------------------------------------===//
129
// Basic methods.
130
//===----------------------------------------------------------------------===//
131
132
6.55k
bool SubRegion::isSubRegionOf(const MemRegion* R) const {
133
6.55k
  const MemRegion* r = this;
134
11.4k
  do {
135
11.4k
    if (r == R)
136
2.80k
      return true;
137
8.64k
    if (const auto *sr = dyn_cast<SubRegion>(r))
138
4.90k
      r = sr->getSuperRegion();
139
3.74k
    else
140
3.74k
      break;
141
4.90k
  } while (r != nullptr);
142
6.55k
  
return false3.74k
;
143
6.55k
}
144
145
830k
MemRegionManager &SubRegion::getMemRegionManager() const {
146
830k
  const SubRegion* r = this;
147
1.14M
  do {
148
1.14M
    const MemRegion *superRegion = r->getSuperRegion();
149
1.14M
    if (const auto *sr = dyn_cast<SubRegion>(superRegion)) {
150
311k
      r = sr;
151
311k
      continue;
152
311k
    }
153
830k
    return superRegion->getMemRegionManager();
154
830k
  } while (
true311k
);
155
830k
}
156
157
2.03M
const StackFrameContext *VarRegion::getStackFrame() const {
158
2.03M
  const auto *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
159
2.03M
  return SSR ? 
SSR->getStackFrame()1.94M
:
nullptr87.3k
;
160
2.03M
}
161
162
ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const SubRegion *sReg)
163
645
    : DeclRegion(ivd, sReg, ObjCIvarRegionKind) {}
164
165
17.0k
const ObjCIvarDecl *ObjCIvarRegion::getDecl() const {
166
17.0k
  return cast<ObjCIvarDecl>(D);
167
17.0k
}
168
169
16.0k
QualType ObjCIvarRegion::getValueType() const {
170
16.0k
  return getDecl()->getType();
171
16.0k
}
172
173
6.76k
QualType CXXBaseObjectRegion::getValueType() const {
174
6.76k
  return QualType(getDecl()->getTypeForDecl(), 0);
175
6.76k
}
176
177
41
QualType CXXDerivedObjectRegion::getValueType() const {
178
41
  return QualType(getDecl()->getTypeForDecl(), 0);
179
41
}
180
181
//===----------------------------------------------------------------------===//
182
// FoldingSet profiling.
183
//===----------------------------------------------------------------------===//
184
185
0
void MemSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
186
0
  ID.AddInteger(static_cast<unsigned>(getKind()));
187
0
}
188
189
0
void StackSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
190
0
  ID.AddInteger(static_cast<unsigned>(getKind()));
191
0
  ID.AddPointer(getStackFrame());
192
0
}
193
194
0
void StaticGlobalSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
195
0
  ID.AddInteger(static_cast<unsigned>(getKind()));
196
0
  ID.AddPointer(getCodeRegion());
197
0
}
198
199
void StringRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
200
                                 const StringLiteral *Str,
201
10.6k
                                 const MemRegion *superRegion) {
202
10.6k
  ID.AddInteger(static_cast<unsigned>(StringRegionKind));
203
10.6k
  ID.AddPointer(Str);
204
10.6k
  ID.AddPointer(superRegion);
205
10.6k
}
206
207
void ObjCStringRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
208
                                     const ObjCStringLiteral *Str,
209
2.06k
                                     const MemRegion *superRegion) {
210
2.06k
  ID.AddInteger(static_cast<unsigned>(ObjCStringRegionKind));
211
2.06k
  ID.AddPointer(Str);
212
2.06k
  ID.AddPointer(superRegion);
213
2.06k
}
214
215
void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
216
                                 const Expr *Ex, unsigned cnt,
217
123
                                 const MemRegion *superRegion) {
218
123
  ID.AddInteger(static_cast<unsigned>(AllocaRegionKind));
219
123
  ID.AddPointer(Ex);
220
123
  ID.AddInteger(cnt);
221
123
  ID.AddPointer(superRegion);
222
123
}
223
224
32
void AllocaRegion::Profile(llvm::FoldingSetNodeID& ID) const {
225
32
  ProfileRegion(ID, Ex, Cnt, superRegion);
226
32
}
227
228
7
void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID& ID) const {
229
7
  CompoundLiteralRegion::ProfileRegion(ID, CL, superRegion);
230
7
}
231
232
void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
233
                                          const CompoundLiteralExpr *CL,
234
59
                                          const MemRegion* superRegion) {
235
59
  ID.AddInteger(static_cast<unsigned>(CompoundLiteralRegionKind));
236
59
  ID.AddPointer(CL);
237
59
  ID.AddPointer(superRegion);
238
59
}
239
240
void CXXThisRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
241
                                  const PointerType *PT,
242
346k
                                  const MemRegion *sRegion) {
243
346k
  ID.AddInteger(static_cast<unsigned>(CXXThisRegionKind));
244
346k
  ID.AddPointer(PT);
245
346k
  ID.AddPointer(sRegion);
246
346k
}
247
248
198k
void CXXThisRegion::Profile(llvm::FoldingSetNodeID &ID) const {
249
198k
  CXXThisRegion::ProfileRegion(ID, ThisPointerTy, superRegion);
250
198k
}
251
252
void ObjCIvarRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
253
                                   const ObjCIvarDecl *ivd,
254
1.44k
                                   const MemRegion* superRegion) {
255
1.44k
  DeclRegion::ProfileRegion(ID, ivd, superRegion, ObjCIvarRegionKind);
256
1.44k
}
257
258
void DeclRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl *D,
259
1.04M
                               const MemRegion* superRegion, Kind k) {
260
1.04M
  ID.AddInteger(static_cast<unsigned>(k));
261
1.04M
  ID.AddPointer(D);
262
1.04M
  ID.AddPointer(superRegion);
263
1.04M
}
264
265
208k
void DeclRegion::Profile(llvm::FoldingSetNodeID& ID) const {
266
208k
  DeclRegion::ProfileRegion(ID, D, superRegion, getKind());
267
208k
}
268
269
392k
void VarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
270
392k
  VarRegion::ProfileRegion(ID, getDecl(), superRegion);
271
392k
}
272
273
void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym,
274
155k
                                   const MemRegion *sreg) {
275
155k
  ID.AddInteger(static_cast<unsigned>(MemRegion::SymbolicRegionKind));
276
155k
  ID.Add(sym);
277
155k
  ID.AddPointer(sreg);
278
155k
}
279
280
88.0k
void SymbolicRegion::Profile(llvm::FoldingSetNodeID& ID) const {
281
88.0k
  SymbolicRegion::ProfileRegion(ID, sym, getSuperRegion());
282
88.0k
}
283
284
void ElementRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
285
                                  QualType ElementType, SVal Idx,
286
199k
                                  const MemRegion* superRegion) {
287
199k
  ID.AddInteger(MemRegion::ElementRegionKind);
288
199k
  ID.Add(ElementType);
289
199k
  ID.AddPointer(superRegion);
290
199k
  Idx.Profile(ID);
291
199k
}
292
293
133k
void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
294
133k
  ElementRegion::ProfileRegion(ID, ElementType, Index, superRegion);
295
133k
}
296
297
void FunctionCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
298
                                       const NamedDecl *FD,
299
156k
                                       const MemRegion*) {
300
156k
  ID.AddInteger(MemRegion::FunctionCodeRegionKind);
301
156k
  ID.AddPointer(FD);
302
156k
}
303
304
73.6k
void FunctionCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
305
73.6k
  FunctionCodeRegion::ProfileRegion(ID, FD, superRegion);
306
73.6k
}
307
308
void BlockCodeRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
309
                                    const BlockDecl *BD, CanQualType,
310
                                    const AnalysisDeclContext *AC,
311
454
                                    const MemRegion*) {
312
454
  ID.AddInteger(MemRegion::BlockCodeRegionKind);
313
454
  ID.AddPointer(BD);
314
454
}
315
316
65
void BlockCodeRegion::Profile(llvm::FoldingSetNodeID& ID) const {
317
65
  BlockCodeRegion::ProfileRegion(ID, BD, locTy, AC, superRegion);
318
65
}
319
320
void BlockDataRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
321
                                    const BlockCodeRegion *BC,
322
                                    const LocationContext *LC,
323
                                    unsigned BlkCount,
324
428
                                    const MemRegion *sReg) {
325
428
  ID.AddInteger(MemRegion::BlockDataRegionKind);
326
428
  ID.AddPointer(BC);
327
428
  ID.AddPointer(LC);
328
428
  ID.AddInteger(BlkCount);
329
428
  ID.AddPointer(sReg);
330
428
}
331
332
52
void BlockDataRegion::Profile(llvm::FoldingSetNodeID& ID) const {
333
52
  BlockDataRegion::ProfileRegion(ID, BC, LC, BlockCount, getSuperRegion());
334
52
}
335
336
void CXXTempObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
337
                                        Expr const *Ex,
338
39.9k
                                        const MemRegion *sReg) {
339
39.9k
  ID.AddPointer(Ex);
340
39.9k
  ID.AddPointer(sReg);
341
39.9k
}
342
343
23.7k
void CXXTempObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
344
23.7k
  ProfileRegion(ID, Ex, getSuperRegion());
345
23.7k
}
346
347
void CXXBaseObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
348
                                        const CXXRecordDecl *RD,
349
                                        bool IsVirtual,
350
3.21k
                                        const MemRegion *SReg) {
351
3.21k
  ID.AddPointer(RD);
352
3.21k
  ID.AddBoolean(IsVirtual);
353
3.21k
  ID.AddPointer(SReg);
354
3.21k
}
355
356
1.25k
void CXXBaseObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
357
1.25k
  ProfileRegion(ID, getDecl(), isVirtual(), superRegion);
358
1.25k
}
359
360
void CXXDerivedObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
361
                                           const CXXRecordDecl *RD,
362
22
                                           const MemRegion *SReg) {
363
22
  ID.AddPointer(RD);
364
22
  ID.AddPointer(SReg);
365
22
}
366
367
1
void CXXDerivedObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
368
1
  ProfileRegion(ID, getDecl(), superRegion);
369
1
}
370
371
//===----------------------------------------------------------------------===//
372
// Region anchors.
373
//===----------------------------------------------------------------------===//
374
375
0
void GlobalsSpaceRegion::anchor() {}
376
377
0
void NonStaticGlobalSpaceRegion::anchor() {}
378
379
0
void StackSpaceRegion::anchor() {}
380
381
0
void TypedRegion::anchor() {}
382
383
0
void TypedValueRegion::anchor() {}
384
385
0
void CodeTextRegion::anchor() {}
386
387
0
void SubRegion::anchor() {}
388
389
//===----------------------------------------------------------------------===//
390
// Region pretty-printing.
391
//===----------------------------------------------------------------------===//
392
393
0
LLVM_DUMP_METHOD void MemRegion::dump() const {
394
0
  dumpToStream(llvm::errs());
395
0
}
396
397
155
std::string MemRegion::getString() const {
398
155
  std::string s;
399
155
  llvm::raw_string_ostream os(s);
400
155
  dumpToStream(os);
401
155
  return os.str();
402
155
}
403
404
0
void MemRegion::dumpToStream(raw_ostream &os) const {
405
0
  os << "<Unknown Region>";
406
0
}
407
408
0
void AllocaRegion::dumpToStream(raw_ostream &os) const {
409
0
  os << "alloca{S" << Ex->getID(getContext()) << ',' << Cnt << '}';
410
0
}
411
412
19
void FunctionCodeRegion::dumpToStream(raw_ostream &os) const {
413
19
  os << "code{" << getDecl()->getDeclName().getAsString() << '}';
414
19
}
415
416
0
void BlockCodeRegion::dumpToStream(raw_ostream &os) const {
417
0
  os << "block_code{" << static_cast<const void *>(this) << '}';
418
0
}
419
420
0
void BlockDataRegion::dumpToStream(raw_ostream &os) const {
421
0
  os << "block_data{" << BC;
422
0
  os << "; ";
423
0
  for (BlockDataRegion::referenced_vars_iterator
424
0
         I = referenced_vars_begin(),
425
0
         E = referenced_vars_end(); I != E; ++I)
426
0
    os << "(" << I.getCapturedRegion() << "<-" <<
427
0
                 I.getOriginalRegion() << ") ";
428
0
  os << '}';
429
0
}
430
431
0
void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
432
0
  // FIXME: More elaborate pretty-printing.
433
0
  os << "{ S" << CL->getID(getContext()) <<  " }";
434
0
}
435
436
4
void CXXTempObjectRegion::dumpToStream(raw_ostream &os) const {
437
4
  os << "temp_object{" << getValueType().getAsString() << ", "
438
4
     << "S" << Ex->getID(getContext()) << '}';
439
4
}
440
441
0
void CXXBaseObjectRegion::dumpToStream(raw_ostream &os) const {
442
0
  os << "Base{" << superRegion << ',' << getDecl()->getName() << '}';
443
0
}
444
445
0
void CXXDerivedObjectRegion::dumpToStream(raw_ostream &os) const {
446
0
  os << "Derived{" << superRegion << ',' << getDecl()->getName() << '}';
447
0
}
448
449
24
void CXXThisRegion::dumpToStream(raw_ostream &os) const {
450
24
  os << "this";
451
24
}
452
453
9
void ElementRegion::dumpToStream(raw_ostream &os) const {
454
9
  os << "Element{" << superRegion << ','
455
9
     << Index << ',' << getElementType().getAsString() << '}';
456
9
}
457
458
17
void FieldRegion::dumpToStream(raw_ostream &os) const {
459
17
  os << superRegion << "." << *getDecl();
460
17
}
461
462
0
void ObjCIvarRegion::dumpToStream(raw_ostream &os) const {
463
0
  os << "Ivar{" << superRegion << ',' << *getDecl() << '}';
464
0
}
465
466
9
void StringRegion::dumpToStream(raw_ostream &os) const {
467
9
  assert(Str != nullptr && "Expecting non-null StringLiteral");
468
9
  Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
469
9
}
470
471
0
void ObjCStringRegion::dumpToStream(raw_ostream &os) const {
472
0
  assert(Str != nullptr && "Expecting non-null ObjCStringLiteral");
473
0
  Str->printPretty(os, nullptr, PrintingPolicy(getContext().getLangOpts()));
474
0
}
475
476
75
void SymbolicRegion::dumpToStream(raw_ostream &os) const {
477
75
  if (isa<HeapSpaceRegion>(getSuperRegion()))
478
30
    os << "Heap";
479
75
  os << "SymRegion{" << sym << '}';
480
75
}
481
482
254
void VarRegion::dumpToStream(raw_ostream &os) const {
483
254
  const auto *VD = cast<VarDecl>(D);
484
254
  if (const IdentifierInfo *ID = VD->getIdentifier())
485
254
    os << ID->getName();
486
0
  else
487
0
    os << "VarRegion{D" << VD->getID() << '}';
488
254
}
489
490
0
LLVM_DUMP_METHOD void RegionRawOffset::dump() const {
491
0
  dumpToStream(llvm::errs());
492
0
}
493
494
0
void RegionRawOffset::dumpToStream(raw_ostream &os) const {
495
0
  os << "raw_offset{" << getRegion() << ',' << getOffset().getQuantity() << '}';
496
0
}
497
498
0
void CodeSpaceRegion::dumpToStream(raw_ostream &os) const {
499
0
  os << "CodeSpaceRegion";
500
0
}
501
502
0
void StaticGlobalSpaceRegion::dumpToStream(raw_ostream &os) const {
503
0
  os << "StaticGlobalsMemSpace{" << CR << '}';
504
0
}
505
506
4
void GlobalInternalSpaceRegion::dumpToStream(raw_ostream &os) const {
507
4
  os << "GlobalInternalSpaceRegion";
508
4
}
509
510
29
void GlobalSystemSpaceRegion::dumpToStream(raw_ostream &os) const {
511
29
  os << "GlobalSystemSpaceRegion";
512
29
}
513
514
0
void GlobalImmutableSpaceRegion::dumpToStream(raw_ostream &os) const {
515
0
  os << "GlobalImmutableSpaceRegion";
516
0
}
517
518
0
void HeapSpaceRegion::dumpToStream(raw_ostream &os) const {
519
0
  os << "HeapSpaceRegion";
520
0
}
521
522
0
void UnknownSpaceRegion::dumpToStream(raw_ostream &os) const {
523
0
  os << "UnknownSpaceRegion";
524
0
}
525
526
0
void StackArgumentsSpaceRegion::dumpToStream(raw_ostream &os) const {
527
0
  os << "StackArgumentsSpaceRegion";
528
0
}
529
530
0
void StackLocalsSpaceRegion::dumpToStream(raw_ostream &os) const {
531
0
  os << "StackLocalsSpaceRegion";
532
0
}
533
534
5.39k
bool MemRegion::canPrintPretty() const {
535
5.39k
  return canPrintPrettyAsExpr();
536
5.39k
}
537
538
114
bool MemRegion::canPrintPrettyAsExpr() const {
539
114
  return false;
540
114
}
541
542
1.71k
void MemRegion::printPretty(raw_ostream &os) const {
543
1.71k
  assert(canPrintPretty() && "This region cannot be printed pretty.");
544
1.71k
  os << "'";
545
1.71k
  printPrettyAsExpr(os);
546
1.71k
  os << "'";
547
1.71k
}
548
549
0
void MemRegion::printPrettyAsExpr(raw_ostream &) const {
550
0
  llvm_unreachable("This region cannot be printed pretty.");
551
0
}
552
553
5.45k
bool VarRegion::canPrintPrettyAsExpr() const {
554
5.45k
  return true;
555
5.45k
}
556
557
1.81k
void VarRegion::printPrettyAsExpr(raw_ostream &os) const {
558
1.81k
  os << getDecl()->getName();
559
1.81k
}
560
561
39
bool ObjCIvarRegion::canPrintPrettyAsExpr() const {
562
39
  return true;
563
39
}
564
565
14
void ObjCIvarRegion::printPrettyAsExpr(raw_ostream &os) const {
566
14
  os << getDecl()->getName();
567
14
}
568
569
124
bool FieldRegion::canPrintPretty() const {
570
124
  return true;
571
124
}
572
573
152
bool FieldRegion::canPrintPrettyAsExpr() const {
574
152
  return superRegion->canPrintPrettyAsExpr();
575
152
}
576
577
60
void FieldRegion::printPrettyAsExpr(raw_ostream &os) const {
578
60
  assert(canPrintPrettyAsExpr());
579
60
  superRegion->printPrettyAsExpr(os);
580
60
  os << "." << getDecl()->getName();
581
60
}
582
583
79
void FieldRegion::printPretty(raw_ostream &os) const {
584
79
  if (canPrintPrettyAsExpr()) {
585
51
    os << "\'";
586
51
    printPrettyAsExpr(os);
587
51
    os << "'";
588
51
  } else {
589
28
    os << "field " << "\'" << getDecl()->getName() << "'";
590
28
  }
591
79
}
592
593
6
bool CXXBaseObjectRegion::canPrintPrettyAsExpr() const {
594
6
  return superRegion->canPrintPrettyAsExpr();
595
6
}
596
597
3
void CXXBaseObjectRegion::printPrettyAsExpr(raw_ostream &os) const {
598
3
  superRegion->printPrettyAsExpr(os);
599
3
}
600
601
0
bool CXXDerivedObjectRegion::canPrintPrettyAsExpr() const {
602
0
  return superRegion->canPrintPrettyAsExpr();
603
0
}
604
605
0
void CXXDerivedObjectRegion::printPrettyAsExpr(raw_ostream &os) const {
606
0
  superRegion->printPrettyAsExpr(os);
607
0
}
608
609
77
std::string MemRegion::getDescriptiveName(bool UseQuotes) const {
610
77
  std::string VariableName;
611
77
  std::string ArrayIndices;
612
77
  const MemRegion *R = this;
613
77
  SmallString<50> buf;
614
77
  llvm::raw_svector_ostream os(buf);
615
77
616
77
  // Obtain array indices to add them to the variable name.
617
77
  const ElementRegion *ER = nullptr;
618
104
  while ((ER = R->getAs<ElementRegion>())) {
619
27
    // Index is a ConcreteInt.
620
27
    if (auto CI = ER->getIndex().getAs<nonloc::ConcreteInt>()) {
621
27
      llvm::SmallString<2> Idx;
622
27
      CI->getValue().toString(Idx);
623
27
      ArrayIndices = (llvm::Twine("[") + Idx.str() + "]" + ArrayIndices).str();
624
27
    }
625
0
    // If not a ConcreteInt, try to obtain the variable
626
0
    // name by calling 'getDescriptiveName' recursively.
627
0
    else {
628
0
      std::string Idx = ER->getDescriptiveName(false);
629
0
      if (!Idx.empty()) {
630
0
        ArrayIndices = (llvm::Twine("[") + Idx + "]" + ArrayIndices).str();
631
0
      }
632
0
    }
633
27
    R = ER->getSuperRegion();
634
27
  }
635
77
636
77
  // Get variable name.
637
77
  if (R && R->canPrintPrettyAsExpr()) {
638
71
    R->printPrettyAsExpr(os);
639
71
    if (UseQuotes)
640
71
      return (llvm::Twine("'") + os.str() + ArrayIndices + "'").str();
641
0
    else
642
0
      return (llvm::Twine(os.str()) + ArrayIndices).str();
643
6
  }
644
6
645
6
  return VariableName;
646
6
}
647
648
34
SourceRange MemRegion::sourceRange() const {
649
34
  const auto *const VR = dyn_cast<VarRegion>(this->getBaseRegion());
650
34
  const auto *const FR = dyn_cast<FieldRegion>(this);
651
34
652
34
  // Check for more specific regions first.
653
34
  // FieldRegion
654
34
  if (FR) {
655
3
    return FR->getDecl()->getSourceRange();
656
3
  }
657
31
  // VarRegion
658
31
  else if (VR) {
659
31
    return VR->getDecl()->getSourceRange();
660
31
  }
661
0
  // Return invalid source range (can be checked by client).
662
0
  else
663
0
    return {};
664
34
}
665
666
//===----------------------------------------------------------------------===//
667
// MemRegionManager methods.
668
//===----------------------------------------------------------------------===//
669
670
static DefinedOrUnknownSVal getTypeSize(QualType Ty, ASTContext &Ctx,
671
29.7k
                                          SValBuilder &SVB) {
672
29.7k
  CharUnits Size = Ctx.getTypeSizeInChars(Ty);
673
29.7k
  QualType SizeTy = SVB.getArrayIndexType();
674
29.7k
  return SVB.makeIntVal(Size.getQuantity(), SizeTy);
675
29.7k
}
676
677
DefinedOrUnknownSVal MemRegionManager::getStaticSize(const MemRegion *MR,
678
31.8k
                                                     SValBuilder &SVB) const {
679
31.8k
  const auto *SR = cast<SubRegion>(MR);
680
31.8k
  SymbolManager &SymMgr = SVB.getSymbolManager();
681
31.8k
682
31.8k
  switch (SR->getKind()) {
683
2.03k
  case MemRegion::AllocaRegionKind:
684
2.03k
  case MemRegion::SymbolicRegionKind:
685
2.03k
    return nonloc::SymbolVal(SymMgr.getExtentSymbol(SR));
686
2.03k
  case MemRegion::StringRegionKind:
687
8
    return SVB.makeIntVal(
688
8
        cast<StringRegion>(SR)->getStringLiteral()->getByteLength() + 1,
689
8
        SVB.getArrayIndexType());
690
12.2k
  case MemRegion::CompoundLiteralRegionKind:
691
12.2k
  case MemRegion::CXXBaseObjectRegionKind:
692
12.2k
  case MemRegion::CXXDerivedObjectRegionKind:
693
12.2k
  case MemRegion::CXXTempObjectRegionKind:
694
12.2k
  case MemRegion::CXXThisRegionKind:
695
12.2k
  case MemRegion::ObjCIvarRegionKind:
696
12.2k
  case MemRegion::VarRegionKind:
697
12.2k
  case MemRegion::ElementRegionKind:
698
12.2k
  case MemRegion::ObjCStringRegionKind: {
699
12.2k
    QualType Ty = cast<TypedValueRegion>(SR)->getDesugaredValueType(Ctx);
700
12.2k
    if (isa<VariableArrayType>(Ty))
701
44
      return nonloc::SymbolVal(SymMgr.getExtentSymbol(SR));
702
12.2k
703
12.2k
    if (Ty->isIncompleteType())
704
2
      return UnknownVal();
705
12.2k
706
12.2k
    return getTypeSize(Ty, Ctx, SVB);
707
12.2k
  }
708
17.5k
  case MemRegion::FieldRegionKind: {
709
17.5k
    // Force callers to deal with bitfields explicitly.
710
17.5k
    if (cast<FieldRegion>(SR)->getDecl()->isBitField())
711
37
      return UnknownVal();
712
17.5k
713
17.5k
    QualType Ty = cast<TypedValueRegion>(SR)->getDesugaredValueType(Ctx);
714
17.5k
    DefinedOrUnknownSVal Size = getTypeSize(Ty, Ctx, SVB);
715
17.5k
716
17.5k
    // A zero-length array at the end of a struct often stands for dynamically
717
17.5k
    // allocated extra memory.
718
17.5k
    if (Size.isZeroConstant()) {
719
5
      if (isa<ConstantArrayType>(Ty))
720
3
        return UnknownVal();
721
17.4k
    }
722
17.4k
723
17.4k
    return Size;
724
17.4k
  }
725
17.4k
    // FIXME: The following are being used in 'SimpleSValBuilder' and in
726
17.4k
    // 'ArrayBoundChecker::checkLocation' because there is no symbol to
727
17.4k
    // represent the regions more appropriately.
728
17.4k
  case MemRegion::BlockDataRegionKind:
729
6
  case MemRegion::BlockCodeRegionKind:
730
6
  case MemRegion::FunctionCodeRegionKind:
731
6
    return nonloc::SymbolVal(SymMgr.getExtentSymbol(SR));
732
6
  default:
733
0
    llvm_unreachable("Unhandled region");
734
31.8k
  }
735
31.8k
}
736
737
template <typename REG>
738
233k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
233k
  if (!region) {
740
29.6k
    region = A.Allocate<REG>();
741
29.6k
    new (region) REG(*this);
742
29.6k
  }
743
233k
744
233k
  return region;
745
233k
}
clang::ento::GlobalSystemSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::GlobalSystemSpaceRegion>(clang::ento::GlobalSystemSpaceRegion*&)
Line
Count
Source
738
35.2k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
35.2k
  if (!region) {
740
6.21k
    region = A.Allocate<REG>();
741
6.21k
    new (region) REG(*this);
742
6.21k
  }
743
35.2k
744
35.2k
  return region;
745
35.2k
}
clang::ento::GlobalImmutableSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::GlobalImmutableSpaceRegion>(clang::ento::GlobalImmutableSpaceRegion*&)
Line
Count
Source
738
362
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
362
  if (!region) {
740
220
    region = A.Allocate<REG>();
741
220
    new (region) REG(*this);
742
220
  }
743
362
744
362
  return region;
745
362
}
clang::ento::GlobalInternalSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::GlobalInternalSpaceRegion>(clang::ento::GlobalInternalSpaceRegion*&)
Line
Count
Source
738
45.0k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
45.0k
  if (!region) {
740
6.41k
    region = A.Allocate<REG>();
741
6.41k
    new (region) REG(*this);
742
6.41k
  }
743
45.0k
744
45.0k
  return region;
745
45.0k
}
clang::ento::HeapSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::HeapSpaceRegion>(clang::ento::HeapSpaceRegion*&)
Line
Count
Source
738
1.43k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
1.43k
  if (!region) {
740
1.14k
    region = A.Allocate<REG>();
741
1.14k
    new (region) REG(*this);
742
1.14k
  }
743
1.43k
744
1.43k
  return region;
745
1.43k
}
clang::ento::UnknownSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::UnknownSpaceRegion>(clang::ento::UnknownSpaceRegion*&)
Line
Count
Source
738
68.0k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
68.0k
  if (!region) {
740
7.37k
    region = A.Allocate<REG>();
741
7.37k
    new (region) REG(*this);
742
7.37k
  }
743
68.0k
744
68.0k
  return region;
745
68.0k
}
clang::ento::CodeSpaceRegion const* clang::ento::MemRegionManager::LazyAllocate<clang::ento::CodeSpaceRegion>(clang::ento::CodeSpaceRegion*&)
Line
Count
Source
738
83.0k
const REG *MemRegionManager::LazyAllocate(REG*& region) {
739
83.0k
  if (!region) {
740
8.29k
    region = A.Allocate<REG>();
741
8.29k
    new (region) REG(*this);
742
8.29k
  }
743
83.0k
744
83.0k
  return region;
745
83.0k
}
746
747
template <typename REG, typename ARG>
748
const REG *MemRegionManager::LazyAllocate(REG*& region, ARG a) {
749
  if (!region) {
750
    region = A.Allocate<REG>();
751
    new (region) REG(this, a);
752
  }
753
754
  return region;
755
}
756
757
const StackLocalsSpaceRegion*
758
169k
MemRegionManager::getStackLocalsRegion(const StackFrameContext *STC) {
759
169k
  assert(STC);
760
169k
  StackLocalsSpaceRegion *&R = StackLocalsSpaceRegions[STC];
761
169k
762
169k
  if (R)
763
158k
    return R;
764
10.5k
765
10.5k
  R = A.Allocate<StackLocalsSpaceRegion>();
766
10.5k
  new (R) StackLocalsSpaceRegion(*this, STC);
767
10.5k
  return R;
768
10.5k
}
769
770
const StackArgumentsSpaceRegion *
771
288k
MemRegionManager::getStackArgumentsRegion(const StackFrameContext *STC) {
772
288k
  assert(STC);
773
288k
  StackArgumentsSpaceRegion *&R = StackArgumentsSpaceRegions[STC];
774
288k
775
288k
  if (R)
776
263k
    return R;
777
24.3k
778
24.3k
  R = A.Allocate<StackArgumentsSpaceRegion>();
779
24.3k
  new (R) StackArgumentsSpaceRegion(*this, STC);
780
24.3k
  return R;
781
24.3k
}
782
783
const GlobalsSpaceRegion
784
*MemRegionManager::getGlobalsRegion(MemRegion::Kind K,
785
81.2k
                                    const CodeTextRegion *CR) {
786
81.2k
  if (!CR) {
787
80.6k
    if (K == MemRegion::GlobalSystemSpaceRegionKind)
788
35.2k
      return LazyAllocate(SystemGlobals);
789
45.4k
    if (K == MemRegion::GlobalImmutableSpaceRegionKind)
790
362
      return LazyAllocate(ImmutableGlobals);
791
45.0k
    assert(K == MemRegion::GlobalInternalSpaceRegionKind);
792
45.0k
    return LazyAllocate(InternalGlobals);
793
45.0k
  }
794
631
795
631
  assert(K == MemRegion::StaticGlobalSpaceRegionKind);
796
631
  StaticGlobalSpaceRegion *&R = StaticsGlobalSpaceRegions[CR];
797
631
  if (R)
798
466
    return R;
799
165
800
165
  R = A.Allocate<StaticGlobalSpaceRegion>();
801
165
  new (R) StaticGlobalSpaceRegion(*this, CR);
802
165
  return R;
803
165
}
804
805
1.43k
const HeapSpaceRegion *MemRegionManager::getHeapRegion() {
806
1.43k
  return LazyAllocate(heap);
807
1.43k
}
808
809
68.0k
const UnknownSpaceRegion *MemRegionManager::getUnknownRegion() {
810
68.0k
  return LazyAllocate(unknown);
811
68.0k
}
812
813
83.0k
const CodeSpaceRegion *MemRegionManager::getCodeRegion() {
814
83.0k
  return LazyAllocate(code);
815
83.0k
}
816
817
//===----------------------------------------------------------------------===//
818
// Constructing regions.
819
//===----------------------------------------------------------------------===//
820
821
6.39k
const StringRegion *MemRegionManager::getStringRegion(const StringLiteral *Str){
822
6.39k
  return getSubRegion<StringRegion>(
823
6.39k
      Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
824
6.39k
}
825
826
const ObjCStringRegion *
827
1.09k
MemRegionManager::getObjCStringRegion(const ObjCStringLiteral *Str){
828
1.09k
  return getSubRegion<ObjCStringRegion>(
829
1.09k
      Str, cast<GlobalInternalSpaceRegion>(getGlobalsRegion()));
830
1.09k
}
831
832
/// Look through a chain of LocationContexts to either find the
833
/// StackFrameContext that matches a DeclContext, or find a VarRegion
834
/// for a variable captured by a block.
835
static llvm::PointerUnion<const StackFrameContext *, const VarRegion *>
836
getStackOrCaptureRegionForDeclContext(const LocationContext *LC,
837
                                      const DeclContext *DC,
838
294k
                                      const VarDecl *VD) {
839
294k
  while (LC) {
840
294k
    if (const auto *SFC = dyn_cast<StackFrameContext>(LC)) {
841
294k
      if (cast<DeclContext>(SFC->getDecl()) == DC)
842
293k
        return SFC;
843
643
    }
844
643
    if (const auto *BC = dyn_cast<BlockInvocationContext>(LC)) {
845
161
      const auto *BR =
846
161
          static_cast<const BlockDataRegion *>(BC->getContextData());
847
161
      // FIXME: This can be made more efficient.
848
161
      for (BlockDataRegion::referenced_vars_iterator
849
161
           I = BR->referenced_vars_begin(),
850
203
           E = BR->referenced_vars_end(); I != E; 
++I42
) {
851
203
        const VarRegion *VR = I.getOriginalRegion();
852
203
        if (VR->getDecl() == VD)
853
161
          return cast<VarRegion>(I.getCapturedRegion());
854
203
      }
855
161
    }
856
643
857
643
    LC = LC->getParent();
858
482
  }
859
294k
  
return (const StackFrameContext *)nullptr213
;
860
294k
}
861
862
const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
863
302k
                                                const LocationContext *LC) {
864
302k
  D = D->getCanonicalDecl();
865
302k
  const MemRegion *sReg = nullptr;
866
302k
867
302k
  if (D->hasGlobalStorage() && 
!D->isStaticLocal()8.52k
) {
868
7.86k
869
7.86k
    // First handle the globals defined in system headers.
870
7.86k
    if (Ctx.getSourceManager().isInSystemHeader(D->getLocation())) {
871
59
      // Whitelist the system globals which often DO GET modified, assume the
872
59
      // rest are immutable.
873
59
      if (D->getName().find("errno") != StringRef::npos)
874
6
        sReg = getGlobalsRegion(MemRegion::GlobalSystemSpaceRegionKind);
875
53
      else
876
53
        sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
877
59
878
59
    // Treat other globals as GlobalInternal unless they are constants.
879
7.80k
    } else {
880
7.80k
      QualType GQT = D->getType();
881
7.80k
      const Type *GT = GQT.getTypePtrOrNull();
882
7.80k
      // TODO: We could walk the complex types here and see if everything is
883
7.80k
      // constified.
884
7.80k
      if (GT && GQT.isConstQualified() && 
GT->isArithmeticType()420
)
885
160
        sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
886
7.64k
      else
887
7.64k
        sReg = getGlobalsRegion();
888
7.80k
    }
889
7.86k
890
7.86k
  // Finally handle static locals.
891
294k
  } else {
892
294k
    // FIXME: Once we implement scope handling, we will need to properly lookup
893
294k
    // 'D' to the proper LocationContext.
894
294k
    const DeclContext *DC = D->getDeclContext();
895
294k
    llvm::PointerUnion<const StackFrameContext *, const VarRegion *> V =
896
294k
      getStackOrCaptureRegionForDeclContext(LC, DC, D);
897
294k
898
294k
    if (V.is<const VarRegion*>())
899
161
      return V.get<const VarRegion*>();
900
294k
901
294k
    const auto *STC = V.get<const StackFrameContext *>();
902
294k
903
294k
    if (!STC) {
904
213
      // FIXME: Assign a more sensible memory space to static locals
905
213
      // we see from within blocks that we analyze as top-level declarations.
906
213
      sReg = getUnknownRegion();
907
293k
    } else {
908
293k
      if (D->hasLocalStorage()) {
909
293k
        sReg = isa<ParmVarDecl>(D) || 
isa<ImplicitParamDecl>(D)159k
910
293k
               ? 
static_cast<const MemRegion*>(getStackArgumentsRegion(STC))140k
911
293k
               : 
static_cast<const MemRegion*>(getStackLocalsRegion(STC))152k
;
912
293k
      }
913
631
      else {
914
631
        assert(D->isStaticLocal());
915
631
        const Decl *STCD = STC->getDecl();
916
631
        if (isa<FunctionDecl>(STCD) || 
isa<ObjCMethodDecl>(STCD)82
)
917
618
          sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
918
618
                                  getFunctionCodeRegion(cast<NamedDecl>(STCD)));
919
13
        else if (const auto *BD = dyn_cast<BlockDecl>(STCD)) {
920
13
          // FIXME: The fallback type here is totally bogus -- though it should
921
13
          // never be queried, it will prevent uniquing with the real
922
13
          // BlockCodeRegion. Ideally we'd fix the AST so that we always had a
923
13
          // signature.
924
13
          QualType T;
925
13
          if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten())
926
11
            T = TSI->getType();
927
13
          if (T.isNull())
928
2
            T = getContext().VoidTy;
929
13
          if (!T->getAs<FunctionType>())
930
5
            T = getContext().getFunctionNoProtoType(T);
931
13
          T = getContext().getBlockPointerType(T);
932
13
933
13
          const BlockCodeRegion *BTR =
934
13
            getBlockCodeRegion(BD, Ctx.getCanonicalType(T),
935
13
                               STC->getAnalysisDeclContext());
936
13
          sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
937
13
                                  BTR);
938
13
        }
939
0
        else {
940
0
          sReg = getGlobalsRegion();
941
0
        }
942
631
      }
943
293k
    }
944
294k
  }
945
302k
946
302k
  
return getSubRegion<VarRegion>(D, sReg)301k
;
947
302k
}
948
949
const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
950
192
                                                const MemRegion *superR) {
951
192
  D = D->getCanonicalDecl();
952
192
  return getSubRegion<VarRegion>(D, superR);
953
192
}
954
955
const BlockDataRegion *
956
MemRegionManager::getBlockDataRegion(const BlockCodeRegion *BC,
957
                                     const LocationContext *LC,
958
376
                                     unsigned blockCount) {
959
376
  const MemSpaceRegion *sReg = nullptr;
960
376
  const BlockDecl *BD = BC->getDecl();
961
376
  if (!BD->hasCaptures()) {
962
149
    // This handles 'static' blocks.
963
149
    sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
964
149
  }
965
227
  else {
966
227
    if (LC) {
967
227
      // FIXME: Once we implement scope handling, we want the parent region
968
227
      // to be the scope.
969
227
      const StackFrameContext *STC = LC->getStackFrame();
970
227
      assert(STC);
971
227
      sReg = getStackLocalsRegion(STC);
972
227
    }
973
0
    else {
974
0
      // We allow 'LC' to be NULL for cases where want BlockDataRegions
975
0
      // without context-sensitivity.
976
0
      sReg = getUnknownRegion();
977
0
    }
978
227
  }
979
376
980
376
  return getSubRegion<BlockDataRegion>(BC, LC, blockCount, sReg);
981
376
}
982
983
const CXXTempObjectRegion *
984
15
MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
985
15
  return getSubRegion<CXXTempObjectRegion>(
986
15
      Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, nullptr));
987
15
}
988
989
const CompoundLiteralRegion*
990
MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
991
52
                                           const LocationContext *LC) {
992
52
  const MemSpaceRegion *sReg = nullptr;
993
52
994
52
  if (CL->isFileScope())
995
0
    sReg = getGlobalsRegion();
996
52
  else {
997
52
    const StackFrameContext *STC = LC->getStackFrame();
998
52
    assert(STC);
999
52
    sReg = getStackLocalsRegion(STC);
1000
52
  }
1001
52
1002
52
  return getSubRegion<CompoundLiteralRegion>(CL, sReg);
1003
52
}
1004
1005
const ElementRegion*
1006
MemRegionManager::getElementRegion(QualType elementType, NonLoc Idx,
1007
                                   const SubRegion* superRegion,
1008
66.2k
                                   ASTContext &Ctx){
1009
66.2k
  QualType T = Ctx.getCanonicalType(elementType).getUnqualifiedType();
1010
66.2k
1011
66.2k
  llvm::FoldingSetNodeID ID;
1012
66.2k
  ElementRegion::ProfileRegion(ID, T, Idx, superRegion);
1013
66.2k
1014
66.2k
  void *InsertPos;
1015
66.2k
  MemRegion* data = Regions.FindNodeOrInsertPos(ID, InsertPos);
1016
66.2k
  auto *R = cast_or_null<ElementRegion>(data);
1017
66.2k
1018
66.2k
  if (!R) {
1019
11.7k
    R = A.Allocate<ElementRegion>();
1020
11.7k
    new (R) ElementRegion(T, Idx, superRegion);
1021
11.7k
    Regions.InsertNode(R, InsertPos);
1022
11.7k
  }
1023
66.2k
1024
66.2k
  return R;
1025
66.2k
}
1026
1027
const FunctionCodeRegion *
1028
82.6k
MemRegionManager::getFunctionCodeRegion(const NamedDecl *FD) {
1029
82.6k
  // To think: should we canonicalize the declaration here?
1030
82.6k
  return getSubRegion<FunctionCodeRegion>(FD, getCodeRegion());
1031
82.6k
}
1032
1033
const BlockCodeRegion *
1034
MemRegionManager::getBlockCodeRegion(const BlockDecl *BD, CanQualType locTy,
1035
389
                                     AnalysisDeclContext *AC) {
1036
389
  return getSubRegion<BlockCodeRegion>(BD, locTy, AC, getCodeRegion());
1037
389
}
1038
1039
/// getSymbolicRegion - Retrieve or create a "symbolic" memory region.
1040
65.8k
const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
1041
65.8k
  return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
1042
65.8k
}
1043
1044
1.43k
const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
1045
1.43k
  return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
1046
1.43k
}
1047
1048
const FieldRegion*
1049
MemRegionManager::getFieldRegion(const FieldDecl *d,
1050
135k
                                 const SubRegion* superRegion){
1051
135k
  return getSubRegion<FieldRegion>(d, superRegion);
1052
135k
}
1053
1054
const ObjCIvarRegion*
1055
MemRegionManager::getObjCIvarRegion(const ObjCIvarDecl *d,
1056
1.44k
                                    const SubRegion* superRegion) {
1057
1.44k
  return getSubRegion<ObjCIvarRegion>(d, superRegion);
1058
1.44k
}
1059
1060
const CXXTempObjectRegion*
1061
MemRegionManager::getCXXTempObjectRegion(Expr const *E,
1062
16.2k
                                         LocationContext const *LC) {
1063
16.2k
  const StackFrameContext *SFC = LC->getStackFrame();
1064
16.2k
  assert(SFC);
1065
16.2k
  return getSubRegion<CXXTempObjectRegion>(E, getStackLocalsRegion(SFC));
1066
16.2k
}
1067
1068
/// Checks whether \p BaseClass is a valid virtual or direct non-virtual base
1069
/// class of the type of \p Super.
1070
static bool isValidBaseClass(const CXXRecordDecl *BaseClass,
1071
                             const TypedValueRegion *Super,
1072
1.51k
                             bool IsVirtual) {
1073
1.51k
  BaseClass = BaseClass->getCanonicalDecl();
1074
1.51k
1075
1.51k
  const CXXRecordDecl *Class = Super->getValueType()->getAsCXXRecordDecl();
1076
1.51k
  if (!Class)
1077
0
    return true;
1078
1.51k
1079
1.51k
  if (IsVirtual)
1080
157
    return Class->isVirtuallyDerivedFrom(BaseClass);
1081
1.35k
1082
1.52k
  
for (const auto &I : Class->bases())1.35k
{
1083
1.52k
    if (I.getType()->getAsCXXRecordDecl()->getCanonicalDecl() == BaseClass)
1084
1.35k
      return true;
1085
1.52k
  }
1086
1.35k
1087
1.35k
  
return false0
;
1088
1.35k
}
1089
1090
const CXXBaseObjectRegion *
1091
MemRegionManager::getCXXBaseObjectRegion(const CXXRecordDecl *RD,
1092
                                         const SubRegion *Super,
1093
1.96k
                                         bool IsVirtual) {
1094
1.96k
  if (isa<TypedValueRegion>(Super)) {
1095
1.51k
    assert(isValidBaseClass(RD, cast<TypedValueRegion>(Super), IsVirtual));
1096
1.51k
    (void)&isValidBaseClass;
1097
1.51k
1098
1.51k
    if (IsVirtual) {
1099
157
      // Virtual base regions should not be layered, since the layout rules
1100
157
      // are different.
1101
195
      while (const auto *Base = dyn_cast<CXXBaseObjectRegion>(Super))
1102
38
        Super = cast<SubRegion>(Base->getSuperRegion());
1103
157
      assert(Super && !isa<MemSpaceRegion>(Super));
1104
157
    }
1105
1.51k
  }
1106
1.96k
1107
1.96k
  return getSubRegion<CXXBaseObjectRegion>(RD, IsVirtual, Super);
1108
1.96k
}
1109
1110
const CXXDerivedObjectRegion *
1111
MemRegionManager::getCXXDerivedObjectRegion(const CXXRecordDecl *RD,
1112
21
                                            const SubRegion *Super) {
1113
21
  return getSubRegion<CXXDerivedObjectRegion>(RD, Super);
1114
21
}
1115
1116
const CXXThisRegion*
1117
MemRegionManager::getCXXThisRegion(QualType thisPointerTy,
1118
147k
                                   const LocationContext *LC) {
1119
147k
  const auto *PT = thisPointerTy->getAs<PointerType>();
1120
147k
  assert(PT);
1121
147k
  // Inside the body of the operator() of a lambda a this expr might refer to an
1122
147k
  // object in one of the parent location contexts.
1123
147k
  const auto *D = dyn_cast<CXXMethodDecl>(LC->getDecl());
1124
147k
  // FIXME: when operator() of lambda is analyzed as a top level function and
1125
147k
  // 'this' refers to a this to the enclosing scope, there is no right region to
1126
147k
  // return.
1127
147k
  while (!LC->inTopFrame() && 
(144k
!D144k
||
D->isStatic()144k
||
1128
144k
                               
PT != D->getThisType()->getAs<PointerType>()144k
)) {
1129
80
    LC = LC->getParent();
1130
80
    D = dyn_cast<CXXMethodDecl>(LC->getDecl());
1131
80
  }
1132
147k
  const StackFrameContext *STC = LC->getStackFrame();
1133
147k
  assert(STC);
1134
147k
  return getSubRegion<CXXThisRegion>(PT, getStackArgumentsRegion(STC));
1135
147k
}
1136
1137
const AllocaRegion*
1138
MemRegionManager::getAllocaRegion(const Expr *E, unsigned cnt,
1139
91
                                  const LocationContext *LC) {
1140
91
  const StackFrameContext *STC = LC->getStackFrame();
1141
91
  assert(STC);
1142
91
  return getSubRegion<AllocaRegion>(E, cnt, getStackLocalsRegion(STC));
1143
91
}
1144
1145
2.97M
const MemSpaceRegion *MemRegion::getMemorySpace() const {
1146
2.97M
  const MemRegion *R = this;
1147
2.97M
  const auto *SR = dyn_cast<SubRegion>(this);
1148
2.97M
1149
6.03M
  while (SR) {
1150
3.06M
    R = SR->getSuperRegion();
1151
3.06M
    SR = dyn_cast<SubRegion>(R);
1152
3.06M
  }
1153
2.97M
1154
2.97M
  return dyn_cast<MemSpaceRegion>(R);
1155
2.97M
}
1156
1157
91.2k
bool MemRegion::hasStackStorage() const {
1158
91.2k
  return isa<StackSpaceRegion>(getMemorySpace());
1159
91.2k
}
1160
1161
69.7k
bool MemRegion::hasStackNonParametersStorage() const {
1162
69.7k
  return isa<StackLocalsSpaceRegion>(getMemorySpace());
1163
69.7k
}
1164
1165
71.4k
bool MemRegion::hasStackParametersStorage() const {
1166
71.4k
  return isa<StackArgumentsSpaceRegion>(getMemorySpace());
1167
71.4k
}
1168
1169
0
bool MemRegion::hasGlobalsOrParametersStorage() const {
1170
0
  const MemSpaceRegion *MS = getMemorySpace();
1171
0
  return isa<StackArgumentsSpaceRegion>(MS) ||
1172
0
         isa<GlobalsSpaceRegion>(MS);
1173
0
}
1174
1175
// getBaseRegion strips away all elements and fields, and get the base region
1176
// of them.
1177
11.7M
const MemRegion *MemRegion::getBaseRegion() const {
1178
11.7M
  const MemRegion *R = this;
1179
14.2M
  while (true) {
1180
14.2M
    switch (R->getKind()) {
1181
2.51M
      case MemRegion::ElementRegionKind:
1182
2.51M
      case MemRegion::FieldRegionKind:
1183
2.51M
      case MemRegion::ObjCIvarRegionKind:
1184
2.51M
      case MemRegion::CXXBaseObjectRegionKind:
1185
2.51M
      case MemRegion::CXXDerivedObjectRegionKind:
1186
2.51M
        R = cast<SubRegion>(R)->getSuperRegion();
1187
2.51M
        continue;
1188
11.7M
      default:
1189
11.7M
        break;
1190
11.7M
    }
1191
11.7M
    break;
1192
11.7M
  }
1193
11.7M
  return R;
1194
11.7M
}
1195
1196
// getgetMostDerivedObjectRegion gets the region of the root class of a C++
1197
// class hierarchy.
1198
17.5k
const MemRegion *MemRegion::getMostDerivedObjectRegion() const {
1199
17.5k
  const MemRegion *R = this;
1200
17.6k
  while (const auto *BR = dyn_cast<CXXBaseObjectRegion>(R))
1201
96
    R = BR->getSuperRegion();
1202
17.5k
  return R;
1203
17.5k
}
1204
1205
0
bool MemRegion::isSubRegionOf(const MemRegion *) const {
1206
0
  return false;
1207
0
}
1208
1209
//===----------------------------------------------------------------------===//
1210
// View handling.
1211
//===----------------------------------------------------------------------===//
1212
1213
509k
const MemRegion *MemRegion::StripCasts(bool StripBaseAndDerivedCasts) const {
1214
509k
  const MemRegion *R = this;
1215
559k
  while (true) {
1216
559k
    switch (R->getKind()) {
1217
79.9k
    case ElementRegionKind: {
1218
79.9k
      const auto *ER = cast<ElementRegion>(R);
1219
79.9k
      if (!ER->getIndex().isZeroConstant())
1220
32.6k
        return R;
1221
47.3k
      R = ER->getSuperRegion();
1222
47.3k
      break;
1223
47.3k
    }
1224
47.3k
    case CXXBaseObjectRegionKind:
1225
2.65k
    case CXXDerivedObjectRegionKind:
1226
2.65k
      if (!StripBaseAndDerivedCasts)
1227
0
        return R;
1228
2.65k
      R = cast<TypedValueRegion>(R)->getSuperRegion();
1229
2.65k
      break;
1230
476k
    default:
1231
476k
      return R;
1232
559k
    }
1233
559k
  }
1234
509k
}
1235
1236
2.16M
const SymbolicRegion *MemRegion::getSymbolicBase() const {
1237
2.16M
  const auto *SubR = dyn_cast<SubRegion>(this);
1238
2.16M
1239
4.62M
  while (SubR) {
1240
2.72M
    if (const auto *SymR = dyn_cast<SymbolicRegion>(SubR))
1241
269k
      return SymR;
1242
2.45M
    SubR = dyn_cast<SubRegion>(SubR->getSuperRegion());
1243
2.45M
  }
1244
2.16M
  
return nullptr1.89M
;
1245
2.16M
}
1246
1247
18.8k
RegionRawOffset ElementRegion::getAsArrayOffset() const {
1248
18.8k
  int64_t offset = 0;
1249
18.8k
  const ElementRegion *ER = this;
1250
18.8k
  const MemRegion *superR = nullptr;
1251
18.8k
  ASTContext &C = getContext();
1252
18.8k
1253
18.8k
  // FIXME: Handle multi-dimensional arrays.
1254
18.8k
1255
35.0k
  while (ER) {
1256
19.3k
    superR = ER->getSuperRegion();
1257
19.3k
1258
19.3k
    // FIXME: generalize to symbolic offsets.
1259
19.3k
    SVal index = ER->getIndex();
1260
19.3k
    if (auto CI = index.getAs<nonloc::ConcreteInt>()) {
1261
16.2k
      // Update the offset.
1262
16.2k
      int64_t i = CI->getValue().getSExtValue();
1263
16.2k
1264
16.2k
      if (i != 0) {
1265
3.51k
        QualType elemType = ER->getElementType();
1266
3.51k
1267
3.51k
        // If we are pointing to an incomplete type, go no further.
1268
3.51k
        if (elemType->isIncompleteType()) {
1269
0
          superR = ER;
1270
0
          break;
1271
0
        }
1272
3.51k
1273
3.51k
        int64_t size = C.getTypeSizeInChars(elemType).getQuantity();
1274
3.51k
        if (auto NewOffset = llvm::checkedMulAdd(i, size, offset)) {
1275
3.50k
          offset = *NewOffset;
1276
3.50k
        } else {
1277
6
          LLVM_DEBUG(llvm::dbgs() << "MemRegion::getAsArrayOffset: "
1278
6
                                  << "offset overflowing, returning unknown\n");
1279
6
1280
6
          return nullptr;
1281
6
        }
1282
16.2k
      }
1283
16.2k
1284
16.2k
      // Go to the next ElementRegion (if any).
1285
16.2k
      ER = dyn_cast<ElementRegion>(superR);
1286
16.2k
      continue;
1287
16.2k
    }
1288
3.09k
1289
3.09k
    return nullptr;
1290
3.09k
  }
1291
18.8k
1292
18.8k
  assert(superR && "super region cannot be NULL");
1293
15.7k
  return RegionRawOffset(superR, CharUnits::fromQuantity(offset));
1294
18.8k
}
1295
1296
/// Returns true if \p Base is an immediate base class of \p Child
1297
static bool isImmediateBase(const CXXRecordDecl *Child,
1298
213
                            const CXXRecordDecl *Base) {
1299
213
  assert(Child && "Child must not be null");
1300
213
  // Note that we do NOT canonicalize the base class here, because
1301
213
  // ASTRecordLayout doesn't either. If that leads us down the wrong path,
1302
213
  // so be it; at least we won't crash.
1303
245
  for (const auto &I : Child->bases()) {
1304
245
    if (I.getType()->getAsCXXRecordDecl() == Base)
1305
211
      return true;
1306
245
  }
1307
213
1308
213
  
return false2
;
1309
213
}
1310
1311
97.3k
static RegionOffset calculateOffset(const MemRegion *R) {
1312
97.3k
  const MemRegion *SymbolicOffsetBase = nullptr;
1313
97.3k
  int64_t Offset = 0;
1314
97.3k
1315
121k
  while (true) {
1316
121k
    switch (R->getKind()) {
1317
15.0k
    case MemRegion::CodeSpaceRegionKind:
1318
15.0k
    case MemRegion::StackLocalsSpaceRegionKind:
1319
15.0k
    case MemRegion::StackArgumentsSpaceRegionKind:
1320
15.0k
    case MemRegion::HeapSpaceRegionKind:
1321
15.0k
    case MemRegion::UnknownSpaceRegionKind:
1322
15.0k
    case MemRegion::StaticGlobalSpaceRegionKind:
1323
15.0k
    case MemRegion::GlobalInternalSpaceRegionKind:
1324
15.0k
    case MemRegion::GlobalSystemSpaceRegionKind:
1325
15.0k
    case MemRegion::GlobalImmutableSpaceRegionKind:
1326
15.0k
      // Stores can bind directly to a region space to set a default value.
1327
15.0k
      assert(Offset == 0 && !SymbolicOffsetBase);
1328
15.0k
      goto Finish;
1329
15.0k
1330
15.0k
    case MemRegion::FunctionCodeRegionKind:
1331
77
    case MemRegion::BlockCodeRegionKind:
1332
77
    case MemRegion::BlockDataRegionKind:
1333
77
      // These will never have bindings, but may end up having values requested
1334
77
      // if the user does some strange casting.
1335
77
      if (Offset != 0)
1336
6
        SymbolicOffsetBase = R;
1337
77
      goto Finish;
1338
77
1339
81.6k
    case MemRegion::SymbolicRegionKind:
1340
81.6k
    case MemRegion::AllocaRegionKind:
1341
81.6k
    case MemRegion::CompoundLiteralRegionKind:
1342
81.6k
    case MemRegion::CXXThisRegionKind:
1343
81.6k
    case MemRegion::StringRegionKind:
1344
81.6k
    case MemRegion::ObjCStringRegionKind:
1345
81.6k
    case MemRegion::VarRegionKind:
1346
81.6k
    case MemRegion::CXXTempObjectRegionKind:
1347
81.6k
      // Usual base regions.
1348
81.6k
      goto Finish;
1349
81.6k
1350
81.6k
    case MemRegion::ObjCIvarRegionKind:
1351
634
      // This is a little strange, but it's a compromise between
1352
634
      // ObjCIvarRegions having unknown compile-time offsets (when using the
1353
634
      // non-fragile runtime) and yet still being distinct, non-overlapping
1354
634
      // regions. Thus we treat them as "like" base regions for the purposes
1355
634
      // of computing offsets.
1356
634
      goto Finish;
1357
81.6k
1358
81.6k
    case MemRegion::CXXBaseObjectRegionKind: {
1359
1.44k
      const auto *BOR = cast<CXXBaseObjectRegion>(R);
1360
1.44k
      R = BOR->getSuperRegion();
1361
1.44k
1362
1.44k
      QualType Ty;
1363
1.44k
      bool RootIsSymbolic = false;
1364
1.44k
      if (const auto *TVR = dyn_cast<TypedValueRegion>(R)) {
1365
1.19k
        Ty = TVR->getDesugaredValueType(R->getContext());
1366
1.19k
      } else 
if (const auto *248
SR248
= dyn_cast<SymbolicRegion>(R)) {
1367
248
        // If our base region is symbolic, we don't know what type it really is.
1368
248
        // Pretend the type of the symbol is the true dynamic type.
1369
248
        // (This will at least be self-consistent for the life of the symbol.)
1370
248
        Ty = SR->getSymbol()->getType()->getPointeeType();
1371
248
        RootIsSymbolic = true;
1372
248
      }
1373
1.44k
1374
1.44k
      const CXXRecordDecl *Child = Ty->getAsCXXRecordDecl();
1375
1.44k
      if (!Child) {
1376
0
        // We cannot compute the offset of the base class.
1377
0
        SymbolicOffsetBase = R;
1378
1.44k
      } else {
1379
1.44k
        if (RootIsSymbolic) {
1380
248
          // Base layers on symbolic regions may not be type-correct.
1381
248
          // Double-check the inheritance here, and revert to a symbolic offset
1382
248
          // if it's invalid (e.g. due to a reinterpret_cast).
1383
248
          if (BOR->isVirtual()) {
1384
35
            if (!Child->isVirtuallyDerivedFrom(BOR->getDecl()))
1385
0
              SymbolicOffsetBase = R;
1386
213
          } else {
1387
213
            if (!isImmediateBase(Child, BOR->getDecl()))
1388
2
              SymbolicOffsetBase = R;
1389
213
          }
1390
248
        }
1391
1.44k
      }
1392
1.44k
1393
1.44k
      // Don't bother calculating precise offsets if we already have a
1394
1.44k
      // symbolic offset somewhere in the chain.
1395
1.44k
      if (SymbolicOffsetBase)
1396
5
        continue;
1397
1.44k
1398
1.44k
      CharUnits BaseOffset;
1399
1.44k
      const ASTRecordLayout &Layout = R->getContext().getASTRecordLayout(Child);
1400
1.44k
      if (BOR->isVirtual())
1401
96
        BaseOffset = Layout.getVBaseClassOffset(BOR->getDecl());
1402
1.34k
      else
1403
1.34k
        BaseOffset = Layout.getBaseClassOffset(BOR->getDecl());
1404
1.44k
1405
1.44k
      // The base offset is in chars, not in bits.
1406
1.44k
      Offset += BaseOffset.getQuantity() * R->getContext().getCharWidth();
1407
1.44k
      break;
1408
1.44k
    }
1409
1.44k
1410
1.44k
    case MemRegion::CXXDerivedObjectRegionKind: {
1411
4
      // TODO: Store the base type in the CXXDerivedObjectRegion and use it.
1412
4
      goto Finish;
1413
1.44k
    }
1414
1.44k
1415
7.38k
    case MemRegion::ElementRegionKind: {
1416
7.38k
      const auto *ER = cast<ElementRegion>(R);
1417
7.38k
      R = ER->getSuperRegion();
1418
7.38k
1419
7.38k
      QualType EleTy = ER->getValueType();
1420
7.38k
      if (EleTy->isIncompleteType()) {
1421
10
        // We cannot compute the offset of the base class.
1422
10
        SymbolicOffsetBase = R;
1423
10
        continue;
1424
10
      }
1425
7.37k
1426
7.37k
      SVal Index = ER->getIndex();
1427
7.37k
      if (Optional<nonloc::ConcreteInt> CI =
1428
6.94k
              Index.getAs<nonloc::ConcreteInt>()) {
1429
6.94k
        // Don't bother calculating precise offsets if we already have a
1430
6.94k
        // symbolic offset somewhere in the chain.
1431
6.94k
        if (SymbolicOffsetBase)
1432
3
          continue;
1433
6.94k
1434
6.94k
        int64_t i = CI->getValue().getSExtValue();
1435
6.94k
        // This type size is in bits.
1436
6.94k
        Offset += i * R->getContext().getTypeSize(EleTy);
1437
6.94k
      } else {
1438
434
        // We cannot compute offset for non-concrete index.
1439
434
        SymbolicOffsetBase = R;
1440
434
      }
1441
7.37k
      
break7.37k
;
1442
7.37k
    }
1443
14.9k
    case MemRegion::FieldRegionKind: {
1444
14.9k
      const auto *FR = cast<FieldRegion>(R);
1445
14.9k
      R = FR->getSuperRegion();
1446
14.9k
      assert(R);
1447
14.9k
1448
14.9k
      const RecordDecl *RD = FR->getDecl()->getParent();
1449
14.9k
      if (RD->isUnion() || 
!RD->isCompleteDefinition()14.8k
) {
1450
109
        // We cannot compute offset for incomplete type.
1451
109
        // For unions, we could treat everything as offset 0, but we'd rather
1452
109
        // treat each field as a symbolic offset so they aren't stored on top
1453
109
        // of each other, since we depend on things in typed regions actually
1454
109
        // matching their types.
1455
109
        SymbolicOffsetBase = R;
1456
109
      }
1457
14.9k
1458
14.9k
      // Don't bother calculating precise offsets if we already have a
1459
14.9k
      // symbolic offset somewhere in the chain.
1460
14.9k
      if (SymbolicOffsetBase)
1461
248
        continue;
1462
14.6k
1463
14.6k
      // Get the field number.
1464
14.6k
      unsigned idx = 0;
1465
14.6k
      for (RecordDecl::field_iterator FI = RD->field_begin(),
1466
20.4k
             FE = RD->field_end(); FI != FE; 
++FI, ++idx5.75k
) {
1467
20.4k
        if (FR->getDecl() == *FI)
1468
14.6k
          break;
1469
20.4k
      }
1470
14.6k
      const ASTRecordLayout &Layout = R->getContext().getASTRecordLayout(RD);
1471
14.6k
      // This is offset in bits.
1472
14.6k
      Offset += Layout.getFieldOffset(idx);
1473
14.6k
      break;
1474
14.6k
    }
1475
121k
    }
1476
121k
  }
1477
97.3k
1478
97.3k
 Finish:
1479
97.3k
  if (SymbolicOffsetBase)
1480
553
    return RegionOffset(SymbolicOffsetBase, RegionOffset::Symbolic);
1481
96.8k
  return RegionOffset(R, Offset);
1482
96.8k
}
1483
1484
1.79M
RegionOffset MemRegion::getAsOffset() const {
1485
1.79M
  if (!cachedOffset)
1486
97.3k
    cachedOffset = calculateOffset(this);
1487
1.79M
  return *cachedOffset;
1488
1.79M
}
1489
1490
//===----------------------------------------------------------------------===//
1491
// BlockDataRegion
1492
//===----------------------------------------------------------------------===//
1493
1494
std::pair<const VarRegion *, const VarRegion *>
1495
294
BlockDataRegion::getCaptureRegions(const VarDecl *VD) {
1496
294
  MemRegionManager &MemMgr = getMemRegionManager();
1497
294
  const VarRegion *VR = nullptr;
1498
294
  const VarRegion *OriginalVR = nullptr;
1499
294
1500
294
  if (!VD->hasAttr<BlocksAttr>() && 
VD->hasLocalStorage()232
) {
1501
192
    VR = MemMgr.getVarRegion(VD, this);
1502
192
    OriginalVR = MemMgr.getVarRegion(VD, LC);
1503
192
  }
1504
102
  else {
1505
102
    if (LC) {
1506
102
      VR = MemMgr.getVarRegion(VD, LC);
1507
102
      OriginalVR = VR;
1508
102
    }
1509
0
    else {
1510
0
      VR = MemMgr.getVarRegion(VD, MemMgr.getUnknownRegion());
1511
0
      OriginalVR = MemMgr.getVarRegion(VD, LC);
1512
0
    }
1513
102
  }
1514
294
  return std::make_pair(VR, OriginalVR);
1515
294
}
1516
1517
5.91k
void BlockDataRegion::LazyInitializeReferencedVars() {
1518
5.91k
  if (ReferencedVars)
1519
5.54k
    return;
1520
362
1521
362
  AnalysisDeclContext *AC = getCodeRegion()->getAnalysisDeclContext();
1522
362
  const auto &ReferencedBlockVars = AC->getReferencedBlockVars(BC->getDecl());
1523
362
  auto NumBlockVars =
1524
362
      std::distance(ReferencedBlockVars.begin(), ReferencedBlockVars.end());
1525
362
1526
362
  if (NumBlockVars == 0) {
1527
129
    ReferencedVars = (void*) 0x1;
1528
129
    return;
1529
129
  }
1530
233
1531
233
  MemRegionManager &MemMgr = getMemRegionManager();
1532
233
  llvm::BumpPtrAllocator &A = MemMgr.getAllocator();
1533
233
  BumpVectorContext BC(A);
1534
233
1535
233
  using VarVec = BumpVector<const MemRegion *>;
1536
233
1537
233
  auto *BV = A.Allocate<VarVec>();
1538
233
  new (BV) VarVec(BC, NumBlockVars);
1539
233
  auto *BVOriginal = A.Allocate<VarVec>();
1540
233
  new (BVOriginal) VarVec(BC, NumBlockVars);
1541
233
1542
294
  for (const auto *VD : ReferencedBlockVars) {
1543
294
    const VarRegion *VR = nullptr;
1544
294
    const VarRegion *OriginalVR = nullptr;
1545
294
    std::tie(VR, OriginalVR) = getCaptureRegions(VD);
1546
294
    assert(VR);
1547
294
    assert(OriginalVR);
1548
294
    BV->push_back(VR, BC);
1549
294
    BVOriginal->push_back(OriginalVR, BC);
1550
294
  }
1551
233
1552
233
  ReferencedVars = BV;
1553
233
  OriginalVars = BVOriginal;
1554
233
}
1555
1556
BlockDataRegion::referenced_vars_iterator
1557
2.95k
BlockDataRegion::referenced_vars_begin() const {
1558
2.95k
  const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
1559
2.95k
1560
2.95k
  auto *Vec = static_cast<BumpVector<const MemRegion *> *>(ReferencedVars);
1561
2.95k
1562
2.95k
  if (Vec == (void*) 0x1)
1563
687
    return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
1564
2.26k
1565
2.26k
  auto *VecOriginal =
1566
2.26k
      static_cast<BumpVector<const MemRegion *> *>(OriginalVars);
1567
2.26k
1568
2.26k
  return BlockDataRegion::referenced_vars_iterator(Vec->begin(),
1569
2.26k
                                                   VecOriginal->begin());
1570
2.26k
}
1571
1572
BlockDataRegion::referenced_vars_iterator
1573
2.95k
BlockDataRegion::referenced_vars_end() const {
1574
2.95k
  const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
1575
2.95k
1576
2.95k
  auto *Vec = static_cast<BumpVector<const MemRegion *> *>(ReferencedVars);
1577
2.95k
1578
2.95k
  if (Vec == (void*) 0x1)
1579
687
    return BlockDataRegion::referenced_vars_iterator(nullptr, nullptr);
1580
2.26k
1581
2.26k
  auto *VecOriginal =
1582
2.26k
      static_cast<BumpVector<const MemRegion *> *>(OriginalVars);
1583
2.26k
1584
2.26k
  return BlockDataRegion::referenced_vars_iterator(Vec->end(),
1585
2.26k
                                                   VecOriginal->end());
1586
2.26k
}
1587
1588
4
const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
1589
4
  for (referenced_vars_iterator I = referenced_vars_begin(),
1590
4
                                E = referenced_vars_end();
1591
6
       I != E; 
++I2
) {
1592
6
    if (I.getCapturedRegion() == R)
1593
4
      return I.getOriginalRegion();
1594
6
  }
1595
4
  
return nullptr0
;
1596
4
}
1597
1598
//===----------------------------------------------------------------------===//
1599
// RegionAndSymbolInvalidationTraits
1600
//===----------------------------------------------------------------------===//
1601
1602
void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym,
1603
1.99k
                                                 InvalidationKinds IK) {
1604
1.99k
  SymTraitsMap[Sym] |= IK;
1605
1.99k
}
1606
1607
void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR,
1608
8.78k
                                                 InvalidationKinds IK) {
1609
8.78k
  assert(MR);
1610
8.78k
  if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
1611
1.88k
    setTrait(SR->getSymbol(), IK);
1612
6.90k
  else
1613
6.90k
    MRTraitsMap[MR] |= IK;
1614
8.78k
}
1615
1616
bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym,
1617
102k
                                                 InvalidationKinds IK) const {
1618
102k
  const_symbol_iterator I = SymTraitsMap.find(Sym);
1619
102k
  if (I != SymTraitsMap.end())
1620
7.16k
    return I->second & IK;
1621
95.2k
1622
95.2k
  return false;
1623
95.2k
}
1624
1625
bool RegionAndSymbolInvalidationTraits::hasTrait(const MemRegion *MR,
1626
173k
                                                 InvalidationKinds IK) const {
1627
173k
  if (!MR)
1628
0
    return false;
1629
173k
1630
173k
  if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
1631
16.3k
    return hasTrait(SR->getSymbol(), IK);
1632
157k
1633
157k
  const_region_iterator I = MRTraitsMap.find(MR);
1634
157k
  if (I != MRTraitsMap.end())
1635
11.9k
    return I->second & IK;
1636
145k
1637
145k
  return false;
1638
145k
}