maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity
llvm-project/clang/lib/StaticAnalyzer/Core/CallEvent.cpp

1121 lines
40 KiB
C++
Raw Normal View History

[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
//===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--//
//
// The LLVM Compiler Infrastructure
//
// This file is distributed under the University of Illinois Open Source
// License. See LICENSE.TXT for details.
//
//===----------------------------------------------------------------------===//
//
/// \file This file defines CallEvent and its subclasses, which represent path-
/// sensitive instances of different kinds of function and method calls
/// (C, C++, and Objective-C).
//
//===----------------------------------------------------------------------===//
[analyzer] Rename Calls.{h,cpp} to CallEvent.{h,cpp}. No functionality change. llvm-svn: 160815
2012-07-27 05:39:41 +08:00
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
#include "clang/AST/ParentMap.h"
Sort all of Clang's files under 'lib', and fix up the broken headers uncovered. This required manually correcting all of the incorrect main-module headers I could find, and running the new llvm/utils/sort_includes.py script over the files. I also manually added quite a few missing headers that were uncovered by shuffling the order or moving headers up to be main-module-headers. llvm-svn: 169237
2012-12-04 17:13:33 +08:00
#include "clang/Analysis/ProgramPoint.h"
#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
[Static Analyzer] Properly clean up the dynamic type information for dead regions. Differential Revision: http://reviews.llvm.org/D12767 llvm-svn: 247430
2015-09-12 01:19:57 +08:00
#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeMap.h"
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
#include "llvm/ADT/SmallSet.h"
[analyzer] Finish replacing ObjCMessage with ObjCMethodDecl and friends. The preObjCMessage and postObjCMessage callbacks now take an ObjCMethodCall argument, which can represent an explicit message send (ObjCMessageSend) or an implicit message generated by a property access (ObjCPropertyAccess). llvm-svn: 159559
2012-07-03 03:28:04 +08:00
#include "llvm/ADT/StringExtras.h"
Include pruning and general cleanup. llvm-svn: 169095
2012-12-02 01:12:56 +08:00
#include "llvm/Support/raw_ostream.h"
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
using namespace clang;
using namespace ento;
QualType CallEvent::getResultType() const {
[analyzer] Always derive a CallEvent's return type from its origin expr. Previously, we preferred to get a result type by looking at the callee's declared result type. This allowed us to handlereferences, which are represented in the AST as lvalues of their pointee type. (That is, a call to a function returning 'int &' has type 'int' and value kind 'lvalue'.) However, this results in us preferring the original type of a function over a casted type. This is a problem when a function pointer is casted to another type, because the conjured result value will have the wrong type. AdjustedReturnValueChecker is supposed to handle this, but still doesn't handle the case where there is no "original function" at all, i.e. where the callee is unknown. Now, we instead look at the call expression's value kind (lvalue, xvalue, or prvalue), and adjust the expr's type accordingly. This will have no effect when the function is inlined, and will conjure the value that will actually be used when it is not. This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately, the cases where it would still be useful are where we need to cast the result of an inlined function or a checker-evaluated function, and in these cases we don't know what we're casting /from/ by the time we can do post- call checks. In light of that, remove AdjustedReturnValueChecker, which was already not checking quite a few calls. llvm-svn: 163065
2012-09-02 01:39:00 +08:00
const Expr *E = getOriginExpr();
assert(E && "Calls without origin expressions do not have results");
QualType ResultTy = E->getType();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
[analyzer] Always derive a CallEvent's return type from its origin expr. Previously, we preferred to get a result type by looking at the callee's declared result type. This allowed us to handlereferences, which are represented in the AST as lvalues of their pointee type. (That is, a call to a function returning 'int &' has type 'int' and value kind 'lvalue'.) However, this results in us preferring the original type of a function over a casted type. This is a problem when a function pointer is casted to another type, because the conjured result value will have the wrong type. AdjustedReturnValueChecker is supposed to handle this, but still doesn't handle the case where there is no "original function" at all, i.e. where the callee is unknown. Now, we instead look at the call expression's value kind (lvalue, xvalue, or prvalue), and adjust the expr's type accordingly. This will have no effect when the function is inlined, and will conjure the value that will actually be used when it is not. This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately, the cases where it would still be useful are where we need to cast the result of an inlined function or a checker-evaluated function, and in these cases we don't know what we're casting /from/ by the time we can do post- call checks. In light of that, remove AdjustedReturnValueChecker, which was already not checking quite a few calls. llvm-svn: 163065
2012-09-02 01:39:00 +08:00
ASTContext &Ctx = getState()->getStateManager().getContext();
// A function that returns a reference to 'int' will have a result type
// of simply 'int'. Check the origin expr's value kind to recover the
// proper type.
switch (E->getValueKind()) {
case VK_LValue:
ResultTy = Ctx.getLValueReferenceType(ResultTy);
break;
case VK_XValue:
ResultTy = Ctx.getRValueReferenceType(ResultTy);
break;
case VK_RValue:
// No adjustment is necessary.
break;
}
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
return ResultTy;
}
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
static bool isCallback(QualType T) {
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
// If a parameter is a block or a callback, assume it can modify pointer.
if (T->isBlockPointerType() ||
T->isFunctionPointerType() ||
T->isObjCSelType())
return true;
// Check if a callback is passed inside a struct (for both, struct passed by
// reference and by value). Dig just one level into the struct for now.
[analyzer] Clean up a couple uses of getPointeeType(). No intended functionality change. llvm-svn: 163219
2012-09-06 01:11:22 +08:00
if (T->isAnyPointerType() || T->isReferenceType())
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
T = T->getPointeeType();
if (const RecordType *RT = T->getAsStructureType()) {
const RecordDecl *RD = RT->getDecl();
[C++11] Replacing RecordDecl iterators field_begin() and field_end() with iterator_range fields(). Updating all of the usages of the iterators with range-based for loops. llvm-svn: 203355
2014-03-09 04:12:42 +08:00
for (const auto *I : RD->fields()) {
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
QualType FieldT = I->getType();
if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
return true;
}
}
return false;
}
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
static bool isVoidPointerToNonConst(QualType T) {
if (const PointerType *PT = T->getAs<PointerType>()) {
QualType PointeeTy = PT->getPointeeType();
if (PointeeTy.isConstQualified())
return false;
return PointeeTy->isVoidType();
} else
return false;
}
bool CallEvent::hasNonNullArgumentsWithType(bool (*Condition)(QualType)) const {
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
unsigned NumOfArgs = getNumArgs();
// If calling using a function pointer, assume the function does not
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
// satisfy the callback.
// TODO: We could check the types of the arguments here.
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
if (!getDecl())
return false;
unsigned Idx = 0;
for (CallEvent::param_type_iterator I = param_type_begin(),
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
E = param_type_end();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
I != E && Idx < NumOfArgs; ++I, ++Idx) {
if (NumOfArgs <= Idx)
break;
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
// If the parameter is 0, it's harmless.
if (getArgSVal(Idx).isZeroConstant())
continue;
if (Condition(*I))
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
return true;
}
return false;
}
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
bool CallEvent::hasNonZeroCallbackArg() const {
return hasNonNullArgumentsWithType(isCallback);
}
bool CallEvent::hasVoidPointerToNonConstArg() const {
return hasNonNullArgumentsWithType(isVoidPointerToNonConst);
}
[analyzer] Add some convenience accessors to CallEvent, and use them. These are CallEvent-equivalents of helpers already accessible in CheckerContext, as part of making it easier for new checkers to be written using CallEvent rather than raw CallExprs. llvm-svn: 167338
2012-11-03 07:49:29 +08:00
bool CallEvent::isGlobalCFunction(StringRef FunctionName) const {
const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(getDecl());
if (!FD)
return false;
return CheckerContext::isCLibraryFunction(FD, FunctionName);
}
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
/// \brief Returns true if a type is a pointer-to-const or reference-to-const
/// with no further indirection.
static bool isPointerToConst(QualType Ty) {
QualType PointeeTy = Ty->getPointeeType();
if (PointeeTy == QualType())
return false;
if (!PointeeTy.isConstQualified())
return false;
if (PointeeTy->isAnyPointerType())
return false;
return true;
}
// Try to retrieve the function declaration and find the function parameter
// types which are pointers/references to a non-pointer const.
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
// We will not invalidate the corresponding argument regions.
[analyzer] Invalidate regions indirectly accessible through const pointers. In this case, the value of 'x' may be changed after the call to indirectAccess: struct Wrapper { int *ptr; }; void indirectAccess(const Wrapper &w); void test() { int x = 42; Wrapper w = { x }; clang_analyzer_eval(x == 42); // TRUE indirectAccess(w); clang_analyzer_eval(x == 42); // UNKNOWN } This is important for modelling return-by-value objects in C++, to show that the contents of the struct are escaping in the return copy-constructor. <rdar://problem/13239826> llvm-svn: 177570
2013-03-21 04:35:53 +08:00
static void findPtrToConstParams(llvm::SmallSet<unsigned, 4> &PreserveArgs,
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
const CallEvent &Call) {
unsigned Idx = 0;
for (CallEvent::param_type_iterator I = Call.param_type_begin(),
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
E = Call.param_type_end();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
I != E; ++I, ++Idx) {
if (isPointerToConst(*I))
PreserveArgs.insert(Idx);
}
}
ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
[analyzer] Invalidate regions indirectly accessible through const pointers. In this case, the value of 'x' may be changed after the call to indirectAccess: struct Wrapper { int *ptr; }; void indirectAccess(const Wrapper &w); void test() { int x = 42; Wrapper w = { x }; clang_analyzer_eval(x == 42); // TRUE indirectAccess(w); clang_analyzer_eval(x == 42); // UNKNOWN } This is important for modelling return-by-value objects in C++, to show that the contents of the struct are escaping in the return copy-constructor. <rdar://problem/13239826> llvm-svn: 177570
2013-03-21 04:35:53 +08:00
ProgramStateRef Orig) const {
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
ProgramStateRef Result = (Orig ? Orig : getState());
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
[analyzer] Functions marked __attribute__((const)) don't modify any memory. This applies to __attribute__((pure)) as well, but 'const' is more interesting because many of our builtins are marked 'const'. PR19661 llvm-svn: 208154
2014-05-07 11:29:56 +08:00
// Don't invalidate anything if the callee is marked pure/const.
if (const Decl *callee = getDecl())
if (callee->hasAttr<PureAttr>() || callee->hasAttr<ConstAttr>())
return Result;
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
SmallVector<SVal, 8> ValuesToInvalidate;
[analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future. With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters. This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker. llvm-svn: 191342
2013-09-25 07:47:29 +08:00
RegionAndSymbolInvalidationTraits ETraits;
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
getExtraInvalidatedValues(ValuesToInvalidate, &ETraits);
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
// Indexes of arguments whose values will be preserved by the call.
[analyzer] Invalidate regions indirectly accessible through const pointers. In this case, the value of 'x' may be changed after the call to indirectAccess: struct Wrapper { int *ptr; }; void indirectAccess(const Wrapper &w); void test() { int x = 42; Wrapper w = { x }; clang_analyzer_eval(x == 42); // TRUE indirectAccess(w); clang_analyzer_eval(x == 42); // UNKNOWN } This is important for modelling return-by-value objects in C++, to show that the contents of the struct are escaping in the return copy-constructor. <rdar://problem/13239826> llvm-svn: 177570
2013-03-21 04:35:53 +08:00
llvm::SmallSet<unsigned, 4> PreserveArgs;
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
if (!argumentsMayEscape())
findPtrToConstParams(PreserveArgs, *this);
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
[analyzer] Invalidate regions indirectly accessible through const pointers. In this case, the value of 'x' may be changed after the call to indirectAccess: struct Wrapper { int *ptr; }; void indirectAccess(const Wrapper &w); void test() { int x = 42; Wrapper w = { x }; clang_analyzer_eval(x == 42); // TRUE indirectAccess(w); clang_analyzer_eval(x == 42); // UNKNOWN } This is important for modelling return-by-value objects in C++, to show that the contents of the struct are escaping in the return copy-constructor. <rdar://problem/13239826> llvm-svn: 177570
2013-03-21 04:35:53 +08:00
// Mark this region for invalidation. We batch invalidate regions
// below for efficiency.
if (PreserveArgs.count(Idx))
[analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future. With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters. This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker. llvm-svn: 191342
2013-09-25 07:47:29 +08:00
if (const MemRegion *MR = getArgSVal(Idx).getAsRegion())
[analyzer] Let TK_PreserveContents span across the whole base region. If an address of a field is passed through a const pointer, the whole structure's base region should receive the TK_PreserveContents trait and avoid invalidation. Additionally, include a few FIXME tests shown up during testing. Differential Revision: http://reviews.llvm.org/D19057 llvm-svn: 267413
2016-04-25 22:44:25 +08:00
ETraits.setTrait(MR->getBaseRegion(),
[analyzer] This patch removes passing around of const-invalidation vs regular-invalidation info by passing around a datastructure that maps regions and symbols to the type of invalidation they experience. This simplifies the code and would allow to associate more different invalidation types in the future. With this patch things like preserving contents of regions (either hi- or low-level ones) or processing of the only top-level region can be implemented easily without passing around extra parameters. This patch is a first step towards adequate modeling of memcpy() by the CStringChecker checker and towards eliminating of majority of false-positives produced by the NewDeleteLeaks checker. llvm-svn: 191342
2013-09-25 07:47:29 +08:00
RegionAndSymbolInvalidationTraits::TK_PreserveContents);
// TODO: Factor this out + handle the lower level const pointers.
ValuesToInvalidate.push_back(getArgSVal(Idx));
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
// Invalidate designated regions using the batch invalidation API.
// NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
// global variables.
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
return Result->invalidateRegions(ValuesToInvalidate, getOriginExpr(),
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
BlockCount, getLocationContext(),
[analyzer] Address Jordan's nitpicks as per code review of r170625. llvm-svn: 170832
2012-12-21 09:50:14 +08:00
/*CausedByPointerEscape*/ true,
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
/*Symbols=*/nullptr, this, &ETraits);
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints. These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
2012-07-11 06:07:42 +08:00
ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
const ProgramPointTag *Tag) const {
if (const Expr *E = getOriginExpr()) {
if (IsPreVisit)
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
return PreStmt(E, getLocationContext(), Tag);
return PostStmt(E, getLocationContext(), Tag);
[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints. These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
2012-07-11 06:07:42 +08:00
}
const Decl *D = getDecl();
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
assert(D && "Cannot get a program point without a statement or decl");
[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints. These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
2012-07-11 06:07:42 +08:00
SourceLocation Loc = getSourceRange().getBegin();
if (IsPreVisit)
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
return PreImplicitCall(D, Loc, getLocationContext(), Tag);
return PostImplicitCall(D, Loc, getLocationContext(), Tag);
[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints. These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
2012-07-11 06:07:42 +08:00
}
[analyzer] Utility to match function calls. This patch adds a small utility to match function calls. This utility abstracts away the mutable keywords and the lazy initialization and caching logic of identifiers from the checkers. The SimpleStreamChecker is ported over this utility within this patch to show the reduction of code and to test this change. Differential Revision: http://reviews.llvm.org/D15921 llvm-svn: 258572
2016-01-23 06:32:46 +08:00
bool CallEvent::isCalled(const CallDescription &CD) const {
assert(getKind() != CE_ObjCMessage && "Obj-C methods are not supported");
if (!CD.II)
CD.II = &getState()->getStateManager().getContext().Idents.get(CD.FuncName);
if (getCalleeIdentifier() != CD.II)
return false;
return (CD.RequiredArgs == CallDescription::NoArgRequirement ||
CD.RequiredArgs == getNumArgs());
}
[analyzer] CallEvent is no longer a value object. After discussion, the type-based dispatch was decided to be bad for maintenance and made it very easy for subtle bugs to creep in. Instead, we'll just be very careful when we do have to allocate these on the heap. llvm-svn: 160817
2012-07-27 05:41:15 +08:00
SVal CallEvent::getArgSVal(unsigned Index) const {
const Expr *ArgE = getArgExpr(Index);
if (!ArgE)
return UnknownVal();
return getSVal(ArgE);
}
SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
const Expr *ArgE = getArgExpr(Index);
if (!ArgE)
return SourceRange();
return ArgE->getSourceRange();
}
[analyzer] Add some convenience accessors to CallEvent, and use them. These are CallEvent-equivalents of helpers already accessible in CheckerContext, as part of making it easier for new checkers to be written using CallEvent rather than raw CallExprs. llvm-svn: 167338
2012-11-03 07:49:29 +08:00
SVal CallEvent::getReturnValue() const {
const Expr *E = getOriginExpr();
if (!E)
return UndefinedVal();
return getSVal(E);
}
Only mark dump() function definitions 'used' in debug builds This has the dual effect of (1) enabling more dead-stripping in release builds and (2) ensuring that debug helper functions aren't stripped away in debug builds, as they're intended to be called from the debugger. Note that the attribute is applied to definitions rather than declarations in headers going forward because it's now conditional on NDEBUG: /// \brief Mark debug helper function definitions like dump() that should not be /// stripped from debug builds. Requires corresponding macro added in LLVM r198456. llvm-svn: 198489
2014-01-04 21:47:14 +08:00
LLVM_DUMP_METHOD void CallEvent::dump() const { dump(llvm::errs()); }
Do NOT use inline functions with LLVM_ATTRIBUTE_USED. The function will be emitted into every single TU including the header! llvm-svn: 161872
2012-08-14 22:50:32 +08:00
[analyzer] CallEvent is no longer a value object. After discussion, the type-based dispatch was decided to be bad for maintenance and made it very easy for subtle bugs to creep in. Instead, we'll just be very careful when we do have to allocate these on the heap. llvm-svn: 160817
2012-07-27 05:41:15 +08:00
void CallEvent::dump(raw_ostream &Out) const {
ASTContext &Ctx = getState()->getStateManager().getContext();
if (const Expr *E = getOriginExpr()) {
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
E->printPretty(Out, nullptr, Ctx.getPrintingPolicy());
[analyzer] CallEvent is no longer a value object. After discussion, the type-based dispatch was decided to be bad for maintenance and made it very easy for subtle bugs to creep in. Instead, we'll just be very careful when we do have to allocate these on the heap. llvm-svn: 160817
2012-07-27 05:41:15 +08:00
Out << "\n";
return;
}
if (const Decl *D = getDecl()) {
Out << "Call to ";
D->print(Out, Ctx.getPrintingPolicy());
return;
}
// FIXME: a string representation of the kind would be nice.
Out << "Unknown call (type " << getKind() << ")";
}
[analyzer] Add new PreImplicitCall and PostImplicitCall ProgramPoints. These are currently unused, but are intended to be used in lieu of PreStmt and PostStmt when the call is implicit (e.g. an automatic object destructor). This also modifies the Data1 field of ProgramPoints to allow storing any pointer-sized value, as opposed to only aligned pointers. This is necessary to store SourceLocations. There is currently no BugReporter support for these; they should be skipped over in any diagnostic output. This commit also tags checkers that currently rely on function calls only occurring at StmtPoints. llvm-svn: 160019
2012-07-11 06:07:42 +08:00
[analyzer] Rename CallEvent::mayBeInlined to CallEvent::isCallStmt. The two callers are using this in order to be conservative, so let's just clarify the information that's actually being provided here. This is not related to inlining decisions in any way. No functionality change. llvm-svn: 162717
2012-08-28 08:50:38 +08:00
bool CallEvent::isCallStmt(const Stmt *S) {
[analyzer] CallEvent is no longer a value object. After discussion, the type-based dispatch was decided to be bad for maintenance and made it very easy for subtle bugs to creep in. Instead, we'll just be very careful when we do have to allocate these on the heap. llvm-svn: 160817
2012-07-27 05:41:15 +08:00
return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
[analyzer] Rename CallEvent::mayBeInlined to CallEvent::isCallStmt. The two callers are using this in order to be conservative, so let's just clarify the information that's actually being provided here. This is not related to inlining decisions in any way. No functionality change. llvm-svn: 162717
2012-08-28 08:50:38 +08:00
|| isa<CXXConstructExpr>(S)
|| isa<CXXNewExpr>(S);
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
}
[analyzer] Do not report use of undef on "return foo();" when the return type is void. Fixes a false positive found by analyzing LLVM code base. llvm-svn: 163750
2012-09-13 06:57:40 +08:00
QualType CallEvent::getDeclaredResultType(const Decl *D) {
assert(D);
if (const FunctionDecl* FD = dyn_cast<FunctionDecl>(D))
Rename getResultType() on function and method declarations to getReturnType() A return type is the declared or deduced part of the function type specified in the declaration. A result type is the (potentially adjusted) type of the value of an expression that calls the function. Rule of thumb: * Declarations have return types and parameters. * Expressions have result types and arguments. llvm-svn: 200082
2014-01-26 00:55:45 +08:00
return FD->getReturnType();
[analyzer] Don't warn for returning void expressions in void blocks. This was slightly tricky because BlockDecls don't currently store an inferred return type. However, we can rely on the fact that blocks with inferred return types will have return statements that match the inferred type. <rdar://problem/13665798> llvm-svn: 179699
2013-04-18 02:03:48 +08:00
if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(D))
Rename getResultType() on function and method declarations to getReturnType() A return type is the declared or deduced part of the function type specified in the declaration. A result type is the (potentially adjusted) type of the value of an expression that calls the function. Rule of thumb: * Declarations have return types and parameters. * Expressions have result types and arguments. llvm-svn: 200082
2014-01-26 00:55:45 +08:00
return MD->getReturnType();
[analyzer] Don't warn for returning void expressions in void blocks. This was slightly tricky because BlockDecls don't currently store an inferred return type. However, we can rely on the fact that blocks with inferred return types will have return statements that match the inferred type. <rdar://problem/13665798> llvm-svn: 179699
2013-04-18 02:03:48 +08:00
if (const BlockDecl *BD = dyn_cast<BlockDecl>(D)) {
// Blocks are difficult because the return type may not be stored in the
// BlockDecl itself. The AST should probably be enhanced, but for now we
// just do what we can.
[analyzer] Don't crash if a block's signature just has the return type. It is okay to declare a block without an argument list: ^ {} or ^void {}. In these cases, the BlockDecl's signature-as-written will just contain the return type, rather than the entire function type. It is unclear if this is intentional, but the analyzer shouldn't crash because of it. <rdar://problem/14018351> llvm-svn: 182948
2013-05-31 02:14:27 +08:00
// If the block is declared without an explicit argument list, the
// signature-as-written just includes the return type, not the entire
// function type.
[analyzer] Don't crash if a block doesn't have a type signature. Currently, blocks instantiated in templates lose their "signature as written"; it's not clear if this is intentional. Change the analyzer's use of BlockDecl::getSignatureAsWritten to check whether or not the signature is actually there. <rdar://problem/13954714> llvm-svn: 182497
2013-05-23 02:09:44 +08:00
// FIXME: All blocks should have signatures-as-written, even if the return
[analyzer] Don't crash if a block's signature just has the return type. It is okay to declare a block without an argument list: ^ {} or ^void {}. In these cases, the BlockDecl's signature-as-written will just contain the return type, rather than the entire function type. It is unclear if this is intentional, but the analyzer shouldn't crash because of it. <rdar://problem/14018351> llvm-svn: 182948
2013-05-31 02:14:27 +08:00
// type is inferred. (That's signified with a dependent result type.)
[analyzer] Don't crash if a block doesn't have a type signature. Currently, blocks instantiated in templates lose their "signature as written"; it's not clear if this is intentional. Change the analyzer's use of BlockDecl::getSignatureAsWritten to check whether or not the signature is actually there. <rdar://problem/13954714> llvm-svn: 182497
2013-05-23 02:09:44 +08:00
if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten()) {
[analyzer] Don't crash if a block's signature just has the return type. It is okay to declare a block without an argument list: ^ {} or ^void {}. In these cases, the BlockDecl's signature-as-written will just contain the return type, rather than the entire function type. It is unclear if this is intentional, but the analyzer shouldn't crash because of it. <rdar://problem/14018351> llvm-svn: 182948
2013-05-31 02:14:27 +08:00
QualType Ty = TSI->getType();
if (const FunctionType *FT = Ty->getAs<FunctionType>())
Rename getResultType() on function and method declarations to getReturnType() A return type is the declared or deduced part of the function type specified in the declaration. A result type is the (potentially adjusted) type of the value of an expression that calls the function. Rule of thumb: * Declarations have return types and parameters. * Expressions have result types and arguments. llvm-svn: 200082
2014-01-26 00:55:45 +08:00
Ty = FT->getReturnType();
[analyzer] Don't crash if a block's signature just has the return type. It is okay to declare a block without an argument list: ^ {} or ^void {}. In these cases, the BlockDecl's signature-as-written will just contain the return type, rather than the entire function type. It is unclear if this is intentional, but the analyzer shouldn't crash because of it. <rdar://problem/14018351> llvm-svn: 182948
2013-05-31 02:14:27 +08:00
if (!Ty->isDependentType())
return Ty;
[analyzer] Don't crash if a block doesn't have a type signature. Currently, blocks instantiated in templates lose their "signature as written"; it's not clear if this is intentional. Change the analyzer's use of BlockDecl::getSignatureAsWritten to check whether or not the signature is actually there. <rdar://problem/13954714> llvm-svn: 182497
2013-05-23 02:09:44 +08:00
}
[analyzer] Don't warn for returning void expressions in void blocks. This was slightly tricky because BlockDecls don't currently store an inferred return type. However, we can rely on the fact that blocks with inferred return types will have return statements that match the inferred type. <rdar://problem/13665798> llvm-svn: 179699
2013-04-18 02:03:48 +08:00
return QualType();
}
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
[analyzer] Make inlining decisions based on the callee being variadic. ...rather than trying to figure it out from the call site, and having people complain that we guessed wrong and that a prototype-less call is the same as a variadic call on their system. More importantly, fix a crash when there's no decl at the call site (though we could have just returned a default value). <rdar://problem/15037033> llvm-svn: 191599
2013-09-28 10:04:19 +08:00
llvm_unreachable("unknown callable kind");
}
bool CallEvent::isVariadic(const Decl *D) {
assert(D);
if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(D))
return FD->isVariadic();
if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D))
return MD->isVariadic();
if (const BlockDecl *BD = dyn_cast<BlockDecl>(D))
return BD->isVariadic();
llvm_unreachable("unknown callable kind");
[analyzer] Do not report use of undef on "return foo();" when the return type is void. Fixes a false positive found by analyzing LLVM code base. llvm-svn: 163750
2012-09-13 06:57:40 +08:00
}
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
CallEvent::BindingsTy &Bindings,
SValBuilder &SVB,
const CallEvent &Call,
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
ArrayRef<ParmVarDecl*> parameters) {
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
MemRegionManager &MRMgr = SVB.getRegionManager();
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
Fix a crash in the static analyzer (bug #16307) Summary: When processing a call to a function, which got passed less arguments than it expects, the analyzer would crash. I've also added a test for that and a analyzer warning which detects these cases. CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D994 llvm-svn: 184288
2013-06-19 16:19:56 +08:00
// If the function has fewer parameters than the call has arguments, we simply
// do not bind any values to them.
unsigned NumArgs = Call.getNumArgs();
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
unsigned Idx = 0;
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
ArrayRef<ParmVarDecl*>::iterator I = parameters.begin(), E = parameters.end();
Fix a crash in the static analyzer (bug #16307) Summary: When processing a call to a function, which got passed less arguments than it expects, the analyzer would crash. I've also added a test for that and a analyzer warning which detects these cases. CC: cfe-commits Differential Revision: http://llvm-reviews.chandlerc.com/D994 llvm-svn: 184288
2013-06-19 16:19:56 +08:00
for (; I != E && Idx < NumArgs; ++I, ++Idx) {
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
const ParmVarDecl *ParamDecl = *I;
assert(ParamDecl && "Formal parameter has no decl?");
SVal ArgVal = Call.getArgSVal(Idx);
if (!ArgVal.isUnknown()) {
Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
}
}
// FIXME: Variadic arguments are not handled at all right now.
}
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
ArrayRef<ParmVarDecl*> AnyFunctionCall::parameters() const {
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
const FunctionDecl *D = getDecl();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
if (!D)
Remove llvm:: from uses of ArrayRef. llvm-svn: 211987
2014-06-29 07:22:23 +08:00
return None;
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
return D->parameters();
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
}
void AnyFunctionCall::getInitialStackFrameContents(
const StackFrameContext *CalleeCtx,
BindingsTy &Bindings) const {
const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl());
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
D->parameters());
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
bool AnyFunctionCall::argumentsMayEscape() const {
[analyzer] Assume escape is possible through system functions taking void* The analyzer assumes that system functions will not free memory or modify the arguments in other ways, so we assume that arguments do not escape when those are called. However, this may lead to false positive leak errors. For example, in code like this where the pointers added to the rb_tree are freed later on: struct alarm_event *e = calloc(1, sizeof(*e)); <snip> rb_tree_insert_node(&alarm_tree, e); Add a heuristic to assume that calls to system functions taking void* arguments allow for pointer escape. llvm-svn: 251449
2015-10-28 04:19:45 +08:00
if (CallEvent::argumentsMayEscape() || hasVoidPointerToNonConstArg())
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
return true;
const FunctionDecl *D = getDecl();
if (!D)
return true;
const IdentifierInfo *II = D->getIdentifier();
if (!II)
[analyzer]Don't invalidate const arguments when there is no IdentifierInfo. Ee: C++ copy constructors. llvm-svn: 167092
2012-10-31 09:18:26 +08:00
return false;
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
// This set of "escaping" APIs is
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
// - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
// value into thread local storage. The value can later be retrieved with
// 'void *ptheread_getspecific(pthread_key)'. So even thought the
// parameter is 'const void *', the region escapes through the call.
if (II->isStr("pthread_setspecific"))
return true;
// - xpc_connection_set_context stores a value which can be retrieved later
// with xpc_connection_get_context.
if (II->isStr("xpc_connection_set_context"))
return true;
// - funopen - sets a buffer for future IO calls.
if (II->isStr("funopen"))
return true;
[analyzer] Teach the analyzer that pointers can escape into __cxa_demangle This fixes a reported false positive in the malloc checker. Differential Revision: https://reviews.llvm.org/D27599 llvm-svn: 289886
2016-12-16 06:55:18 +08:00
// - __cxa_demangle - can reallocate memory and can return the pointer to
// the input buffer.
if (II->isStr("__cxa_demangle"))
return true;
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
StringRef FName = II->getName();
// - CoreFoundation functions that end with "NoCopy" can free a passed-in
// buffer even if it is const.
if (FName.endswith("NoCopy"))
return true;
// - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
// be deallocated by NSMapRemove.
if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
return true;
// - Many CF containers allow objects to escape through custom
// allocators/deallocators upon container construction. (PR12101)
if (FName.startswith("CF") || FName.startswith("CG")) {
return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
StrInStrNoCase(FName, "WithData") != StringRef::npos ||
StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
}
return false;
}
[analyzer] BlockCall shouldn't really be an AnyFunctionCall. Per discussion with Anna a /long/ time ago, it was way too easy to misuse BlockCall: because it inherited from AnyFunctionCall (through SimpleCall), getDecl() was constrained to return a FunctionDecl, and you had to call getBlockDecl() instead. This goes against the whole point of CallEvent (to abstract over different ways to invoke bodies of code). Now, BlockCall just inherits directly from CallEvent. There's a bit of duplication in getting things out of the origin expression (which is still known to be a CallExpr), but nothing significant. llvm-svn: 199321
2014-01-16 01:25:15 +08:00
const FunctionDecl *SimpleFunctionCall::getDecl() const {
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
const FunctionDecl *D = getOriginExpr()->getDirectCallee();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
if (D)
return D;
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
[analyzer] Reduce code duplication: make CXXDestructorCall a CXXInstanceCall. While there is now some duplication between SimpleCall and the CXXInstanceCall sub-hierarchy, this is much better than copy-and-pasting the devirtualization logic shared by both instance methods and destructors. An unfortunate side effect is that there is no longer a single CallEvent type that corresponds to "calls written as CallExprs". For the most part this is a good thing, but the checker callback eval::Call still takes a CallExpr rather than a CallEvent (since we're not sure if we want to allow checkers to evaluate other kinds of calls). A mistake here will be caught by a cast<> in CheckerManager::runCheckersForEvalCall. No functionality change. llvm-svn: 161809
2012-08-14 07:46:05 +08:00
const FunctionDecl *CXXInstanceCall::getDecl() const {
const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr());
if (!CE)
return AnyFunctionCall::getDecl();
const FunctionDecl *D = CE->getDirectCallee();
if (D)
return D;
return getSVal(CE->getCallee()).getAsFunctionDecl();
}
[Analyzer] Fix comments and formatting. NFC. llvm-svn: 252599
2015-11-10 19:48:55 +08:00
void CXXInstanceCall::getExtraInvalidatedValues(
ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
SVal ThisVal = getCXXThisVal();
Values.push_back(ThisVal);
Test commit llvm-svn: 250500
2015-10-16 16:54:23 +08:00
// Don't invalidate if the method is const and there are no mutable fields.
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
if (const CXXMethodDecl *D = cast_or_null<CXXMethodDecl>(getDecl())) {
if (!D->isConst())
return;
// Get the record decl for the class of 'This'. D->getParent() may return a
// base class decl, rather than the class of the instance which needs to be
// checked for mutable fields.
const Expr *Ex = getCXXThisExpr()->ignoreParenBaseCasts();
const CXXRecordDecl *ParentRecord = Ex->getType()->getAsCXXRecordDecl();
if (!ParentRecord || ParentRecord->hasMutableFields())
return;
// Preserve CXXThis.
const MemRegion *ThisRegion = ThisVal.getAsRegion();
[analyzer] Fix assertion failure invalidating on const member function calls (PR25392). We now return early when the 'this' value cannot be converted to a MemRegion. llvm-svn: 252506
2015-11-10 03:50:29 +08:00
if (!ThisRegion)
return;
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
ETraits->setTrait(ThisRegion->getBaseRegion(),
[Analyzer] Fix comments and formatting. NFC. llvm-svn: 252599
2015-11-10 19:48:55 +08:00
RegionAndSymbolInvalidationTraits::TK_PreserveContents);
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
}
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
}
[analyzer] Be more forgiving about calling methods on struct rvalues. The problem is that the value of 'this' in a C++ member function call should always be a region (or NULL). However, if the object is an rvalue, it has no associated region (only a conjured symbol or LazyCompoundVal). For now, we handle this in two ways: 1) Actually respect MaterializeTemporaryExpr. Before, it was relying on CXXConstructExpr to create temporary regions for all struct values. Now it just does the right thing: if the value is not in a temporary region, create one. 2) Have CallEvent recognize the case where its 'this' pointer is a non-region, and just return UnknownVal to keep from confusing clients. The long-term problem is being tracked internally in <rdar://problem/12137950>, but this makes many test cases pass. llvm-svn: 163220
2012-09-06 01:11:26 +08:00
SVal CXXInstanceCall::getCXXThisVal() const {
const Expr *Base = getCXXThisExpr();
// FIXME: This doesn't handle an overloaded ->* operator.
if (!Base)
return UnknownVal();
SVal ThisVal = getSVal(Base);
Replace SVal llvm::cast support to be well-defined. See r175462 for another example/more details. llvm-svn: 175594
2013-02-20 13:52:05 +08:00
assert(ThisVal.isUnknownOrUndef() || ThisVal.getAs<Loc>());
[analyzer] Be more forgiving about calling methods on struct rvalues. The problem is that the value of 'this' in a C++ member function call should always be a region (or NULL). However, if the object is an rvalue, it has no associated region (only a conjured symbol or LazyCompoundVal). For now, we handle this in two ways: 1) Actually respect MaterializeTemporaryExpr. Before, it was relying on CXXConstructExpr to create temporary regions for all struct values. Now it just does the right thing: if the value is not in a temporary region, create one. 2) Have CallEvent recognize the case where its 'this' pointer is a non-region, and just return UnknownVal to keep from confusing clients. The long-term problem is being tracked internally in <rdar://problem/12137950>, but this makes many test cases pass. llvm-svn: 163220
2012-09-06 01:11:26 +08:00
return ThisVal;
}
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
// Do we have a decl at all?
[analyzer] Try to devirtualize even if the static callee has no definition. This mostly affects pure virtual methods, but would also affect parent methods defined inline in the header when analyzing the child's source file. llvm-svn: 161709
2012-08-11 06:26:43 +08:00
const Decl *D = getDecl();
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
if (!D)
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
return RuntimeDefinition();
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
// If the method is non-virtual, we know we can inline it.
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
const CXXMethodDecl *MD = cast<CXXMethodDecl>(D);
if (!MD->isVirtual())
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
return AnyFunctionCall::getRuntimeDefinition();
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
// Do we know the implicit 'this' object being called?
const MemRegion *R = getCXXThisVal().getAsRegion();
if (!R)
return RuntimeDefinition();
// Do we know anything about the type of 'this'?
[Static Analyzer] Properly clean up the dynamic type information for dead regions. Differential Revision: http://reviews.llvm.org/D12767 llvm-svn: 247430
2015-09-12 01:19:57 +08:00
DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
if (!DynType.isValid())
return RuntimeDefinition();
// Is the type a C++ class? (This is mostly a defensive check.)
QualType RegionType = DynType.getType()->getPointeeType();
[analyzer] Clean up a couple uses of getPointeeType(). No intended functionality change. llvm-svn: 163219
2012-09-06 01:11:22 +08:00
assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
[analyzer] Don't try to devirtualize if the class is incomplete. A similar issue to the previous commit, introduced by r161915. llvm-svn: 161961
2012-08-16 01:33:37 +08:00
if (!RD || !RD->hasDefinition())
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
return RuntimeDefinition();
Revert "[analyzer] Use the static type for a virtual call if the dynamic type is worse." Using the static type may be inconsistent with later calls. We should just report that there is no inlining definition available if the static type is better than the dynamic type. See next commit. This reverts r163644 / 19d5886d1704e24282c86217b09d5c6d35ba604d. llvm-svn: 163744
2012-09-13 05:48:13 +08:00
// Find the decl for this method in that class.
const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
[analyzer] Fail gracefully when the dynamic type is outside the hierarchy. With some particularly evil casts, we can get an object whose dynamic type is not actually a subclass of its static type. In this case, we won't even find the statically-resolved method as a devirtualization candidate. Rather than assert that this situation cannot occur, we now simply check that the dynamic type is not an ancestor or descendent of the static type, and leave it at that. This error actually occurred analyzing LLVM: CallEventManager uses a BumpPtrAllocator to allocate a concrete subclass of CallEvent (FunctionCall), but then casts it to the actual subclass requested (such as ObjCMethodCall) to perform the constructor. Yet another crash in PR13763. llvm-svn: 163367
2012-09-07 09:19:42 +08:00
if (!Result) {
// We might not even get the original statically-resolved method due to
// some particularly nasty casting (e.g. casts to sister classes).
// However, we should at least be able to search up and down our own class
// hierarchy, and some real bugs have been caught by checking this.
assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
[analyzer] Handle when the dynamic type is worse than the static type. Currently we don't update the dynamic type of a C++ object when it is cast. This can cause the situation above, where the static type of the region is now known to be a subclass of the dynamic type. Once we start updating DynamicTypeInfo in response to the various kinds of casts in C++, we can re-add this assert to make sure we don't miss any cases. This work is tracked by <rdar://problem/12287087>. In -Asserts builds, we will simply not return any runtime definition when our DynamicTypeInfo is known to be incorrect like this. llvm-svn: 163745
2012-09-13 05:48:17 +08:00
// FIXME: This is checking that our DynamicTypeInfo is at least as good as
// the static type. However, because we currently don't update
// DynamicTypeInfo when an object is cast, we can't actually be sure the
// DynamicTypeInfo is up to date. This assert should be re-enabled once
// this is fixed. <rdar://problem/12287087>
//assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
[analyzer] Fail gracefully when the dynamic type is outside the hierarchy. With some particularly evil casts, we can get an object whose dynamic type is not actually a subclass of its static type. In this case, we won't even find the statically-resolved method as a devirtualization candidate. Rather than assert that this situation cannot occur, we now simply check that the dynamic type is not an ancestor or descendent of the static type, and leave it at that. This error actually occurred analyzing LLVM: CallEventManager uses a BumpPtrAllocator to allocate a concrete subclass of CallEvent (FunctionCall), but then casts it to the actual subclass requested (such as ObjCMethodCall) to perform the constructor. Yet another crash in PR13763. llvm-svn: 163367
2012-09-07 09:19:42 +08:00
return RuntimeDefinition();
}
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
// Does the decl that we found have an implementation?
const FunctionDecl *Definition;
if (!Result->hasBody(Definition))
return RuntimeDefinition();
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
[analyzer] Correctly devirtualize virtual method calls in destructors. C++11 [class.cdtor]p4: When a virtual function is called directly or indirectly from a constructor or from a destructor, including during the construction or destruction of the class’s non-static data members, and the object to which the call applies is the object under construction or destruction, the function called is the final overrider in the constructor's or destructor's class and not one overriding it in a more-derived class. llvm-svn: 161915
2012-08-15 08:51:56 +08:00
// We found a definition. If we're not sure that this devirtualization is
// actually what will happen at runtime, make sure to provide the region so
// that ExprEngine can decide what to do with it.
if (DynType.canBeASubClass())
return RuntimeDefinition(Definition, R->StripCasts());
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
}
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
void CXXInstanceCall::getInitialStackFrameContents(
const StackFrameContext *CalleeCtx,
BindingsTy &Bindings) const {
AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
// Handle the binding of 'this' in the new stack frame.
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
SVal ThisVal = getCXXThisVal();
if (!ThisVal.isUnknown()) {
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
ProgramStateManager &StateMgr = getState()->getStateManager();
SValBuilder &SVB = StateMgr.getSValBuilder();
[analyzer] Only adjust the type of 'this' when we devirtualize a method call. With reinterpret_cast, we can get completely unrelated types in a region hierarchy together; this was resulting in CXXBaseObjectRegions being layered directly on an (untyped) SymbolicRegion, whose symbol was from a completely different type hierarchy. This was what was causing the internal buildbot to fail. Reverts r161911, which merely masked the problem. llvm-svn: 161960
2012-08-16 01:33:34 +08:00
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
[analyzer] Only adjust the type of 'this' when we devirtualize a method call. With reinterpret_cast, we can get completely unrelated types in a region hierarchy together; this was resulting in CXXBaseObjectRegions being layered directly on an (untyped) SymbolicRegion, whose symbol was from a completely different type hierarchy. This was what was causing the internal buildbot to fail. Reverts r161911, which merely masked the problem. llvm-svn: 161960
2012-08-16 01:33:34 +08:00
// If we devirtualized to a different member function, we need to make sure
// we have the proper layering of CXXBaseObjectRegions.
if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
[analyzer] Be more careful when downcasting for devirtualization. Virtual base regions are never layered, so simply stripping them off won't necessarily get you to the correct casted class. Instead, what we want is the same logic for evaluating dynamic_cast: strip off base regions if possible, but add new base regions if necessary. llvm-svn: 161808
2012-08-14 07:46:01 +08:00
ASTContext &Ctx = SVB.getContext();
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
const CXXRecordDecl *Class = MD->getParent();
[analyzer] Be more careful when downcasting for devirtualization. Virtual base regions are never layered, so simply stripping them off won't necessarily get you to the correct casted class. Instead, what we want is the same logic for evaluating dynamic_cast: strip off base regions if possible, but add new base regions if necessary. llvm-svn: 161808
2012-08-14 07:46:01 +08:00
QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
[analyzer] Be more careful when downcasting for devirtualization. Virtual base regions are never layered, so simply stripping them off won't necessarily get you to the correct casted class. Instead, what we want is the same logic for evaluating dynamic_cast: strip off base regions if possible, but add new base regions if necessary. llvm-svn: 161808
2012-08-14 07:46:01 +08:00
// FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
bool Failed;
[analyzer] Model base to derived casts more precisely. Dynamic casts are handled relatively well by the static analyzer. BaseToDerived casts however are treated conservatively. This can cause some false positives with the NewDeleteLeaks checker. This patch alters the behavior of BaseToDerived casts. In case a dynamic cast would succeed use the same semantics. Otherwise fall back to the conservative approach. Differential Revision: https://reviews.llvm.org/D23014 llvm-svn: 277989
2016-08-08 17:22:59 +08:00
ThisVal = StateMgr.getStoreManager().attemptDownCast(ThisVal, Ty, Failed);
[analyzer] Be more careful when downcasting for devirtualization. Virtual base regions are never layered, so simply stripping them off won't necessarily get you to the correct casted class. Instead, what we want is the same logic for evaluating dynamic_cast: strip off base regions if possible, but add new base regions if necessary. llvm-svn: 161808
2012-08-14 07:46:01 +08:00
assert(!Failed && "Calling an incorrectly devirtualized method");
[analyzer] Strip CXXBaseObjectRegions when devirtualizing method calls. This was causing a crash when we tried to re-apply a base object region to itself. It probably also caused incorrect offset calculations in RegionStore. PR13569 / <rdar://problem/12076683> llvm-svn: 161710
2012-08-11 06:26:46 +08:00
}
[analyzer] Only adjust the type of 'this' when we devirtualize a method call. With reinterpret_cast, we can get completely unrelated types in a region hierarchy together; this was resulting in CXXBaseObjectRegions being layered directly on an (untyped) SymbolicRegion, whose symbol was from a completely different type hierarchy. This was what was causing the internal buildbot to fail. Reverts r161911, which merely masked the problem. llvm-svn: 161960
2012-08-16 01:33:34 +08:00
if (!ThisVal.isUnknown())
Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
}
}
[analyzer] Don't inline virtual calls unless we can devirtualize properly. Previously we were using the static type of the base object to inline methods, whether virtual or non-virtual. Now, we try to see if the base object has a known type, and if so ask for its implementation of the method. llvm-svn: 160094
2012-07-12 08:16:25 +08:00
[analyzer] Track null/uninitialized C++ objects used in method calls. llvm-svn: 161278
2012-08-04 07:08:49 +08:00
const Expr *CXXMemberCall::getCXXThisExpr() const {
return getOriginExpr()->getImplicitObjectArgument();
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
}
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
RuntimeDefinition CXXMemberCall::getRuntimeDefinition() const {
[analyzer] Member function calls that use qualified names are non-virtual. C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> llvm-svn: 163577
2012-09-11 08:31:02 +08:00
// C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the
// id-expression in the class member access expression is a qualified-id,
// that function is called. Otherwise, its final overrider in the dynamic type
// of the object expression is called.
if (const MemberExpr *ME = dyn_cast<MemberExpr>(getOriginExpr()->getCallee()))
if (ME->hasQualifier())
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
return AnyFunctionCall::getRuntimeDefinition();
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
return CXXInstanceCall::getRuntimeDefinition();
[analyzer] Member function calls that use qualified names are non-virtual. C++11 [expr.call]p1: ...If the selected function is non-virtual, or if the id-expression in the class member access expression is a qualified-id, that function is called. Otherwise, its final overrider in the dynamic type of the object expression is called. <rdar://problem/12255556> llvm-svn: 163577
2012-09-11 08:31:02 +08:00
}
[analyzer] Move the last bits of CallOrObjCMessage over to CallEvent. This involved refactoring some common pointer-escapes code onto CallEvent, then having MallocChecker use those callbacks for whether or not to consider a pointer's /ownership/ as escaping. This still needs to be pinned down, and probably we want to make the new argumentsMayEscape() function a little more discerning (content invalidation vs. ownership/metadata invalidation), but this is a good improvement. As a bonus, also remove CallOrObjCMessage from the source completely. llvm-svn: 159557
2012-07-03 03:27:51 +08:00
[analyzer] Track null/uninitialized C++ objects used in method calls. llvm-svn: 161278
2012-08-04 07:08:49 +08:00
const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
return getOriginExpr()->getArg(0);
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
}
[analyzer] For now, don't inline non-static member overloaded operators. Our current inlining support (specifically RegionStore::enterStackFrame) doesn't know that calls to overloaded operators may be calls to non-static member functions, and that in these cases the first argument should be treated as 'this'. This caused incorrect results and sometimes crashes. The long-term fix will be to rewrite RegionStore::enterStackFrame to use CallEvent and its subclasses, but for now we can just disable these problematic calls by classifying them under a new CallEvent, CXXMemberOperatorCall. llvm-svn: 159692
2012-07-04 06:55:57 +08:00
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
const BlockDataRegion *BlockCall::getBlockRegion() const {
const Expr *Callee = getOriginExpr()->getCallee();
const MemRegion *DataReg = getSVal(Callee).getAsRegion();
[analyzer] Use CallEvent for inlining and call default-evaluation. llvm-svn: 159560
2012-07-03 03:28:09 +08:00
return dyn_cast_or_null<BlockDataRegion>(DataReg);
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
ArrayRef<ParmVarDecl*> BlockCall::parameters() const {
[analyzer] BlockCall shouldn't really be an AnyFunctionCall. Per discussion with Anna a /long/ time ago, it was way too easy to misuse BlockCall: because it inherited from AnyFunctionCall (through SimpleCall), getDecl() was constrained to return a FunctionDecl, and you had to call getBlockDecl() instead. This goes against the whole point of CallEvent (to abstract over different ways to invoke bodies of code). Now, BlockCall just inherits directly from CallEvent. There's a bit of duplication in getting things out of the origin expression (which is still known to be a CallExpr), but nothing significant. llvm-svn: 199321
2014-01-16 01:25:15 +08:00
const BlockDecl *D = getDecl();
[analyzer] Use CallEvent for inlining and call default-evaluation. llvm-svn: 159560
2012-07-03 03:28:09 +08:00
if (!D)
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
return nullptr;
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
return D->parameters();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
void BlockCall::getExtraInvalidatedValues(ValueList &Values,
RegionAndSymbolInvalidationTraits *ETraits) const {
[analyzer] Use CallEvent for inlining and call default-evaluation. llvm-svn: 159560
2012-07-03 03:28:09 +08:00
// FIXME: This also needs to invalidate captured globals.
if (const MemRegion *R = getBlockRegion())
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
Values.push_back(loc::MemRegionVal(R));
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
BindingsTy &Bindings) const {
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
[analyzer] Support inlining lambda-converted blocks. clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
2015-12-04 13:00:36 +08:00
ArrayRef<ParmVarDecl*> Params;
if (isConversionFromLambda()) {
auto *LambdaOperatorDecl = cast<CXXMethodDecl>(CalleeCtx->getDecl());
Params = LambdaOperatorDecl->parameters();
// For blocks converted from a C++ lambda, the callee declaration is the
fix typos; NFC llvm-svn: 255163
2015-12-10 06:16:07 +08:00
// operator() method on the lambda so we bind "this" to
[analyzer] Support inlining lambda-converted blocks. clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
2015-12-04 13:00:36 +08:00
// the lambda captured by the block.
const VarRegion *CapturedLambdaRegion = getRegionStoringCapturedLambda();
SVal ThisVal = loc::MemRegionVal(CapturedLambdaRegion);
Loc ThisLoc = SVB.getCXXThis(LambdaOperatorDecl, CalleeCtx);
Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
} else {
Params = cast<BlockDecl>(CalleeCtx->getDecl())->parameters();
}
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
[analyzer] Support inlining lambda-converted blocks. clang converts C++ lambdas to blocks with an implicit user-defined conversion operator method on the lambda record. This method returns a block that captures a copy of the lambda. To inline a lambda-converted block, the analyzer now calls the lambda records's call operator method on the lambda captured by the block. llvm-svn: 254702
2015-12-04 13:00:36 +08:00
Params);
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
}
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
SVal CXXConstructorCall::getCXXThisVal() const {
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
if (Data)
return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
return UnknownVal();
}
[analyzer] Don’t invalidate CXXThis when conservatively evaluating const methods (PR 21606) Prevent invalidation of `this' when a method is const; fixing PR 21606. A patch by Sean Eveson! Differential Revision: http://reviews.llvm.org/D13099 llvm-svn: 250237
2015-10-14 06:20:52 +08:00
void CXXConstructorCall::getExtraInvalidatedValues(ValueList &Values,
RegionAndSymbolInvalidationTraits *ETraits) const {
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
if (Data)
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
Values.push_back(loc::MemRegionVal(static_cast<const MemRegion *>(Data)));
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
void CXXConstructorCall::getInitialStackFrameContents(
const StackFrameContext *CalleeCtx,
BindingsTy &Bindings) const {
AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
SVal ThisVal = getCXXThisVal();
if (!ThisVal.isUnknown()) {
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
}
}
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
SVal CXXDestructorCall::getCXXThisVal() const {
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
if (Data)
[analyzer] Don't attempt to devirtualize calls to base class destructors. CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. llvm-svn: 163348
2012-09-07 04:37:08 +08:00
return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
[analyzer] Use CallEvent for building inlined stack frames. In order to accomplish this, we now build the callee's stack frame as part of the CallEnter node, rather than the subsequent BlockEdge node. This should not have any effect on perceived behavior or diagnostics. This makes it safe to re-enable inlining of member overloaded operators. llvm-svn: 160022
2012-07-11 06:07:57 +08:00
return UnknownVal();
}
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
[analyzer] Don't attempt to devirtualize calls to base class destructors. CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. llvm-svn: 163348
2012-09-07 04:37:08 +08:00
// Base destructors are always called non-virtually.
// Skip CXXInstanceCall's devirtualization logic in this case.
if (isBaseDestructor())
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
return AnyFunctionCall::getRuntimeDefinition();
[analyzer] Don't attempt to devirtualize calls to base class destructors. CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. llvm-svn: 163348
2012-09-07 04:37:08 +08:00
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
return CXXInstanceCall::getRuntimeDefinition();
[analyzer] Don't attempt to devirtualize calls to base class destructors. CXXDestructorCall now has a flag for when it is a base destructor call. Other kinds of destructor calls (locals, fields, temporaries, and 'delete') all behave as "whole-object" destructors and do not behave differently from one another (specifically, in these cases we /should/ try to devirtualize a call to a virtual destructor). This was causing crashes in both our internal buildbot, the crash still being tracked in PR13765, and some of the crashes being tracked in PR13763, due to a assertion failure. (The behavior under -Asserts happened to be correct anyway.) Adding this knowledge also allows our DynamicTypePropagation checker to do a bit less work; the special rules about virtual method calls during a destructor only require extra handling during base destructors. llvm-svn: 163348
2012-09-07 04:37:08 +08:00
}
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
ArrayRef<ParmVarDecl*> ObjCMethodCall::parameters() const {
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
const ObjCMethodDecl *D = getDecl();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
if (!D)
Simplify creation of a bunch of ArrayRefs by using None, makeArrayRef or just letting them be implicitly created. llvm-svn: 216528
2014-08-27 14:28:36 +08:00
return None;
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
return D->parameters();
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Improve modeling of ObjC synthesized property setters. When modeling a call to a setter for a property that is synthesized to be backed by an instance variable, don't invalidate the entire instance but rather only the storage for the updated instance variable itself. This still doesn't model the effect of the setter completely. It doesn't bind the set value to the ivar storage location because doing so would cause the set value to escape, removing valuable diagnostics about potential leaks of the value from the retain count checker. llvm-svn: 261243
2016-02-19 03:13:30 +08:00
void ObjCMethodCall::getExtraInvalidatedValues(
ValueList &Values, RegionAndSymbolInvalidationTraits *ETraits) const {
// If the method call is a setter for property known to be backed by
// an instance variable, don't invalidate the entire receiver, just
// the storage for that instance variable.
if (const ObjCPropertyDecl *PropDecl = getAccessedProperty()) {
if (const ObjCIvarDecl *PropIvar = PropDecl->getPropertyIvarDecl()) {
SVal IvarLVal = getState()->getLValue(PropIvar, getReceiverSVal());
const MemRegion *IvarRegion = IvarLVal.getAsRegion();
ETraits->setTrait(
IvarRegion,
RegionAndSymbolInvalidationTraits::TK_DoNotInvalidateSuperRegion);
ETraits->setTrait(IvarRegion,
RegionAndSymbolInvalidationTraits::TK_SuppressEscape);
Values.push_back(IvarLVal);
return;
}
}
[analyzer] Teach invalidateRegions that regions within LazyCompoundVal need to be invalidated Refactor invalidateRegions to take SVals instead of Regions as input and teach RegionStore about processing LazyCompoundVal as a top-level “escaping” value. This addresses several false positives that get triggered by the NewDelete checker, but the underlying issue is reproducible with other checkers as well (for example, MallocChecker). llvm-svn: 178518
2013-04-02 09:28:24 +08:00
Values.push_back(getReceiverSVal());
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Make analyzer less aggressive when dealing with [self init]. With inlining, retain count checker starts tracking 'self' through the init methods. The analyser results were too noisy if the developer did not follow 'self = [super init]' pattern (which is common especially in older code bases) - we reported self init anti-pattern AND possible use-after-free. This patch teaches the retain count checker to assume that [super init] does not fail when it's not consumed by another expression. This silences the retain count warning that warns about possibility of use-after-free when init fails, while preserving all the other checking on 'self'. llvm-svn: 162508
2012-08-24 08:06:12 +08:00
SVal ObjCMethodCall::getSelfSVal() const {
const LocationContext *LCtx = getLocationContext();
const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
if (!SelfDecl)
return SVal();
return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
}
[analyzer] Begin replacing ObjCMessage with ObjCMethodCall and friends. Previously, the CallEvent subclass ObjCMessageInvocation was just a wrapper around the existing ObjCMessage abstraction (over message sends and property accesses). Now, we have abstract CallEvent ObjCMethodCall with subclasses ObjCMessageSend and ObjCPropertyAccess. In addition to removing yet another wrapper object, this should make it easy to add a ObjCSubscriptAccess call event soon. llvm-svn: 159558
2012-07-03 03:27:56 +08:00
SVal ObjCMethodCall::getReceiverSVal() const {
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
// FIXME: Is this the best way to handle class receivers?
if (!isInstanceMessage())
return UnknownVal();
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
[analyzer] Add a checker to manage dynamic type propagation. Instead of sprinkling dynamic type info propagation throughout ExprEngine, the added checker would add the more precise type information on known APIs (Ex: ObjC alloc, new) and propagate the type info in other cases (ex: ObjC init method, casts (the second is not implemented yet)). Add handling of ObjC alloc, new and init to the checker. llvm-svn: 161357
2012-08-07 07:25:39 +08:00
if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
return getSVal(RecE);
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
// An instance message with no expression means we are sending to super.
// In this case the object reference is the same as 'self'.
[analyzer] Make analyzer less aggressive when dealing with [self init]. With inlining, retain count checker starts tracking 'self' through the init methods. The analyser results were too noisy if the developer did not follow 'self = [super init]' pattern (which is common especially in older code bases) - we reported self init anti-pattern AND possible use-after-free. This patch teaches the retain count checker to assume that [super init] does not fail when it's not consumed by another expression. This silences the retain count warning that warns about possibility of use-after-free when init fails, while preserving all the other checking on 'self'. llvm-svn: 162508
2012-08-24 08:06:12 +08:00
assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
SVal SelfVal = getSelfSVal();
assert(SelfVal.isValid() && "Calling super but not in ObjC method");
return SelfVal;
}
bool ObjCMethodCall::isReceiverSelfOrSuper() const {
if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
return true;
if (!isInstanceMessage())
return false;
SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
return (RecVal == getSelfSVal());
[analyzer] Make CallEvent a value object. We will need to be able to easily reconstruct a CallEvent from an ExplodedNode for diagnostic purposes, and that's exactly what factory functions are for. CallEvent objects are small enough (four pointers and a SourceLocation) that returning them through the stack is fairly cheap. Clients who just need to use existing CallEvents can continue to do so using const references. This uses the same sort of "kind-field-dispatch" as SVal, though most of the nastiness is contained in the DISPATCH and DISPATCH_ARG macros at the end of the file. (We can't use a template for this because member-pointers to base class methods don't call derived-class methods even when casting to the derived class. We can't use variadic macros because they're a C99 feature.) llvm-svn: 160459
2012-07-19 05:59:41 +08:00
}
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
SourceRange ObjCMethodCall::getSourceRange() const {
switch (getMessageKind()) {
case OCM_Message:
return getOriginExpr()->getSourceRange();
case OCM_PropertyAccess:
case OCM_Subscript:
return getContainingPseudoObjectExpr()->getSourceRange();
}
Silence another GCC warning. llvm-svn: 160488
2012-07-19 11:08:07 +08:00
llvm_unreachable("unknown message kind");
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
}
typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
assert(Data && "Lazy lookup not yet performed.");
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
assert(getMessageKind() != OCM_Message && "Explicit message send.");
return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
}
[analyzer] Improve modeling of ObjC synthesized property setters. When modeling a call to a setter for a property that is synthesized to be backed by an instance variable, don't invalidate the entire instance but rather only the storage for the updated instance variable itself. This still doesn't model the effect of the setter completely. It doesn't bind the set value to the ivar storage location because doing so would cause the set value to escape, removing valuable diagnostics about potential leaks of the value from the retain count checker. llvm-svn: 261243
2016-02-19 03:13:30 +08:00
static const Expr *
getSyntacticFromForPseudoObjectExpr(const PseudoObjectExpr *POE) {
const Expr *Syntactic = POE->getSyntacticForm();
// This handles the funny case of assigning to the result of a getter.
// This can happen if the getter returns a non-const reference.
if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic))
Syntactic = BO->getLHS();
return Syntactic;
}
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
ObjCMessageKind ObjCMethodCall::getMessageKind() const {
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
if (!Data) {
[analyzer] More reliably detect property accessors. This has a side effect of preventing a crash, which occurs because we get a property getter declaration, which is overriding but is declared inside @protocol. Will file a bug about this inconsistency internally. Getting a small test case is very challenging. llvm-svn: 190836
2013-09-17 09:30:57 +08:00
// Find the parent, ignoring implicit casts.
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
ParentMap &PM = getLocationContext()->getParentMap();
[analyzer] Use getParentIgnoreParenCasts instead of doing it by hand. Apart from being more compact and already implemented, this also handles the case where the parent is null. (It does also ignore all casts, not just implicit ones, but this is more efficient to test and in the case we care about---a message in a PseudoObjectExpr---there should only be implicit casts anyway. This should fix our internal buildbot. llvm-svn: 191094
2013-09-21 00:51:50 +08:00
const Stmt *S = PM.getParentIgnoreParenCasts(getOriginExpr());
[analyzer] More reliably detect property accessors. This has a side effect of preventing a crash, which occurs because we get a property getter declaration, which is overriding but is declared inside @protocol. Will file a bug about this inconsistency internally. Getting a small test case is very challenging. llvm-svn: 190836
2013-09-17 09:30:57 +08:00
// Check if parent is a PseudoObjectExpr.
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
[analyzer] Improve modeling of ObjC synthesized property setters. When modeling a call to a setter for a property that is synthesized to be backed by an instance variable, don't invalidate the entire instance but rather only the storage for the updated instance variable itself. This still doesn't model the effect of the setter completely. It doesn't bind the set value to the ivar storage location because doing so would cause the set value to escape, removing valuable diagnostics about potential leaks of the value from the retain count checker. llvm-svn: 261243
2016-02-19 03:13:30 +08:00
const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
ObjCMessageKind K;
switch (Syntactic->getStmtClass()) {
case Stmt::ObjCPropertyRefExprClass:
K = OCM_PropertyAccess;
break;
case Stmt::ObjCSubscriptRefExprClass:
K = OCM_Subscript;
break;
default:
// FIXME: Can this ever happen?
K = OCM_Message;
break;
}
if (K != OCM_Message) {
const_cast<ObjCMethodCall *>(this)->Data
= ObjCMessageDataTy(POE, K).getOpaqueValue();
assert(getMessageKind() == K);
return K;
}
}
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
const_cast<ObjCMethodCall *>(this)->Data
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
= ObjCMessageDataTy(nullptr, 1).getOpaqueValue();
[analyzer] Combine all ObjC message CallEvents into ObjCMethodCall. As pointed out by Anna, we only differentiate between explicit message sends This also adds support for ObjCSubscriptExprs, which are basically the same as properties in many ways. We were already checking these, but not emitting nice messages for them. This depends on the llvm::PointerIntPair change in r160456. llvm-svn: 160461
2012-07-19 05:59:51 +08:00
assert(getMessageKind() == OCM_Message);
return OCM_Message;
}
ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
if (!Info.getPointer())
return OCM_Message;
return static_cast<ObjCMessageKind>(Info.getInt());
[analyzer] Add a new abstraction over all types of calls: CallEvent This is intended to replace CallOrObjCMessage, and is eventually intended to be used for anything that cares more about /what/ is being called than /how/ it's being called. For example, inlining destructors should be the same as inlining blocks, and checking __attribute__((nonnull)) should apply to the allocator calls generated by operator new. llvm-svn: 159554
2012-07-03 03:27:35 +08:00
}
[analyzer] Inline ObjC class methods. - Some cleanup(the TODOs) will be done after ObjC method inlining is complete. - Simplified CallEvent::getDefinition not to require ISDynamicDispatch parameter. - Also addressed Jordan's comments from r160530. llvm-svn: 160768
2012-07-26 08:27:51 +08:00
[analyzer] Improve modeling of ObjC synthesized property setters. When modeling a call to a setter for a property that is synthesized to be backed by an instance variable, don't invalidate the entire instance but rather only the storage for the updated instance variable itself. This still doesn't model the effect of the setter completely. It doesn't bind the set value to the ivar storage location because doing so would cause the set value to escape, removing valuable diagnostics about potential leaks of the value from the retain count checker. llvm-svn: 261243
2016-02-19 03:13:30 +08:00
const ObjCPropertyDecl *ObjCMethodCall::getAccessedProperty() const {
// Look for properties accessed with property syntax (foo.bar = ...)
if ( getMessageKind() == OCM_PropertyAccess) {
const PseudoObjectExpr *POE = getContainingPseudoObjectExpr();
assert(POE && "Property access without PseudoObjectExpr?");
const Expr *Syntactic = getSyntacticFromForPseudoObjectExpr(POE);
auto *RefExpr = cast<ObjCPropertyRefExpr>(Syntactic);
if (RefExpr->isExplicitProperty())
return RefExpr->getExplicitProperty();
}
// Look for properties accessed with method syntax ([foo setBar:...]).
const ObjCMethodDecl *MD = getDecl();
if (!MD || !MD->isPropertyAccessor())
return nullptr;
// Note: This is potentially quite slow.
return MD->findPropertyDecl();
}
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
Selector Sel) const {
assert(IDecl);
const SourceManager &SM =
getState()->getStateManager().getContext().getSourceManager();
// If the class interface is declared inside the main file, assume it is not
[analyzer] Apply whitespace cleanups by Honggyu Kim. llvm-svn: 246978
2015-09-08 11:50:52 +08:00
// subcassed.
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
// TODO: It could actually be subclassed if the subclass is private as well.
// This is probably very rare.
SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
Split isFromMainFile into two functions. Basically, isInMainFile considers line markers, and isWrittenInMainFile doesn't. Distinguishing between the two is useful when dealing with files which are preprocessed files or rewritten with -frewrite-includes (so we don't, for example, print useless warnings). llvm-svn: 188968
2013-08-22 08:27:10 +08:00
if (InterfLoc.isValid() && SM.isInMainFile(InterfLoc))
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
return false;
[analyzer]Assume that the properties cannot be overridden when dot syntax is used. llvm-svn: 161889
2012-08-15 03:19:18 +08:00
// Assume that property accessors are not overridden.
if (getMessageKind() == OCM_PropertyAccess)
return false;
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
// We assume that if the method is public (declared outside of main file) or
// has a parent which publicly declares the method, the method could be
// overridden in a subclass.
// Find the first declaration in the class hierarchy that declares
// the selector.
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
ObjCMethodDecl *D = nullptr;
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
while (true) {
D = IDecl->lookupMethod(Sel, true);
// Cannot find a public definition.
if (!D)
return false;
// If outside the main file,
Split isFromMainFile into two functions. Basically, isInMainFile considers line markers, and isWrittenInMainFile doesn't. Distinguishing between the two is useful when dealing with files which are preprocessed files or rewritten with -frewrite-includes (so we don't, for example, print useless warnings). llvm-svn: 188968
2013-08-22 08:27:10 +08:00
if (D->getLocation().isValid() && !SM.isInMainFile(D->getLocation()))
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
return true;
if (D->isOverriding()) {
// Search in the superclass on the next iteration.
IDecl = D->getClassInterface();
if (!IDecl)
return false;
IDecl = IDecl->getSuperClass();
if (!IDecl)
return false;
continue;
}
return false;
};
llvm_unreachable("The while loop should always terminate.");
}
Simplify getRuntimeDefinition() back to taking no arguments. llvm-svn: 164363
2012-09-21 14:13:13 +08:00
RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
[analyzer] Very simple ObjC instance method inlining - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
2012-07-31 04:31:29 +08:00
const ObjCMessageExpr *E = getOriginExpr();
assert(E);
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
Selector Sel = E->getSelector();
[analyzer] Very simple ObjC instance method inlining - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
2012-07-31 04:31:29 +08:00
if (E->isInstanceMessage()) {
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
Fix "the the" in comments/documentation/etc. llvm-svn: 240110
2015-06-19 09:52:53 +08:00
// Find the receiver type.
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
const ObjCObjectPointerType *ReceiverT = nullptr;
[analyzer] Track if a region can be a subclass in the dynamic type info. When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
2012-08-11 02:55:58 +08:00
bool CanBeSubClassed = false;
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
QualType SupersType = E->getSuperType();
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
const MemRegion *Receiver = nullptr;
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
if (!SupersType.isNull()) {
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
// Super always means the type of immediate predecessor to the method
// where the call occurs.
[analyzer] Address Jordan's review of DynamicTypePropagation. llvm-svn: 161391
2012-08-07 13:12:24 +08:00
ReceiverT = cast<ObjCObjectPointerType>(SupersType);
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
} else {
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
Receiver = getReceiverSVal().getAsRegion();
[analyzer] Don't try to inline if there's no region for a message receiver. While usually we'd use a symbolic region rather than a straight-up Unknown, we can still generate unknowns via array subscripts with symbolic indexes. (And if this ever changes in the future, we still shouldn't crash.) llvm-svn: 161059
2012-08-01 02:04:53 +08:00
if (!Receiver)
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
return RuntimeDefinition();
[analyzer] Don't try to inline if there's no region for a message receiver. While usually we'd use a symbolic region rather than a straight-up Unknown, we can still generate unknowns via array subscripts with symbolic indexes. (And if this ever changes in the future, we still shouldn't crash.) llvm-svn: 161059
2012-08-01 02:04:53 +08:00
[Static Analyzer] Properly clean up the dynamic type information for dead regions. Differential Revision: http://reviews.llvm.org/D12767 llvm-svn: 247430
2015-09-12 01:19:57 +08:00
DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
[analyzer] Track if a region can be a subclass in the dynamic type info. When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
2012-08-11 02:55:58 +08:00
QualType DynType = DTI.getType();
CanBeSubClassed = DTI.canBeASubClass();
[analyzer] Address Jordan's review of DynamicTypePropagation. llvm-svn: 161391
2012-08-07 13:12:24 +08:00
ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType);
[analyzer] Track if a region can be a subclass in the dynamic type info. When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
2012-08-11 02:55:58 +08:00
if (ReceiverT && CanBeSubClassed)
if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
if (!canBeOverridenInSubclass(IDecl, Sel))
CanBeSubClassed = false;
[analyzer] Inline ObjC class methods. - Some cleanup(the TODOs) will be done after ObjC method inlining is complete. - Simplified CallEvent::getDefinition not to require ISDynamicDispatch parameter. - Also addressed Jordan's comments from r160530. llvm-svn: 160768
2012-07-26 08:27:51 +08:00
}
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
// Lookup the method implementation.
if (ReceiverT)
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. llvm-svn: 169589
2012-12-07 15:30:19 +08:00
// Repeatedly calling lookupPrivateMethod() is expensive, especially
// when in many cases it returns null. We cache the results so
// that repeated queries on the same ObjCIntefaceDecl and Selector
// don't incur the same cost. On some test cases, we can see the
// same query being issued thousands of times.
//
// NOTE: This cache is essentially a "global" variable, but it
// only gets lazily created when we get here. The value of the
// cache probably comes from it being global across ExprEngines,
// where the same queries may get issued. If we are worried about
// concurrency, or possibly loading/unloading ASTs, etc., we may
// need to revisit this someday. In terms of memory, this table
// stays around until clang quits, which also may be bad if we
// need to release memory.
typedef std::pair<const ObjCInterfaceDecl*, Selector>
PrivateMethodKey;
typedef llvm::DenseMap<PrivateMethodKey,
Include llvm::Optional in clang/Basic/LLVM.h Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
2013-02-21 06:23:23 +08:00
Optional<const ObjCMethodDecl *> >
Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. llvm-svn: 169589
2012-12-07 15:30:19 +08:00
PrivateMethodCache;
static PrivateMethodCache PMC;
Include llvm::Optional in clang/Basic/LLVM.h Post-commit CR feedback from Jordan Rose regarding r175594. llvm-svn: 175679
2013-02-21 06:23:23 +08:00
Optional<const ObjCMethodDecl *> &Val = PMC[std::make_pair(IDecl, Sel)];
Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. llvm-svn: 169589
2012-12-07 15:30:19 +08:00
// Query lookupPrivateMethod() if the cache does not hit.
[analyzer] Model getters of known-@synthesized Objective-C properties. ...by synthesizing their body to be "return self->_prop;", with an extra nudge to RetainCountChecker to still treat the value as +0 if we have no other information. This doesn't handle weak properties, but that's mostly correct anyway, since they can go to nil at any time. This also doesn't apply to properties whose implementations we can't see, since they may not be backed by an ivar at all. And finally, this doesn't handle properties of C++ class type, because we can't invoke the copy constructor. (Sema has actually done this work already, but the AST it synthesizes is one the analyzer doesn't quite handle -- it has an rvalue DeclRefExpr.) Modeling setters is likely to be more difficult (since it requires handling strong/copy), but not impossible. <rdar://problem/11956898> llvm-svn: 198953
2014-01-11 04:06:06 +08:00
if (!Val.hasValue()) {
Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. llvm-svn: 169589
2012-12-07 15:30:19 +08:00
Val = IDecl->lookupPrivateMethod(Sel);
[analyzer] Model getters of known-@synthesized Objective-C properties. ...by synthesizing their body to be "return self->_prop;", with an extra nudge to RetainCountChecker to still treat the value as +0 if we have no other information. This doesn't handle weak properties, but that's mostly correct anyway, since they can go to nil at any time. This also doesn't apply to properties whose implementations we can't see, since they may not be backed by an ivar at all. And finally, this doesn't handle properties of C++ class type, because we can't invoke the copy constructor. (Sema has actually done this work already, but the AST it synthesizes is one the analyzer doesn't quite handle -- it has an rvalue DeclRefExpr.) Modeling setters is likely to be more difficult (since it requires handling strong/copy), but not impossible. <rdar://problem/11956898> llvm-svn: 198953
2014-01-11 04:06:06 +08:00
// If the method is a property accessor, we should try to "inline" it
// even if we don't actually have an implementation.
if (!*Val)
if (const ObjCMethodDecl *CompileTimeMD = E->getMethodDecl())
[analyzer] Prefer accessor method in extension over category in CallEvent. In ObjCMethodCall:getRuntimeDefinition(), if the method is an accessor in a category, and it doesn't have a self declaration, first try to find the method in a class extension. This works around a bug in Sema where multiple accessors are synthesized for properties in class extensions that are redeclared in a category. The implicit parameters are not filled in for the method on the category, which causes a crash when trying to synthesize a getter for the property in BodyFarm. The Sema bug is tracked as rdar://problem/25481164. rdar://problem/25056531 llvm-svn: 265103
2016-04-01 11:24:13 +08:00
if (CompileTimeMD->isPropertyAccessor()) {
if (!CompileTimeMD->getSelfDecl() &&
isa<ObjCCategoryDecl>(CompileTimeMD->getDeclContext())) {
// If the method is an accessor in a category, and it doesn't
// have a self declaration, first
// try to find the method in a class extension. This
// works around a bug in Sema where multiple accessors
// are synthesized for properties in class
// extensions that are redeclared in a category and the
// the implicit parameters are not filled in for
// the method on the category.
// This ensures we find the accessor in the extension, which
// has the implicit parameters filled in.
auto *ID = CompileTimeMD->getClassInterface();
for (auto *CatDecl : ID->visible_extensions()) {
Val = CatDecl->getMethod(Sel,
CompileTimeMD->isInstanceMethod());
if (*Val)
break;
}
}
if (!*Val)
Val = IDecl->lookupInstanceMethod(Sel);
}
[analyzer] Model getters of known-@synthesized Objective-C properties. ...by synthesizing their body to be "return self->_prop;", with an extra nudge to RetainCountChecker to still treat the value as +0 if we have no other information. This doesn't handle weak properties, but that's mostly correct anyway, since they can go to nil at any time. This also doesn't apply to properties whose implementations we can't see, since they may not be backed by an ivar at all. And finally, this doesn't handle properties of C++ class type, because we can't invoke the copy constructor. (Sema has actually done this work already, but the AST it synthesizes is one the analyzer doesn't quite handle -- it has an rvalue DeclRefExpr.) Modeling setters is likely to be more difficult (since it requires handling strong/copy), but not impossible. <rdar://problem/11956898> llvm-svn: 198953
2014-01-11 04:06:06 +08:00
}
Cache queries to lookupPrivateMethod() within ObjCMethodCall::getRuntimeDefinition(). The same queries can happen thousands of times. This reduces the analysis time on one heavy Objective-C file by 2.4%. llvm-svn: 169589
2012-12-07 15:30:19 +08:00
const ObjCMethodDecl *MD = Val.getValue();
[analyzer] Track if a region can be a subclass in the dynamic type info. When object is allocated with alloc or init, we assume it cannot be a subclass (currently used only for bifurcation purposes). llvm-svn: 161682
2012-08-11 02:55:58 +08:00
if (CanBeSubClassed)
return RuntimeDefinition(MD, Receiver);
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
else
[C++11] Use 'nullptr'. StaticAnalyzer edition. llvm-svn: 209642
2014-05-27 10:45:47 +08:00
return RuntimeDefinition(MD, nullptr);
[analyzer] Optimize dynamic dispatch bifurcation by detecting the cases when we don't need to split. In some cases we know that a method cannot have a different implementation in a subclass: - the class is declared in the main file (private) - all the method declarations (including the ones coming from super classes) are in the main file. This can be improved further, but might be enough for the heuristic. (When we are too aggressive splitting the state, efficiency suffers. When we fail to split the state coverage might suffer.) llvm-svn: 161681
2012-08-11 02:55:53 +08:00
}
[analyzer] Handle inlining of instance calls to super. Use self-init.m for testing. (It used to have a bunch of failing tests with dynamic inlining turned on.) llvm-svn: 161012
2012-07-31 07:48:36 +08:00
[analyzer] Very simple ObjC instance method inlining - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
2012-07-31 04:31:29 +08:00
} else {
// This is a class method.
// If we have type info for the receiver class, we are calling via
// class name.
if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
// Find/Return the method implementation.
[analyzer] Improve readability of the dyn. dispatch bifurcation patch r161552. As per Jordan's feedback. llvm-svn: 161603
2012-08-10 02:43:00 +08:00
return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
[analyzer] Very simple ObjC instance method inlining - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
2012-07-31 04:31:29 +08:00
}
[analyzer] Inline ObjC class methods. - Some cleanup(the TODOs) will be done after ObjC method inlining is complete. - Simplified CallEvent::getDefinition not to require ISDynamicDispatch parameter. - Also addressed Jordan's comments from r160530. llvm-svn: 160768
2012-07-26 08:27:51 +08:00
}
[analyzer] Very simple ObjC instance method inlining - Retrieves the type of the object/receiver from the state. - Binds self during stack setup. - Only explores the path on which the method is inlined (no bifurcation to explore the path on which the method is not inlined). llvm-svn: 160991
2012-07-31 04:31:29 +08:00
[analyzer] Bifurcate the path with dynamic dispatch. This is an initial (unoptimized) version. We split the path when inlining ObjC instance methods. On one branch we always assume that the type information for the given memory region is precise. On the other we assume that we don't have the exact type info. It is important to check since the class could be subclassed and the method can be overridden. If we always inline we can loose coverage. Had to refactor some of the call eval functions. llvm-svn: 161552
2012-08-09 08:21:33 +08:00
return RuntimeDefinition();
[analyzer] Inline ObjC class methods. - Some cleanup(the TODOs) will be done after ObjC method inlining is complete. - Simplified CallEvent::getDefinition not to require ISDynamicDispatch parameter. - Also addressed Jordan's comments from r160530. llvm-svn: 160768
2012-07-26 08:27:51 +08:00
}
[analyzer] Pointers escape into +[NSValue valueWithPointer:]... ...even though the argument is declared "const void *", because this is just a way to pass pointers around as objects. (Though NSData is often a better one.) PR18262 llvm-svn: 198710
2014-01-08 05:39:48 +08:00
bool ObjCMethodCall::argumentsMayEscape() const {
if (isInSystemHeader() && !isInstanceMessage()) {
Selector Sel = getSelector();
if (Sel.getNumArgs() == 1 &&
Sel.getIdentifierInfoForSlot(0)->isStr("valueWithPointer"))
return true;
}
return CallEvent::argumentsMayEscape();
}
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
void ObjCMethodCall::getInitialStackFrameContents(
const StackFrameContext *CalleeCtx,
BindingsTy &Bindings) const {
const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
Change CallEvent to use ArrayRef<> interface to get formal parameters of callee. llvm-svn: 199472
2014-01-17 15:15:31 +08:00
D->parameters());
[analyzer] Let CallEvent decide what goes in an inital stack frame. This removes explicit checks for 'this' and 'self' from Store::enterStackFrame. It also removes getCXXThisRegion() as a virtual method on all CallEvents; it's now only implemented in the parts of the hierarchy where it is relevant. Finally, it removes the option to ask for the ParmVarDecls attached to the definition of an inlined function, saving a recomputation of the result of getRuntimeDefinition(). No visible functionality change! llvm-svn: 161017
2012-07-31 09:07:55 +08:00
SVal SelfVal = getReceiverSVal();
if (!SelfVal.isUnknown()) {
const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
MemRegionManager &MRMgr = SVB.getRegionManager();
Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
}
}
[analyzer] Reduce code duplication: make CXXDestructorCall a CXXInstanceCall. While there is now some duplication between SimpleCall and the CXXInstanceCall sub-hierarchy, this is much better than copy-and-pasting the devirtualization logic shared by both instance methods and destructors. An unfortunate side effect is that there is no longer a single CallEvent type that corresponds to "calls written as CallExprs". For the most part this is a good thing, but the checker callback eval::Call still takes a CallExpr rather than a CallEvent (since we're not sure if we want to allow checkers to evaluate other kinds of calls). A mistake here will be caught by a cast<> in CheckerManager::runCheckersForEvalCall. No functionality change. llvm-svn: 161809
2012-08-14 07:46:05 +08:00
CallEventRef<>
[analyzer] Only allow CallEvents to be created by CallEventManager. This ensures that it is valid to reference-count any CallEvents, and we won't accidentally try to reclaim a CallEvent that lives on the stack. It also hides an ugly switch statement for handling CallExprs! There should be no functionality change here. llvm-svn: 160986
2012-07-31 04:22:09 +08:00
CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
const LocationContext *LCtx) {
if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE))
return create<CXXMemberCall>(MCE, State, LCtx);
if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
if (MD->isInstance())
return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
} else if (CE->getCallee()->getType()->isBlockPointerType()) {
return create<BlockCall>(CE, State, LCtx);
}
// Otherwise, it's a normal function call, static member function call, or
// something we can't reason about.
[analyzer] BlockCall shouldn't really be an AnyFunctionCall. Per discussion with Anna a /long/ time ago, it was way too easy to misuse BlockCall: because it inherited from AnyFunctionCall (through SimpleCall), getDecl() was constrained to return a FunctionDecl, and you had to call getBlockDecl() instead. This goes against the whole point of CallEvent (to abstract over different ways to invoke bodies of code). Now, BlockCall just inherits directly from CallEvent. There's a bit of duplication in getting things out of the origin expression (which is still known to be a CallExpr), but nothing significant. llvm-svn: 199321
2014-01-16 01:25:15 +08:00
return create<SimpleFunctionCall>(CE, State, LCtx);
[analyzer] Only allow CallEvents to be created by CallEventManager. This ensures that it is valid to reference-count any CallEvents, and we won't accidentally try to reclaim a CallEvent that lives on the stack. It also hides an ugly switch statement for handling CallExprs! There should be no functionality change here. llvm-svn: 160986
2012-07-31 04:22:09 +08:00
}
[analyzer] Perform post-call checks for all inlined calls. Previously, we were only checking the origin expressions of inlined calls. Checkers using the generic postCall and older postObjCMessage callbacks were ignored. Now that we have CallEventManager, it is much easier to create a CallEvent generically when exiting an inlined function, which we can then use for post-call checks. No test case because we don't (yet) have any checkers that depend on this behavior (which is why it hadn't been fixed before now). llvm-svn: 161005
2012-07-31 07:39:47 +08:00
CallEventRef<>
CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
ProgramStateRef State) {
const LocationContext *ParentCtx = CalleeCtx->getParent();
const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame();
assert(CallerCtx && "This should not be used for top-level stack frames");
const Stmt *CallSite = CalleeCtx->getCallSite();
if (CallSite) {
if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
return getSimpleCall(CE, State, CallerCtx);
switch (CallSite->getStmtClass()) {
[analyzer] Teach CallEventManager that CXXTemporaryObjectExpr is also a ctor. Specifically, CallEventManager::getCaller was looking at the call site for an inlined call and trying to see what kind of call it was, but it only checked for CXXConstructExprClass. (It's not using an isa<> here to avoid doing three more checks on the the statement class.) This caused an unreachable when we actually did inline the constructor of a temporary object. PR13717 llvm-svn: 162792
2012-08-29 04:52:21 +08:00
case Stmt::CXXConstructExprClass:
case Stmt::CXXTemporaryObjectExprClass: {
[analyzer] Perform post-call checks for all inlined calls. Previously, we were only checking the origin expressions of inlined calls. Checkers using the generic postCall and older postObjCMessage callbacks were ignored. Now that we have CallEventManager, it is much easier to create a CallEvent generically when exiting an inlined function, which we can then use for post-call checks. No test case because we don't (yet) have any checkers that depend on this behavior (which is why it hadn't been fixed before now). llvm-svn: 161005
2012-07-31 07:39:47 +08:00
SValBuilder &SVB = State->getStateManager().getSValBuilder();
const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
SVal ThisVal = State->getSVal(ThisPtr);
return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
ThisVal.getAsRegion(), State, CallerCtx);
}
case Stmt::CXXNewExprClass:
return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
case Stmt::ObjCMessageExprClass:
return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
State, CallerCtx);
default:
llvm_unreachable("This is not an inlineable statement.");
}
}
// Fall back to the CFG. The only thing we haven't handled yet is
// destructors, though this could change in the future.
const CFGBlock *B = CalleeCtx->getCallSiteBlock();
CFGElement E = (*B)[CalleeCtx->getIndex()];
Replace CFGElement llvm::cast support to be well-defined. See r175462 for another example/more details. llvm-svn: 175796
2013-02-22 04:58:29 +08:00
assert(E.getAs<CFGImplicitDtor>() &&
"All other CFG elements should have exprs");
assert(!E.getAs<CFGTemporaryDtor>() && "We don't handle temporaries yet");
[analyzer] Perform post-call checks for all inlined calls. Previously, we were only checking the origin expressions of inlined calls. Checkers using the generic postCall and older postObjCMessage callbacks were ignored. Now that we have CallEventManager, it is much easier to create a CallEvent generically when exiting an inlined function, which we can then use for post-call checks. No test case because we don't (yet) have any checkers that depend on this behavior (which is why it hadn't been fixed before now). llvm-svn: 161005
2012-07-31 07:39:47 +08:00
SValBuilder &SVB = State->getStateManager().getSValBuilder();
const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
SVal ThisVal = State->getSVal(ThisPtr);
const Stmt *Trigger;
Remove the CFGElement "Invalid" state. Use Optional<CFG*> where invalid states were needed previously. In the one case where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy CFGAutomaticObjDtor. Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek and Doug Gregor. Post commit code review feedback on r175796 by Ted Kremenek. llvm-svn: 175938
2013-02-23 08:29:34 +08:00
if (Optional<CFGAutomaticObjDtor> AutoDtor = E.getAs<CFGAutomaticObjDtor>())
Trigger = AutoDtor->getTriggerStmt();
[analyzer] Handle destructors for the argument to C++ 'delete'. Now that the CFG includes nodes for the destructors in a delete-expression, process them in the analyzer using the same common destructor interface currently used for local, member, and base destructors. Also, check for when the value is known to be null, in which case no destructor is actually run. This does not yet handle destructors for deleted /arrays/, which may need more CFG work. It also causes a slight regression in the location of double delete warnings; the double delete is detected at the destructor call, which is implicit, and so is reported on the first access within the destructor instead of at the 'delete' statement. This will be fixed soon. Patch by Karthik Bhat! llvm-svn: 191381
2013-09-26 00:06:17 +08:00
else if (Optional<CFGDeleteDtor> DeleteDtor = E.getAs<CFGDeleteDtor>())
Trigger = cast<Stmt>(DeleteDtor->getDeleteExpr());
[analyzer] Perform post-call checks for all inlined calls. Previously, we were only checking the origin expressions of inlined calls. Checkers using the generic postCall and older postObjCMessage callbacks were ignored. Now that we have CallEventManager, it is much easier to create a CallEvent generically when exiting an inlined function, which we can then use for post-call checks. No test case because we don't (yet) have any checkers that depend on this behavior (which is why it hadn't been fixed before now). llvm-svn: 161005
2012-07-31 07:39:47 +08:00
else
Trigger = Dtor->getBody();
return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
Remove the CFGElement "Invalid" state. Use Optional<CFG*> where invalid states were needed previously. In the one case where that's not possible (beginAutomaticObjDtorsInsert) just use a dummy CFGAutomaticObjDtor. Thanks for the help from Jordan Rose & discussion/feedback from Ted Kremenek and Doug Gregor. Post commit code review feedback on r175796 by Ted Kremenek. llvm-svn: 175938
2013-02-23 08:29:34 +08:00
E.getAs<CFGBaseDtor>().hasValue(), State,
CallerCtx);
[analyzer] Perform post-call checks for all inlined calls. Previously, we were only checking the origin expressions of inlined calls. Checkers using the generic postCall and older postObjCMessage callbacks were ignored. Now that we have CallEventManager, it is much easier to create a CallEvent generically when exiting an inlined function, which we can then use for post-call checks. No test case because we don't (yet) have any checkers that depend on this behavior (which is why it hadn't been fixed before now). llvm-svn: 161005
2012-07-31 07:39:47 +08:00
}