2012-07-03 03:27:35 +08:00
|
|
|
//===- Calls.cpp - Wrapper for all function and method calls ------*- C++ -*--//
|
|
|
|
//
|
|
|
|
// The LLVM Compiler Infrastructure
|
|
|
|
//
|
|
|
|
// This file is distributed under the University of Illinois Open Source
|
|
|
|
// License. See LICENSE.TXT for details.
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
//
|
|
|
|
/// \file This file defines CallEvent and its subclasses, which represent path-
|
|
|
|
/// sensitive instances of different kinds of function and method calls
|
|
|
|
/// (C, C++, and Objective-C).
|
|
|
|
//
|
|
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
|
2012-07-27 05:39:41 +08:00
|
|
|
#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"
|
2012-07-11 06:07:42 +08:00
|
|
|
#include "clang/Analysis/ProgramPoint.h"
|
2012-07-19 05:59:41 +08:00
|
|
|
#include "clang/AST/ParentMap.h"
|
2012-07-03 03:27:35 +08:00
|
|
|
#include "llvm/ADT/SmallSet.h"
|
2012-07-03 03:28:04 +08:00
|
|
|
#include "llvm/ADT/StringExtras.h"
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
using namespace clang;
|
|
|
|
using namespace ento;
|
|
|
|
|
|
|
|
QualType CallEvent::getResultType() const {
|
[analyzer] Always derive a CallEvent's return type from its origin expr.
Previously, we preferred to get a result type by looking at the callee's
declared result type. This allowed us to handlereferences, which are
represented in the AST as lvalues of their pointee type. (That is, a call
to a function returning 'int &' has type 'int' and value kind 'lvalue'.)
However, this results in us preferring the original type of a function
over a casted type. This is a problem when a function pointer is casted
to another type, because the conjured result value will have the wrong
type. AdjustedReturnValueChecker is supposed to handle this, but still
doesn't handle the case where there is no "original function" at all,
i.e. where the callee is unknown.
Now, we instead look at the call expression's value kind (lvalue, xvalue,
or prvalue), and adjust the expr's type accordingly. This will have no
effect when the function is inlined, and will conjure the value that will
actually be used when it is not.
This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately,
the cases where it would still be useful are where we need to cast the
result of an inlined function or a checker-evaluated function, and in these
cases we don't know what we're casting /from/ by the time we can do post-
call checks. In light of that, remove AdjustedReturnValueChecker, which
was already not checking quite a few calls.
llvm-svn: 163065
2012-09-02 01:39:00 +08:00
|
|
|
const Expr *E = getOriginExpr();
|
|
|
|
assert(E && "Calls without origin expressions do not have results");
|
|
|
|
QualType ResultTy = E->getType();
|
2012-07-03 03:27:35 +08:00
|
|
|
|
[analyzer] Always derive a CallEvent's return type from its origin expr.
Previously, we preferred to get a result type by looking at the callee's
declared result type. This allowed us to handlereferences, which are
represented in the AST as lvalues of their pointee type. (That is, a call
to a function returning 'int &' has type 'int' and value kind 'lvalue'.)
However, this results in us preferring the original type of a function
over a casted type. This is a problem when a function pointer is casted
to another type, because the conjured result value will have the wrong
type. AdjustedReturnValueChecker is supposed to handle this, but still
doesn't handle the case where there is no "original function" at all,
i.e. where the callee is unknown.
Now, we instead look at the call expression's value kind (lvalue, xvalue,
or prvalue), and adjust the expr's type accordingly. This will have no
effect when the function is inlined, and will conjure the value that will
actually be used when it is not.
This makes AdjustedReturnValueChecker /nearly/ unnecessary; unfortunately,
the cases where it would still be useful are where we need to cast the
result of an inlined function or a checker-evaluated function, and in these
cases we don't know what we're casting /from/ by the time we can do post-
call checks. In light of that, remove AdjustedReturnValueChecker, which
was already not checking quite a few calls.
llvm-svn: 163065
2012-09-02 01:39:00 +08:00
|
|
|
ASTContext &Ctx = getState()->getStateManager().getContext();
|
|
|
|
|
|
|
|
// A function that returns a reference to 'int' will have a result type
|
|
|
|
// of simply 'int'. Check the origin expr's value kind to recover the
|
|
|
|
// proper type.
|
|
|
|
switch (E->getValueKind()) {
|
|
|
|
case VK_LValue:
|
|
|
|
ResultTy = Ctx.getLValueReferenceType(ResultTy);
|
|
|
|
break;
|
|
|
|
case VK_XValue:
|
|
|
|
ResultTy = Ctx.getRValueReferenceType(ResultTy);
|
|
|
|
break;
|
|
|
|
case VK_RValue:
|
|
|
|
// No adjustment is necessary.
|
|
|
|
break;
|
|
|
|
}
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
return ResultTy;
|
|
|
|
}
|
|
|
|
|
|
|
|
static bool isCallbackArg(SVal V, QualType T) {
|
|
|
|
// If the parameter is 0, it's harmless.
|
|
|
|
if (V.isZeroConstant())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// If a parameter is a block or a callback, assume it can modify pointer.
|
|
|
|
if (T->isBlockPointerType() ||
|
|
|
|
T->isFunctionPointerType() ||
|
|
|
|
T->isObjCSelType())
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// Check if a callback is passed inside a struct (for both, struct passed by
|
|
|
|
// reference and by value). Dig just one level into the struct for now.
|
|
|
|
|
2012-09-06 01:11:22 +08:00
|
|
|
if (T->isAnyPointerType() || T->isReferenceType())
|
2012-07-03 03:27:35 +08:00
|
|
|
T = T->getPointeeType();
|
|
|
|
|
|
|
|
if (const RecordType *RT = T->getAsStructureType()) {
|
|
|
|
const RecordDecl *RD = RT->getDecl();
|
|
|
|
for (RecordDecl::field_iterator I = RD->field_begin(), E = RD->field_end();
|
|
|
|
I != E; ++I) {
|
|
|
|
QualType FieldT = I->getType();
|
|
|
|
if (FieldT->isBlockPointerType() || FieldT->isFunctionPointerType())
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool CallEvent::hasNonZeroCallbackArg() const {
|
|
|
|
unsigned NumOfArgs = getNumArgs();
|
|
|
|
|
|
|
|
// If calling using a function pointer, assume the function does not
|
|
|
|
// have a callback. TODO: We could check the types of the arguments here.
|
|
|
|
if (!getDecl())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
unsigned Idx = 0;
|
|
|
|
for (CallEvent::param_type_iterator I = param_type_begin(),
|
|
|
|
E = param_type_end();
|
|
|
|
I != E && Idx < NumOfArgs; ++I, ++Idx) {
|
|
|
|
if (NumOfArgs <= Idx)
|
|
|
|
break;
|
|
|
|
|
|
|
|
if (isCallbackArg(getArgSVal(Idx), *I))
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
/// \brief Returns true if a type is a pointer-to-const or reference-to-const
|
|
|
|
/// with no further indirection.
|
|
|
|
static bool isPointerToConst(QualType Ty) {
|
|
|
|
QualType PointeeTy = Ty->getPointeeType();
|
|
|
|
if (PointeeTy == QualType())
|
|
|
|
return false;
|
|
|
|
if (!PointeeTy.isConstQualified())
|
|
|
|
return false;
|
|
|
|
if (PointeeTy->isAnyPointerType())
|
|
|
|
return false;
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
// Try to retrieve the function declaration and find the function parameter
|
|
|
|
// types which are pointers/references to a non-pointer const.
|
2012-07-03 03:27:51 +08:00
|
|
|
// We will not invalidate the corresponding argument regions.
|
2012-07-03 03:27:35 +08:00
|
|
|
static void findPtrToConstParams(llvm::SmallSet<unsigned, 1> &PreserveArgs,
|
|
|
|
const CallEvent &Call) {
|
|
|
|
unsigned Idx = 0;
|
|
|
|
for (CallEvent::param_type_iterator I = Call.param_type_begin(),
|
2012-07-03 03:27:51 +08:00
|
|
|
E = Call.param_type_end();
|
2012-07-03 03:27:35 +08:00
|
|
|
I != E; ++I, ++Idx) {
|
|
|
|
if (isPointerToConst(*I))
|
|
|
|
PreserveArgs.insert(Idx);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
ProgramStateRef CallEvent::invalidateRegions(unsigned BlockCount,
|
|
|
|
ProgramStateRef Orig) const {
|
2012-07-19 05:59:41 +08:00
|
|
|
ProgramStateRef Result = (Orig ? Orig : getState());
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
SmallVector<const MemRegion *, 8> RegionsToInvalidate;
|
2012-07-19 05:59:46 +08:00
|
|
|
getExtraInvalidatedRegions(RegionsToInvalidate);
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
// Indexes of arguments whose values will be preserved by the call.
|
|
|
|
llvm::SmallSet<unsigned, 1> PreserveArgs;
|
2012-07-03 03:27:51 +08:00
|
|
|
if (!argumentsMayEscape())
|
|
|
|
findPtrToConstParams(PreserveArgs, *this);
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
for (unsigned Idx = 0, Count = getNumArgs(); Idx != Count; ++Idx) {
|
|
|
|
if (PreserveArgs.count(Idx))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
SVal V = getArgSVal(Idx);
|
|
|
|
|
|
|
|
// If we are passing a location wrapped as an integer, unwrap it and
|
|
|
|
// invalidate the values referred by the location.
|
|
|
|
if (nonloc::LocAsInteger *Wrapped = dyn_cast<nonloc::LocAsInteger>(&V))
|
|
|
|
V = Wrapped->getLoc();
|
|
|
|
else if (!isa<Loc>(V))
|
|
|
|
continue;
|
|
|
|
|
|
|
|
if (const MemRegion *R = V.getAsRegion()) {
|
|
|
|
// Invalidate the value of the variable passed by reference.
|
|
|
|
|
|
|
|
// Are we dealing with an ElementRegion? If the element type is
|
|
|
|
// a basic integer type (e.g., char, int) and the underlying region
|
|
|
|
// is a variable region then strip off the ElementRegion.
|
|
|
|
// FIXME: We really need to think about this for the general case
|
|
|
|
// as sometimes we are reasoning about arrays and other times
|
|
|
|
// about (char*), etc., is just a form of passing raw bytes.
|
|
|
|
// e.g., void *p = alloca(); foo((char*)p);
|
|
|
|
if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) {
|
|
|
|
// Checking for 'integral type' is probably too promiscuous, but
|
|
|
|
// we'll leave it in for now until we have a systematic way of
|
|
|
|
// handling all of these cases. Eventually we need to come up
|
|
|
|
// with an interface to StoreManager so that this logic can be
|
|
|
|
// appropriately delegated to the respective StoreManagers while
|
|
|
|
// still allowing us to do checker-specific logic (e.g.,
|
|
|
|
// invalidating reference counts), probably via callbacks.
|
|
|
|
if (ER->getElementType()->isIntegralOrEnumerationType()) {
|
|
|
|
const MemRegion *superReg = ER->getSuperRegion();
|
|
|
|
if (isa<VarRegion>(superReg) || isa<FieldRegion>(superReg) ||
|
|
|
|
isa<ObjCIvarRegion>(superReg))
|
|
|
|
R = cast<TypedRegion>(superReg);
|
|
|
|
}
|
|
|
|
// FIXME: What about layers of ElementRegions?
|
|
|
|
}
|
|
|
|
|
|
|
|
// Mark this region for invalidation. We batch invalidate regions
|
|
|
|
// below for efficiency.
|
|
|
|
RegionsToInvalidate.push_back(R);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Invalidate designated regions using the batch invalidation API.
|
|
|
|
// NOTE: Even if RegionsToInvalidate is empty, we may still invalidate
|
|
|
|
// global variables.
|
|
|
|
return Result->invalidateRegions(RegionsToInvalidate, getOriginExpr(),
|
2012-07-19 05:59:41 +08:00
|
|
|
BlockCount, getLocationContext(),
|
|
|
|
/*Symbols=*/0, this);
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-11 06:07:42 +08:00
|
|
|
ProgramPoint CallEvent::getProgramPoint(bool IsPreVisit,
|
|
|
|
const ProgramPointTag *Tag) const {
|
|
|
|
if (const Expr *E = getOriginExpr()) {
|
|
|
|
if (IsPreVisit)
|
2012-07-19 05:59:41 +08:00
|
|
|
return PreStmt(E, getLocationContext(), Tag);
|
|
|
|
return PostStmt(E, getLocationContext(), Tag);
|
2012-07-11 06:07:42 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
const Decl *D = getDecl();
|
|
|
|
assert(D && "Cannot get a program point without a statement or decl");
|
|
|
|
|
|
|
|
SourceLocation Loc = getSourceRange().getBegin();
|
|
|
|
if (IsPreVisit)
|
2012-07-19 05:59:41 +08:00
|
|
|
return PreImplicitCall(D, Loc, getLocationContext(), Tag);
|
|
|
|
return PostImplicitCall(D, Loc, getLocationContext(), Tag);
|
2012-07-11 06:07:42 +08:00
|
|
|
}
|
|
|
|
|
2012-07-27 05:41:15 +08:00
|
|
|
SVal CallEvent::getArgSVal(unsigned Index) const {
|
|
|
|
const Expr *ArgE = getArgExpr(Index);
|
|
|
|
if (!ArgE)
|
|
|
|
return UnknownVal();
|
|
|
|
return getSVal(ArgE);
|
|
|
|
}
|
|
|
|
|
|
|
|
SourceRange CallEvent::getArgSourceRange(unsigned Index) const {
|
|
|
|
const Expr *ArgE = getArgExpr(Index);
|
|
|
|
if (!ArgE)
|
|
|
|
return SourceRange();
|
|
|
|
return ArgE->getSourceRange();
|
|
|
|
}
|
|
|
|
|
2012-08-14 22:50:32 +08:00
|
|
|
void CallEvent::dump() const {
|
|
|
|
dump(llvm::errs());
|
|
|
|
}
|
|
|
|
|
2012-07-27 05:41:15 +08:00
|
|
|
void CallEvent::dump(raw_ostream &Out) const {
|
|
|
|
ASTContext &Ctx = getState()->getStateManager().getContext();
|
|
|
|
if (const Expr *E = getOriginExpr()) {
|
2012-08-16 11:56:14 +08:00
|
|
|
E->printPretty(Out, 0, Ctx.getPrintingPolicy());
|
2012-07-27 05:41:15 +08:00
|
|
|
Out << "\n";
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (const Decl *D = getDecl()) {
|
|
|
|
Out << "Call to ";
|
|
|
|
D->print(Out, Ctx.getPrintingPolicy());
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
// FIXME: a string representation of the kind would be nice.
|
|
|
|
Out << "Unknown call (type " << getKind() << ")";
|
|
|
|
}
|
|
|
|
|
2012-07-11 06:07:42 +08:00
|
|
|
|
2012-08-28 08:50:38 +08:00
|
|
|
bool CallEvent::isCallStmt(const Stmt *S) {
|
2012-07-27 05:41:15 +08:00
|
|
|
return isa<CallExpr>(S) || isa<ObjCMessageExpr>(S)
|
2012-08-28 08:50:38 +08:00
|
|
|
|| isa<CXXConstructExpr>(S)
|
|
|
|
|| isa<CXXNewExpr>(S);
|
2012-07-03 03:27:51 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
static void addParameterValuesToBindings(const StackFrameContext *CalleeCtx,
|
|
|
|
CallEvent::BindingsTy &Bindings,
|
|
|
|
SValBuilder &SVB,
|
|
|
|
const CallEvent &Call,
|
|
|
|
CallEvent::param_iterator I,
|
|
|
|
CallEvent::param_iterator E) {
|
|
|
|
MemRegionManager &MRMgr = SVB.getRegionManager();
|
2012-07-03 03:27:51 +08:00
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
unsigned Idx = 0;
|
|
|
|
for (; I != E; ++I, ++Idx) {
|
|
|
|
const ParmVarDecl *ParamDecl = *I;
|
|
|
|
assert(ParamDecl && "Formal parameter has no decl?");
|
|
|
|
|
|
|
|
SVal ArgVal = Call.getArgSVal(Idx);
|
|
|
|
if (!ArgVal.isUnknown()) {
|
|
|
|
Loc ParamLoc = SVB.makeLoc(MRMgr.getVarRegion(ParamDecl, CalleeCtx));
|
|
|
|
Bindings.push_back(std::make_pair(ParamLoc, ArgVal));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// FIXME: Variadic arguments are not handled at all right now.
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
CallEvent::param_iterator AnyFunctionCall::param_begin() const {
|
|
|
|
const FunctionDecl *D = getDecl();
|
2012-07-03 03:27:35 +08:00
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
return D->param_begin();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
CallEvent::param_iterator AnyFunctionCall::param_end() const {
|
|
|
|
const FunctionDecl *D = getDecl();
|
2012-07-03 03:27:35 +08:00
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
return D->param_end();
|
|
|
|
}
|
|
|
|
|
|
|
|
void AnyFunctionCall::getInitialStackFrameContents(
|
|
|
|
const StackFrameContext *CalleeCtx,
|
|
|
|
BindingsTy &Bindings) const {
|
|
|
|
const FunctionDecl *D = cast<FunctionDecl>(CalleeCtx->getDecl());
|
|
|
|
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
|
|
|
|
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
|
|
|
|
D->param_begin(), D->param_end());
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-03 03:27:51 +08:00
|
|
|
bool AnyFunctionCall::argumentsMayEscape() const {
|
2012-07-19 05:59:41 +08:00
|
|
|
if (hasNonZeroCallbackArg())
|
2012-07-03 03:27:51 +08:00
|
|
|
return true;
|
|
|
|
|
|
|
|
const FunctionDecl *D = getDecl();
|
|
|
|
if (!D)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
const IdentifierInfo *II = D->getIdentifier();
|
|
|
|
if (!II)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// This set of "escaping" APIs is
|
|
|
|
|
|
|
|
// - 'int pthread_setspecific(ptheread_key k, const void *)' stores a
|
|
|
|
// value into thread local storage. The value can later be retrieved with
|
|
|
|
// 'void *ptheread_getspecific(pthread_key)'. So even thought the
|
|
|
|
// parameter is 'const void *', the region escapes through the call.
|
|
|
|
if (II->isStr("pthread_setspecific"))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// - xpc_connection_set_context stores a value which can be retrieved later
|
|
|
|
// with xpc_connection_get_context.
|
|
|
|
if (II->isStr("xpc_connection_set_context"))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// - funopen - sets a buffer for future IO calls.
|
|
|
|
if (II->isStr("funopen"))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
StringRef FName = II->getName();
|
|
|
|
|
|
|
|
// - CoreFoundation functions that end with "NoCopy" can free a passed-in
|
|
|
|
// buffer even if it is const.
|
|
|
|
if (FName.endswith("NoCopy"))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// - NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
|
|
|
|
// be deallocated by NSMapRemove.
|
|
|
|
if (FName.startswith("NS") && (FName.find("Insert") != StringRef::npos))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
// - Many CF containers allow objects to escape through custom
|
|
|
|
// allocators/deallocators upon container construction. (PR12101)
|
|
|
|
if (FName.startswith("CF") || FName.startswith("CG")) {
|
|
|
|
return StrInStrNoCase(FName, "InsertValue") != StringRef::npos ||
|
|
|
|
StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
|
|
|
|
StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
|
|
|
|
StrInStrNoCase(FName, "WithData") != StringRef::npos ||
|
|
|
|
StrInStrNoCase(FName, "AppendValue") != StringRef::npos ||
|
|
|
|
StrInStrNoCase(FName, "SetAttribute") != StringRef::npos;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-07-03 03:27:35 +08:00
|
|
|
const FunctionDecl *SimpleCall::getDecl() const {
|
2012-07-19 05:59:41 +08:00
|
|
|
const FunctionDecl *D = getOriginExpr()->getDirectCallee();
|
2012-07-03 03:27:35 +08:00
|
|
|
if (D)
|
|
|
|
return D;
|
|
|
|
|
2012-07-19 05:59:41 +08:00
|
|
|
return getSVal(getOriginExpr()->getCallee()).getAsFunctionDecl();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-03 03:27:51 +08:00
|
|
|
|
2012-08-14 07:46:05 +08:00
|
|
|
const FunctionDecl *CXXInstanceCall::getDecl() const {
|
|
|
|
const CallExpr *CE = cast_or_null<CallExpr>(getOriginExpr());
|
|
|
|
if (!CE)
|
|
|
|
return AnyFunctionCall::getDecl();
|
|
|
|
|
|
|
|
const FunctionDecl *D = CE->getDirectCallee();
|
|
|
|
if (D)
|
|
|
|
return D;
|
|
|
|
|
|
|
|
return getSVal(CE->getCallee()).getAsFunctionDecl();
|
|
|
|
}
|
|
|
|
|
2012-07-19 05:59:46 +08:00
|
|
|
void CXXInstanceCall::getExtraInvalidatedRegions(RegionList &Regions) const {
|
2012-07-12 08:16:25 +08:00
|
|
|
if (const MemRegion *R = getCXXThisVal().getAsRegion())
|
|
|
|
Regions.push_back(R);
|
|
|
|
}
|
|
|
|
|
2012-09-06 01:11:26 +08:00
|
|
|
SVal CXXInstanceCall::getCXXThisVal() const {
|
|
|
|
const Expr *Base = getCXXThisExpr();
|
|
|
|
// FIXME: This doesn't handle an overloaded ->* operator.
|
|
|
|
if (!Base)
|
|
|
|
return UnknownVal();
|
|
|
|
|
|
|
|
SVal ThisVal = getSVal(Base);
|
|
|
|
|
|
|
|
// FIXME: This is only necessary because we can call member functions on
|
|
|
|
// struct rvalues, which do not have regions we can use for a 'this' pointer.
|
|
|
|
// Ideally this should eventually be changed to an assert, i.e. all
|
|
|
|
// non-Unknown, non-null 'this' values should be loc::MemRegionVals.
|
|
|
|
if (isa<DefinedSVal>(ThisVal))
|
|
|
|
if (!ThisVal.getAsRegion() && !ThisVal.isConstant())
|
|
|
|
return UnknownVal();
|
|
|
|
|
|
|
|
return ThisVal;
|
|
|
|
}
|
|
|
|
|
2012-07-12 08:16:25 +08:00
|
|
|
|
2012-08-09 08:21:33 +08:00
|
|
|
RuntimeDefinition CXXInstanceCall::getRuntimeDefinition() const {
|
2012-08-15 08:51:56 +08:00
|
|
|
// Do we have a decl at all?
|
2012-08-11 06:26:43 +08:00
|
|
|
const Decl *D = getDecl();
|
2012-07-12 08:16:25 +08:00
|
|
|
if (!D)
|
2012-08-09 08:21:33 +08:00
|
|
|
return RuntimeDefinition();
|
2012-07-12 08:16:25 +08:00
|
|
|
|
2012-08-15 08:51:56 +08:00
|
|
|
// If the method is non-virtual, we know we can inline it.
|
2012-07-12 08:16:25 +08:00
|
|
|
const CXXMethodDecl *MD = cast<CXXMethodDecl>(D);
|
|
|
|
if (!MD->isVirtual())
|
2012-08-14 07:46:05 +08:00
|
|
|
return AnyFunctionCall::getRuntimeDefinition();
|
2012-07-12 08:16:25 +08:00
|
|
|
|
2012-08-15 08:51:56 +08:00
|
|
|
// Do we know the implicit 'this' object being called?
|
|
|
|
const MemRegion *R = getCXXThisVal().getAsRegion();
|
|
|
|
if (!R)
|
|
|
|
return RuntimeDefinition();
|
|
|
|
|
|
|
|
// Do we know anything about the type of 'this'?
|
|
|
|
DynamicTypeInfo DynType = getState()->getDynamicTypeInfo(R);
|
|
|
|
if (!DynType.isValid())
|
|
|
|
return RuntimeDefinition();
|
|
|
|
|
|
|
|
// Is the type a C++ class? (This is mostly a defensive check.)
|
|
|
|
QualType RegionType = DynType.getType()->getPointeeType();
|
2012-09-06 01:11:22 +08:00
|
|
|
assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
|
|
|
|
|
2012-08-15 08:51:56 +08:00
|
|
|
const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
|
2012-08-16 01:33:37 +08:00
|
|
|
if (!RD || !RD->hasDefinition())
|
2012-08-15 08:51:56 +08:00
|
|
|
return RuntimeDefinition();
|
|
|
|
|
|
|
|
// Find the decl for this method in that class.
|
2012-08-16 04:07:17 +08:00
|
|
|
const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
|
2012-09-07 09:19:42 +08:00
|
|
|
if (!Result) {
|
|
|
|
// We might not even get the original statically-resolved method due to
|
|
|
|
// some particularly nasty casting (e.g. casts to sister classes).
|
|
|
|
// However, we should at least be able to search up and down our own class
|
|
|
|
// hierarchy, and some real bugs have been caught by checking this.
|
|
|
|
assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
|
|
|
|
assert(!RD->isDerivedFrom(MD->getParent()) && "Couldn't find known method");
|
|
|
|
return RuntimeDefinition();
|
|
|
|
}
|
2012-08-15 08:51:56 +08:00
|
|
|
|
|
|
|
// Does the decl that we found have an implementation?
|
|
|
|
const FunctionDecl *Definition;
|
|
|
|
if (!Result->hasBody(Definition))
|
|
|
|
return RuntimeDefinition();
|
2012-07-12 08:16:25 +08:00
|
|
|
|
2012-08-15 08:51:56 +08:00
|
|
|
// We found a definition. If we're not sure that this devirtualization is
|
|
|
|
// actually what will happen at runtime, make sure to provide the region so
|
|
|
|
// that ExprEngine can decide what to do with it.
|
|
|
|
if (DynType.canBeASubClass())
|
|
|
|
return RuntimeDefinition(Definition, R->StripCasts());
|
|
|
|
return RuntimeDefinition(Definition, /*DispatchRegion=*/0);
|
2012-07-12 08:16:25 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
void CXXInstanceCall::getInitialStackFrameContents(
|
|
|
|
const StackFrameContext *CalleeCtx,
|
|
|
|
BindingsTy &Bindings) const {
|
|
|
|
AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
|
|
|
|
|
2012-08-11 06:26:46 +08:00
|
|
|
// Handle the binding of 'this' in the new stack frame.
|
2012-07-31 09:07:55 +08:00
|
|
|
SVal ThisVal = getCXXThisVal();
|
|
|
|
if (!ThisVal.isUnknown()) {
|
2012-08-11 06:26:46 +08:00
|
|
|
ProgramStateManager &StateMgr = getState()->getStateManager();
|
|
|
|
SValBuilder &SVB = StateMgr.getSValBuilder();
|
2012-08-16 01:33:34 +08:00
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
|
|
|
|
Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
|
2012-08-11 06:26:46 +08:00
|
|
|
|
2012-08-16 01:33:34 +08:00
|
|
|
// If we devirtualized to a different member function, we need to make sure
|
|
|
|
// we have the proper layering of CXXBaseObjectRegions.
|
|
|
|
if (MD->getCanonicalDecl() != getDecl()->getCanonicalDecl()) {
|
2012-08-14 07:46:01 +08:00
|
|
|
ASTContext &Ctx = SVB.getContext();
|
2012-08-11 06:26:46 +08:00
|
|
|
const CXXRecordDecl *Class = MD->getParent();
|
2012-08-14 07:46:01 +08:00
|
|
|
QualType Ty = Ctx.getPointerType(Ctx.getRecordType(Class));
|
2012-08-11 06:26:46 +08:00
|
|
|
|
2012-08-14 07:46:01 +08:00
|
|
|
// FIXME: CallEvent maybe shouldn't be directly accessing StoreManager.
|
|
|
|
bool Failed;
|
|
|
|
ThisVal = StateMgr.getStoreManager().evalDynamicCast(ThisVal, Ty, Failed);
|
|
|
|
assert(!Failed && "Calling an incorrectly devirtualized method");
|
2012-08-11 06:26:46 +08:00
|
|
|
}
|
|
|
|
|
2012-08-16 01:33:34 +08:00
|
|
|
if (!ThisVal.isUnknown())
|
|
|
|
Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
|
2012-07-31 09:07:55 +08:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-07-12 08:16:25 +08:00
|
|
|
|
2012-08-04 07:08:49 +08:00
|
|
|
const Expr *CXXMemberCall::getCXXThisExpr() const {
|
|
|
|
return getOriginExpr()->getImplicitObjectArgument();
|
2012-07-11 06:07:57 +08:00
|
|
|
}
|
|
|
|
|
2012-07-03 03:27:51 +08:00
|
|
|
|
2012-08-04 07:08:49 +08:00
|
|
|
const Expr *CXXMemberOperatorCall::getCXXThisExpr() const {
|
|
|
|
return getOriginExpr()->getArg(0);
|
2012-07-11 06:07:57 +08:00
|
|
|
}
|
|
|
|
|
2012-07-04 06:55:57 +08:00
|
|
|
|
2012-07-03 03:27:35 +08:00
|
|
|
const BlockDataRegion *BlockCall::getBlockRegion() const {
|
|
|
|
const Expr *Callee = getOriginExpr()->getCallee();
|
|
|
|
const MemRegion *DataReg = getSVal(Callee).getAsRegion();
|
|
|
|
|
2012-07-03 03:28:09 +08:00
|
|
|
return dyn_cast_or_null<BlockDataRegion>(DataReg);
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
CallEvent::param_iterator BlockCall::param_begin() const {
|
2012-07-03 03:28:09 +08:00
|
|
|
const BlockDecl *D = getBlockDecl();
|
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
return D->param_begin();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
CallEvent::param_iterator BlockCall::param_end() const {
|
2012-07-03 03:28:09 +08:00
|
|
|
const BlockDecl *D = getBlockDecl();
|
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
return D->param_end();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-19 05:59:46 +08:00
|
|
|
void BlockCall::getExtraInvalidatedRegions(RegionList &Regions) const {
|
2012-07-03 03:28:09 +08:00
|
|
|
// FIXME: This also needs to invalidate captured globals.
|
|
|
|
if (const MemRegion *R = getBlockRegion())
|
|
|
|
Regions.push_back(R);
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
void BlockCall::getInitialStackFrameContents(const StackFrameContext *CalleeCtx,
|
|
|
|
BindingsTy &Bindings) const {
|
|
|
|
const BlockDecl *D = cast<BlockDecl>(CalleeCtx->getDecl());
|
|
|
|
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
|
|
|
|
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
|
|
|
|
D->param_begin(), D->param_end());
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-07-11 06:07:57 +08:00
|
|
|
SVal CXXConstructorCall::getCXXThisVal() const {
|
2012-07-19 05:59:41 +08:00
|
|
|
if (Data)
|
|
|
|
return loc::MemRegionVal(static_cast<const MemRegion *>(Data));
|
2012-07-11 06:07:57 +08:00
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
|
2012-07-19 05:59:46 +08:00
|
|
|
void CXXConstructorCall::getExtraInvalidatedRegions(RegionList &Regions) const {
|
2012-07-19 05:59:41 +08:00
|
|
|
if (Data)
|
|
|
|
Regions.push_back(static_cast<const MemRegion *>(Data));
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
void CXXConstructorCall::getInitialStackFrameContents(
|
|
|
|
const StackFrameContext *CalleeCtx,
|
|
|
|
BindingsTy &Bindings) const {
|
|
|
|
AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
|
|
|
|
|
|
|
|
SVal ThisVal = getCXXThisVal();
|
|
|
|
if (!ThisVal.isUnknown()) {
|
|
|
|
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
|
|
|
|
const CXXMethodDecl *MD = cast<CXXMethodDecl>(CalleeCtx->getDecl());
|
|
|
|
Loc ThisLoc = SVB.getCXXThis(MD, CalleeCtx);
|
|
|
|
Bindings.push_back(std::make_pair(ThisLoc, ThisVal));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
|
2012-07-03 03:27:51 +08:00
|
|
|
|
2012-07-11 06:07:57 +08:00
|
|
|
SVal CXXDestructorCall::getCXXThisVal() const {
|
2012-07-19 05:59:41 +08:00
|
|
|
if (Data)
|
2012-09-07 04:37:08 +08:00
|
|
|
return loc::MemRegionVal(DtorDataTy::getFromOpaqueValue(Data).getPointer());
|
2012-07-11 06:07:57 +08:00
|
|
|
return UnknownVal();
|
|
|
|
}
|
|
|
|
|
2012-09-07 04:37:08 +08:00
|
|
|
RuntimeDefinition CXXDestructorCall::getRuntimeDefinition() const {
|
|
|
|
// Base destructors are always called non-virtually.
|
|
|
|
// Skip CXXInstanceCall's devirtualization logic in this case.
|
|
|
|
if (isBaseDestructor())
|
|
|
|
return AnyFunctionCall::getRuntimeDefinition();
|
|
|
|
|
|
|
|
return CXXInstanceCall::getRuntimeDefinition();
|
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
|
|
|
|
CallEvent::param_iterator ObjCMethodCall::param_begin() const {
|
|
|
|
const ObjCMethodDecl *D = getDecl();
|
2012-07-03 03:27:35 +08:00
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
return D->param_begin();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
CallEvent::param_iterator ObjCMethodCall::param_end() const {
|
|
|
|
const ObjCMethodDecl *D = getDecl();
|
2012-07-03 03:27:35 +08:00
|
|
|
if (!D)
|
|
|
|
return 0;
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
return D->param_end();
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
void
|
2012-07-19 05:59:46 +08:00
|
|
|
ObjCMethodCall::getExtraInvalidatedRegions(RegionList &Regions) const {
|
2012-07-03 03:27:35 +08:00
|
|
|
if (const MemRegion *R = getReceiverSVal().getAsRegion())
|
|
|
|
Regions.push_back(R);
|
|
|
|
}
|
|
|
|
|
2012-08-24 08:06:12 +08:00
|
|
|
SVal ObjCMethodCall::getSelfSVal() const {
|
|
|
|
const LocationContext *LCtx = getLocationContext();
|
|
|
|
const ImplicitParamDecl *SelfDecl = LCtx->getSelfDecl();
|
|
|
|
if (!SelfDecl)
|
|
|
|
return SVal();
|
|
|
|
return getState()->getSVal(getState()->getRegion(SelfDecl, LCtx));
|
|
|
|
}
|
|
|
|
|
2012-07-03 03:27:56 +08:00
|
|
|
SVal ObjCMethodCall::getReceiverSVal() const {
|
2012-07-03 03:27:35 +08:00
|
|
|
// FIXME: Is this the best way to handle class receivers?
|
|
|
|
if (!isInstanceMessage())
|
|
|
|
return UnknownVal();
|
|
|
|
|
2012-08-07 07:25:39 +08:00
|
|
|
if (const Expr *RecE = getOriginExpr()->getInstanceReceiver())
|
|
|
|
return getSVal(RecE);
|
2012-07-03 03:27:35 +08:00
|
|
|
|
|
|
|
// An instance message with no expression means we are sending to super.
|
|
|
|
// In this case the object reference is the same as 'self'.
|
2012-08-24 08:06:12 +08:00
|
|
|
assert(getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance);
|
|
|
|
SVal SelfVal = getSelfSVal();
|
|
|
|
assert(SelfVal.isValid() && "Calling super but not in ObjC method");
|
|
|
|
return SelfVal;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool ObjCMethodCall::isReceiverSelfOrSuper() const {
|
|
|
|
if (getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperInstance ||
|
|
|
|
getOriginExpr()->getReceiverKind() == ObjCMessageExpr::SuperClass)
|
|
|
|
return true;
|
|
|
|
|
|
|
|
if (!isInstanceMessage())
|
|
|
|
return false;
|
|
|
|
|
|
|
|
SVal RecVal = getSVal(getOriginExpr()->getInstanceReceiver());
|
|
|
|
|
|
|
|
return (RecVal == getSelfSVal());
|
2012-07-19 05:59:41 +08:00
|
|
|
}
|
|
|
|
|
2012-07-19 05:59:51 +08:00
|
|
|
SourceRange ObjCMethodCall::getSourceRange() const {
|
|
|
|
switch (getMessageKind()) {
|
|
|
|
case OCM_Message:
|
|
|
|
return getOriginExpr()->getSourceRange();
|
|
|
|
case OCM_PropertyAccess:
|
|
|
|
case OCM_Subscript:
|
|
|
|
return getContainingPseudoObjectExpr()->getSourceRange();
|
|
|
|
}
|
2012-07-19 11:08:07 +08:00
|
|
|
llvm_unreachable("unknown message kind");
|
2012-07-19 05:59:51 +08:00
|
|
|
}
|
|
|
|
|
|
|
|
typedef llvm::PointerIntPair<const PseudoObjectExpr *, 2> ObjCMessageDataTy;
|
|
|
|
|
|
|
|
const PseudoObjectExpr *ObjCMethodCall::getContainingPseudoObjectExpr() const {
|
|
|
|
assert(Data != 0 && "Lazy lookup not yet performed.");
|
|
|
|
assert(getMessageKind() != OCM_Message && "Explicit message send.");
|
|
|
|
return ObjCMessageDataTy::getFromOpaqueValue(Data).getPointer();
|
|
|
|
}
|
|
|
|
|
|
|
|
ObjCMessageKind ObjCMethodCall::getMessageKind() const {
|
|
|
|
if (Data == 0) {
|
|
|
|
ParentMap &PM = getLocationContext()->getParentMap();
|
|
|
|
const Stmt *S = PM.getParent(getOriginExpr());
|
|
|
|
if (const PseudoObjectExpr *POE = dyn_cast_or_null<PseudoObjectExpr>(S)) {
|
|
|
|
const Expr *Syntactic = POE->getSyntacticForm();
|
|
|
|
|
|
|
|
// This handles the funny case of assigning to the result of a getter.
|
|
|
|
// This can happen if the getter returns a non-const reference.
|
|
|
|
if (const BinaryOperator *BO = dyn_cast<BinaryOperator>(Syntactic))
|
|
|
|
Syntactic = BO->getLHS();
|
|
|
|
|
|
|
|
ObjCMessageKind K;
|
|
|
|
switch (Syntactic->getStmtClass()) {
|
|
|
|
case Stmt::ObjCPropertyRefExprClass:
|
|
|
|
K = OCM_PropertyAccess;
|
|
|
|
break;
|
|
|
|
case Stmt::ObjCSubscriptRefExprClass:
|
|
|
|
K = OCM_Subscript;
|
|
|
|
break;
|
|
|
|
default:
|
|
|
|
// FIXME: Can this ever happen?
|
|
|
|
K = OCM_Message;
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (K != OCM_Message) {
|
|
|
|
const_cast<ObjCMethodCall *>(this)->Data
|
|
|
|
= ObjCMessageDataTy(POE, K).getOpaqueValue();
|
|
|
|
assert(getMessageKind() == K);
|
|
|
|
return K;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
const_cast<ObjCMethodCall *>(this)->Data
|
|
|
|
= ObjCMessageDataTy(0, 1).getOpaqueValue();
|
|
|
|
assert(getMessageKind() == OCM_Message);
|
|
|
|
return OCM_Message;
|
|
|
|
}
|
|
|
|
|
|
|
|
ObjCMessageDataTy Info = ObjCMessageDataTy::getFromOpaqueValue(Data);
|
|
|
|
if (!Info.getPointer())
|
|
|
|
return OCM_Message;
|
|
|
|
return static_cast<ObjCMessageKind>(Info.getInt());
|
2012-07-03 03:27:35 +08:00
|
|
|
}
|
2012-07-26 08:27:51 +08:00
|
|
|
|
2012-08-11 02:55:53 +08:00
|
|
|
|
|
|
|
bool ObjCMethodCall::canBeOverridenInSubclass(ObjCInterfaceDecl *IDecl,
|
|
|
|
Selector Sel) const {
|
|
|
|
assert(IDecl);
|
|
|
|
const SourceManager &SM =
|
|
|
|
getState()->getStateManager().getContext().getSourceManager();
|
|
|
|
|
|
|
|
// If the class interface is declared inside the main file, assume it is not
|
|
|
|
// subcassed.
|
|
|
|
// TODO: It could actually be subclassed if the subclass is private as well.
|
|
|
|
// This is probably very rare.
|
|
|
|
SourceLocation InterfLoc = IDecl->getEndOfDefinitionLoc();
|
|
|
|
if (InterfLoc.isValid() && SM.isFromMainFile(InterfLoc))
|
|
|
|
return false;
|
|
|
|
|
2012-08-15 03:19:18 +08:00
|
|
|
// Assume that property accessors are not overridden.
|
|
|
|
if (getMessageKind() == OCM_PropertyAccess)
|
|
|
|
return false;
|
2012-08-11 02:55:53 +08:00
|
|
|
|
|
|
|
// We assume that if the method is public (declared outside of main file) or
|
|
|
|
// has a parent which publicly declares the method, the method could be
|
|
|
|
// overridden in a subclass.
|
|
|
|
|
|
|
|
// Find the first declaration in the class hierarchy that declares
|
|
|
|
// the selector.
|
|
|
|
ObjCMethodDecl *D = 0;
|
|
|
|
while (true) {
|
|
|
|
D = IDecl->lookupMethod(Sel, true);
|
|
|
|
|
|
|
|
// Cannot find a public definition.
|
|
|
|
if (!D)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
// If outside the main file,
|
|
|
|
if (D->getLocation().isValid() && !SM.isFromMainFile(D->getLocation()))
|
|
|
|
return true;
|
|
|
|
|
|
|
|
if (D->isOverriding()) {
|
|
|
|
// Search in the superclass on the next iteration.
|
|
|
|
IDecl = D->getClassInterface();
|
|
|
|
if (!IDecl)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
IDecl = IDecl->getSuperClass();
|
|
|
|
if (!IDecl)
|
|
|
|
return false;
|
|
|
|
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
return false;
|
|
|
|
};
|
|
|
|
|
|
|
|
llvm_unreachable("The while loop should always terminate.");
|
|
|
|
}
|
|
|
|
|
2012-08-09 08:21:33 +08:00
|
|
|
RuntimeDefinition ObjCMethodCall::getRuntimeDefinition() const {
|
2012-07-31 04:31:29 +08:00
|
|
|
const ObjCMessageExpr *E = getOriginExpr();
|
|
|
|
assert(E);
|
2012-07-31 07:48:36 +08:00
|
|
|
Selector Sel = E->getSelector();
|
2012-07-31 04:31:29 +08:00
|
|
|
|
|
|
|
if (E->isInstanceMessage()) {
|
2012-07-31 07:48:36 +08:00
|
|
|
|
|
|
|
// Find the the receiver type.
|
|
|
|
const ObjCObjectPointerType *ReceiverT = 0;
|
2012-08-11 02:55:58 +08:00
|
|
|
bool CanBeSubClassed = false;
|
2012-07-31 07:48:36 +08:00
|
|
|
QualType SupersType = E->getSuperType();
|
2012-08-09 08:21:33 +08:00
|
|
|
const MemRegion *Receiver = 0;
|
|
|
|
|
2012-07-31 07:48:36 +08:00
|
|
|
if (!SupersType.isNull()) {
|
2012-08-09 08:21:33 +08:00
|
|
|
// Super always means the type of immediate predecessor to the method
|
|
|
|
// where the call occurs.
|
2012-08-07 13:12:24 +08:00
|
|
|
ReceiverT = cast<ObjCObjectPointerType>(SupersType);
|
2012-07-31 07:48:36 +08:00
|
|
|
} else {
|
2012-08-09 08:21:33 +08:00
|
|
|
Receiver = getReceiverSVal().getAsRegion();
|
2012-08-01 02:04:53 +08:00
|
|
|
if (!Receiver)
|
2012-08-09 08:21:33 +08:00
|
|
|
return RuntimeDefinition();
|
2012-08-01 02:04:53 +08:00
|
|
|
|
2012-08-11 02:55:58 +08:00
|
|
|
DynamicTypeInfo DTI = getState()->getDynamicTypeInfo(Receiver);
|
|
|
|
QualType DynType = DTI.getType();
|
|
|
|
CanBeSubClassed = DTI.canBeASubClass();
|
2012-08-07 13:12:24 +08:00
|
|
|
ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType);
|
2012-08-11 02:55:58 +08:00
|
|
|
|
|
|
|
if (ReceiverT && CanBeSubClassed)
|
|
|
|
if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
|
|
|
|
if (!canBeOverridenInSubclass(IDecl, Sel))
|
|
|
|
CanBeSubClassed = false;
|
2012-07-26 08:27:51 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 07:48:36 +08:00
|
|
|
// Lookup the method implementation.
|
|
|
|
if (ReceiverT)
|
2012-08-11 02:55:53 +08:00
|
|
|
if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl()) {
|
2012-08-11 02:55:58 +08:00
|
|
|
const ObjCMethodDecl *MD = IDecl->lookupPrivateMethod(Sel);
|
|
|
|
if (CanBeSubClassed)
|
|
|
|
return RuntimeDefinition(MD, Receiver);
|
2012-08-11 02:55:53 +08:00
|
|
|
else
|
2012-08-11 02:55:58 +08:00
|
|
|
return RuntimeDefinition(MD, 0);
|
2012-08-11 02:55:53 +08:00
|
|
|
}
|
2012-07-31 07:48:36 +08:00
|
|
|
|
2012-07-31 04:31:29 +08:00
|
|
|
} else {
|
|
|
|
// This is a class method.
|
|
|
|
// If we have type info for the receiver class, we are calling via
|
|
|
|
// class name.
|
|
|
|
if (ObjCInterfaceDecl *IDecl = E->getReceiverInterface()) {
|
|
|
|
// Find/Return the method implementation.
|
2012-08-10 02:43:00 +08:00
|
|
|
return RuntimeDefinition(IDecl->lookupPrivateClassMethod(Sel));
|
2012-07-31 04:31:29 +08:00
|
|
|
}
|
2012-07-26 08:27:51 +08:00
|
|
|
}
|
2012-07-31 04:31:29 +08:00
|
|
|
|
2012-08-09 08:21:33 +08:00
|
|
|
return RuntimeDefinition();
|
2012-07-26 08:27:51 +08:00
|
|
|
}
|
|
|
|
|
2012-07-31 09:07:55 +08:00
|
|
|
void ObjCMethodCall::getInitialStackFrameContents(
|
|
|
|
const StackFrameContext *CalleeCtx,
|
|
|
|
BindingsTy &Bindings) const {
|
|
|
|
const ObjCMethodDecl *D = cast<ObjCMethodDecl>(CalleeCtx->getDecl());
|
|
|
|
SValBuilder &SVB = getState()->getStateManager().getSValBuilder();
|
|
|
|
addParameterValuesToBindings(CalleeCtx, Bindings, SVB, *this,
|
|
|
|
D->param_begin(), D->param_end());
|
|
|
|
|
|
|
|
SVal SelfVal = getReceiverSVal();
|
|
|
|
if (!SelfVal.isUnknown()) {
|
|
|
|
const VarDecl *SelfD = CalleeCtx->getAnalysisDeclContext()->getSelfDecl();
|
|
|
|
MemRegionManager &MRMgr = SVB.getRegionManager();
|
|
|
|
Loc SelfLoc = SVB.makeLoc(MRMgr.getVarRegion(SelfD, CalleeCtx));
|
|
|
|
Bindings.push_back(std::make_pair(SelfLoc, SelfVal));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2012-08-14 07:46:05 +08:00
|
|
|
CallEventRef<>
|
2012-07-31 04:22:09 +08:00
|
|
|
CallEventManager::getSimpleCall(const CallExpr *CE, ProgramStateRef State,
|
|
|
|
const LocationContext *LCtx) {
|
|
|
|
if (const CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(CE))
|
|
|
|
return create<CXXMemberCall>(MCE, State, LCtx);
|
|
|
|
|
|
|
|
if (const CXXOperatorCallExpr *OpCE = dyn_cast<CXXOperatorCallExpr>(CE)) {
|
|
|
|
const FunctionDecl *DirectCallee = OpCE->getDirectCallee();
|
|
|
|
if (const CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(DirectCallee))
|
|
|
|
if (MD->isInstance())
|
|
|
|
return create<CXXMemberOperatorCall>(OpCE, State, LCtx);
|
|
|
|
|
|
|
|
} else if (CE->getCallee()->getType()->isBlockPointerType()) {
|
|
|
|
return create<BlockCall>(CE, State, LCtx);
|
|
|
|
}
|
|
|
|
|
|
|
|
// Otherwise, it's a normal function call, static member function call, or
|
|
|
|
// something we can't reason about.
|
|
|
|
return create<FunctionCall>(CE, State, LCtx);
|
|
|
|
}
|
2012-07-31 07:39:47 +08:00
|
|
|
|
|
|
|
|
|
|
|
CallEventRef<>
|
|
|
|
CallEventManager::getCaller(const StackFrameContext *CalleeCtx,
|
|
|
|
ProgramStateRef State) {
|
|
|
|
const LocationContext *ParentCtx = CalleeCtx->getParent();
|
|
|
|
const LocationContext *CallerCtx = ParentCtx->getCurrentStackFrame();
|
|
|
|
assert(CallerCtx && "This should not be used for top-level stack frames");
|
|
|
|
|
|
|
|
const Stmt *CallSite = CalleeCtx->getCallSite();
|
|
|
|
|
|
|
|
if (CallSite) {
|
|
|
|
if (const CallExpr *CE = dyn_cast<CallExpr>(CallSite))
|
|
|
|
return getSimpleCall(CE, State, CallerCtx);
|
|
|
|
|
|
|
|
switch (CallSite->getStmtClass()) {
|
2012-08-29 04:52:21 +08:00
|
|
|
case Stmt::CXXConstructExprClass:
|
|
|
|
case Stmt::CXXTemporaryObjectExprClass: {
|
2012-07-31 07:39:47 +08:00
|
|
|
SValBuilder &SVB = State->getStateManager().getSValBuilder();
|
|
|
|
const CXXMethodDecl *Ctor = cast<CXXMethodDecl>(CalleeCtx->getDecl());
|
|
|
|
Loc ThisPtr = SVB.getCXXThis(Ctor, CalleeCtx);
|
|
|
|
SVal ThisVal = State->getSVal(ThisPtr);
|
|
|
|
|
|
|
|
return getCXXConstructorCall(cast<CXXConstructExpr>(CallSite),
|
|
|
|
ThisVal.getAsRegion(), State, CallerCtx);
|
|
|
|
}
|
|
|
|
case Stmt::CXXNewExprClass:
|
|
|
|
return getCXXAllocatorCall(cast<CXXNewExpr>(CallSite), State, CallerCtx);
|
|
|
|
case Stmt::ObjCMessageExprClass:
|
|
|
|
return getObjCMethodCall(cast<ObjCMessageExpr>(CallSite),
|
|
|
|
State, CallerCtx);
|
|
|
|
default:
|
|
|
|
llvm_unreachable("This is not an inlineable statement.");
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// Fall back to the CFG. The only thing we haven't handled yet is
|
|
|
|
// destructors, though this could change in the future.
|
|
|
|
const CFGBlock *B = CalleeCtx->getCallSiteBlock();
|
|
|
|
CFGElement E = (*B)[CalleeCtx->getIndex()];
|
|
|
|
assert(isa<CFGImplicitDtor>(E) && "All other CFG elements should have exprs");
|
|
|
|
assert(!isa<CFGTemporaryDtor>(E) && "We don't handle temporaries yet");
|
|
|
|
|
|
|
|
SValBuilder &SVB = State->getStateManager().getSValBuilder();
|
|
|
|
const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CalleeCtx->getDecl());
|
|
|
|
Loc ThisPtr = SVB.getCXXThis(Dtor, CalleeCtx);
|
|
|
|
SVal ThisVal = State->getSVal(ThisPtr);
|
|
|
|
|
|
|
|
const Stmt *Trigger;
|
|
|
|
if (const CFGAutomaticObjDtor *AutoDtor = dyn_cast<CFGAutomaticObjDtor>(&E))
|
|
|
|
Trigger = AutoDtor->getTriggerStmt();
|
|
|
|
else
|
|
|
|
Trigger = Dtor->getBody();
|
|
|
|
|
|
|
|
return getCXXDestructorCall(Dtor, Trigger, ThisVal.getAsRegion(),
|
2012-09-07 04:37:08 +08:00
|
|
|
isa<CFGBaseDtor>(E), State, CallerCtx);
|
2012-07-31 07:39:47 +08:00
|
|
|
}
|