/usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/lib/Analysis/ThreadSafetyCommon.cpp

Bug Summary

File:	src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/lib/Analysis/ThreadSafetyCommon.cpp
Warning:	line 705, column 7 Called C++ object pointer is null

Annotated Source Code

Press '?' to see keyboard shortcuts

Show analyzer invocation

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.0 -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name ThreadSafetyCommon.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model static -mframe-pointer=all -relaxed-aliasing -fno-rounding-math -mconstructor-aliases -munwind-tables -target-cpu x86-64 -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/gnu/usr.bin/clang/libclangAnalysis/obj -resource-dir /usr/local/lib/clang/13.0.0 -I /usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/include -I /usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/llvm/include -I /usr/src/gnu/usr.bin/clang/libclangAnalysis/../include -I /usr/src/gnu/usr.bin/clang/libclangAnalysis/obj -I /usr/src/gnu/usr.bin/clang/libclangAnalysis/obj/../include -D NDEBUG -D __STDC_LIMIT_MACROS -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D LLVM_PREFIX="/usr" -internal-isystem /usr/include/c++/v1 -internal-isystem /usr/local/lib/clang/13.0.0/include -internal-externc-isystem /usr/include -O2 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-comment -std=c++14 -fdeprecated-macro -fdebug-compilation-dir=/usr/src/gnu/usr.bin/clang/libclangAnalysis/obj -ferror-limit 19 -fvisibility-inlines-hidden -fwrapv -stack-protector 2 -fno-rtti -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/vmm/scan-build/2022-01-12-194120-40624-1 -x c++ /usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/lib/Analysis/ThreadSafetyCommon.cpp

/usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/lib/Analysis/ThreadSafetyCommon.cpp

→

1//===- ThreadSafetyCommon.cpp ---------------------------------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// Implementation of the interfaces declared in ThreadSafetyCommon.h
10//
11//===----------------------------------------------------------------------===//

13#include "clang/Analysis/Analyses/ThreadSafetyCommon.h"
14#include "clang/AST/Attr.h"
15#include "clang/AST/Decl.h"
16#include "clang/AST/DeclCXX.h"
17#include "clang/AST/DeclGroup.h"
18#include "clang/AST/DeclObjC.h"
19#include "clang/AST/Expr.h"
20#include "clang/AST/ExprCXX.h"
21#include "clang/AST/OperationKinds.h"
22#include "clang/AST/Stmt.h"
23#include "clang/AST/Type.h"
24#include "clang/Analysis/Analyses/ThreadSafetyTIL.h"
25#include "clang/Analysis/CFG.h"
26#include "clang/Basic/LLVM.h"
27#include "clang/Basic/OperatorKinds.h"
28#include "clang/Basic/Specifiers.h"
29#include "llvm/ADT/StringExtras.h"
30#include "llvm/ADT/StringRef.h"
31#include "llvm/Support/Casting.h"
32#include <algorithm>
33#include <cassert>
34#include <string>
35#include <utility>

37using namespace clang;
38using namespace threadSafety;

40// From ThreadSafetyUtil.h
41std::string threadSafety::getSourceLiteralString(const Expr *CE) {
switch (CE->getStmtClass()) {
  case Stmt::IntegerLiteralClass:
    return toString(cast<IntegerLiteral>(CE)->getValue(), 10, true);
  case Stmt::StringLiteralClass: {
    std::string ret("\"");
    ret += cast<StringLiteral>(CE)->getString();
    ret += "\"";
    return ret;
  }
  case Stmt::CharacterLiteralClass:
  case Stmt::CXXNullPtrLiteralExprClass:
  case Stmt::GNUNullExprClass:
  case Stmt::CXXBoolLiteralExprClass:
  case Stmt::FloatingLiteralClass:
  case Stmt::ImaginaryLiteralClass:
  case Stmt::ObjCStringLiteralClass:
  default:
    return "#lit";
}
61}

63// Return true if E is a variable that points to an incomplete Phi node.
64static bool isIncompletePhi(const til::SExpr *E) {
if (const auto *Ph = dyn_cast<til::Phi>(E))
  return Ph->status() == til::Phi::PH_Incomplete;
return false;
68}

70using CallingContext = SExprBuilder::CallingContext;

72til::SExpr *SExprBuilder::lookupStmt(const Stmt *S) {
auto It = SMap.find(S);
if (It != SMap.end())
  return It->second;
return nullptr;
77}

79til::SCFG *SExprBuilder::buildCFG(CFGWalker &Walker) {
Walker.walk(*this);
1
Calling 'CFGWalker::walk'→
return Scfg;
82}

84static bool isCalleeArrow(const Expr *E) {
const auto *ME = dyn_cast<MemberExpr>(E->IgnoreParenCasts());
return ME ? ME->isArrow() : false;
87}

89/// Translate a clang expression in an attribute to a til::SExpr.
90/// Constructs the context from D, DeclExp, and SelfDecl.
91///
92/// \param AttrExp The expression to translate.
93/// \param D       The declaration to which the attribute is attached.
94/// \param DeclExp An expression involving the Decl to which the attribute
95///                is attached.  E.g. the call to a function.
96CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
                                             const NamedDecl *D,
                                             const Expr *DeclExp,
                                             VarDecl *SelfDecl) {
// If we are processing a raw attribute expression, with no substitutions.
if (!DeclExp)
  return translateAttrExpr(AttrExp, nullptr);

CallingContext Ctx(nullptr, D);

// Examine DeclExp to find SelfArg and FunArgs, which are used to substitute
// for formal parameters when we call buildMutexID later.
if (const auto *ME = dyn_cast<MemberExpr>(DeclExp)) {
  Ctx.SelfArg   = ME->getBase();
  Ctx.SelfArrow = ME->isArrow();
} else if (const auto *CE = dyn_cast<CXXMemberCallExpr>(DeclExp)) {
  Ctx.SelfArg   = CE->getImplicitObjectArgument();
  Ctx.SelfArrow = isCalleeArrow(CE->getCallee());
  Ctx.NumArgs   = CE->getNumArgs();
  Ctx.FunArgs   = CE->getArgs();
} else if (const auto *CE = dyn_cast<CallExpr>(DeclExp)) {
  Ctx.NumArgs = CE->getNumArgs();
  Ctx.FunArgs = CE->getArgs();
} else if (const auto *CE = dyn_cast<CXXConstructExpr>(DeclExp)) {
  Ctx.SelfArg = nullptr;  // Will be set below
  Ctx.NumArgs = CE->getNumArgs();
  Ctx.FunArgs = CE->getArgs();
} else if (D && isa<CXXDestructorDecl>(D)) {
  // There's no such thing as a "destructor call" in the AST.
  Ctx.SelfArg = DeclExp;
}

// Hack to handle constructors, where self cannot be recovered from
// the expression.
if (SelfDecl && !Ctx.SelfArg) {
  DeclRefExpr SelfDRE(SelfDecl->getASTContext(), SelfDecl, false,
                      SelfDecl->getType(), VK_LValue,
                      SelfDecl->getLocation());
  Ctx.SelfArg = &SelfDRE;

  // If the attribute has no arguments, then assume the argument is "this".
  if (!AttrExp)
    return translateAttrExpr(Ctx.SelfArg, nullptr);
  else  // For most attributes.
    return translateAttrExpr(AttrExp, &Ctx);
}

// If the attribute has no arguments, then assume the argument is "this".
if (!AttrExp)
  return translateAttrExpr(Ctx.SelfArg, nullptr);
else  // For most attributes.
  return translateAttrExpr(AttrExp, &Ctx);
148}

150/// Translate a clang expression in an attribute to a til::SExpr.
151// This assumes a CallingContext has already been created.
152CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
                                             CallingContext *Ctx) {
if (!AttrExp)
  return CapabilityExpr(nullptr, false);

if (const auto* SLit = dyn_cast<StringLiteral>(AttrExp)) {
  if (SLit->getString() == StringRef("*"))
    // The "*" expr is a universal lock, which essentially turns off
    // checks until it is removed from the lockset.
    return CapabilityExpr(new (Arena) til::Wildcard(), false);
  else
    // Ignore other string literals for now.
    return CapabilityExpr(nullptr, false);
}

bool Neg = false;
if (const auto *OE = dyn_cast<CXXOperatorCallExpr>(AttrExp)) {
  if (OE->getOperator() == OO_Exclaim) {
    Neg = true;
    AttrExp = OE->getArg(0);
  }
}
else if (const auto *UO = dyn_cast<UnaryOperator>(AttrExp)) {
  if (UO->getOpcode() == UO_LNot) {
    Neg = true;
    AttrExp = UO->getSubExpr();
  }
}

til::SExpr *E = translate(AttrExp, Ctx);

// Trap mutex expressions like nullptr, or 0.
// Any literal value is nonsense.
if (!E || isa<til::Literal>(E))
  return CapabilityExpr(nullptr, false);

// Hack to deal with smart pointers -- strip off top-level pointer casts.
if (const auto *CE = dyn_cast<til::Cast>(E)) {
  if (CE->castOpcode() == til::CAST_objToPtr)
    return CapabilityExpr(CE->expr(), Neg);
}
return CapabilityExpr(E, Neg);
194}

196// Translate a clang statement or expression to a TIL expression.
197// Also performs substitution of variables; Ctx provides the context.
198// Dispatches on the type of S.
199til::SExpr *SExprBuilder::translate(const Stmt *S, CallingContext *Ctx) {
if (!S)
  return nullptr;

// Check if S has already been translated and cached.
// This handles the lookup of SSA names for DeclRefExprs here.
if (til::SExpr *E = lookupStmt(S))
  return E;

switch (S->getStmtClass()) {
case Stmt::DeclRefExprClass:
  return translateDeclRefExpr(cast<DeclRefExpr>(S), Ctx);
case Stmt::CXXThisExprClass:
  return translateCXXThisExpr(cast<CXXThisExpr>(S), Ctx);
case Stmt::MemberExprClass:
  return translateMemberExpr(cast<MemberExpr>(S), Ctx);
case Stmt::ObjCIvarRefExprClass:
  return translateObjCIVarRefExpr(cast<ObjCIvarRefExpr>(S), Ctx);
case Stmt::CallExprClass:
  return translateCallExpr(cast<CallExpr>(S), Ctx);
case Stmt::CXXMemberCallExprClass:
  return translateCXXMemberCallExpr(cast<CXXMemberCallExpr>(S), Ctx);
case Stmt::CXXOperatorCallExprClass:
  return translateCXXOperatorCallExpr(cast<CXXOperatorCallExpr>(S), Ctx);
case Stmt::UnaryOperatorClass:
  return translateUnaryOperator(cast<UnaryOperator>(S), Ctx);
case Stmt::BinaryOperatorClass:
case Stmt::CompoundAssignOperatorClass:
  return translateBinaryOperator(cast<BinaryOperator>(S), Ctx);

case Stmt::ArraySubscriptExprClass:
  return translateArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Ctx);
case Stmt::ConditionalOperatorClass:
  return translateAbstractConditionalOperator(
           cast<ConditionalOperator>(S), Ctx);
case Stmt::BinaryConditionalOperatorClass:
  return translateAbstractConditionalOperator(
           cast<BinaryConditionalOperator>(S), Ctx);

// We treat these as no-ops
case Stmt::ConstantExprClass:
  return translate(cast<ConstantExpr>(S)->getSubExpr(), Ctx);
case Stmt::ParenExprClass:
  return translate(cast<ParenExpr>(S)->getSubExpr(), Ctx);
case Stmt::ExprWithCleanupsClass:
  return translate(cast<ExprWithCleanups>(S)->getSubExpr(), Ctx);
case Stmt::CXXBindTemporaryExprClass:
  return translate(cast<CXXBindTemporaryExpr>(S)->getSubExpr(), Ctx);
case Stmt::MaterializeTemporaryExprClass:
  return translate(cast<MaterializeTemporaryExpr>(S)->getSubExpr(), Ctx);

// Collect all literals
case Stmt::CharacterLiteralClass:
case Stmt::CXXNullPtrLiteralExprClass:
case Stmt::GNUNullExprClass:
case Stmt::CXXBoolLiteralExprClass:
case Stmt::FloatingLiteralClass:
case Stmt::ImaginaryLiteralClass:
case Stmt::IntegerLiteralClass:
case Stmt::StringLiteralClass:
case Stmt::ObjCStringLiteralClass:
  return new (Arena) til::Literal(cast<Expr>(S));

case Stmt::DeclStmtClass:
  return translateDeclStmt(cast<DeclStmt>(S), Ctx);
default:
  break;
}
if (const auto *CE = dyn_cast<CastExpr>(S))
  return translateCastExpr(CE, Ctx);

return new (Arena) til::Undefined(S);
271}

273til::SExpr *SExprBuilder::translateDeclRefExpr(const DeclRefExpr *DRE,
                                             CallingContext *Ctx) {
const auto *VD = cast<ValueDecl>(DRE->getDecl()->getCanonicalDecl());

// Function parameters require substitution and/or renaming.
if (const auto *PV = dyn_cast<ParmVarDecl>(VD)) {
  unsigned I = PV->getFunctionScopeIndex();
  const DeclContext *D = PV->getDeclContext();
  if (Ctx && Ctx->FunArgs) {
    const Decl *Canonical = Ctx->AttrDecl->getCanonicalDecl();
    if (isa<FunctionDecl>(D)
            ? (cast<FunctionDecl>(D)->getCanonicalDecl() == Canonical)
            : (cast<ObjCMethodDecl>(D)->getCanonicalDecl() == Canonical)) {
      // Substitute call arguments for references to function parameters
      assert(I < Ctx->NumArgs)((void)0);
      return translate(Ctx->FunArgs[I], Ctx->Prev);
    }
  }
  // Map the param back to the param of the original function declaration
  // for consistent comparisons.
  VD = isa<FunctionDecl>(D)
           ? cast<FunctionDecl>(D)->getCanonicalDecl()->getParamDecl(I)
           : cast<ObjCMethodDecl>(D)->getCanonicalDecl()->getParamDecl(I);
}

// For non-local variables, treat it as a reference to a named object.
return new (Arena) til::LiteralPtr(VD);
300}

302til::SExpr *SExprBuilder::translateCXXThisExpr(const CXXThisExpr *TE,
                                             CallingContext *Ctx) {
// Substitute for 'this'
if (Ctx && Ctx->SelfArg)
  return translate(Ctx->SelfArg, Ctx->Prev);
assert(SelfVar && "We have no variable for 'this'!")((void)0);
return SelfVar;
309}

311static const ValueDecl *getValueDeclFromSExpr(const til::SExpr *E) {
if (const auto *V = dyn_cast<til::Variable>(E))
  return V->clangDecl();
if (const auto *Ph = dyn_cast<til::Phi>(E))
  return Ph->clangDecl();
if (const auto *P = dyn_cast<til::Project>(E))
  return P->clangDecl();
if (const auto *L = dyn_cast<til::LiteralPtr>(E))
  return L->clangDecl();
return nullptr;
321}

323static bool hasAnyPointerType(const til::SExpr *E) {
auto *VD = getValueDeclFromSExpr(E);
if (VD && VD->getType()->isAnyPointerType())
  return true;
if (const auto *C = dyn_cast<til::Cast>(E))
  return C->castOpcode() == til::CAST_objToPtr;

return false;
331}

333// Grab the very first declaration of virtual method D
334static const CXXMethodDecl *getFirstVirtualDecl(const CXXMethodDecl *D) {
while (true) {
  D = D->getCanonicalDecl();
  auto OverriddenMethods = D->overridden_methods();
  if (OverriddenMethods.begin() == OverriddenMethods.end())
    return D;  // Method does not override anything
  // FIXME: this does not work with multiple inheritance.
  D = *OverriddenMethods.begin();
}
return nullptr;
344}

346til::SExpr *SExprBuilder::translateMemberExpr(const MemberExpr *ME,
                                            CallingContext *Ctx) {
til::SExpr *BE = translate(ME->getBase(), Ctx);
til::SExpr *E  = new (Arena) til::SApply(BE);

const auto *D = cast<ValueDecl>(ME->getMemberDecl()->getCanonicalDecl());
if (const auto *VD = dyn_cast<CXXMethodDecl>(D))
  D = getFirstVirtualDecl(VD);

til::Project *P = new (Arena) til::Project(E, D);
if (hasAnyPointerType(BE))
  P->setArrow(true);
return P;
359}

361til::SExpr *SExprBuilder::translateObjCIVarRefExpr(const ObjCIvarRefExpr *IVRE,
                                                 CallingContext *Ctx) {
til::SExpr *BE = translate(IVRE->getBase(), Ctx);
til::SExpr *E = new (Arena) til::SApply(BE);

const auto *D = cast<ObjCIvarDecl>(IVRE->getDecl()->getCanonicalDecl());

til::Project *P = new (Arena) til::Project(E, D);
if (hasAnyPointerType(BE))
  P->setArrow(true);
return P;
372}

374til::SExpr *SExprBuilder::translateCallExpr(const CallExpr *CE,
                                          CallingContext *Ctx,
                                          const Expr *SelfE) {
if (CapabilityExprMode) {
  // Handle LOCK_RETURNED
  if (const FunctionDecl *FD = CE->getDirectCallee()) {
    FD = FD->getMostRecentDecl();
    if (LockReturnedAttr *At = FD->getAttr<LockReturnedAttr>()) {
      CallingContext LRCallCtx(Ctx);
      LRCallCtx.AttrDecl = CE->getDirectCallee();
      LRCallCtx.SelfArg = SelfE;
      LRCallCtx.NumArgs = CE->getNumArgs();
      LRCallCtx.FunArgs = CE->getArgs();
      return const_cast<til::SExpr *>(
          translateAttrExpr(At->getArg(), &LRCallCtx).sexpr());
    }
  }
}

til::SExpr *E = translate(CE->getCallee(), Ctx);
for (const auto *Arg : CE->arguments()) {
  til::SExpr *A = translate(Arg, Ctx);
  E = new (Arena) til::Apply(E, A);
}
return new (Arena) til::Call(E, CE);
399}

401til::SExpr *SExprBuilder::translateCXXMemberCallExpr(
  const CXXMemberCallExpr *ME, CallingContext *Ctx) {
if (CapabilityExprMode) {
  // Ignore calls to get() on smart pointers.
  if (ME->getMethodDecl()->getNameAsString() == "get" &&
      ME->getNumArgs() == 0) {
    auto *E = translate(ME->getImplicitObjectArgument(), Ctx);
    return new (Arena) til::Cast(til::CAST_objToPtr, E);
    // return E;
  }
}
return translateCallExpr(cast<CallExpr>(ME), Ctx,
                         ME->getImplicitObjectArgument());
414}

416til::SExpr *SExprBuilder::translateCXXOperatorCallExpr(
  const CXXOperatorCallExpr *OCE, CallingContext *Ctx) {
if (CapabilityExprMode) {
  // Ignore operator * and operator -> on smart pointers.
  OverloadedOperatorKind k = OCE->getOperator();
  if (k == OO_Star || k == OO_Arrow) {
    auto *E = translate(OCE->getArg(0), Ctx);
    return new (Arena) til::Cast(til::CAST_objToPtr, E);
    // return E;
  }
}
return translateCallExpr(cast<CallExpr>(OCE), Ctx);
428}

430til::SExpr *SExprBuilder::translateUnaryOperator(const UnaryOperator *UO,
                                               CallingContext *Ctx) {
switch (UO->getOpcode()) {
case UO_PostInc:
case UO_PostDec:
case UO_PreInc:
case UO_PreDec:
  return new (Arena) til::Undefined(UO);

case UO_AddrOf:
  if (CapabilityExprMode) {
    // interpret &Graph::mu_ as an existential.
    if (const auto *DRE = dyn_cast<DeclRefExpr>(UO->getSubExpr())) {
      if (DRE->getDecl()->isCXXInstanceMember()) {
        // This is a pointer-to-member expression, e.g. &MyClass::mu_.
        // We interpret this syntax specially, as a wildcard.
        auto *W = new (Arena) til::Wildcard();
        return new (Arena) til::Project(W, DRE->getDecl());
      }
    }
  }
  // otherwise, & is a no-op
  return translate(UO->getSubExpr(), Ctx);

// We treat these as no-ops
case UO_Deref:
case UO_Plus:
  return translate(UO->getSubExpr(), Ctx);

case UO_Minus:
  return new (Arena)
    til::UnaryOp(til::UOP_Minus, translate(UO->getSubExpr(), Ctx));
case UO_Not:
  return new (Arena)
    til::UnaryOp(til::UOP_BitNot, translate(UO->getSubExpr(), Ctx));
case UO_LNot:
  return new (Arena)
    til::UnaryOp(til::UOP_LogicNot, translate(UO->getSubExpr(), Ctx));

// Currently unsupported
case UO_Real:
case UO_Imag:
case UO_Extension:
case UO_Coawait:
  return new (Arena) til::Undefined(UO);
}
return new (Arena) til::Undefined(UO);
477}

479til::SExpr *SExprBuilder::translateBinOp(til::TIL_BinaryOpcode Op,
                                       const BinaryOperator *BO,
                                       CallingContext *Ctx, bool Reverse) {
 til::SExpr *E0 = translate(BO->getLHS(), Ctx);
 til::SExpr *E1 = translate(BO->getRHS(), Ctx);
 if (Reverse)
   return new (Arena) til::BinaryOp(Op, E1, E0);
 else
   return new (Arena) til::BinaryOp(Op, E0, E1);
488}

490til::SExpr *SExprBuilder::translateBinAssign(til::TIL_BinaryOpcode Op,
                                           const BinaryOperator *BO,
                                           CallingContext *Ctx,
                                           bool Assign) {
const Expr *LHS = BO->getLHS();
const Expr *RHS = BO->getRHS();
til::SExpr *E0 = translate(LHS, Ctx);
til::SExpr *E1 = translate(RHS, Ctx);

const ValueDecl *VD = nullptr;
til::SExpr *CV = nullptr;
if (const auto *DRE = dyn_cast<DeclRefExpr>(LHS)) {
  VD = DRE->getDecl();
  CV = lookupVarDecl(VD);
}

if (!Assign) {
  til::SExpr *Arg = CV ? CV : new (Arena) til::Load(E0);
  E1 = new (Arena) til::BinaryOp(Op, Arg, E1);
  E1 = addStatement(E1, nullptr, VD);
}
if (VD && CV)
  return updateVarDecl(VD, E1);
return new (Arena) til::Store(E0, E1);
514}

516til::SExpr *SExprBuilder::translateBinaryOperator(const BinaryOperator *BO,
                                                CallingContext *Ctx) {
switch (BO->getOpcode()) {
case BO_PtrMemD:
case BO_PtrMemI:
  return new (Arena) til::Undefined(BO);

case BO_Mul:  return translateBinOp(til::BOP_Mul, BO, Ctx);
case BO_Div:  return translateBinOp(til::BOP_Div, BO, Ctx);
case BO_Rem:  return translateBinOp(til::BOP_Rem, BO, Ctx);
case BO_Add:  return translateBinOp(til::BOP_Add, BO, Ctx);
case BO_Sub:  return translateBinOp(til::BOP_Sub, BO, Ctx);
case BO_Shl:  return translateBinOp(til::BOP_Shl, BO, Ctx);
case BO_Shr:  return translateBinOp(til::BOP_Shr, BO, Ctx);
case BO_LT:   return translateBinOp(til::BOP_Lt,  BO, Ctx);
case BO_GT:   return translateBinOp(til::BOP_Lt,  BO, Ctx, true);
case BO_LE:   return translateBinOp(til::BOP_Leq, BO, Ctx);
case BO_GE:   return translateBinOp(til::BOP_Leq, BO, Ctx, true);
case BO_EQ:   return translateBinOp(til::BOP_Eq,  BO, Ctx);
case BO_NE:   return translateBinOp(til::BOP_Neq, BO, Ctx);
case BO_Cmp:  return translateBinOp(til::BOP_Cmp, BO, Ctx);
case BO_And:  return translateBinOp(til::BOP_BitAnd,   BO, Ctx);
case BO_Xor:  return translateBinOp(til::BOP_BitXor,   BO, Ctx);
case BO_Or:   return translateBinOp(til::BOP_BitOr,    BO, Ctx);
case BO_LAnd: return translateBinOp(til::BOP_LogicAnd, BO, Ctx);
case BO_LOr:  return translateBinOp(til::BOP_LogicOr,  BO, Ctx);

case BO_Assign:    return translateBinAssign(til::BOP_Eq,  BO, Ctx, true);
case BO_MulAssign: return translateBinAssign(til::BOP_Mul, BO, Ctx);
case BO_DivAssign: return translateBinAssign(til::BOP_Div, BO, Ctx);
case BO_RemAssign: return translateBinAssign(til::BOP_Rem, BO, Ctx);
case BO_AddAssign: return translateBinAssign(til::BOP_Add, BO, Ctx);
case BO_SubAssign: return translateBinAssign(til::BOP_Sub, BO, Ctx);
case BO_ShlAssign: return translateBinAssign(til::BOP_Shl, BO, Ctx);
case BO_ShrAssign: return translateBinAssign(til::BOP_Shr, BO, Ctx);
case BO_AndAssign: return translateBinAssign(til::BOP_BitAnd, BO, Ctx);
case BO_XorAssign: return translateBinAssign(til::BOP_BitXor, BO, Ctx);
case BO_OrAssign:  return translateBinAssign(til::BOP_BitOr,  BO, Ctx);

case BO_Comma:
  // The clang CFG should have already processed both sides.
  return translate(BO->getRHS(), Ctx);
}
return new (Arena) til::Undefined(BO);
560}

562til::SExpr *SExprBuilder::translateCastExpr(const CastExpr *CE,
                                          CallingContext *Ctx) {
CastKind K = CE->getCastKind();
switch (K) {
case CK_LValueToRValue: {
  if (const auto *DRE = dyn_cast<DeclRefExpr>(CE->getSubExpr())) {
    til::SExpr *E0 = lookupVarDecl(DRE->getDecl());
    if (E0)
      return E0;
  }
  til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
  return E0;
  // FIXME!! -- get Load working properly
  // return new (Arena) til::Load(E0);
}
case CK_NoOp:
case CK_DerivedToBase:
case CK_UncheckedDerivedToBase:
case CK_ArrayToPointerDecay:
case CK_FunctionToPointerDecay: {
  til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
  return E0;
}
default: {
  // FIXME: handle different kinds of casts.
  til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
  if (CapabilityExprMode)
    return E0;
  return new (Arena) til::Cast(til::CAST_none, E0);
}
}
593}

595til::SExpr *
596SExprBuilder::translateArraySubscriptExpr(const ArraySubscriptExpr *E,
                                        CallingContext *Ctx) {
til::SExpr *E0 = translate(E->getBase(), Ctx);
til::SExpr *E1 = translate(E->getIdx(), Ctx);
return new (Arena) til::ArrayIndex(E0, E1);
601}

603til::SExpr *
604SExprBuilder::translateAbstractConditionalOperator(
  const AbstractConditionalOperator *CO, CallingContext *Ctx) {
auto *C = translate(CO->getCond(), Ctx);
auto *T = translate(CO->getTrueExpr(), Ctx);
auto *E = translate(CO->getFalseExpr(), Ctx);
return new (Arena) til::IfThenElse(C, T, E);
610}

612til::SExpr *
613SExprBuilder::translateDeclStmt(const DeclStmt *S, CallingContext *Ctx) {
DeclGroupRef DGrp = S->getDeclGroup();
for (auto I : DGrp) {
  if (auto *VD = dyn_cast_or_null<VarDecl>(I)) {
    Expr *E = VD->getInit();
    til::SExpr* SE = translate(E, Ctx);

    // Add local variables with trivial type to the variable map
    QualType T = VD->getType();
    if (T.isTrivialType(VD->getASTContext()))
      return addVarDecl(VD, SE);
    else {
      // TODO: add alloca
    }
  }
}
return nullptr;
630}

632// If (E) is non-trivial, then add it to the current basic block, and
633// update the statement map so that S refers to E.  Returns a new variable
634// that refers to E.
635// If E is trivial returns E.
636til::SExpr *SExprBuilder::addStatement(til::SExpr* E, const Stmt *S,
                                     const ValueDecl *VD) {
if (!E || !CurrentBB || E->block() || til::ThreadSafetyTIL::isTrivial(E))
  return E;
if (VD)
  E = new (Arena) til::Variable(E, VD);
CurrentInstructions.push_back(E);
if (S)
  insertStmt(S, E);
return E;
646}

648// Returns the current value of VD, if known, and nullptr otherwise.
649til::SExpr *SExprBuilder::lookupVarDecl(const ValueDecl *VD) {
auto It = LVarIdxMap.find(VD);
if (It != LVarIdxMap.end()) {
  assert(CurrentLVarMap[It->second].first == VD)((void)0);
  return CurrentLVarMap[It->second].second;
}
return nullptr;
656}

658// if E is a til::Variable, update its clangDecl.
659static void maybeUpdateVD(til::SExpr *E, const ValueDecl *VD) {
if (!E)
  return;
if (auto *V = dyn_cast<til::Variable>(E)) {
  if (!V->clangDecl())
    V->setClangDecl(VD);
}
666}

668// Adds a new variable declaration.
669til::SExpr *SExprBuilder::addVarDecl(const ValueDecl *VD, til::SExpr *E) {
maybeUpdateVD(E, VD);
LVarIdxMap.insert(std::make_pair(VD, CurrentLVarMap.size()));
CurrentLVarMap.makeWritable();
CurrentLVarMap.push_back(std::make_pair(VD, E));
return E;
675}

677// Updates a current variable declaration.  (E.g. by assignment)
678til::SExpr *SExprBuilder::updateVarDecl(const ValueDecl *VD, til::SExpr *E) {
maybeUpdateVD(E, VD);
auto It = LVarIdxMap.find(VD);
if (It == LVarIdxMap.end()) {
  til::SExpr *Ptr = new (Arena) til::LiteralPtr(VD);
  til::SExpr *St  = new (Arena) til::Store(Ptr, E);
  return St;
}
CurrentLVarMap.makeWritable();
CurrentLVarMap.elem(It->second).second = E;
return E;
689}

691// Make a Phi node in the current block for the i^th variable in CurrentVarMap.
692// If E != null, sets Phi[CurrentBlockInfo->ArgIndex] = E.
693// If E == null, this is a backedge and will be set later.
694void SExprBuilder::makePhiNodeVar(unsigned i, unsigned NPreds, til::SExpr *E) {
unsigned ArgIndex = CurrentBlockInfo->ProcessedPredecessors;
assert(ArgIndex > 0 && ArgIndex < NPreds)((void)0);

til::SExpr *CurrE = CurrentLVarMap[i].second;
if (CurrE->block() == CurrentBB) {
24
←
Assuming the condition is true→
25
←
Taking true branch→
  // We already have a Phi node in the current block,
  // so just add the new variable to the Phi node.
  auto *Ph = dyn_cast<til::Phi>(CurrE);
26
←
Assuming 'CurrE' is not a 'Phi'→
27
←
'Ph' initialized to a null pointer value→
  assert(Ph && "Expecting Phi node.")((void)0);
  if (E)
28
←
Assuming 'E' is non-null→
29
←
Taking true branch→
    Ph->values()[ArgIndex] = E;
30
←
Called C++ object pointer is null
  return;
}

// Make a new phi node: phi(..., E)
// All phi args up to the current index are set to the current value.
til::Phi *Ph = new (Arena) til::Phi(Arena, NPreds);
Ph->values().setValues(NPreds, nullptr);
for (unsigned PIdx = 0; PIdx < ArgIndex; ++PIdx)
  Ph->values()[PIdx] = CurrE;
if (E)
  Ph->values()[ArgIndex] = E;
Ph->setClangDecl(CurrentLVarMap[i].first);
// If E is from a back-edge, or either E or CurrE are incomplete, then
// mark this node as incomplete; we may need to remove it later.
if (!E || isIncompletePhi(E) || isIncompletePhi(CurrE))
  Ph->setStatus(til::Phi::PH_Incomplete);

// Add Phi node to current block, and update CurrentLVarMap[i]
CurrentArguments.push_back(Ph);
if (Ph->status() == til::Phi::PH_Incomplete)
  IncompleteArgs.push_back(Ph);

CurrentLVarMap.makeWritable();
CurrentLVarMap.elem(i).second = Ph;
730}

732// Merge values from Map into the current variable map.
733// This will construct Phi nodes in the current basic block as necessary.
734void SExprBuilder::mergeEntryMap(LVarDefinitionMap Map) {
assert(CurrentBlockInfo && "Not processing a block!")((void)0);

if (!CurrentLVarMap.valid()) {
13
←
Assuming the condition is false→
14
←
Taking false branch→
  // Steal Map, using copy-on-write.
  CurrentLVarMap = std::move(Map);
  return;
}
if (CurrentLVarMap.sameAs(Map))
15
←
Assuming the condition is false→
16
←
Taking false branch→
  return;  // Easy merge: maps from different predecessors are unchanged.

unsigned NPreds = CurrentBB->numPredecessors();
unsigned ESz = CurrentLVarMap.size();
unsigned MSz = Map.size();
unsigned Sz  = std::min(ESz, MSz);

for (unsigned i = 0; i < Sz; ++i) {
17
←
Assuming 'i' is < 'Sz'→
18
←
Loop condition is true.  Entering loop body→
  if (CurrentLVarMap[i].first != Map[i].first) {
19
←
Assuming 'CurrentLVarMap[i].first' is equal to 'Map[i].first'→
20
←
Taking false branch→
    // We've reached the end of variables in common.
    CurrentLVarMap.makeWritable();
    CurrentLVarMap.downsize(i);
    break;
  }
  if (CurrentLVarMap[i].second != Map[i].second)
21
←
Assuming 'CurrentLVarMap[i].second' is not equal to 'Map[i].second'→
22
←
Taking true branch→
    makePhiNodeVar(i, NPreds, Map[i].second);
23
←
Calling 'SExprBuilder::makePhiNodeVar'→
}
if (ESz > MSz) {
  CurrentLVarMap.makeWritable();
  CurrentLVarMap.downsize(Map.size());
}
764}

766// Merge a back edge into the current variable map.
767// This will create phi nodes for all variables in the variable map.
768void SExprBuilder::mergeEntryMapBackEdge() {
// We don't have definitions for variables on the backedge, because we
// haven't gotten that far in the CFG.  Thus, when encountering a back edge,
// we conservatively create Phi nodes for all variables.  Unnecessary Phi
// nodes will be marked as incomplete, and stripped out at the end.
//
// An Phi node is unnecessary if it only refers to itself and one other
// variable, e.g. x = Phi(y, y, x)  can be reduced to x = y.

assert(CurrentBlockInfo && "Not processing a block!")((void)0);

if (CurrentBlockInfo->HasBackEdges)
  return;
CurrentBlockInfo->HasBackEdges = true;

CurrentLVarMap.makeWritable();
unsigned Sz = CurrentLVarMap.size();
unsigned NPreds = CurrentBB->numPredecessors();

for (unsigned i = 0; i < Sz; ++i)
  makePhiNodeVar(i, NPreds, nullptr);
789}

791// Update the phi nodes that were initially created for a back edge
792// once the variable definitions have been computed.
793// I.e., merge the current variable map into the phi nodes for Blk.
794void SExprBuilder::mergePhiNodesBackEdge(const CFGBlock *Blk) {
til::BasicBlock *BB = lookupBlock(Blk);
unsigned ArgIndex = BBInfo[Blk->getBlockID()].ProcessedPredecessors;
assert(ArgIndex > 0 && ArgIndex < BB->numPredecessors())((void)0);

for (til::SExpr *PE : BB->arguments()) {
  auto *Ph = dyn_cast_or_null<til::Phi>(PE);
  assert(Ph && "Expecting Phi Node.")((void)0);
  assert(Ph->values()[ArgIndex] == nullptr && "Wrong index for back edge.")((void)0);

  til::SExpr *E = lookupVarDecl(Ph->clangDecl());
  assert(E && "Couldn't find local variable for Phi node.")((void)0);
  Ph->values()[ArgIndex] = E;
}
808}

810void SExprBuilder::enterCFG(CFG *Cfg, const NamedDecl *D,
                          const CFGBlock *First) {
// Perform initial setup operations.
unsigned NBlocks = Cfg->getNumBlockIDs();
Scfg = new (Arena) til::SCFG(Arena, NBlocks);

// allocate all basic blocks immediately, to handle forward references.
BBInfo.resize(NBlocks);
BlockMap.resize(NBlocks, nullptr);
// create map from clang blockID to til::BasicBlocks
for (auto *B : *Cfg) {
  auto *BB = new (Arena) til::BasicBlock(Arena);
  BB->reserveInstructions(B->size());
  BlockMap[B->getBlockID()] = BB;
}

CurrentBB = lookupBlock(&Cfg->getEntry());
auto Parms = isa<ObjCMethodDecl>(D) ? cast<ObjCMethodDecl>(D)->parameters()
                                    : cast<FunctionDecl>(D)->parameters();
for (auto *Pm : Parms) {
  QualType T = Pm->getType();
  if (!T.isTrivialType(Pm->getASTContext()))
    continue;

  // Add parameters to local variable map.
  // FIXME: right now we emulate params with loads; that should be fixed.
  til::SExpr *Lp = new (Arena) til::LiteralPtr(Pm);
  til::SExpr *Ld = new (Arena) til::Load(Lp);
  til::SExpr *V  = addStatement(Ld, nullptr, Pm);
  addVarDecl(Pm, V);
}
841}

843void SExprBuilder::enterCFGBlock(const CFGBlock *B) {
// Initialize TIL basic block and add it to the CFG.
CurrentBB = lookupBlock(B);
CurrentBB->reservePredecessors(B->pred_size());
Scfg->add(CurrentBB);

CurrentBlockInfo = &BBInfo[B->getBlockID()];

// CurrentLVarMap is moved to ExitMap on block exit.
// FIXME: the entry block will hold function parameters.
// assert(!CurrentLVarMap.valid() && "CurrentLVarMap already initialized.");
854}

856void SExprBuilder::handlePredecessor(const CFGBlock *Pred) {
// Compute CurrentLVarMap on entry from ExitMaps of predecessors

CurrentBB->addPredecessor(BlockMap[Pred->getBlockID()]);
BlockInfo *PredInfo = &BBInfo[Pred->getBlockID()];
assert(PredInfo->UnprocessedSuccessors > 0)((void)0);

if (--PredInfo->UnprocessedSuccessors == 0)
10
←
Assuming the condition is false→
11
←
Taking false branch→
  mergeEntryMap(std::move(PredInfo->ExitMap));
else
  mergeEntryMap(PredInfo->ExitMap.clone());
12
←
Calling 'SExprBuilder::mergeEntryMap'→

++CurrentBlockInfo->ProcessedPredecessors;
869}

871void SExprBuilder::handlePredecessorBackEdge(const CFGBlock *Pred) {
mergeEntryMapBackEdge();
873}

875void SExprBuilder::enterCFGBlockBody(const CFGBlock *B) {
// The merge*() methods have created arguments.
// Push those arguments onto the basic block.
CurrentBB->arguments().reserve(
  static_cast<unsigned>(CurrentArguments.size()), Arena);
for (auto *A : CurrentArguments)
  CurrentBB->addArgument(A);
882}

884void SExprBuilder::handleStatement(const Stmt *S) {
til::SExpr *E = translate(S, nullptr);
addStatement(E, S);
887}

889void SExprBuilder::handleDestructorCall(const VarDecl *VD,
                                      const CXXDestructorDecl *DD) {
til::SExpr *Sf = new (Arena) til::LiteralPtr(VD);
til::SExpr *Dr = new (Arena) til::LiteralPtr(DD);
til::SExpr *Ap = new (Arena) til::Apply(Dr, Sf);
til::SExpr *E = new (Arena) til::Call(Ap);
addStatement(E, nullptr);
896}

898void SExprBuilder::exitCFGBlockBody(const CFGBlock *B) {
CurrentBB->instructions().reserve(
  static_cast<unsigned>(CurrentInstructions.size()), Arena);
for (auto *V : CurrentInstructions)
  CurrentBB->addInstruction(V);

// Create an appropriate terminator
unsigned N = B->succ_size();
auto It = B->succ_begin();
if (N == 1) {
  til::BasicBlock *BB = *It ? lookupBlock(*It) : nullptr;
  // TODO: set index
  unsigned Idx = BB ? BB->findPredecessorIndex(CurrentBB) : 0;
  auto *Tm = new (Arena) til::Goto(BB, Idx);
  CurrentBB->setTerminator(Tm);
}
else if (N == 2) {
  til::SExpr *C = translate(B->getTerminatorCondition(true), nullptr);
  til::BasicBlock *BB1 = *It ? lookupBlock(*It) : nullptr;
  ++It;
  til::BasicBlock *BB2 = *It ? lookupBlock(*It) : nullptr;
  // FIXME: make sure these aren't critical edges.
  auto *Tm = new (Arena) til::Branch(C, BB1, BB2);
  CurrentBB->setTerminator(Tm);
}
923}

925void SExprBuilder::handleSuccessor(const CFGBlock *Succ) {
++CurrentBlockInfo->UnprocessedSuccessors;
927}

929void SExprBuilder::handleSuccessorBackEdge(const CFGBlock *Succ) {
mergePhiNodesBackEdge(Succ);
++BBInfo[Succ->getBlockID()].ProcessedPredecessors;
932}

934void SExprBuilder::exitCFGBlock(const CFGBlock *B) {
CurrentArguments.clear();
CurrentInstructions.clear();
CurrentBlockInfo->ExitMap = std::move(CurrentLVarMap);
CurrentBB = nullptr;
CurrentBlockInfo = nullptr;
940}

942void SExprBuilder::exitCFG(const CFGBlock *Last) {
for (auto *Ph : IncompleteArgs) {
  if (Ph->status() == til::Phi::PH_Incomplete)
    simplifyIncompleteArg(Ph);
}

CurrentArguments.clear();
CurrentInstructions.clear();
IncompleteArgs.clear();
951}

953/*
954namespace {

956class TILPrinter :
  public til::PrettyPrinter<TILPrinter, llvm::raw_ostream> {};

959} // namespace

961namespace clang {
962namespace threadSafety {

964void printSCFG(CFGWalker &Walker) {
llvm::BumpPtrAllocator Bpa;
til::MemRegionRef Arena(&Bpa);
SExprBuilder SxBuilder(Arena);
til::SCFG *Scfg = SxBuilder.buildCFG(Walker);
TILPrinter::print(Scfg, llvm::errs());
970}

972} // namespace threadSafety
973} // namespace clang
974*/

←

/usr/src/gnu/usr.bin/clang/libclangAnalysis/../../../llvm/clang/include/clang/Analysis/Analyses/ThreadSafetyCommon.h

1//===- ThreadSafetyCommon.h -------------------------------------*- C++ -*-===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// Parts of thread safety analysis that are not specific to thread safety
10// itself have been factored into classes here, where they can be potentially
11// used by other analyses.  Currently these include:
12//
13// * Generalize clang CFG visitors.
14// * Conversion of the clang CFG to SSA form.
15// * Translation of clang Exprs to TIL SExprs
16//
17// UNDER CONSTRUCTION.  USE AT YOUR OWN RISK.
18//
19//===----------------------------------------------------------------------===//

21#ifndef LLVM_CLANG_ANALYSIS_ANALYSES_THREADSAFETYCOMMON_H
22#define LLVM_CLANG_ANALYSIS_ANALYSES_THREADSAFETYCOMMON_H

24#include "clang/AST/Decl.h"
25#include "clang/Analysis/Analyses/PostOrderCFGView.h"
26#include "clang/Analysis/Analyses/ThreadSafetyTIL.h"
27#include "clang/Analysis/Analyses/ThreadSafetyTraverse.h"
28#include "clang/Analysis/Analyses/ThreadSafetyUtil.h"
29#include "clang/Analysis/AnalysisDeclContext.h"
30#include "clang/Analysis/CFG.h"
31#include "clang/Basic/LLVM.h"
32#include "llvm/ADT/DenseMap.h"
33#include "llvm/ADT/SmallVector.h"
34#include "llvm/Support/Casting.h"
35#include <sstream>
36#include <string>
37#include <utility>
38#include <vector>

40namespace clang {

42class AbstractConditionalOperator;
43class ArraySubscriptExpr;
44class BinaryOperator;
45class CallExpr;
46class CastExpr;
47class CXXDestructorDecl;
48class CXXMemberCallExpr;
49class CXXOperatorCallExpr;
50class CXXThisExpr;
51class DeclRefExpr;
52class DeclStmt;
53class Expr;
54class MemberExpr;
55class Stmt;
56class UnaryOperator;

58namespace threadSafety {

60// Various helper functions on til::SExpr
61namespace sx {

63inline bool equals(const til::SExpr *E1, const til::SExpr *E2) {
return til::EqualsComparator::compareExprs(E1, E2);
65}

67inline bool matches(const til::SExpr *E1, const til::SExpr *E2) {
// We treat a top-level wildcard as the "univsersal" lock.
// It matches everything for the purpose of checking locks, but not
// for unlocking them.
if (isa<til::Wildcard>(E1))
  return isa<til::Wildcard>(E2);
if (isa<til::Wildcard>(E2))
  return isa<til::Wildcard>(E1);

return til::MatchComparator::compareExprs(E1, E2);
77}

79inline bool partiallyMatches(const til::SExpr *E1, const til::SExpr *E2) {
const auto *PE1 = dyn_cast_or_null<til::Project>(E1);
if (!PE1)
  return false;
const auto *PE2 = dyn_cast_or_null<til::Project>(E2);
if (!PE2)
  return false;
return PE1->clangDecl() == PE2->clangDecl();
87}

89inline std::string toString(const til::SExpr *E) {
std::stringstream ss;
til::StdPrinter::print(E, ss);
return ss.str();
93}

95}  // namespace sx

97// This class defines the interface of a clang CFG Visitor.
98// CFGWalker will invoke the following methods.
99// Note that methods are not virtual; the visitor is templatized.
100class CFGVisitor {
// Enter the CFG for Decl D, and perform any initial setup operations.
void enterCFG(CFG *Cfg, const NamedDecl *D, const CFGBlock *First) {}

// Enter a CFGBlock.
void enterCFGBlock(const CFGBlock *B) {}

// Returns true if this visitor implements handlePredecessor
bool visitPredecessors() { return true; }

// Process a predecessor edge.
void handlePredecessor(const CFGBlock *Pred) {}

// Process a successor back edge to a previously visited block.
void handlePredecessorBackEdge(const CFGBlock *Pred) {}

// Called just before processing statements.
void enterCFGBlockBody(const CFGBlock *B) {}

// Process an ordinary statement.
void handleStatement(const Stmt *S) {}

// Process a destructor call
void handleDestructorCall(const VarDecl *VD, const CXXDestructorDecl *DD) {}

// Called after all statements have been handled.
void exitCFGBlockBody(const CFGBlock *B) {}

// Return true
bool visitSuccessors() { return true; }

// Process a successor edge.
void handleSuccessor(const CFGBlock *Succ) {}

// Process a successor back edge to a previously visited block.
void handleSuccessorBackEdge(const CFGBlock *Succ) {}

// Leave a CFGBlock.
void exitCFGBlock(const CFGBlock *B) {}

// Leave the CFG, and perform any final cleanup operations.
void exitCFG(const CFGBlock *Last) {}
142};

144// Walks the clang CFG, and invokes methods on a given CFGVisitor.
145class CFGWalker {
146public:
CFGWalker() = default;

// Initialize the CFGWalker.  This setup only needs to be done once, even
// if there are multiple passes over the CFG.
bool init(AnalysisDeclContext &AC) {
  ACtx = &AC;
  CFGraph = AC.getCFG();
  if (!CFGraph)
    return false;

  // Ignore anonymous functions.
  if (!dyn_cast_or_null<NamedDecl>(AC.getDecl()))
    return false;

  SortedGraph = AC.getAnalysis<PostOrderCFGView>();
  if (!SortedGraph)
    return false;

  return true;
}

// Traverse the CFG, calling methods on V as appropriate.
template <class Visitor>
void walk(Visitor &V) {
  PostOrderCFGView::CFGBlockSet VisitedBlocks(CFGraph);

  V.enterCFG(CFGraph, getDecl(), &CFGraph->getEntry());

  for (const auto *CurrBlock : *SortedGraph) {
    VisitedBlocks.insert(CurrBlock);

    V.enterCFGBlock(CurrBlock);

    // Process predecessors, handling back edges last
    if (V.visitPredecessors()) {
2
←
Taking true branch→
      SmallVector<CFGBlock*, 4> BackEdges;
      // Process successors
      for (CFGBlock::const_pred_iterator SI = CurrBlock->pred_begin(),
4
←
Loop condition is true.  Entering loop body→
                                         SE = CurrBlock->pred_end();
           SI != SE; ++SI) {
3
←
Assuming 'SI' is not equal to 'SE'→
        if (*SI == nullptr)
5
←
Assuming the condition is false→
6
←
Taking false branch→
          continue;

        if (!VisitedBlocks.alreadySet(*SI)) {
7
←
Assuming the condition is false→
8
←
Taking false branch→
          BackEdges.push_back(*SI);
          continue;
        }
        V.handlePredecessor(*SI);
9
←
Calling 'SExprBuilder::handlePredecessor'→
      }

      for (auto *Blk : BackEdges)
        V.handlePredecessorBackEdge(Blk);
    }

    V.enterCFGBlockBody(CurrBlock);

    // Process statements
    for (const auto &BI : *CurrBlock) {
      switch (BI.getKind()) {
      case CFGElement::Statement:
        V.handleStatement(BI.castAs<CFGStmt>().getStmt());
        break;

      case CFGElement::AutomaticObjectDtor: {
        CFGAutomaticObjDtor AD = BI.castAs<CFGAutomaticObjDtor>();
        auto *DD = const_cast<CXXDestructorDecl *>(
            AD.getDestructorDecl(ACtx->getASTContext()));
        auto *VD = const_cast<VarDecl *>(AD.getVarDecl());
        V.handleDestructorCall(VD, DD);
        break;
      }
      default:
        break;
      }
    }

    V.exitCFGBlockBody(CurrBlock);

    // Process successors, handling back edges first.
    if (V.visitSuccessors()) {
      SmallVector<CFGBlock*, 8> ForwardEdges;

      // Process successors
      for (CFGBlock::const_succ_iterator SI = CurrBlock->succ_begin(),
                                         SE = CurrBlock->succ_end();
           SI != SE; ++SI) {
        if (*SI == nullptr)
          continue;

        if (!VisitedBlocks.alreadySet(*SI)) {
          ForwardEdges.push_back(*SI);
          continue;
        }
        V.handleSuccessorBackEdge(*SI);
      }

      for (auto *Blk : ForwardEdges)
        V.handleSuccessor(Blk);
    }

    V.exitCFGBlock(CurrBlock);
  }
  V.exitCFG(&CFGraph->getExit());
}

const CFG *getGraph() const { return CFGraph; }
CFG *getGraph() { return CFGraph; }

const NamedDecl *getDecl() const {
  return dyn_cast<NamedDecl>(ACtx->getDecl());
}

const PostOrderCFGView *getSortedGraph() const { return SortedGraph; }

261private:
CFG *CFGraph = nullptr;
AnalysisDeclContext *ACtx = nullptr;
PostOrderCFGView *SortedGraph = nullptr;
265};

267// TODO: move this back into ThreadSafety.cpp
268// This is specific to thread safety.  It is here because
269// translateAttrExpr needs it, but that should be moved too.
270class CapabilityExpr {
271private:
/// The capability expression.
const til::SExpr* CapExpr;

/// True if this is a negative capability.
bool Negated;

278public:
CapabilityExpr(const til::SExpr *E, bool Neg) : CapExpr(E), Negated(Neg) {}

const til::SExpr* sexpr() const { return CapExpr; }
bool negative() const { return Negated; }

CapabilityExpr operator!() const {
  return CapabilityExpr(CapExpr, !Negated);
}

bool equals(const CapabilityExpr &other) const {
  return (Negated == other.Negated) && sx::equals(CapExpr, other.CapExpr);
}

bool matches(const CapabilityExpr &other) const {
  return (Negated == other.Negated) && sx::matches(CapExpr, other.CapExpr);
}

bool matchesUniv(const CapabilityExpr &CapE) const {
  return isUniversal() || matches(CapE);
}

bool partiallyMatches(const CapabilityExpr &other) const {
  return (Negated == other.Negated) &&
          sx::partiallyMatches(CapExpr, other.CapExpr);
}

const ValueDecl* valueDecl() const {
  if (Negated || CapExpr == nullptr)
    return nullptr;
  if (const auto *P = dyn_cast<til::Project>(CapExpr))
    return P->clangDecl();
  if (const auto *P = dyn_cast<til::LiteralPtr>(CapExpr))
    return P->clangDecl();
  return nullptr;
}

std::string toString() const {
  if (Negated)
    return "!" + sx::toString(CapExpr);
  return sx::toString(CapExpr);
}

bool shouldIgnore() const { return CapExpr == nullptr; }

bool isInvalid() const { return sexpr() && isa<til::Undefined>(sexpr()); }

bool isUniversal() const { return sexpr() && isa<til::Wildcard>(sexpr()); }
326};

328// Translate clang::Expr to til::SExpr.
329class SExprBuilder {
330public:
/// Encapsulates the lexical context of a function call.  The lexical
/// context includes the arguments to the call, including the implicit object
/// argument.  When an attribute containing a mutex expression is attached to
/// a method, the expression may refer to formal parameters of the method.
/// Actual arguments must be substituted for formal parameters to derive
/// the appropriate mutex expression in the lexical context where the function
/// is called.  PrevCtx holds the context in which the arguments themselves
/// should be evaluated; multiple calling contexts can be chained together
/// by the lock_returned attribute.
struct CallingContext {
  // The previous context; or 0 if none.
  CallingContext  *Prev;

  // The decl to which the attr is attached.
  const NamedDecl *AttrDecl;

  // Implicit object argument -- e.g. 'this'
  const Expr *SelfArg = nullptr;

  // Number of funArgs
  unsigned NumArgs = 0;

  // Function arguments
  const Expr *const *FunArgs = nullptr;

  // is Self referred to with -> or .?
  bool SelfArrow = false;

  CallingContext(CallingContext *P, const NamedDecl *D = nullptr)
      : Prev(P), AttrDecl(D) {}
};

SExprBuilder(til::MemRegionRef A) : Arena(A) {
  // FIXME: we don't always have a self-variable.
  SelfVar = new (Arena) til::Variable(nullptr);
  SelfVar->setKind(til::Variable::VK_SFun);
}

// Translate a clang expression in an attribute to a til::SExpr.
// Constructs the context from D, DeclExp, and SelfDecl.
CapabilityExpr translateAttrExpr(const Expr *AttrExp, const NamedDecl *D,
                                 const Expr *DeclExp, VarDecl *SelfD=nullptr);

CapabilityExpr translateAttrExpr(const Expr *AttrExp, CallingContext *Ctx);

// Translate a clang statement or expression to a TIL expression.
// Also performs substitution of variables; Ctx provides the context.
// Dispatches on the type of S.
til::SExpr *translate(const Stmt *S, CallingContext *Ctx);
til::SCFG  *buildCFG(CFGWalker &Walker);

til::SExpr *lookupStmt(const Stmt *S);

til::BasicBlock *lookupBlock(const CFGBlock *B) {
  return BlockMap[B->getBlockID()];
}

const til::SCFG *getCFG() const { return Scfg; }
til::SCFG *getCFG() { return Scfg; }

391private:
// We implement the CFGVisitor API
friend class CFGWalker;

til::SExpr *translateDeclRefExpr(const DeclRefExpr *DRE,
                                 CallingContext *Ctx) ;
til::SExpr *translateCXXThisExpr(const CXXThisExpr *TE, CallingContext *Ctx);
til::SExpr *translateMemberExpr(const MemberExpr *ME, CallingContext *Ctx);
til::SExpr *translateObjCIVarRefExpr(const ObjCIvarRefExpr *IVRE,
                                     CallingContext *Ctx);
til::SExpr *translateCallExpr(const CallExpr *CE, CallingContext *Ctx,
                              const Expr *SelfE = nullptr);
til::SExpr *translateCXXMemberCallExpr(const CXXMemberCallExpr *ME,
                                       CallingContext *Ctx);
til::SExpr *translateCXXOperatorCallExpr(const CXXOperatorCallExpr *OCE,
                                         CallingContext *Ctx);
til::SExpr *translateUnaryOperator(const UnaryOperator *UO,
                                   CallingContext *Ctx);
til::SExpr *translateBinOp(til::TIL_BinaryOpcode Op,
                           const BinaryOperator *BO,
                           CallingContext *Ctx, bool Reverse = false);
til::SExpr *translateBinAssign(til::TIL_BinaryOpcode Op,
                               const BinaryOperator *BO,
                               CallingContext *Ctx, bool Assign = false);
til::SExpr *translateBinaryOperator(const BinaryOperator *BO,
                                    CallingContext *Ctx);
til::SExpr *translateCastExpr(const CastExpr *CE, CallingContext *Ctx);
til::SExpr *translateArraySubscriptExpr(const ArraySubscriptExpr *E,
                                        CallingContext *Ctx);
til::SExpr *translateAbstractConditionalOperator(
    const AbstractConditionalOperator *C, CallingContext *Ctx);

til::SExpr *translateDeclStmt(const DeclStmt *S, CallingContext *Ctx);

// Map from statements in the clang CFG to SExprs in the til::SCFG.
using StatementMap = llvm::DenseMap<const Stmt *, til::SExpr *>;

// Map from clang local variables to indices in a LVarDefinitionMap.
using LVarIndexMap = llvm::DenseMap<const ValueDecl *, unsigned>;

// Map from local variable indices to SSA variables (or constants).
using NameVarPair = std::pair<const ValueDecl *, til::SExpr *>;
using LVarDefinitionMap = CopyOnWriteVector<NameVarPair>;

struct BlockInfo {
  LVarDefinitionMap ExitMap;
  bool HasBackEdges = false;

  // Successors yet to be processed
  unsigned UnprocessedSuccessors = 0;

  // Predecessors already processed
  unsigned ProcessedPredecessors = 0;

  BlockInfo() = default;
  BlockInfo(BlockInfo &&) = default;
  BlockInfo &operator=(BlockInfo &&) = default;
};

void enterCFG(CFG *Cfg, const NamedDecl *D, const CFGBlock *First);
void enterCFGBlock(const CFGBlock *B);
bool visitPredecessors() { return true; }
void handlePredecessor(const CFGBlock *Pred);
void handlePredecessorBackEdge(const CFGBlock *Pred);
void enterCFGBlockBody(const CFGBlock *B);
void handleStatement(const Stmt *S);
void handleDestructorCall(const VarDecl *VD, const CXXDestructorDecl *DD);
void exitCFGBlockBody(const CFGBlock *B);
bool visitSuccessors() { return true; }
void handleSuccessor(const CFGBlock *Succ);
void handleSuccessorBackEdge(const CFGBlock *Succ);
void exitCFGBlock(const CFGBlock *B);
void exitCFG(const CFGBlock *Last);

void insertStmt(const Stmt *S, til::SExpr *E) {
  SMap.insert(std::make_pair(S, E));
}

til::SExpr *getCurrentLVarDefinition(const ValueDecl *VD);

til::SExpr *addStatement(til::SExpr *E, const Stmt *S,
                         const ValueDecl *VD = nullptr);
til::SExpr *lookupVarDecl(const ValueDecl *VD);
til::SExpr *addVarDecl(const ValueDecl *VD, til::SExpr *E);
til::SExpr *updateVarDecl(const ValueDecl *VD, til::SExpr *E);

void makePhiNodeVar(unsigned i, unsigned NPreds, til::SExpr *E);
void mergeEntryMap(LVarDefinitionMap Map);
void mergeEntryMapBackEdge();
void mergePhiNodesBackEdge(const CFGBlock *Blk);

482private:
// Set to true when parsing capability expressions, which get translated
// inaccurately in order to hack around smart pointers etc.
static const bool CapabilityExprMode = true;

til::MemRegionRef Arena;

// Variable to use for 'this'.  May be null.
til::Variable *SelfVar = nullptr;

til::SCFG *Scfg = nullptr;

// Map from Stmt to TIL Variables
StatementMap SMap;

// Indices of clang local vars.
LVarIndexMap LVarIdxMap;

// Map from clang to til BBs.
std::vector<til::BasicBlock *> BlockMap;

// Extra information per BB. Indexed by clang BlockID.
std::vector<BlockInfo> BBInfo;

LVarDefinitionMap CurrentLVarMap;
std::vector<til::Phi *> CurrentArguments;
std::vector<til::SExpr *> CurrentInstructions;
std::vector<til::Phi *> IncompleteArgs;
til::BasicBlock *CurrentBB = nullptr;
BlockInfo *CurrentBlockInfo = nullptr;
512};

514// Dump an SCFG to llvm::errs().
515void printSCFG(CFGWalker &Walker);

517} // namespace threadSafety
518} // namespace clang

520#endif // LLVM_CLANG_THREAD_SAFETY_COMMON_H