1 //== BodyFarm.cpp  - Factory for conjuring up fake bodies ----------*- C++ -*-//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // BodyFarm is a factory for creating faux implementations for functions/methods
11 // for analysis purposes.
12 //
13 //===----------------------------------------------------------------------===//
14 
15 #include "clang/Analysis/BodyFarm.h"
16 #include "clang/AST/ASTContext.h"
17 #include "clang/AST/CXXInheritance.h"
18 #include "clang/AST/Decl.h"
19 #include "clang/AST/Expr.h"
20 #include "clang/AST/ExprCXX.h"
21 #include "clang/AST/ExprObjC.h"
22 #include "clang/AST/NestedNameSpecifier.h"
23 #include "clang/Analysis/CodeInjector.h"
24 #include "clang/Basic/OperatorKinds.h"
25 #include "llvm/ADT/StringSwitch.h"
26 #include "llvm/Support/Debug.h"
27 
28 #define DEBUG_TYPE "body-farm"
29 
30 using namespace clang;
31 
32 //===----------------------------------------------------------------------===//
33 // Helper creation functions for constructing faux ASTs.
34 //===----------------------------------------------------------------------===//
35 
36 static bool isDispatchBlock(QualType Ty) {
37   // Is it a block pointer?
38   const BlockPointerType *BPT = Ty->getAs<BlockPointerType>();
39   if (!BPT)
40     return false;
41 
42   // Check if the block pointer type takes no arguments and
43   // returns void.
44   const FunctionProtoType *FT =
45   BPT->getPointeeType()->getAs<FunctionProtoType>();
46   return FT && FT->getReturnType()->isVoidType() && FT->getNumParams() == 0;
47 }
48 
49 namespace {
50 class ASTMaker {
51 public:
52   ASTMaker(ASTContext &C) : C(C) {}
53 
54   /// Create a new BinaryOperator representing a simple assignment.
55   BinaryOperator *makeAssignment(const Expr *LHS, const Expr *RHS, QualType Ty);
56 
57   /// Create a new BinaryOperator representing a comparison.
58   BinaryOperator *makeComparison(const Expr *LHS, const Expr *RHS,
59                                  BinaryOperator::Opcode Op);
60 
61   /// Create a new compound stmt using the provided statements.
62   CompoundStmt *makeCompound(ArrayRef<Stmt*>);
63 
64   /// Create a new DeclRefExpr for the referenced variable.
65   DeclRefExpr *makeDeclRefExpr(const VarDecl *D,
66                                bool RefersToEnclosingVariableOrCapture = false);
67 
68   /// Create a new UnaryOperator representing a dereference.
69   UnaryOperator *makeDereference(const Expr *Arg, QualType Ty);
70 
71   /// Create an implicit cast for an integer conversion.
72   Expr *makeIntegralCast(const Expr *Arg, QualType Ty);
73 
74   /// Create an implicit cast to a builtin boolean type.
75   ImplicitCastExpr *makeIntegralCastToBoolean(const Expr *Arg);
76 
77   /// Create an implicit cast for lvalue-to-rvaluate conversions.
78   ImplicitCastExpr *makeLvalueToRvalue(const Expr *Arg, QualType Ty);
79 
80   /// Make RValue out of variable declaration, creating a temporary
81   /// DeclRefExpr in the process.
82   ImplicitCastExpr *
83   makeLvalueToRvalue(const VarDecl *Decl,
84                      bool RefersToEnclosingVariableOrCapture = false);
85 
86   /// Create an implicit cast of the given type.
87   ImplicitCastExpr *makeImplicitCast(const Expr *Arg, QualType Ty,
88                                      CastKind CK = CK_LValueToRValue);
89 
90   /// Create an Objective-C bool literal.
91   ObjCBoolLiteralExpr *makeObjCBool(bool Val);
92 
93   /// Create an Objective-C ivar reference.
94   ObjCIvarRefExpr *makeObjCIvarRef(const Expr *Base, const ObjCIvarDecl *IVar);
95 
96   /// Create a Return statement.
97   ReturnStmt *makeReturn(const Expr *RetVal);
98 
99   /// Create an integer literal expression of the given type.
100   IntegerLiteral *makeIntegerLiteral(uint64_t Value, QualType Ty);
101 
102   /// Create a member expression.
103   MemberExpr *makeMemberExpression(Expr *base, ValueDecl *MemberDecl,
104                                    bool IsArrow = false,
105                                    ExprValueKind ValueKind = VK_LValue);
106 
107   /// Returns a *first* member field of a record declaration with a given name.
108   /// \return an nullptr if no member with such a name exists.
109   ValueDecl *findMemberField(const RecordDecl *RD, StringRef Name);
110 
111 private:
112   ASTContext &C;
113 };
114 }
115 
116 BinaryOperator *ASTMaker::makeAssignment(const Expr *LHS, const Expr *RHS,
117                                          QualType Ty) {
118  return new (C) BinaryOperator(const_cast<Expr*>(LHS), const_cast<Expr*>(RHS),
119                                BO_Assign, Ty, VK_RValue,
120                                OK_Ordinary, SourceLocation(), FPOptions());
121 }
122 
123 BinaryOperator *ASTMaker::makeComparison(const Expr *LHS, const Expr *RHS,
124                                          BinaryOperator::Opcode Op) {
125   assert(BinaryOperator::isLogicalOp(Op) ||
126          BinaryOperator::isComparisonOp(Op));
127   return new (C) BinaryOperator(const_cast<Expr*>(LHS),
128                                 const_cast<Expr*>(RHS),
129                                 Op,
130                                 C.getLogicalOperationType(),
131                                 VK_RValue,
132                                 OK_Ordinary, SourceLocation(), FPOptions());
133 }
134 
135 CompoundStmt *ASTMaker::makeCompound(ArrayRef<Stmt *> Stmts) {
136   return CompoundStmt::Create(C, Stmts, SourceLocation(), SourceLocation());
137 }
138 
139 DeclRefExpr *ASTMaker::makeDeclRefExpr(
140     const VarDecl *D,
141     bool RefersToEnclosingVariableOrCapture) {
142   QualType Type = D->getType().getNonReferenceType();
143 
144   DeclRefExpr *DR = DeclRefExpr::Create(
145       C, NestedNameSpecifierLoc(), SourceLocation(), const_cast<VarDecl *>(D),
146       RefersToEnclosingVariableOrCapture, SourceLocation(), Type, VK_LValue);
147   return DR;
148 }
149 
150 UnaryOperator *ASTMaker::makeDereference(const Expr *Arg, QualType Ty) {
151   return new (C) UnaryOperator(const_cast<Expr*>(Arg), UO_Deref, Ty,
152                                VK_LValue, OK_Ordinary, SourceLocation(),
153                               /*CanOverflow*/ false);
154 }
155 
156 ImplicitCastExpr *ASTMaker::makeLvalueToRvalue(const Expr *Arg, QualType Ty) {
157   return makeImplicitCast(Arg, Ty, CK_LValueToRValue);
158 }
159 
160 ImplicitCastExpr *
161 ASTMaker::makeLvalueToRvalue(const VarDecl *Arg,
162                              bool RefersToEnclosingVariableOrCapture) {
163   QualType Type = Arg->getType().getNonReferenceType();
164   return makeLvalueToRvalue(makeDeclRefExpr(Arg,
165                                             RefersToEnclosingVariableOrCapture),
166                             Type);
167 }
168 
169 ImplicitCastExpr *ASTMaker::makeImplicitCast(const Expr *Arg, QualType Ty,
170                                              CastKind CK) {
171   return ImplicitCastExpr::Create(C, Ty,
172                                   /* CastKind=*/ CK,
173                                   /* Expr=*/ const_cast<Expr *>(Arg),
174                                   /* CXXCastPath=*/ nullptr,
175                                   /* ExprValueKind=*/ VK_RValue);
176 }
177 
178 Expr *ASTMaker::makeIntegralCast(const Expr *Arg, QualType Ty) {
179   if (Arg->getType() == Ty)
180     return const_cast<Expr*>(Arg);
181 
182   return ImplicitCastExpr::Create(C, Ty, CK_IntegralCast,
183                                   const_cast<Expr*>(Arg), nullptr, VK_RValue);
184 }
185 
186 ImplicitCastExpr *ASTMaker::makeIntegralCastToBoolean(const Expr *Arg) {
187   return ImplicitCastExpr::Create(C, C.BoolTy, CK_IntegralToBoolean,
188                                   const_cast<Expr*>(Arg), nullptr, VK_RValue);
189 }
190 
191 ObjCBoolLiteralExpr *ASTMaker::makeObjCBool(bool Val) {
192   QualType Ty = C.getBOOLDecl() ? C.getBOOLType() : C.ObjCBuiltinBoolTy;
193   return new (C) ObjCBoolLiteralExpr(Val, Ty, SourceLocation());
194 }
195 
196 ObjCIvarRefExpr *ASTMaker::makeObjCIvarRef(const Expr *Base,
197                                            const ObjCIvarDecl *IVar) {
198   return new (C) ObjCIvarRefExpr(const_cast<ObjCIvarDecl*>(IVar),
199                                  IVar->getType(), SourceLocation(),
200                                  SourceLocation(), const_cast<Expr*>(Base),
201                                  /*arrow=*/true, /*free=*/false);
202 }
203 
204 
205 ReturnStmt *ASTMaker::makeReturn(const Expr *RetVal) {
206   return new (C) ReturnStmt(SourceLocation(), const_cast<Expr*>(RetVal),
207                             nullptr);
208 }
209 
210 IntegerLiteral *ASTMaker::makeIntegerLiteral(uint64_t Value, QualType Ty) {
211   llvm::APInt APValue = llvm::APInt(C.getTypeSize(Ty), Value);
212   return IntegerLiteral::Create(C, APValue, Ty, SourceLocation());
213 }
214 
215 MemberExpr *ASTMaker::makeMemberExpression(Expr *base, ValueDecl *MemberDecl,
216                                            bool IsArrow,
217                                            ExprValueKind ValueKind) {
218 
219   DeclAccessPair FoundDecl = DeclAccessPair::make(MemberDecl, AS_public);
220   return MemberExpr::Create(
221       C, base, IsArrow, SourceLocation(), NestedNameSpecifierLoc(),
222       SourceLocation(), MemberDecl, FoundDecl,
223       DeclarationNameInfo(MemberDecl->getDeclName(), SourceLocation()),
224       /* TemplateArgumentListInfo=*/ nullptr, MemberDecl->getType(), ValueKind,
225       OK_Ordinary);
226 }
227 
228 ValueDecl *ASTMaker::findMemberField(const RecordDecl *RD, StringRef Name) {
229 
230   CXXBasePaths Paths(
231       /* FindAmbiguities=*/false,
232       /* RecordPaths=*/false,
233       /* DetectVirtual=*/ false);
234   const IdentifierInfo &II = C.Idents.get(Name);
235   DeclarationName DeclName = C.DeclarationNames.getIdentifier(&II);
236 
237   DeclContextLookupResult Decls = RD->lookup(DeclName);
238   for (NamedDecl *FoundDecl : Decls)
239     if (!FoundDecl->getDeclContext()->isFunctionOrMethod())
240       return cast<ValueDecl>(FoundDecl);
241 
242   return nullptr;
243 }
244 
245 //===----------------------------------------------------------------------===//
246 // Creation functions for faux ASTs.
247 //===----------------------------------------------------------------------===//
248 
249 typedef Stmt *(*FunctionFarmer)(ASTContext &C, const FunctionDecl *D);
250 
251 static CallExpr *create_call_once_funcptr_call(ASTContext &C, ASTMaker M,
252                                                const ParmVarDecl *Callback,
253                                                ArrayRef<Expr *> CallArgs) {
254 
255   QualType Ty = Callback->getType();
256   DeclRefExpr *Call = M.makeDeclRefExpr(Callback);
257   CastKind CK;
258   if (Ty->isRValueReferenceType()) {
259     CK = CK_LValueToRValue;
260   } else {
261     assert(Ty->isLValueReferenceType());
262     CK = CK_FunctionToPointerDecay;
263     Ty = C.getPointerType(Ty.getNonReferenceType());
264   }
265 
266   return new (C)
267       CallExpr(C, M.makeImplicitCast(Call, Ty.getNonReferenceType(), CK),
268                /*args=*/CallArgs,
269                /*QualType=*/C.VoidTy,
270                /*ExprValueType=*/VK_RValue,
271                /*SourceLocation=*/SourceLocation());
272 }
273 
274 static CallExpr *create_call_once_lambda_call(ASTContext &C, ASTMaker M,
275                                               const ParmVarDecl *Callback,
276                                               CXXRecordDecl *CallbackDecl,
277                                               ArrayRef<Expr *> CallArgs) {
278   assert(CallbackDecl != nullptr);
279   assert(CallbackDecl->isLambda());
280   FunctionDecl *callOperatorDecl = CallbackDecl->getLambdaCallOperator();
281   assert(callOperatorDecl != nullptr);
282 
283   DeclRefExpr *callOperatorDeclRef =
284       DeclRefExpr::Create(/* Ctx =*/ C,
285                           /* QualifierLoc =*/ NestedNameSpecifierLoc(),
286                           /* TemplateKWLoc =*/ SourceLocation(),
287                           const_cast<FunctionDecl *>(callOperatorDecl),
288                           /* RefersToEnclosingVariableOrCapture=*/ false,
289                           /* NameLoc =*/ SourceLocation(),
290                           /* T =*/ callOperatorDecl->getType(),
291                           /* VK =*/ VK_LValue);
292 
293   return new (C)
294       CXXOperatorCallExpr(/*AstContext=*/C, OO_Call, callOperatorDeclRef,
295                           /*args=*/CallArgs,
296                           /*QualType=*/C.VoidTy,
297                           /*ExprValueType=*/VK_RValue,
298                           /*SourceLocation=*/SourceLocation(), FPOptions());
299 }
300 
301 /// Create a fake body for std::call_once.
302 /// Emulates the following function body:
303 ///
304 /// \code
305 /// typedef struct once_flag_s {
306 ///   unsigned long __state = 0;
307 /// } once_flag;
308 /// template<class Callable>
309 /// void call_once(once_flag& o, Callable func) {
310 ///   if (!o.__state) {
311 ///     func();
312 ///   }
313 ///   o.__state = 1;
314 /// }
315 /// \endcode
316 static Stmt *create_call_once(ASTContext &C, const FunctionDecl *D) {
317   DEBUG(llvm::dbgs() << "Generating body for call_once\n");
318 
319   // We need at least two parameters.
320   if (D->param_size() < 2)
321     return nullptr;
322 
323   ASTMaker M(C);
324 
325   const ParmVarDecl *Flag = D->getParamDecl(0);
326   const ParmVarDecl *Callback = D->getParamDecl(1);
327 
328   if (!Callback->getType()->isReferenceType()) {
329     llvm::dbgs() << "libcxx03 std::call_once implementation, skipping.\n";
330     return nullptr;
331   }
332   if (!Flag->getType()->isReferenceType()) {
333     llvm::dbgs() << "unknown std::call_once implementation, skipping.\n";
334     return nullptr;
335   }
336 
337   QualType CallbackType = Callback->getType().getNonReferenceType();
338 
339   // Nullable pointer, non-null iff function is a CXXRecordDecl.
340   CXXRecordDecl *CallbackRecordDecl = CallbackType->getAsCXXRecordDecl();
341   QualType FlagType = Flag->getType().getNonReferenceType();
342   auto *FlagRecordDecl = dyn_cast_or_null<RecordDecl>(FlagType->getAsTagDecl());
343 
344   if (!FlagRecordDecl) {
345     DEBUG(llvm::dbgs() << "Flag field is not a record: "
346                        << "unknown std::call_once implementation, "
347                        << "ignoring the call.\n");
348     return nullptr;
349   }
350 
351   // We initially assume libc++ implementation of call_once,
352   // where the once_flag struct has a field `__state_`.
353   ValueDecl *FlagFieldDecl = M.findMemberField(FlagRecordDecl, "__state_");
354 
355   // Otherwise, try libstdc++ implementation, with a field
356   // `_M_once`
357   if (!FlagFieldDecl) {
358     FlagFieldDecl = M.findMemberField(FlagRecordDecl, "_M_once");
359   }
360 
361   if (!FlagFieldDecl) {
362     DEBUG(llvm::dbgs() << "No field _M_once or __state_ found on "
363                        << "std::once_flag struct: unknown std::call_once "
364                        << "implementation, ignoring the call.");
365     return nullptr;
366   }
367 
368   bool isLambdaCall = CallbackRecordDecl && CallbackRecordDecl->isLambda();
369   if (CallbackRecordDecl && !isLambdaCall) {
370     DEBUG(llvm::dbgs() << "Not supported: synthesizing body for functors when "
371                        << "body farming std::call_once, ignoring the call.");
372     return nullptr;
373   }
374 
375   SmallVector<Expr *, 5> CallArgs;
376   const FunctionProtoType *CallbackFunctionType;
377   if (isLambdaCall) {
378 
379     // Lambda requires callback itself inserted as a first parameter.
380     CallArgs.push_back(
381         M.makeDeclRefExpr(Callback,
382                           /* RefersToEnclosingVariableOrCapture=*/ true));
383     CallbackFunctionType = CallbackRecordDecl->getLambdaCallOperator()
384                                ->getType()
385                                ->getAs<FunctionProtoType>();
386   } else if (!CallbackType->getPointeeType().isNull()) {
387     CallbackFunctionType =
388         CallbackType->getPointeeType()->getAs<FunctionProtoType>();
389   } else {
390     CallbackFunctionType = CallbackType->getAs<FunctionProtoType>();
391   }
392 
393   if (!CallbackFunctionType)
394     return nullptr;
395 
396   // First two arguments are used for the flag and for the callback.
397   if (D->getNumParams() != CallbackFunctionType->getNumParams() + 2) {
398     DEBUG(llvm::dbgs() << "Types of params of the callback do not match "
399                        << "params passed to std::call_once, "
400                        << "ignoring the call\n");
401     return nullptr;
402   }
403 
404   // All arguments past first two ones are passed to the callback,
405   // and we turn lvalues into rvalues if the argument is not passed by
406   // reference.
407   for (unsigned int ParamIdx = 2; ParamIdx < D->getNumParams(); ParamIdx++) {
408     const ParmVarDecl *PDecl = D->getParamDecl(ParamIdx);
409     if (PDecl &&
410         CallbackFunctionType->getParamType(ParamIdx - 2)
411                 .getNonReferenceType()
412                 .getCanonicalType() !=
413             PDecl->getType().getNonReferenceType().getCanonicalType()) {
414       DEBUG(llvm::dbgs() << "Types of params of the callback do not match "
415                          << "params passed to std::call_once, "
416                          << "ignoring the call\n");
417       return nullptr;
418     }
419     Expr *ParamExpr = M.makeDeclRefExpr(PDecl);
420     if (!CallbackFunctionType->getParamType(ParamIdx - 2)->isReferenceType()) {
421       QualType PTy = PDecl->getType().getNonReferenceType();
422       ParamExpr = M.makeLvalueToRvalue(ParamExpr, PTy);
423     }
424     CallArgs.push_back(ParamExpr);
425   }
426 
427   CallExpr *CallbackCall;
428   if (isLambdaCall) {
429 
430     CallbackCall = create_call_once_lambda_call(C, M, Callback,
431                                                 CallbackRecordDecl, CallArgs);
432   } else {
433 
434     // Function pointer case.
435     CallbackCall = create_call_once_funcptr_call(C, M, Callback, CallArgs);
436   }
437 
438   DeclRefExpr *FlagDecl =
439       M.makeDeclRefExpr(Flag,
440                         /* RefersToEnclosingVariableOrCapture=*/true);
441 
442 
443   MemberExpr *Deref = M.makeMemberExpression(FlagDecl, FlagFieldDecl);
444   assert(Deref->isLValue());
445   QualType DerefType = Deref->getType();
446 
447   // Negation predicate.
448   UnaryOperator *FlagCheck = new (C) UnaryOperator(
449       /* input=*/
450       M.makeImplicitCast(M.makeLvalueToRvalue(Deref, DerefType), DerefType,
451                          CK_IntegralToBoolean),
452       /* opc=*/ UO_LNot,
453       /* QualType=*/ C.IntTy,
454       /* ExprValueKind=*/ VK_RValue,
455       /* ExprObjectKind=*/ OK_Ordinary, SourceLocation(),
456       /* CanOverflow*/ false);
457 
458   // Create assignment.
459   BinaryOperator *FlagAssignment = M.makeAssignment(
460       Deref, M.makeIntegralCast(M.makeIntegerLiteral(1, C.IntTy), DerefType),
461       DerefType);
462 
463   IfStmt *Out = new (C)
464       IfStmt(C, SourceLocation(),
465              /* IsConstexpr=*/ false,
466              /* init=*/ nullptr,
467              /* var=*/ nullptr,
468              /* cond=*/ FlagCheck,
469              /* then=*/ M.makeCompound({CallbackCall, FlagAssignment}));
470 
471   return Out;
472 }
473 
474 /// Create a fake body for dispatch_once.
475 static Stmt *create_dispatch_once(ASTContext &C, const FunctionDecl *D) {
476   // Check if we have at least two parameters.
477   if (D->param_size() != 2)
478     return nullptr;
479 
480   // Check if the first parameter is a pointer to integer type.
481   const ParmVarDecl *Predicate = D->getParamDecl(0);
482   QualType PredicateQPtrTy = Predicate->getType();
483   const PointerType *PredicatePtrTy = PredicateQPtrTy->getAs<PointerType>();
484   if (!PredicatePtrTy)
485     return nullptr;
486   QualType PredicateTy = PredicatePtrTy->getPointeeType();
487   if (!PredicateTy->isIntegerType())
488     return nullptr;
489 
490   // Check if the second parameter is the proper block type.
491   const ParmVarDecl *Block = D->getParamDecl(1);
492   QualType Ty = Block->getType();
493   if (!isDispatchBlock(Ty))
494     return nullptr;
495 
496   // Everything checks out.  Create a fakse body that checks the predicate,
497   // sets it, and calls the block.  Basically, an AST dump of:
498   //
499   // void dispatch_once(dispatch_once_t *predicate, dispatch_block_t block) {
500   //  if (*predicate != ~0l) {
501   //    *predicate = ~0l;
502   //    block();
503   //  }
504   // }
505 
506   ASTMaker M(C);
507 
508   // (1) Create the call.
509   CallExpr *CE = new (C) CallExpr(
510       /*ASTContext=*/C,
511       /*StmtClass=*/M.makeLvalueToRvalue(/*Expr=*/Block),
512       /*args=*/None,
513       /*QualType=*/C.VoidTy,
514       /*ExprValueType=*/VK_RValue,
515       /*SourceLocation=*/SourceLocation());
516 
517   // (2) Create the assignment to the predicate.
518   Expr *DoneValue =
519       new (C) UnaryOperator(M.makeIntegerLiteral(0, C.LongTy), UO_Not, C.LongTy,
520                             VK_RValue, OK_Ordinary, SourceLocation(),
521                             /*CanOverflow*/false);
522 
523   BinaryOperator *B =
524     M.makeAssignment(
525        M.makeDereference(
526           M.makeLvalueToRvalue(
527             M.makeDeclRefExpr(Predicate), PredicateQPtrTy),
528             PredicateTy),
529        M.makeIntegralCast(DoneValue, PredicateTy),
530        PredicateTy);
531 
532   // (3) Create the compound statement.
533   Stmt *Stmts[] = { B, CE };
534   CompoundStmt *CS = M.makeCompound(Stmts);
535 
536   // (4) Create the 'if' condition.
537   ImplicitCastExpr *LValToRval =
538     M.makeLvalueToRvalue(
539       M.makeDereference(
540         M.makeLvalueToRvalue(
541           M.makeDeclRefExpr(Predicate),
542           PredicateQPtrTy),
543         PredicateTy),
544     PredicateTy);
545 
546   Expr *GuardCondition = M.makeComparison(LValToRval, DoneValue, BO_NE);
547   // (5) Create the 'if' statement.
548   IfStmt *If = new (C) IfStmt(C, SourceLocation(),
549                               /* IsConstexpr=*/ false,
550                               /* init=*/ nullptr,
551                               /* var=*/ nullptr,
552                               /* cond=*/ GuardCondition,
553                               /* then=*/ CS);
554   return If;
555 }
556 
557 /// Create a fake body for dispatch_sync.
558 static Stmt *create_dispatch_sync(ASTContext &C, const FunctionDecl *D) {
559   // Check if we have at least two parameters.
560   if (D->param_size() != 2)
561     return nullptr;
562 
563   // Check if the second parameter is a block.
564   const ParmVarDecl *PV = D->getParamDecl(1);
565   QualType Ty = PV->getType();
566   if (!isDispatchBlock(Ty))
567     return nullptr;
568 
569   // Everything checks out.  Create a fake body that just calls the block.
570   // This is basically just an AST dump of:
571   //
572   // void dispatch_sync(dispatch_queue_t queue, void (^block)(void)) {
573   //   block();
574   // }
575   //
576   ASTMaker M(C);
577   DeclRefExpr *DR = M.makeDeclRefExpr(PV);
578   ImplicitCastExpr *ICE = M.makeLvalueToRvalue(DR, Ty);
579   CallExpr *CE = new (C) CallExpr(C, ICE, None, C.VoidTy, VK_RValue,
580                                   SourceLocation());
581   return CE;
582 }
583 
584 static Stmt *create_OSAtomicCompareAndSwap(ASTContext &C, const FunctionDecl *D)
585 {
586   // There are exactly 3 arguments.
587   if (D->param_size() != 3)
588     return nullptr;
589 
590   // Signature:
591   // _Bool OSAtomicCompareAndSwapPtr(void *__oldValue,
592   //                                 void *__newValue,
593   //                                 void * volatile *__theValue)
594   // Generate body:
595   //   if (oldValue == *theValue) {
596   //    *theValue = newValue;
597   //    return YES;
598   //   }
599   //   else return NO;
600 
601   QualType ResultTy = D->getReturnType();
602   bool isBoolean = ResultTy->isBooleanType();
603   if (!isBoolean && !ResultTy->isIntegralType(C))
604     return nullptr;
605 
606   const ParmVarDecl *OldValue = D->getParamDecl(0);
607   QualType OldValueTy = OldValue->getType();
608 
609   const ParmVarDecl *NewValue = D->getParamDecl(1);
610   QualType NewValueTy = NewValue->getType();
611 
612   assert(OldValueTy == NewValueTy);
613 
614   const ParmVarDecl *TheValue = D->getParamDecl(2);
615   QualType TheValueTy = TheValue->getType();
616   const PointerType *PT = TheValueTy->getAs<PointerType>();
617   if (!PT)
618     return nullptr;
619   QualType PointeeTy = PT->getPointeeType();
620 
621   ASTMaker M(C);
622   // Construct the comparison.
623   Expr *Comparison =
624     M.makeComparison(
625       M.makeLvalueToRvalue(M.makeDeclRefExpr(OldValue), OldValueTy),
626       M.makeLvalueToRvalue(
627         M.makeDereference(
628           M.makeLvalueToRvalue(M.makeDeclRefExpr(TheValue), TheValueTy),
629           PointeeTy),
630         PointeeTy),
631       BO_EQ);
632 
633   // Construct the body of the IfStmt.
634   Stmt *Stmts[2];
635   Stmts[0] =
636     M.makeAssignment(
637       M.makeDereference(
638         M.makeLvalueToRvalue(M.makeDeclRefExpr(TheValue), TheValueTy),
639         PointeeTy),
640       M.makeLvalueToRvalue(M.makeDeclRefExpr(NewValue), NewValueTy),
641       NewValueTy);
642 
643   Expr *BoolVal = M.makeObjCBool(true);
644   Expr *RetVal = isBoolean ? M.makeIntegralCastToBoolean(BoolVal)
645                            : M.makeIntegralCast(BoolVal, ResultTy);
646   Stmts[1] = M.makeReturn(RetVal);
647   CompoundStmt *Body = M.makeCompound(Stmts);
648 
649   // Construct the else clause.
650   BoolVal = M.makeObjCBool(false);
651   RetVal = isBoolean ? M.makeIntegralCastToBoolean(BoolVal)
652                      : M.makeIntegralCast(BoolVal, ResultTy);
653   Stmt *Else = M.makeReturn(RetVal);
654 
655   /// Construct the If.
656   Stmt *If = new (C) IfStmt(C, SourceLocation(), false, nullptr, nullptr,
657                             Comparison, Body, SourceLocation(), Else);
658 
659   return If;
660 }
661 
662 Stmt *BodyFarm::getBody(const FunctionDecl *D) {
663   D = D->getCanonicalDecl();
664 
665   Optional<Stmt *> &Val = Bodies[D];
666   if (Val.hasValue())
667     return Val.getValue();
668 
669   Val = nullptr;
670 
671   if (D->getIdentifier() == nullptr)
672     return nullptr;
673 
674   StringRef Name = D->getName();
675   if (Name.empty())
676     return nullptr;
677 
678   FunctionFarmer FF;
679 
680   if (Name.startswith("OSAtomicCompareAndSwap") ||
681       Name.startswith("objc_atomicCompareAndSwap")) {
682     FF = create_OSAtomicCompareAndSwap;
683   } else if (Name == "call_once" && D->getDeclContext()->isStdNamespace()) {
684     FF = create_call_once;
685   } else {
686     FF = llvm::StringSwitch<FunctionFarmer>(Name)
687           .Case("dispatch_sync", create_dispatch_sync)
688           .Case("dispatch_once", create_dispatch_once)
689           .Default(nullptr);
690   }
691 
692   if (FF) { Val = FF(C, D); }
693   else if (Injector) { Val = Injector->getBody(D); }
694   return Val.getValue();
695 }
696 
697 static const ObjCIvarDecl *findBackingIvar(const ObjCPropertyDecl *Prop) {
698   const ObjCIvarDecl *IVar = Prop->getPropertyIvarDecl();
699 
700   if (IVar)
701     return IVar;
702 
703   // When a readonly property is shadowed in a class extensions with a
704   // a readwrite property, the instance variable belongs to the shadowing
705   // property rather than the shadowed property. If there is no instance
706   // variable on a readonly property, check to see whether the property is
707   // shadowed and if so try to get the instance variable from shadowing
708   // property.
709   if (!Prop->isReadOnly())
710     return nullptr;
711 
712   auto *Container = cast<ObjCContainerDecl>(Prop->getDeclContext());
713   const ObjCInterfaceDecl *PrimaryInterface = nullptr;
714   if (auto *InterfaceDecl = dyn_cast<ObjCInterfaceDecl>(Container)) {
715     PrimaryInterface = InterfaceDecl;
716   } else if (auto *CategoryDecl = dyn_cast<ObjCCategoryDecl>(Container)) {
717     PrimaryInterface = CategoryDecl->getClassInterface();
718   } else if (auto *ImplDecl = dyn_cast<ObjCImplDecl>(Container)) {
719     PrimaryInterface = ImplDecl->getClassInterface();
720   } else {
721     return nullptr;
722   }
723 
724   // FindPropertyVisibleInPrimaryClass() looks first in class extensions, so it
725   // is guaranteed to find the shadowing property, if it exists, rather than
726   // the shadowed property.
727   auto *ShadowingProp = PrimaryInterface->FindPropertyVisibleInPrimaryClass(
728       Prop->getIdentifier(), Prop->getQueryKind());
729   if (ShadowingProp && ShadowingProp != Prop) {
730     IVar = ShadowingProp->getPropertyIvarDecl();
731   }
732 
733   return IVar;
734 }
735 
736 static Stmt *createObjCPropertyGetter(ASTContext &Ctx,
737                                       const ObjCPropertyDecl *Prop) {
738   // First, find the backing ivar.
739   const ObjCIvarDecl *IVar = findBackingIvar(Prop);
740   if (!IVar)
741     return nullptr;
742 
743   // Ignore weak variables, which have special behavior.
744   if (Prop->getPropertyAttributes() & ObjCPropertyDecl::OBJC_PR_weak)
745     return nullptr;
746 
747   // Look to see if Sema has synthesized a body for us. This happens in
748   // Objective-C++ because the return value may be a C++ class type with a
749   // non-trivial copy constructor. We can only do this if we can find the
750   // @synthesize for this property, though (or if we know it's been auto-
751   // synthesized).
752   const ObjCImplementationDecl *ImplDecl =
753     IVar->getContainingInterface()->getImplementation();
754   if (ImplDecl) {
755     for (const auto *I : ImplDecl->property_impls()) {
756       if (I->getPropertyDecl() != Prop)
757         continue;
758 
759       if (I->getGetterCXXConstructor()) {
760         ASTMaker M(Ctx);
761         return M.makeReturn(I->getGetterCXXConstructor());
762       }
763     }
764   }
765 
766   // Sanity check that the property is the same type as the ivar, or a
767   // reference to it, and that it is either an object pointer or trivially
768   // copyable.
769   if (!Ctx.hasSameUnqualifiedType(IVar->getType(),
770                                   Prop->getType().getNonReferenceType()))
771     return nullptr;
772   if (!IVar->getType()->isObjCLifetimeType() &&
773       !IVar->getType().isTriviallyCopyableType(Ctx))
774     return nullptr;
775 
776   // Generate our body:
777   //   return self->_ivar;
778   ASTMaker M(Ctx);
779 
780   const VarDecl *selfVar = Prop->getGetterMethodDecl()->getSelfDecl();
781   if (!selfVar)
782     return nullptr;
783 
784   Expr *loadedIVar =
785     M.makeObjCIvarRef(
786       M.makeLvalueToRvalue(
787         M.makeDeclRefExpr(selfVar),
788         selfVar->getType()),
789       IVar);
790 
791   if (!Prop->getType()->isReferenceType())
792     loadedIVar = M.makeLvalueToRvalue(loadedIVar, IVar->getType());
793 
794   return M.makeReturn(loadedIVar);
795 }
796 
797 Stmt *BodyFarm::getBody(const ObjCMethodDecl *D) {
798   // We currently only know how to synthesize property accessors.
799   if (!D->isPropertyAccessor())
800     return nullptr;
801 
802   D = D->getCanonicalDecl();
803 
804   Optional<Stmt *> &Val = Bodies[D];
805   if (Val.hasValue())
806     return Val.getValue();
807   Val = nullptr;
808 
809   const ObjCPropertyDecl *Prop = D->findPropertyDecl();
810   if (!Prop)
811     return nullptr;
812 
813   // For now, we only synthesize getters.
814   // Synthesizing setters would cause false negatives in the
815   // RetainCountChecker because the method body would bind the parameter
816   // to an instance variable, causing it to escape. This would prevent
817   // warning in the following common scenario:
818   //
819   //  id foo = [[NSObject alloc] init];
820   //  self.foo = foo; // We should warn that foo leaks here.
821   //
822   if (D->param_size() != 0)
823     return nullptr;
824 
825   Val = createObjCPropertyGetter(C, Prop);
826 
827   return Val.getValue();
828 }
829