1 //===-- UncheckedOptionalAccessModel.cpp ------------------------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 //  This file defines a dataflow analysis that detects unsafe uses of optional
10 //  values.
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/Analysis/FlowSensitive/Models/UncheckedOptionalAccessModel.h"
15 #include "clang/AST/ASTContext.h"
16 #include "clang/AST/Expr.h"
17 #include "clang/AST/ExprCXX.h"
18 #include "clang/AST/Stmt.h"
19 #include "clang/ASTMatchers/ASTMatchers.h"
20 #include "clang/Analysis/FlowSensitive/DataflowEnvironment.h"
21 #include "clang/Analysis/FlowSensitive/MatchSwitch.h"
22 #include "clang/Analysis/FlowSensitive/SourceLocationsLattice.h"
23 #include "clang/Analysis/FlowSensitive/Value.h"
24 #include "llvm/ADT/StringRef.h"
25 #include "llvm/Support/Casting.h"
26 #include <cassert>
27 #include <memory>
28 #include <utility>
29 
30 namespace clang {
31 namespace dataflow {
32 namespace {
33 
34 using namespace ::clang::ast_matchers;
35 
36 using LatticeTransferState = TransferState<SourceLocationsLattice>;
37 
38 auto optionalClass() {
39   return classTemplateSpecializationDecl(
40       anyOf(hasName("std::optional"), hasName("std::__optional_storage_base"),
41             hasName("__optional_destruct_base"), hasName("absl::optional"),
42             hasName("base::Optional")),
43       hasTemplateArgument(0, refersToType(type().bind("T"))));
44 }
45 
46 auto hasOptionalType() { return hasType(optionalClass()); }
47 
48 auto isOptionalMemberCallWithName(
49     llvm::StringRef MemberName,
50     llvm::Optional<StatementMatcher> Ignorable = llvm::None) {
51   auto Exception = unless(Ignorable ? expr(anyOf(*Ignorable, cxxThisExpr()))
52                                     : cxxThisExpr());
53   return cxxMemberCallExpr(
54       on(expr(Exception)),
55       callee(cxxMethodDecl(hasName(MemberName), ofClass(optionalClass()))));
56 }
57 
58 auto isOptionalOperatorCallWithName(
59     llvm::StringRef operator_name,
60     llvm::Optional<StatementMatcher> Ignorable = llvm::None) {
61   return cxxOperatorCallExpr(
62       hasOverloadedOperatorName(operator_name),
63       callee(cxxMethodDecl(ofClass(optionalClass()))),
64       Ignorable ? callExpr(unless(hasArgument(0, *Ignorable))) : callExpr());
65 }
66 
67 auto isMakeOptionalCall() {
68   return callExpr(
69       callee(functionDecl(hasAnyName(
70           "std::make_optional", "base::make_optional", "absl::make_optional"))),
71       hasOptionalType());
72 }
73 
74 auto hasNulloptType() {
75   return hasType(namedDecl(
76       hasAnyName("std::nullopt_t", "absl::nullopt_t", "base::nullopt_t")));
77 }
78 
79 auto inPlaceClass() {
80   return recordDecl(
81       hasAnyName("std::in_place_t", "absl::in_place_t", "base::in_place_t"));
82 }
83 
84 auto isOptionalNulloptConstructor() {
85   return cxxConstructExpr(hasOptionalType(), argumentCountIs(1),
86                           hasArgument(0, hasNulloptType()));
87 }
88 
89 auto isOptionalInPlaceConstructor() {
90   return cxxConstructExpr(hasOptionalType(),
91                           hasArgument(0, hasType(inPlaceClass())));
92 }
93 
94 auto isOptionalValueOrConversionConstructor() {
95   return cxxConstructExpr(
96       hasOptionalType(),
97       unless(hasDeclaration(
98           cxxConstructorDecl(anyOf(isCopyConstructor(), isMoveConstructor())))),
99       argumentCountIs(1), hasArgument(0, unless(hasNulloptType())));
100 }
101 
102 auto isOptionalValueOrConversionAssignment() {
103   return cxxOperatorCallExpr(
104       hasOverloadedOperatorName("="),
105       callee(cxxMethodDecl(ofClass(optionalClass()))),
106       unless(hasDeclaration(cxxMethodDecl(
107           anyOf(isCopyAssignmentOperator(), isMoveAssignmentOperator())))),
108       argumentCountIs(2), hasArgument(1, unless(hasNulloptType())));
109 }
110 
111 auto isOptionalNulloptAssignment() {
112   return cxxOperatorCallExpr(hasOverloadedOperatorName("="),
113                              callee(cxxMethodDecl(ofClass(optionalClass()))),
114                              argumentCountIs(2),
115                              hasArgument(1, hasNulloptType()));
116 }
117 
118 auto isStdSwapCall() {
119   return callExpr(callee(functionDecl(hasName("std::swap"))),
120                   argumentCountIs(2), hasArgument(0, hasOptionalType()),
121                   hasArgument(1, hasOptionalType()));
122 }
123 
124 constexpr llvm::StringLiteral ValueOrCallID = "ValueOrCall";
125 
126 auto isValueOrStringEmptyCall() {
127   // `opt.value_or("").empty()`
128   return cxxMemberCallExpr(
129       callee(cxxMethodDecl(hasName("empty"))),
130       onImplicitObjectArgument(ignoringImplicit(
131           cxxMemberCallExpr(on(expr(unless(cxxThisExpr()))),
132                             callee(cxxMethodDecl(hasName("value_or"),
133                                                  ofClass(optionalClass()))),
134                             hasArgument(0, stringLiteral(hasSize(0))))
135               .bind(ValueOrCallID))));
136 }
137 
138 auto isValueOrNotEqX() {
139   auto ComparesToSame = [](ast_matchers::internal::Matcher<Stmt> Arg) {
140     return hasOperands(
141         ignoringImplicit(
142             cxxMemberCallExpr(on(expr(unless(cxxThisExpr()))),
143                               callee(cxxMethodDecl(hasName("value_or"),
144                                                    ofClass(optionalClass()))),
145                               hasArgument(0, Arg))
146                 .bind(ValueOrCallID)),
147         ignoringImplicit(Arg));
148   };
149 
150   // `opt.value_or(X) != X`, for X is `nullptr`, `""`, or `0`. Ideally, we'd
151   // support this pattern for any expression, but the AST does not have a
152   // generic expression comparison facility, so we specialize to common cases
153   // seen in practice.  FIXME: define a matcher that compares values across
154   // nodes, which would let us generalize this to any `X`.
155   return binaryOperation(hasOperatorName("!="),
156                          anyOf(ComparesToSame(cxxNullPtrLiteralExpr()),
157                                ComparesToSame(stringLiteral(hasSize(0))),
158                                ComparesToSame(integerLiteral(equals(0)))));
159 }
160 
161 /// Creates a symbolic value for an `optional` value using `HasValueVal` as the
162 /// symbolic value of its "has_value" property.
163 StructValue &createOptionalValue(Environment &Env, BoolValue &HasValueVal) {
164   auto OptionalVal = std::make_unique<StructValue>();
165   OptionalVal->setProperty("has_value", HasValueVal);
166   return Env.takeOwnership(std::move(OptionalVal));
167 }
168 
169 /// Returns the symbolic value that represents the "has_value" property of the
170 /// optional value `Val`. Returns null if `Val` is null.
171 BoolValue *getHasValue(Value *Val) {
172   if (auto *OptionalVal = cast_or_null<StructValue>(Val)) {
173     return cast<BoolValue>(OptionalVal->getProperty("has_value"));
174   }
175   return nullptr;
176 }
177 
178 /// If `Type` is a reference type, returns the type of its pointee. Otherwise,
179 /// returns `Type` itself.
180 QualType stripReference(QualType Type) {
181   return Type->isReferenceType() ? Type->getPointeeType() : Type;
182 }
183 
184 /// Returns true if and only if `Type` is an optional type.
185 bool IsOptionalType(QualType Type) {
186   if (!Type->isRecordType())
187     return false;
188   // FIXME: Optimize this by avoiding the `getQualifiedNameAsString` call.
189   auto TypeName = Type->getAsCXXRecordDecl()->getQualifiedNameAsString();
190   return TypeName == "std::optional" || TypeName == "absl::optional" ||
191          TypeName == "base::Optional";
192 }
193 
194 /// Returns the number of optional wrappers in `Type`.
195 ///
196 /// For example, if `Type` is `optional<optional<int>>`, the result of this
197 /// function will be 2.
198 int countOptionalWrappers(const ASTContext &ASTCtx, QualType Type) {
199   if (!IsOptionalType(Type))
200     return 0;
201   return 1 + countOptionalWrappers(
202                  ASTCtx,
203                  cast<ClassTemplateSpecializationDecl>(Type->getAsRecordDecl())
204                      ->getTemplateArgs()
205                      .get(0)
206                      .getAsType()
207                      .getDesugaredType(ASTCtx));
208 }
209 
210 void initializeOptionalReference(const Expr *OptionalExpr,
211                                  const MatchFinder::MatchResult &,
212                                  LatticeTransferState &State) {
213   if (auto *OptionalVal = cast_or_null<StructValue>(
214           State.Env.getValue(*OptionalExpr, SkipPast::Reference))) {
215     if (OptionalVal->getProperty("has_value") == nullptr) {
216       OptionalVal->setProperty("has_value", State.Env.makeAtomicBoolValue());
217     }
218   }
219 }
220 
221 void transferUnwrapCall(const Expr *UnwrapExpr, const Expr *ObjectExpr,
222                         LatticeTransferState &State) {
223   if (auto *OptionalVal = cast_or_null<StructValue>(
224           State.Env.getValue(*ObjectExpr, SkipPast::ReferenceThenPointer))) {
225     auto *HasValueVal = getHasValue(OptionalVal);
226     assert(HasValueVal != nullptr);
227 
228     if (State.Env.flowConditionImplies(*HasValueVal))
229       return;
230   }
231 
232   // Record that this unwrap is *not* provably safe.
233   State.Lattice.getSourceLocations().insert(ObjectExpr->getBeginLoc());
234 }
235 
236 void transferMakeOptionalCall(const CallExpr *E,
237                               const MatchFinder::MatchResult &,
238                               LatticeTransferState &State) {
239   auto &Loc = State.Env.createStorageLocation(*E);
240   State.Env.setStorageLocation(*E, Loc);
241   State.Env.setValue(
242       Loc, createOptionalValue(State.Env, State.Env.getBoolLiteralValue(true)));
243 }
244 
245 void transferOptionalHasValueCall(const CXXMemberCallExpr *CallExpr,
246                                   const MatchFinder::MatchResult &,
247                                   LatticeTransferState &State) {
248   if (auto *OptionalVal = cast_or_null<StructValue>(
249           State.Env.getValue(*CallExpr->getImplicitObjectArgument(),
250                              SkipPast::ReferenceThenPointer))) {
251     auto *HasValueVal = getHasValue(OptionalVal);
252     assert(HasValueVal != nullptr);
253 
254     auto &CallExprLoc = State.Env.createStorageLocation(*CallExpr);
255     State.Env.setValue(CallExprLoc, *HasValueVal);
256     State.Env.setStorageLocation(*CallExpr, CallExprLoc);
257   }
258 }
259 
260 /// `ModelPred` builds a logical formula relating the predicate in
261 /// `ValueOrPredExpr` to the optional's `has_value` property.
262 void transferValueOrImpl(const clang::Expr *ValueOrPredExpr,
263                          const MatchFinder::MatchResult &Result,
264                          LatticeTransferState &State,
265                          BoolValue &(*ModelPred)(Environment &Env,
266                                                  BoolValue &ExprVal,
267                                                  BoolValue &HasValueVal)) {
268   auto &Env = State.Env;
269 
270   const auto *ObjectArgumentExpr =
271       Result.Nodes.getNodeAs<clang::CXXMemberCallExpr>(ValueOrCallID)
272           ->getImplicitObjectArgument();
273 
274   auto *OptionalVal = cast_or_null<StructValue>(
275       Env.getValue(*ObjectArgumentExpr, SkipPast::ReferenceThenPointer));
276   if (OptionalVal == nullptr)
277     return;
278   auto *HasValueVal = getHasValue(OptionalVal);
279   assert(HasValueVal != nullptr);
280 
281   auto *ExprValue = cast_or_null<BoolValue>(
282       State.Env.getValue(*ValueOrPredExpr, SkipPast::None));
283   if (ExprValue == nullptr) {
284     auto &ExprLoc = State.Env.createStorageLocation(*ValueOrPredExpr);
285     ExprValue = &State.Env.makeAtomicBoolValue();
286     State.Env.setValue(ExprLoc, *ExprValue);
287     State.Env.setStorageLocation(*ValueOrPredExpr, ExprLoc);
288   }
289 
290   Env.addToFlowCondition(ModelPred(Env, *ExprValue, *HasValueVal));
291 }
292 
293 void transferValueOrStringEmptyCall(const clang::Expr *ComparisonExpr,
294                                     const MatchFinder::MatchResult &Result,
295                                     LatticeTransferState &State) {
296   return transferValueOrImpl(ComparisonExpr, Result, State,
297                              [](Environment &Env, BoolValue &ExprVal,
298                                 BoolValue &HasValueVal) -> BoolValue & {
299                                // If the result is *not* empty, then we know the
300                                // optional must have been holding a value. If
301                                // `ExprVal` is true, though, we don't learn
302                                // anything definite about `has_value`, so we
303                                // don't add any corresponding implications to
304                                // the flow condition.
305                                return Env.makeImplication(Env.makeNot(ExprVal),
306                                                           HasValueVal);
307                              });
308 }
309 
310 void transferValueOrNotEqX(const Expr *ComparisonExpr,
311                            const MatchFinder::MatchResult &Result,
312                            LatticeTransferState &State) {
313   transferValueOrImpl(ComparisonExpr, Result, State,
314                       [](Environment &Env, BoolValue &ExprVal,
315                          BoolValue &HasValueVal) -> BoolValue & {
316                         // We know that if `(opt.value_or(X) != X)` then
317                         // `opt.hasValue()`, even without knowing further
318                         // details about the contents of `opt`.
319                         return Env.makeImplication(ExprVal, HasValueVal);
320                       });
321 }
322 
323 void assignOptionalValue(const Expr &E, LatticeTransferState &State,
324                          BoolValue &HasValueVal) {
325   if (auto *OptionalLoc =
326           State.Env.getStorageLocation(E, SkipPast::ReferenceThenPointer)) {
327     State.Env.setValue(*OptionalLoc,
328                        createOptionalValue(State.Env, HasValueVal));
329   }
330 }
331 
332 /// Returns a symbolic value for the "has_value" property of an `optional<T>`
333 /// value that is constructed/assigned from a value of type `U` or `optional<U>`
334 /// where `T` is constructible from `U`.
335 BoolValue &
336 getValueOrConversionHasValue(const FunctionDecl &F, const Expr &E,
337                              const MatchFinder::MatchResult &MatchRes,
338                              LatticeTransferState &State) {
339   assert(F.getTemplateSpecializationArgs()->size() > 0);
340 
341   const int TemplateParamOptionalWrappersCount = countOptionalWrappers(
342       *MatchRes.Context,
343       stripReference(F.getTemplateSpecializationArgs()->get(0).getAsType()));
344   const int ArgTypeOptionalWrappersCount =
345       countOptionalWrappers(*MatchRes.Context, stripReference(E.getType()));
346 
347   // Check if this is a constructor/assignment call for `optional<T>` with
348   // argument of type `U` such that `T` is constructible from `U`.
349   if (TemplateParamOptionalWrappersCount == ArgTypeOptionalWrappersCount)
350     return State.Env.getBoolLiteralValue(true);
351 
352   // This is a constructor/assignment call for `optional<T>` with argument of
353   // type `optional<U>` such that `T` is constructible from `U`.
354   if (BoolValue *Val = getHasValue(State.Env.getValue(E, SkipPast::Reference)))
355     return *Val;
356   return State.Env.makeAtomicBoolValue();
357 }
358 
359 void transferValueOrConversionConstructor(
360     const CXXConstructExpr *E, const MatchFinder::MatchResult &MatchRes,
361     LatticeTransferState &State) {
362   assert(E->getNumArgs() > 0);
363 
364   assignOptionalValue(*E, State,
365                       getValueOrConversionHasValue(*E->getConstructor(),
366                                                    *E->getArg(0), MatchRes,
367                                                    State));
368 }
369 
370 void transferAssignment(const CXXOperatorCallExpr *E, BoolValue &HasValueVal,
371                         LatticeTransferState &State) {
372   assert(E->getNumArgs() > 0);
373 
374   auto *OptionalLoc =
375       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
376   assert(OptionalLoc != nullptr);
377 
378   State.Env.setValue(*OptionalLoc, createOptionalValue(State.Env, HasValueVal));
379 
380   // Assign a storage location for the whole expression.
381   State.Env.setStorageLocation(*E, *OptionalLoc);
382 }
383 
384 void transferValueOrConversionAssignment(
385     const CXXOperatorCallExpr *E, const MatchFinder::MatchResult &MatchRes,
386     LatticeTransferState &State) {
387   assert(E->getNumArgs() > 1);
388   transferAssignment(E,
389                      getValueOrConversionHasValue(
390                          *E->getDirectCallee(), *E->getArg(1), MatchRes, State),
391                      State);
392 }
393 
394 void transferNulloptAssignment(const CXXOperatorCallExpr *E,
395                                const MatchFinder::MatchResult &,
396                                LatticeTransferState &State) {
397   transferAssignment(E, State.Env.getBoolLiteralValue(false), State);
398 }
399 
400 void transferSwap(const StorageLocation &OptionalLoc1,
401                   const StorageLocation &OptionalLoc2,
402                   LatticeTransferState &State) {
403   auto *OptionalVal1 = State.Env.getValue(OptionalLoc1);
404   assert(OptionalVal1 != nullptr);
405 
406   auto *OptionalVal2 = State.Env.getValue(OptionalLoc2);
407   assert(OptionalVal2 != nullptr);
408 
409   State.Env.setValue(OptionalLoc1, *OptionalVal2);
410   State.Env.setValue(OptionalLoc2, *OptionalVal1);
411 }
412 
413 void transferSwapCall(const CXXMemberCallExpr *E,
414                       const MatchFinder::MatchResult &,
415                       LatticeTransferState &State) {
416   assert(E->getNumArgs() == 1);
417 
418   auto *OptionalLoc1 = State.Env.getStorageLocation(
419       *E->getImplicitObjectArgument(), SkipPast::ReferenceThenPointer);
420   assert(OptionalLoc1 != nullptr);
421 
422   auto *OptionalLoc2 =
423       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
424   assert(OptionalLoc2 != nullptr);
425 
426   transferSwap(*OptionalLoc1, *OptionalLoc2, State);
427 }
428 
429 void transferStdSwapCall(const CallExpr *E, const MatchFinder::MatchResult &,
430                          LatticeTransferState &State) {
431   assert(E->getNumArgs() == 2);
432 
433   auto *OptionalLoc1 =
434       State.Env.getStorageLocation(*E->getArg(0), SkipPast::Reference);
435   assert(OptionalLoc1 != nullptr);
436 
437   auto *OptionalLoc2 =
438       State.Env.getStorageLocation(*E->getArg(1), SkipPast::Reference);
439   assert(OptionalLoc2 != nullptr);
440 
441   transferSwap(*OptionalLoc1, *OptionalLoc2, State);
442 }
443 
444 llvm::Optional<StatementMatcher>
445 ignorableOptional(const UncheckedOptionalAccessModelOptions &Options) {
446   if (Options.IgnoreSmartPointerDereference)
447     return memberExpr(hasObjectExpression(ignoringParenImpCasts(
448         cxxOperatorCallExpr(anyOf(hasOverloadedOperatorName("->"),
449                                   hasOverloadedOperatorName("*")),
450                             unless(hasArgument(0, expr(hasOptionalType())))))));
451   return llvm::None;
452 }
453 
454 auto buildTransferMatchSwitch(
455     const UncheckedOptionalAccessModelOptions &Options) {
456   // FIXME: Evaluate the efficiency of matchers. If using matchers results in a
457   // lot of duplicated work (e.g. string comparisons), consider providing APIs
458   // that avoid it through memoization.
459   auto IgnorableOptional = ignorableOptional(Options);
460   return MatchSwitchBuilder<LatticeTransferState>()
461       // Attach a symbolic "has_value" state to optional values that we see for
462       // the first time.
463       .CaseOf<Expr>(expr(anyOf(declRefExpr(), memberExpr()), hasOptionalType()),
464                     initializeOptionalReference)
465 
466       // make_optional
467       .CaseOf<CallExpr>(isMakeOptionalCall(), transferMakeOptionalCall)
468 
469       // optional::optional
470       .CaseOf<CXXConstructExpr>(
471           isOptionalInPlaceConstructor(),
472           [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
473              LatticeTransferState &State) {
474             assignOptionalValue(*E, State, State.Env.getBoolLiteralValue(true));
475           })
476       .CaseOf<CXXConstructExpr>(
477           isOptionalNulloptConstructor(),
478           [](const CXXConstructExpr *E, const MatchFinder::MatchResult &,
479              LatticeTransferState &State) {
480             assignOptionalValue(*E, State,
481                                 State.Env.getBoolLiteralValue(false));
482           })
483       .CaseOf<CXXConstructExpr>(isOptionalValueOrConversionConstructor(),
484                                 transferValueOrConversionConstructor)
485 
486       // optional::operator=
487       .CaseOf<CXXOperatorCallExpr>(isOptionalValueOrConversionAssignment(),
488                                    transferValueOrConversionAssignment)
489       .CaseOf<CXXOperatorCallExpr>(isOptionalNulloptAssignment(),
490                                    transferNulloptAssignment)
491 
492       // optional::value
493       .CaseOf<CXXMemberCallExpr>(
494           isOptionalMemberCallWithName("value", IgnorableOptional),
495           [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
496              LatticeTransferState &State) {
497             transferUnwrapCall(E, E->getImplicitObjectArgument(), State);
498           })
499 
500       // optional::operator*, optional::operator->
501       .CaseOf<CallExpr>(
502           expr(anyOf(isOptionalOperatorCallWithName("*", IgnorableOptional),
503                      isOptionalOperatorCallWithName("->", IgnorableOptional))),
504           [](const CallExpr *E, const MatchFinder::MatchResult &,
505              LatticeTransferState &State) {
506             transferUnwrapCall(E, E->getArg(0), State);
507           })
508 
509       // optional::has_value
510       .CaseOf<CXXMemberCallExpr>(isOptionalMemberCallWithName("has_value"),
511                                  transferOptionalHasValueCall)
512 
513       // optional::operator bool
514       .CaseOf<CXXMemberCallExpr>(isOptionalMemberCallWithName("operator bool"),
515                                  transferOptionalHasValueCall)
516 
517       // optional::emplace
518       .CaseOf<CXXMemberCallExpr>(
519           isOptionalMemberCallWithName("emplace"),
520           [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
521              LatticeTransferState &State) {
522             assignOptionalValue(*E->getImplicitObjectArgument(), State,
523                                 State.Env.getBoolLiteralValue(true));
524           })
525 
526       // optional::reset
527       .CaseOf<CXXMemberCallExpr>(
528           isOptionalMemberCallWithName("reset"),
529           [](const CXXMemberCallExpr *E, const MatchFinder::MatchResult &,
530              LatticeTransferState &State) {
531             assignOptionalValue(*E->getImplicitObjectArgument(), State,
532                                 State.Env.getBoolLiteralValue(false));
533           })
534 
535       // optional::swap
536       .CaseOf<CXXMemberCallExpr>(isOptionalMemberCallWithName("swap"),
537                                  transferSwapCall)
538 
539       // std::swap
540       .CaseOf<CallExpr>(isStdSwapCall(), transferStdSwapCall)
541 
542       // opt.value_or("").empty()
543       .CaseOf<Expr>(isValueOrStringEmptyCall(), transferValueOrStringEmptyCall)
544 
545       // opt.value_or(X) != X
546       .CaseOf<Expr>(isValueOrNotEqX(), transferValueOrNotEqX)
547 
548       .Build();
549 }
550 
551 } // namespace
552 
553 UncheckedOptionalAccessModel::UncheckedOptionalAccessModel(
554     ASTContext &Ctx, UncheckedOptionalAccessModelOptions Options)
555     : DataflowAnalysis<UncheckedOptionalAccessModel, SourceLocationsLattice>(
556           Ctx),
557       TransferMatchSwitch(buildTransferMatchSwitch(Options)) {}
558 
559 void UncheckedOptionalAccessModel::transfer(const Stmt *S,
560                                             SourceLocationsLattice &L,
561                                             Environment &Env) {
562   LatticeTransferState State(L, Env);
563   TransferMatchSwitch(*S, getASTContext(), State);
564 }
565 
566 } // namespace dataflow
567 } // namespace clang
568