1 //===- ThreadSafetyCommon.cpp ---------------------------------------------===//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // Implementation of the interfaces declared in ThreadSafetyCommon.h
11 //
12 //===----------------------------------------------------------------------===//
13 
14 #include "clang/Analysis/Analyses/ThreadSafetyCommon.h"
15 #include "clang/AST/Attr.h"
16 #include "clang/AST/Decl.h"
17 #include "clang/AST/DeclCXX.h"
18 #include "clang/AST/DeclGroup.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/Expr.h"
21 #include "clang/AST/ExprCXX.h"
22 #include "clang/AST/OperationKinds.h"
23 #include "clang/AST/Stmt.h"
24 #include "clang/AST/Type.h"
25 #include "clang/Analysis/Analyses/ThreadSafetyTIL.h"
26 #include "clang/Analysis/CFG.h"
27 #include "clang/Basic/LLVM.h"
28 #include "clang/Basic/OperatorKinds.h"
29 #include "clang/Basic/Specifiers.h"
30 #include "llvm/ADT/StringRef.h"
31 #include "llvm/Support/Casting.h"
32 #include <algorithm>
33 #include <cassert>
34 #include <string>
35 #include <utility>
36 
37 using namespace clang;
38 using namespace threadSafety;
39 
40 // From ThreadSafetyUtil.h
41 std::string threadSafety::getSourceLiteralString(const Expr *CE) {
42   switch (CE->getStmtClass()) {
43     case Stmt::IntegerLiteralClass:
44       return cast<IntegerLiteral>(CE)->getValue().toString(10, true);
45     case Stmt::StringLiteralClass: {
46       std::string ret("\"");
47       ret += cast<StringLiteral>(CE)->getString();
48       ret += "\"";
49       return ret;
50     }
51     case Stmt::CharacterLiteralClass:
52     case Stmt::CXXNullPtrLiteralExprClass:
53     case Stmt::GNUNullExprClass:
54     case Stmt::CXXBoolLiteralExprClass:
55     case Stmt::FloatingLiteralClass:
56     case Stmt::ImaginaryLiteralClass:
57     case Stmt::ObjCStringLiteralClass:
58     default:
59       return "#lit";
60   }
61 }
62 
63 // Return true if E is a variable that points to an incomplete Phi node.
64 static bool isIncompletePhi(const til::SExpr *E) {
65   if (const auto *Ph = dyn_cast<til::Phi>(E))
66     return Ph->status() == til::Phi::PH_Incomplete;
67   return false;
68 }
69 
70 using CallingContext = SExprBuilder::CallingContext;
71 
72 til::SExpr *SExprBuilder::lookupStmt(const Stmt *S) {
73   auto It = SMap.find(S);
74   if (It != SMap.end())
75     return It->second;
76   return nullptr;
77 }
78 
79 til::SCFG *SExprBuilder::buildCFG(CFGWalker &Walker) {
80   Walker.walk(*this);
81   return Scfg;
82 }
83 
84 static bool isCalleeArrow(const Expr *E) {
85   const auto *ME = dyn_cast<MemberExpr>(E->IgnoreParenCasts());
86   return ME ? ME->isArrow() : false;
87 }
88 
89 /// Translate a clang expression in an attribute to a til::SExpr.
90 /// Constructs the context from D, DeclExp, and SelfDecl.
91 ///
92 /// \param AttrExp The expression to translate.
93 /// \param D       The declaration to which the attribute is attached.
94 /// \param DeclExp An expression involving the Decl to which the attribute
95 ///                is attached.  E.g. the call to a function.
96 CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
97                                                const NamedDecl *D,
98                                                const Expr *DeclExp,
99                                                VarDecl *SelfDecl) {
100   // If we are processing a raw attribute expression, with no substitutions.
101   if (!DeclExp)
102     return translateAttrExpr(AttrExp, nullptr);
103 
104   CallingContext Ctx(nullptr, D);
105 
106   // Examine DeclExp to find SelfArg and FunArgs, which are used to substitute
107   // for formal parameters when we call buildMutexID later.
108   if (const auto *ME = dyn_cast<MemberExpr>(DeclExp)) {
109     Ctx.SelfArg   = ME->getBase();
110     Ctx.SelfArrow = ME->isArrow();
111   } else if (const auto *CE = dyn_cast<CXXMemberCallExpr>(DeclExp)) {
112     Ctx.SelfArg   = CE->getImplicitObjectArgument();
113     Ctx.SelfArrow = isCalleeArrow(CE->getCallee());
114     Ctx.NumArgs   = CE->getNumArgs();
115     Ctx.FunArgs   = CE->getArgs();
116   } else if (const auto *CE = dyn_cast<CallExpr>(DeclExp)) {
117     Ctx.NumArgs = CE->getNumArgs();
118     Ctx.FunArgs = CE->getArgs();
119   } else if (const auto *CE = dyn_cast<CXXConstructExpr>(DeclExp)) {
120     Ctx.SelfArg = nullptr;  // Will be set below
121     Ctx.NumArgs = CE->getNumArgs();
122     Ctx.FunArgs = CE->getArgs();
123   } else if (D && isa<CXXDestructorDecl>(D)) {
124     // There's no such thing as a "destructor call" in the AST.
125     Ctx.SelfArg = DeclExp;
126   }
127 
128   // Hack to handle constructors, where self cannot be recovered from
129   // the expression.
130   if (SelfDecl && !Ctx.SelfArg) {
131     DeclRefExpr SelfDRE(SelfDecl, false, SelfDecl->getType(), VK_LValue,
132                         SelfDecl->getLocation());
133     Ctx.SelfArg = &SelfDRE;
134 
135     // If the attribute has no arguments, then assume the argument is "this".
136     if (!AttrExp)
137       return translateAttrExpr(Ctx.SelfArg, nullptr);
138     else  // For most attributes.
139       return translateAttrExpr(AttrExp, &Ctx);
140   }
141 
142   // If the attribute has no arguments, then assume the argument is "this".
143   if (!AttrExp)
144     return translateAttrExpr(Ctx.SelfArg, nullptr);
145   else  // For most attributes.
146     return translateAttrExpr(AttrExp, &Ctx);
147 }
148 
149 /// Translate a clang expression in an attribute to a til::SExpr.
150 // This assumes a CallingContext has already been created.
151 CapabilityExpr SExprBuilder::translateAttrExpr(const Expr *AttrExp,
152                                                CallingContext *Ctx) {
153   if (!AttrExp)
154     return CapabilityExpr(nullptr, false);
155 
156   if (const auto* SLit = dyn_cast<StringLiteral>(AttrExp)) {
157     if (SLit->getString() == StringRef("*"))
158       // The "*" expr is a universal lock, which essentially turns off
159       // checks until it is removed from the lockset.
160       return CapabilityExpr(new (Arena) til::Wildcard(), false);
161     else
162       // Ignore other string literals for now.
163       return CapabilityExpr(nullptr, false);
164   }
165 
166   bool Neg = false;
167   if (const auto *OE = dyn_cast<CXXOperatorCallExpr>(AttrExp)) {
168     if (OE->getOperator() == OO_Exclaim) {
169       Neg = true;
170       AttrExp = OE->getArg(0);
171     }
172   }
173   else if (const auto *UO = dyn_cast<UnaryOperator>(AttrExp)) {
174     if (UO->getOpcode() == UO_LNot) {
175       Neg = true;
176       AttrExp = UO->getSubExpr();
177     }
178   }
179 
180   til::SExpr *E = translate(AttrExp, Ctx);
181 
182   // Trap mutex expressions like nullptr, or 0.
183   // Any literal value is nonsense.
184   if (!E || isa<til::Literal>(E))
185     return CapabilityExpr(nullptr, false);
186 
187   // Hack to deal with smart pointers -- strip off top-level pointer casts.
188   if (const auto *CE = dyn_cast_or_null<til::Cast>(E)) {
189     if (CE->castOpcode() == til::CAST_objToPtr)
190       return CapabilityExpr(CE->expr(), Neg);
191   }
192   return CapabilityExpr(E, Neg);
193 }
194 
195 // Translate a clang statement or expression to a TIL expression.
196 // Also performs substitution of variables; Ctx provides the context.
197 // Dispatches on the type of S.
198 til::SExpr *SExprBuilder::translate(const Stmt *S, CallingContext *Ctx) {
199   if (!S)
200     return nullptr;
201 
202   // Check if S has already been translated and cached.
203   // This handles the lookup of SSA names for DeclRefExprs here.
204   if (til::SExpr *E = lookupStmt(S))
205     return E;
206 
207   switch (S->getStmtClass()) {
208   case Stmt::DeclRefExprClass:
209     return translateDeclRefExpr(cast<DeclRefExpr>(S), Ctx);
210   case Stmt::CXXThisExprClass:
211     return translateCXXThisExpr(cast<CXXThisExpr>(S), Ctx);
212   case Stmt::MemberExprClass:
213     return translateMemberExpr(cast<MemberExpr>(S), Ctx);
214   case Stmt::CallExprClass:
215     return translateCallExpr(cast<CallExpr>(S), Ctx);
216   case Stmt::CXXMemberCallExprClass:
217     return translateCXXMemberCallExpr(cast<CXXMemberCallExpr>(S), Ctx);
218   case Stmt::CXXOperatorCallExprClass:
219     return translateCXXOperatorCallExpr(cast<CXXOperatorCallExpr>(S), Ctx);
220   case Stmt::UnaryOperatorClass:
221     return translateUnaryOperator(cast<UnaryOperator>(S), Ctx);
222   case Stmt::BinaryOperatorClass:
223   case Stmt::CompoundAssignOperatorClass:
224     return translateBinaryOperator(cast<BinaryOperator>(S), Ctx);
225 
226   case Stmt::ArraySubscriptExprClass:
227     return translateArraySubscriptExpr(cast<ArraySubscriptExpr>(S), Ctx);
228   case Stmt::ConditionalOperatorClass:
229     return translateAbstractConditionalOperator(
230              cast<ConditionalOperator>(S), Ctx);
231   case Stmt::BinaryConditionalOperatorClass:
232     return translateAbstractConditionalOperator(
233              cast<BinaryConditionalOperator>(S), Ctx);
234 
235   // We treat these as no-ops
236   case Stmt::ParenExprClass:
237     return translate(cast<ParenExpr>(S)->getSubExpr(), Ctx);
238   case Stmt::ExprWithCleanupsClass:
239     return translate(cast<ExprWithCleanups>(S)->getSubExpr(), Ctx);
240   case Stmt::CXXBindTemporaryExprClass:
241     return translate(cast<CXXBindTemporaryExpr>(S)->getSubExpr(), Ctx);
242   case Stmt::MaterializeTemporaryExprClass:
243     return translate(cast<MaterializeTemporaryExpr>(S)->GetTemporaryExpr(),
244                      Ctx);
245 
246   // Collect all literals
247   case Stmt::CharacterLiteralClass:
248   case Stmt::CXXNullPtrLiteralExprClass:
249   case Stmt::GNUNullExprClass:
250   case Stmt::CXXBoolLiteralExprClass:
251   case Stmt::FloatingLiteralClass:
252   case Stmt::ImaginaryLiteralClass:
253   case Stmt::IntegerLiteralClass:
254   case Stmt::StringLiteralClass:
255   case Stmt::ObjCStringLiteralClass:
256     return new (Arena) til::Literal(cast<Expr>(S));
257 
258   case Stmt::DeclStmtClass:
259     return translateDeclStmt(cast<DeclStmt>(S), Ctx);
260   default:
261     break;
262   }
263   if (const auto *CE = dyn_cast<CastExpr>(S))
264     return translateCastExpr(CE, Ctx);
265 
266   return new (Arena) til::Undefined(S);
267 }
268 
269 til::SExpr *SExprBuilder::translateDeclRefExpr(const DeclRefExpr *DRE,
270                                                CallingContext *Ctx) {
271   const auto *VD = cast<ValueDecl>(DRE->getDecl()->getCanonicalDecl());
272 
273   // Function parameters require substitution and/or renaming.
274   if (const auto *PV = dyn_cast_or_null<ParmVarDecl>(VD)) {
275     const auto *FD =
276         cast<FunctionDecl>(PV->getDeclContext())->getCanonicalDecl();
277     unsigned I = PV->getFunctionScopeIndex();
278 
279     if (Ctx && Ctx->FunArgs && FD == Ctx->AttrDecl->getCanonicalDecl()) {
280       // Substitute call arguments for references to function parameters
281       assert(I < Ctx->NumArgs);
282       return translate(Ctx->FunArgs[I], Ctx->Prev);
283     }
284     // Map the param back to the param of the original function declaration
285     // for consistent comparisons.
286     VD = FD->getParamDecl(I);
287   }
288 
289   // For non-local variables, treat it as a reference to a named object.
290   return new (Arena) til::LiteralPtr(VD);
291 }
292 
293 til::SExpr *SExprBuilder::translateCXXThisExpr(const CXXThisExpr *TE,
294                                                CallingContext *Ctx) {
295   // Substitute for 'this'
296   if (Ctx && Ctx->SelfArg)
297     return translate(Ctx->SelfArg, Ctx->Prev);
298   assert(SelfVar && "We have no variable for 'this'!");
299   return SelfVar;
300 }
301 
302 static const ValueDecl *getValueDeclFromSExpr(const til::SExpr *E) {
303   if (const auto *V = dyn_cast<til::Variable>(E))
304     return V->clangDecl();
305   if (const auto *Ph = dyn_cast<til::Phi>(E))
306     return Ph->clangDecl();
307   if (const auto *P = dyn_cast<til::Project>(E))
308     return P->clangDecl();
309   if (const auto *L = dyn_cast<til::LiteralPtr>(E))
310     return L->clangDecl();
311   return nullptr;
312 }
313 
314 static bool hasCppPointerType(const til::SExpr *E) {
315   auto *VD = getValueDeclFromSExpr(E);
316   if (VD && VD->getType()->isPointerType())
317     return true;
318   if (const auto *C = dyn_cast<til::Cast>(E))
319     return C->castOpcode() == til::CAST_objToPtr;
320 
321   return false;
322 }
323 
324 // Grab the very first declaration of virtual method D
325 static const CXXMethodDecl *getFirstVirtualDecl(const CXXMethodDecl *D) {
326   while (true) {
327     D = D->getCanonicalDecl();
328     auto OverriddenMethods = D->overridden_methods();
329     if (OverriddenMethods.begin() == OverriddenMethods.end())
330       return D;  // Method does not override anything
331     // FIXME: this does not work with multiple inheritance.
332     D = *OverriddenMethods.begin();
333   }
334   return nullptr;
335 }
336 
337 til::SExpr *SExprBuilder::translateMemberExpr(const MemberExpr *ME,
338                                               CallingContext *Ctx) {
339   til::SExpr *BE = translate(ME->getBase(), Ctx);
340   til::SExpr *E  = new (Arena) til::SApply(BE);
341 
342   const auto *D = cast<ValueDecl>(ME->getMemberDecl()->getCanonicalDecl());
343   if (const auto *VD = dyn_cast<CXXMethodDecl>(D))
344     D = getFirstVirtualDecl(VD);
345 
346   til::Project *P = new (Arena) til::Project(E, D);
347   if (hasCppPointerType(BE))
348     P->setArrow(true);
349   return P;
350 }
351 
352 til::SExpr *SExprBuilder::translateCallExpr(const CallExpr *CE,
353                                             CallingContext *Ctx,
354                                             const Expr *SelfE) {
355   if (CapabilityExprMode) {
356     // Handle LOCK_RETURNED
357     if (const FunctionDecl *FD = CE->getDirectCallee()) {
358       FD = FD->getMostRecentDecl();
359       if (LockReturnedAttr *At = FD->getAttr<LockReturnedAttr>()) {
360         CallingContext LRCallCtx(Ctx);
361         LRCallCtx.AttrDecl = CE->getDirectCallee();
362         LRCallCtx.SelfArg = SelfE;
363         LRCallCtx.NumArgs = CE->getNumArgs();
364         LRCallCtx.FunArgs = CE->getArgs();
365         return const_cast<til::SExpr *>(
366             translateAttrExpr(At->getArg(), &LRCallCtx).sexpr());
367       }
368     }
369   }
370 
371   til::SExpr *E = translate(CE->getCallee(), Ctx);
372   for (const auto *Arg : CE->arguments()) {
373     til::SExpr *A = translate(Arg, Ctx);
374     E = new (Arena) til::Apply(E, A);
375   }
376   return new (Arena) til::Call(E, CE);
377 }
378 
379 til::SExpr *SExprBuilder::translateCXXMemberCallExpr(
380     const CXXMemberCallExpr *ME, CallingContext *Ctx) {
381   if (CapabilityExprMode) {
382     // Ignore calls to get() on smart pointers.
383     if (ME->getMethodDecl()->getNameAsString() == "get" &&
384         ME->getNumArgs() == 0) {
385       auto *E = translate(ME->getImplicitObjectArgument(), Ctx);
386       return new (Arena) til::Cast(til::CAST_objToPtr, E);
387       // return E;
388     }
389   }
390   return translateCallExpr(cast<CallExpr>(ME), Ctx,
391                            ME->getImplicitObjectArgument());
392 }
393 
394 til::SExpr *SExprBuilder::translateCXXOperatorCallExpr(
395     const CXXOperatorCallExpr *OCE, CallingContext *Ctx) {
396   if (CapabilityExprMode) {
397     // Ignore operator * and operator -> on smart pointers.
398     OverloadedOperatorKind k = OCE->getOperator();
399     if (k == OO_Star || k == OO_Arrow) {
400       auto *E = translate(OCE->getArg(0), Ctx);
401       return new (Arena) til::Cast(til::CAST_objToPtr, E);
402       // return E;
403     }
404   }
405   return translateCallExpr(cast<CallExpr>(OCE), Ctx);
406 }
407 
408 til::SExpr *SExprBuilder::translateUnaryOperator(const UnaryOperator *UO,
409                                                  CallingContext *Ctx) {
410   switch (UO->getOpcode()) {
411   case UO_PostInc:
412   case UO_PostDec:
413   case UO_PreInc:
414   case UO_PreDec:
415     return new (Arena) til::Undefined(UO);
416 
417   case UO_AddrOf:
418     if (CapabilityExprMode) {
419       // interpret &Graph::mu_ as an existential.
420       if (const auto *DRE = dyn_cast<DeclRefExpr>(UO->getSubExpr())) {
421         if (DRE->getDecl()->isCXXInstanceMember()) {
422           // This is a pointer-to-member expression, e.g. &MyClass::mu_.
423           // We interpret this syntax specially, as a wildcard.
424           auto *W = new (Arena) til::Wildcard();
425           return new (Arena) til::Project(W, DRE->getDecl());
426         }
427       }
428     }
429     // otherwise, & is a no-op
430     return translate(UO->getSubExpr(), Ctx);
431 
432   // We treat these as no-ops
433   case UO_Deref:
434   case UO_Plus:
435     return translate(UO->getSubExpr(), Ctx);
436 
437   case UO_Minus:
438     return new (Arena)
439       til::UnaryOp(til::UOP_Minus, translate(UO->getSubExpr(), Ctx));
440   case UO_Not:
441     return new (Arena)
442       til::UnaryOp(til::UOP_BitNot, translate(UO->getSubExpr(), Ctx));
443   case UO_LNot:
444     return new (Arena)
445       til::UnaryOp(til::UOP_LogicNot, translate(UO->getSubExpr(), Ctx));
446 
447   // Currently unsupported
448   case UO_Real:
449   case UO_Imag:
450   case UO_Extension:
451   case UO_Coawait:
452     return new (Arena) til::Undefined(UO);
453   }
454   return new (Arena) til::Undefined(UO);
455 }
456 
457 til::SExpr *SExprBuilder::translateBinOp(til::TIL_BinaryOpcode Op,
458                                          const BinaryOperator *BO,
459                                          CallingContext *Ctx, bool Reverse) {
460    til::SExpr *E0 = translate(BO->getLHS(), Ctx);
461    til::SExpr *E1 = translate(BO->getRHS(), Ctx);
462    if (Reverse)
463      return new (Arena) til::BinaryOp(Op, E1, E0);
464    else
465      return new (Arena) til::BinaryOp(Op, E0, E1);
466 }
467 
468 til::SExpr *SExprBuilder::translateBinAssign(til::TIL_BinaryOpcode Op,
469                                              const BinaryOperator *BO,
470                                              CallingContext *Ctx,
471                                              bool Assign) {
472   const Expr *LHS = BO->getLHS();
473   const Expr *RHS = BO->getRHS();
474   til::SExpr *E0 = translate(LHS, Ctx);
475   til::SExpr *E1 = translate(RHS, Ctx);
476 
477   const ValueDecl *VD = nullptr;
478   til::SExpr *CV = nullptr;
479   if (const auto *DRE = dyn_cast<DeclRefExpr>(LHS)) {
480     VD = DRE->getDecl();
481     CV = lookupVarDecl(VD);
482   }
483 
484   if (!Assign) {
485     til::SExpr *Arg = CV ? CV : new (Arena) til::Load(E0);
486     E1 = new (Arena) til::BinaryOp(Op, Arg, E1);
487     E1 = addStatement(E1, nullptr, VD);
488   }
489   if (VD && CV)
490     return updateVarDecl(VD, E1);
491   return new (Arena) til::Store(E0, E1);
492 }
493 
494 til::SExpr *SExprBuilder::translateBinaryOperator(const BinaryOperator *BO,
495                                                   CallingContext *Ctx) {
496   switch (BO->getOpcode()) {
497   case BO_PtrMemD:
498   case BO_PtrMemI:
499     return new (Arena) til::Undefined(BO);
500 
501   case BO_Mul:  return translateBinOp(til::BOP_Mul, BO, Ctx);
502   case BO_Div:  return translateBinOp(til::BOP_Div, BO, Ctx);
503   case BO_Rem:  return translateBinOp(til::BOP_Rem, BO, Ctx);
504   case BO_Add:  return translateBinOp(til::BOP_Add, BO, Ctx);
505   case BO_Sub:  return translateBinOp(til::BOP_Sub, BO, Ctx);
506   case BO_Shl:  return translateBinOp(til::BOP_Shl, BO, Ctx);
507   case BO_Shr:  return translateBinOp(til::BOP_Shr, BO, Ctx);
508   case BO_LT:   return translateBinOp(til::BOP_Lt,  BO, Ctx);
509   case BO_GT:   return translateBinOp(til::BOP_Lt,  BO, Ctx, true);
510   case BO_LE:   return translateBinOp(til::BOP_Leq, BO, Ctx);
511   case BO_GE:   return translateBinOp(til::BOP_Leq, BO, Ctx, true);
512   case BO_EQ:   return translateBinOp(til::BOP_Eq,  BO, Ctx);
513   case BO_NE:   return translateBinOp(til::BOP_Neq, BO, Ctx);
514   case BO_Cmp:  return translateBinOp(til::BOP_Cmp, BO, Ctx);
515   case BO_And:  return translateBinOp(til::BOP_BitAnd,   BO, Ctx);
516   case BO_Xor:  return translateBinOp(til::BOP_BitXor,   BO, Ctx);
517   case BO_Or:   return translateBinOp(til::BOP_BitOr,    BO, Ctx);
518   case BO_LAnd: return translateBinOp(til::BOP_LogicAnd, BO, Ctx);
519   case BO_LOr:  return translateBinOp(til::BOP_LogicOr,  BO, Ctx);
520 
521   case BO_Assign:    return translateBinAssign(til::BOP_Eq,  BO, Ctx, true);
522   case BO_MulAssign: return translateBinAssign(til::BOP_Mul, BO, Ctx);
523   case BO_DivAssign: return translateBinAssign(til::BOP_Div, BO, Ctx);
524   case BO_RemAssign: return translateBinAssign(til::BOP_Rem, BO, Ctx);
525   case BO_AddAssign: return translateBinAssign(til::BOP_Add, BO, Ctx);
526   case BO_SubAssign: return translateBinAssign(til::BOP_Sub, BO, Ctx);
527   case BO_ShlAssign: return translateBinAssign(til::BOP_Shl, BO, Ctx);
528   case BO_ShrAssign: return translateBinAssign(til::BOP_Shr, BO, Ctx);
529   case BO_AndAssign: return translateBinAssign(til::BOP_BitAnd, BO, Ctx);
530   case BO_XorAssign: return translateBinAssign(til::BOP_BitXor, BO, Ctx);
531   case BO_OrAssign:  return translateBinAssign(til::BOP_BitOr,  BO, Ctx);
532 
533   case BO_Comma:
534     // The clang CFG should have already processed both sides.
535     return translate(BO->getRHS(), Ctx);
536   }
537   return new (Arena) til::Undefined(BO);
538 }
539 
540 til::SExpr *SExprBuilder::translateCastExpr(const CastExpr *CE,
541                                             CallingContext *Ctx) {
542   CastKind K = CE->getCastKind();
543   switch (K) {
544   case CK_LValueToRValue: {
545     if (const auto *DRE = dyn_cast<DeclRefExpr>(CE->getSubExpr())) {
546       til::SExpr *E0 = lookupVarDecl(DRE->getDecl());
547       if (E0)
548         return E0;
549     }
550     til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
551     return E0;
552     // FIXME!! -- get Load working properly
553     // return new (Arena) til::Load(E0);
554   }
555   case CK_NoOp:
556   case CK_DerivedToBase:
557   case CK_UncheckedDerivedToBase:
558   case CK_ArrayToPointerDecay:
559   case CK_FunctionToPointerDecay: {
560     til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
561     return E0;
562   }
563   default: {
564     // FIXME: handle different kinds of casts.
565     til::SExpr *E0 = translate(CE->getSubExpr(), Ctx);
566     if (CapabilityExprMode)
567       return E0;
568     return new (Arena) til::Cast(til::CAST_none, E0);
569   }
570   }
571 }
572 
573 til::SExpr *
574 SExprBuilder::translateArraySubscriptExpr(const ArraySubscriptExpr *E,
575                                           CallingContext *Ctx) {
576   til::SExpr *E0 = translate(E->getBase(), Ctx);
577   til::SExpr *E1 = translate(E->getIdx(), Ctx);
578   return new (Arena) til::ArrayIndex(E0, E1);
579 }
580 
581 til::SExpr *
582 SExprBuilder::translateAbstractConditionalOperator(
583     const AbstractConditionalOperator *CO, CallingContext *Ctx) {
584   auto *C = translate(CO->getCond(), Ctx);
585   auto *T = translate(CO->getTrueExpr(), Ctx);
586   auto *E = translate(CO->getFalseExpr(), Ctx);
587   return new (Arena) til::IfThenElse(C, T, E);
588 }
589 
590 til::SExpr *
591 SExprBuilder::translateDeclStmt(const DeclStmt *S, CallingContext *Ctx) {
592   DeclGroupRef DGrp = S->getDeclGroup();
593   for (auto I : DGrp) {
594     if (auto *VD = dyn_cast_or_null<VarDecl>(I)) {
595       Expr *E = VD->getInit();
596       til::SExpr* SE = translate(E, Ctx);
597 
598       // Add local variables with trivial type to the variable map
599       QualType T = VD->getType();
600       if (T.isTrivialType(VD->getASTContext()))
601         return addVarDecl(VD, SE);
602       else {
603         // TODO: add alloca
604       }
605     }
606   }
607   return nullptr;
608 }
609 
610 // If (E) is non-trivial, then add it to the current basic block, and
611 // update the statement map so that S refers to E.  Returns a new variable
612 // that refers to E.
613 // If E is trivial returns E.
614 til::SExpr *SExprBuilder::addStatement(til::SExpr* E, const Stmt *S,
615                                        const ValueDecl *VD) {
616   if (!E || !CurrentBB || E->block() || til::ThreadSafetyTIL::isTrivial(E))
617     return E;
618   if (VD)
619     E = new (Arena) til::Variable(E, VD);
620   CurrentInstructions.push_back(E);
621   if (S)
622     insertStmt(S, E);
623   return E;
624 }
625 
626 // Returns the current value of VD, if known, and nullptr otherwise.
627 til::SExpr *SExprBuilder::lookupVarDecl(const ValueDecl *VD) {
628   auto It = LVarIdxMap.find(VD);
629   if (It != LVarIdxMap.end()) {
630     assert(CurrentLVarMap[It->second].first == VD);
631     return CurrentLVarMap[It->second].second;
632   }
633   return nullptr;
634 }
635 
636 // if E is a til::Variable, update its clangDecl.
637 static void maybeUpdateVD(til::SExpr *E, const ValueDecl *VD) {
638   if (!E)
639     return;
640   if (auto *V = dyn_cast<til::Variable>(E)) {
641     if (!V->clangDecl())
642       V->setClangDecl(VD);
643   }
644 }
645 
646 // Adds a new variable declaration.
647 til::SExpr *SExprBuilder::addVarDecl(const ValueDecl *VD, til::SExpr *E) {
648   maybeUpdateVD(E, VD);
649   LVarIdxMap.insert(std::make_pair(VD, CurrentLVarMap.size()));
650   CurrentLVarMap.makeWritable();
651   CurrentLVarMap.push_back(std::make_pair(VD, E));
652   return E;
653 }
654 
655 // Updates a current variable declaration.  (E.g. by assignment)
656 til::SExpr *SExprBuilder::updateVarDecl(const ValueDecl *VD, til::SExpr *E) {
657   maybeUpdateVD(E, VD);
658   auto It = LVarIdxMap.find(VD);
659   if (It == LVarIdxMap.end()) {
660     til::SExpr *Ptr = new (Arena) til::LiteralPtr(VD);
661     til::SExpr *St  = new (Arena) til::Store(Ptr, E);
662     return St;
663   }
664   CurrentLVarMap.makeWritable();
665   CurrentLVarMap.elem(It->second).second = E;
666   return E;
667 }
668 
669 // Make a Phi node in the current block for the i^th variable in CurrentVarMap.
670 // If E != null, sets Phi[CurrentBlockInfo->ArgIndex] = E.
671 // If E == null, this is a backedge and will be set later.
672 void SExprBuilder::makePhiNodeVar(unsigned i, unsigned NPreds, til::SExpr *E) {
673   unsigned ArgIndex = CurrentBlockInfo->ProcessedPredecessors;
674   assert(ArgIndex > 0 && ArgIndex < NPreds);
675 
676   til::SExpr *CurrE = CurrentLVarMap[i].second;
677   if (CurrE->block() == CurrentBB) {
678     // We already have a Phi node in the current block,
679     // so just add the new variable to the Phi node.
680     auto *Ph = dyn_cast<til::Phi>(CurrE);
681     assert(Ph && "Expecting Phi node.");
682     if (E)
683       Ph->values()[ArgIndex] = E;
684     return;
685   }
686 
687   // Make a new phi node: phi(..., E)
688   // All phi args up to the current index are set to the current value.
689   til::Phi *Ph = new (Arena) til::Phi(Arena, NPreds);
690   Ph->values().setValues(NPreds, nullptr);
691   for (unsigned PIdx = 0; PIdx < ArgIndex; ++PIdx)
692     Ph->values()[PIdx] = CurrE;
693   if (E)
694     Ph->values()[ArgIndex] = E;
695   Ph->setClangDecl(CurrentLVarMap[i].first);
696   // If E is from a back-edge, or either E or CurrE are incomplete, then
697   // mark this node as incomplete; we may need to remove it later.
698   if (!E || isIncompletePhi(E) || isIncompletePhi(CurrE))
699     Ph->setStatus(til::Phi::PH_Incomplete);
700 
701   // Add Phi node to current block, and update CurrentLVarMap[i]
702   CurrentArguments.push_back(Ph);
703   if (Ph->status() == til::Phi::PH_Incomplete)
704     IncompleteArgs.push_back(Ph);
705 
706   CurrentLVarMap.makeWritable();
707   CurrentLVarMap.elem(i).second = Ph;
708 }
709 
710 // Merge values from Map into the current variable map.
711 // This will construct Phi nodes in the current basic block as necessary.
712 void SExprBuilder::mergeEntryMap(LVarDefinitionMap Map) {
713   assert(CurrentBlockInfo && "Not processing a block!");
714 
715   if (!CurrentLVarMap.valid()) {
716     // Steal Map, using copy-on-write.
717     CurrentLVarMap = std::move(Map);
718     return;
719   }
720   if (CurrentLVarMap.sameAs(Map))
721     return;  // Easy merge: maps from different predecessors are unchanged.
722 
723   unsigned NPreds = CurrentBB->numPredecessors();
724   unsigned ESz = CurrentLVarMap.size();
725   unsigned MSz = Map.size();
726   unsigned Sz  = std::min(ESz, MSz);
727 
728   for (unsigned i = 0; i < Sz; ++i) {
729     if (CurrentLVarMap[i].first != Map[i].first) {
730       // We've reached the end of variables in common.
731       CurrentLVarMap.makeWritable();
732       CurrentLVarMap.downsize(i);
733       break;
734     }
735     if (CurrentLVarMap[i].second != Map[i].second)
736       makePhiNodeVar(i, NPreds, Map[i].second);
737   }
738   if (ESz > MSz) {
739     CurrentLVarMap.makeWritable();
740     CurrentLVarMap.downsize(Map.size());
741   }
742 }
743 
744 // Merge a back edge into the current variable map.
745 // This will create phi nodes for all variables in the variable map.
746 void SExprBuilder::mergeEntryMapBackEdge() {
747   // We don't have definitions for variables on the backedge, because we
748   // haven't gotten that far in the CFG.  Thus, when encountering a back edge,
749   // we conservatively create Phi nodes for all variables.  Unnecessary Phi
750   // nodes will be marked as incomplete, and stripped out at the end.
751   //
752   // An Phi node is unnecessary if it only refers to itself and one other
753   // variable, e.g. x = Phi(y, y, x)  can be reduced to x = y.
754 
755   assert(CurrentBlockInfo && "Not processing a block!");
756 
757   if (CurrentBlockInfo->HasBackEdges)
758     return;
759   CurrentBlockInfo->HasBackEdges = true;
760 
761   CurrentLVarMap.makeWritable();
762   unsigned Sz = CurrentLVarMap.size();
763   unsigned NPreds = CurrentBB->numPredecessors();
764 
765   for (unsigned i = 0; i < Sz; ++i)
766     makePhiNodeVar(i, NPreds, nullptr);
767 }
768 
769 // Update the phi nodes that were initially created for a back edge
770 // once the variable definitions have been computed.
771 // I.e., merge the current variable map into the phi nodes for Blk.
772 void SExprBuilder::mergePhiNodesBackEdge(const CFGBlock *Blk) {
773   til::BasicBlock *BB = lookupBlock(Blk);
774   unsigned ArgIndex = BBInfo[Blk->getBlockID()].ProcessedPredecessors;
775   assert(ArgIndex > 0 && ArgIndex < BB->numPredecessors());
776 
777   for (til::SExpr *PE : BB->arguments()) {
778     auto *Ph = dyn_cast_or_null<til::Phi>(PE);
779     assert(Ph && "Expecting Phi Node.");
780     assert(Ph->values()[ArgIndex] == nullptr && "Wrong index for back edge.");
781 
782     til::SExpr *E = lookupVarDecl(Ph->clangDecl());
783     assert(E && "Couldn't find local variable for Phi node.");
784     Ph->values()[ArgIndex] = E;
785   }
786 }
787 
788 void SExprBuilder::enterCFG(CFG *Cfg, const NamedDecl *D,
789                             const CFGBlock *First) {
790   // Perform initial setup operations.
791   unsigned NBlocks = Cfg->getNumBlockIDs();
792   Scfg = new (Arena) til::SCFG(Arena, NBlocks);
793 
794   // allocate all basic blocks immediately, to handle forward references.
795   BBInfo.resize(NBlocks);
796   BlockMap.resize(NBlocks, nullptr);
797   // create map from clang blockID to til::BasicBlocks
798   for (auto *B : *Cfg) {
799     auto *BB = new (Arena) til::BasicBlock(Arena);
800     BB->reserveInstructions(B->size());
801     BlockMap[B->getBlockID()] = BB;
802   }
803 
804   CurrentBB = lookupBlock(&Cfg->getEntry());
805   auto Parms = isa<ObjCMethodDecl>(D) ? cast<ObjCMethodDecl>(D)->parameters()
806                                       : cast<FunctionDecl>(D)->parameters();
807   for (auto *Pm : Parms) {
808     QualType T = Pm->getType();
809     if (!T.isTrivialType(Pm->getASTContext()))
810       continue;
811 
812     // Add parameters to local variable map.
813     // FIXME: right now we emulate params with loads; that should be fixed.
814     til::SExpr *Lp = new (Arena) til::LiteralPtr(Pm);
815     til::SExpr *Ld = new (Arena) til::Load(Lp);
816     til::SExpr *V  = addStatement(Ld, nullptr, Pm);
817     addVarDecl(Pm, V);
818   }
819 }
820 
821 void SExprBuilder::enterCFGBlock(const CFGBlock *B) {
822   // Initialize TIL basic block and add it to the CFG.
823   CurrentBB = lookupBlock(B);
824   CurrentBB->reservePredecessors(B->pred_size());
825   Scfg->add(CurrentBB);
826 
827   CurrentBlockInfo = &BBInfo[B->getBlockID()];
828 
829   // CurrentLVarMap is moved to ExitMap on block exit.
830   // FIXME: the entry block will hold function parameters.
831   // assert(!CurrentLVarMap.valid() && "CurrentLVarMap already initialized.");
832 }
833 
834 void SExprBuilder::handlePredecessor(const CFGBlock *Pred) {
835   // Compute CurrentLVarMap on entry from ExitMaps of predecessors
836 
837   CurrentBB->addPredecessor(BlockMap[Pred->getBlockID()]);
838   BlockInfo *PredInfo = &BBInfo[Pred->getBlockID()];
839   assert(PredInfo->UnprocessedSuccessors > 0);
840 
841   if (--PredInfo->UnprocessedSuccessors == 0)
842     mergeEntryMap(std::move(PredInfo->ExitMap));
843   else
844     mergeEntryMap(PredInfo->ExitMap.clone());
845 
846   ++CurrentBlockInfo->ProcessedPredecessors;
847 }
848 
849 void SExprBuilder::handlePredecessorBackEdge(const CFGBlock *Pred) {
850   mergeEntryMapBackEdge();
851 }
852 
853 void SExprBuilder::enterCFGBlockBody(const CFGBlock *B) {
854   // The merge*() methods have created arguments.
855   // Push those arguments onto the basic block.
856   CurrentBB->arguments().reserve(
857     static_cast<unsigned>(CurrentArguments.size()), Arena);
858   for (auto *A : CurrentArguments)
859     CurrentBB->addArgument(A);
860 }
861 
862 void SExprBuilder::handleStatement(const Stmt *S) {
863   til::SExpr *E = translate(S, nullptr);
864   addStatement(E, S);
865 }
866 
867 void SExprBuilder::handleDestructorCall(const VarDecl *VD,
868                                         const CXXDestructorDecl *DD) {
869   til::SExpr *Sf = new (Arena) til::LiteralPtr(VD);
870   til::SExpr *Dr = new (Arena) til::LiteralPtr(DD);
871   til::SExpr *Ap = new (Arena) til::Apply(Dr, Sf);
872   til::SExpr *E = new (Arena) til::Call(Ap);
873   addStatement(E, nullptr);
874 }
875 
876 void SExprBuilder::exitCFGBlockBody(const CFGBlock *B) {
877   CurrentBB->instructions().reserve(
878     static_cast<unsigned>(CurrentInstructions.size()), Arena);
879   for (auto *V : CurrentInstructions)
880     CurrentBB->addInstruction(V);
881 
882   // Create an appropriate terminator
883   unsigned N = B->succ_size();
884   auto It = B->succ_begin();
885   if (N == 1) {
886     til::BasicBlock *BB = *It ? lookupBlock(*It) : nullptr;
887     // TODO: set index
888     unsigned Idx = BB ? BB->findPredecessorIndex(CurrentBB) : 0;
889     auto *Tm = new (Arena) til::Goto(BB, Idx);
890     CurrentBB->setTerminator(Tm);
891   }
892   else if (N == 2) {
893     til::SExpr *C = translate(B->getTerminatorCondition(true), nullptr);
894     til::BasicBlock *BB1 = *It ? lookupBlock(*It) : nullptr;
895     ++It;
896     til::BasicBlock *BB2 = *It ? lookupBlock(*It) : nullptr;
897     // FIXME: make sure these aren't critical edges.
898     auto *Tm = new (Arena) til::Branch(C, BB1, BB2);
899     CurrentBB->setTerminator(Tm);
900   }
901 }
902 
903 void SExprBuilder::handleSuccessor(const CFGBlock *Succ) {
904   ++CurrentBlockInfo->UnprocessedSuccessors;
905 }
906 
907 void SExprBuilder::handleSuccessorBackEdge(const CFGBlock *Succ) {
908   mergePhiNodesBackEdge(Succ);
909   ++BBInfo[Succ->getBlockID()].ProcessedPredecessors;
910 }
911 
912 void SExprBuilder::exitCFGBlock(const CFGBlock *B) {
913   CurrentArguments.clear();
914   CurrentInstructions.clear();
915   CurrentBlockInfo->ExitMap = std::move(CurrentLVarMap);
916   CurrentBB = nullptr;
917   CurrentBlockInfo = nullptr;
918 }
919 
920 void SExprBuilder::exitCFG(const CFGBlock *Last) {
921   for (auto *Ph : IncompleteArgs) {
922     if (Ph->status() == til::Phi::PH_Incomplete)
923       simplifyIncompleteArg(Ph);
924   }
925 
926   CurrentArguments.clear();
927   CurrentInstructions.clear();
928   IncompleteArgs.clear();
929 }
930 
931 /*
932 void printSCFG(CFGWalker &Walker) {
933   llvm::BumpPtrAllocator Bpa;
934   til::MemRegionRef Arena(&Bpa);
935   SExprBuilder SxBuilder(Arena);
936   til::SCFG *Scfg = SxBuilder.buildCFG(Walker);
937   TILPrinter::print(Scfg, llvm::errs());
938 }
939 */
940