1 //== MemRegion.cpp - Abstract memory regions for static analysis --*- C++ -*--//
2 //
3 //                     The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 //  This file defines MemRegion and its subclasses.  MemRegion defines a
11 //  partially-typed abstraction of memory useful for path-sensitive dataflow
12 //  analyses.
13 //
14 //===----------------------------------------------------------------------===//
15 
16 #include "clang/StaticAnalyzer/Core/PathSensitive/MemRegion.h"
17 #include "clang/AST/Attr.h"
18 #include "clang/AST/CharUnits.h"
19 #include "clang/AST/DeclObjC.h"
20 #include "clang/AST/RecordLayout.h"
21 #include "clang/Analysis/AnalysisContext.h"
22 #include "clang/Analysis/Support/BumpVector.h"
23 #include "clang/Basic/SourceManager.h"
24 #include "clang/StaticAnalyzer/Core/PathSensitive/SValBuilder.h"
25 #include "llvm/Support/raw_ostream.h"
26 
27 using namespace clang;
28 using namespace ento;
29 
30 //===----------------------------------------------------------------------===//
31 // MemRegion Construction.
32 //===----------------------------------------------------------------------===//
33 
34 template<typename RegionTy> struct MemRegionManagerTrait;
35 
36 template <typename RegionTy, typename A1>
37 RegionTy* MemRegionManager::getRegion(const A1 a1) {
38 
39   const typename MemRegionManagerTrait<RegionTy>::SuperRegionTy *superRegion =
40   MemRegionManagerTrait<RegionTy>::getSuperRegion(*this, a1);
41 
42   llvm::FoldingSetNodeID ID;
43   RegionTy::ProfileRegion(ID, a1, superRegion);
44   void *InsertPos;
45   RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
46                                                                    InsertPos));
47 
48   if (!R) {
49     R = (RegionTy*) A.Allocate<RegionTy>();
50     new (R) RegionTy(a1, superRegion);
51     Regions.InsertNode(R, InsertPos);
52   }
53 
54   return R;
55 }
56 
57 template <typename RegionTy, typename A1>
58 RegionTy* MemRegionManager::getSubRegion(const A1 a1,
59                                          const MemRegion *superRegion) {
60   llvm::FoldingSetNodeID ID;
61   RegionTy::ProfileRegion(ID, a1, superRegion);
62   void *InsertPos;
63   RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
64                                                                    InsertPos));
65 
66   if (!R) {
67     R = (RegionTy*) A.Allocate<RegionTy>();
68     new (R) RegionTy(a1, superRegion);
69     Regions.InsertNode(R, InsertPos);
70   }
71 
72   return R;
73 }
74 
75 template <typename RegionTy, typename A1, typename A2>
76 RegionTy* MemRegionManager::getRegion(const A1 a1, const A2 a2) {
77 
78   const typename MemRegionManagerTrait<RegionTy>::SuperRegionTy *superRegion =
79   MemRegionManagerTrait<RegionTy>::getSuperRegion(*this, a1, a2);
80 
81   llvm::FoldingSetNodeID ID;
82   RegionTy::ProfileRegion(ID, a1, a2, superRegion);
83   void *InsertPos;
84   RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
85                                                                    InsertPos));
86 
87   if (!R) {
88     R = (RegionTy*) A.Allocate<RegionTy>();
89     new (R) RegionTy(a1, a2, superRegion);
90     Regions.InsertNode(R, InsertPos);
91   }
92 
93   return R;
94 }
95 
96 template <typename RegionTy, typename A1, typename A2>
97 RegionTy* MemRegionManager::getSubRegion(const A1 a1, const A2 a2,
98                                          const MemRegion *superRegion) {
99 
100   llvm::FoldingSetNodeID ID;
101   RegionTy::ProfileRegion(ID, a1, a2, superRegion);
102   void *InsertPos;
103   RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
104                                                                    InsertPos));
105 
106   if (!R) {
107     R = (RegionTy*) A.Allocate<RegionTy>();
108     new (R) RegionTy(a1, a2, superRegion);
109     Regions.InsertNode(R, InsertPos);
110   }
111 
112   return R;
113 }
114 
115 template <typename RegionTy, typename A1, typename A2, typename A3>
116 RegionTy* MemRegionManager::getSubRegion(const A1 a1, const A2 a2, const A3 a3,
117                                          const MemRegion *superRegion) {
118 
119   llvm::FoldingSetNodeID ID;
120   RegionTy::ProfileRegion(ID, a1, a2, a3, superRegion);
121   void *InsertPos;
122   RegionTy* R = cast_or_null<RegionTy>(Regions.FindNodeOrInsertPos(ID,
123                                                                    InsertPos));
124 
125   if (!R) {
126     R = (RegionTy*) A.Allocate<RegionTy>();
127     new (R) RegionTy(a1, a2, a3, superRegion);
128     Regions.InsertNode(R, InsertPos);
129   }
130 
131   return R;
132 }
133 
134 //===----------------------------------------------------------------------===//
135 // Object destruction.
136 //===----------------------------------------------------------------------===//
137 
138 MemRegion::~MemRegion() {}
139 
140 MemRegionManager::~MemRegionManager() {
141   // All regions and their data are BumpPtrAllocated.  No need to call
142   // their destructors.
143 }
144 
145 //===----------------------------------------------------------------------===//
146 // Basic methods.
147 //===----------------------------------------------------------------------===//
148 
149 bool SubRegion::isSubRegionOf(const MemRegion* R) const {
150   const MemRegion* r = getSuperRegion();
151   while (r != 0) {
152     if (r == R)
153       return true;
154     if (const SubRegion* sr = dyn_cast<SubRegion>(r))
155       r = sr->getSuperRegion();
156     else
157       break;
158   }
159   return false;
160 }
161 
162 MemRegionManager* SubRegion::getMemRegionManager() const {
163   const SubRegion* r = this;
164   do {
165     const MemRegion *superRegion = r->getSuperRegion();
166     if (const SubRegion *sr = dyn_cast<SubRegion>(superRegion)) {
167       r = sr;
168       continue;
169     }
170     return superRegion->getMemRegionManager();
171   } while (1);
172 }
173 
174 const StackFrameContext *VarRegion::getStackFrame() const {
175   const StackSpaceRegion *SSR = dyn_cast<StackSpaceRegion>(getMemorySpace());
176   return SSR ? SSR->getStackFrame() : NULL;
177 }
178 
179 //===----------------------------------------------------------------------===//
180 // Region extents.
181 //===----------------------------------------------------------------------===//
182 
183 DefinedOrUnknownSVal TypedValueRegion::getExtent(SValBuilder &svalBuilder) const {
184   ASTContext &Ctx = svalBuilder.getContext();
185   QualType T = getDesugaredValueType(Ctx);
186 
187   if (isa<VariableArrayType>(T))
188     return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
189   if (T->isIncompleteType())
190     return UnknownVal();
191 
192   CharUnits size = Ctx.getTypeSizeInChars(T);
193   QualType sizeTy = svalBuilder.getArrayIndexType();
194   return svalBuilder.makeIntVal(size.getQuantity(), sizeTy);
195 }
196 
197 DefinedOrUnknownSVal FieldRegion::getExtent(SValBuilder &svalBuilder) const {
198   // Force callers to deal with bitfields explicitly.
199   if (getDecl()->isBitField())
200     return UnknownVal();
201 
202   DefinedOrUnknownSVal Extent = DeclRegion::getExtent(svalBuilder);
203 
204   // A zero-length array at the end of a struct often stands for dynamically-
205   // allocated extra memory.
206   if (Extent.isZeroConstant()) {
207     QualType T = getDesugaredValueType(svalBuilder.getContext());
208 
209     if (isa<ConstantArrayType>(T))
210       return UnknownVal();
211   }
212 
213   return Extent;
214 }
215 
216 DefinedOrUnknownSVal AllocaRegion::getExtent(SValBuilder &svalBuilder) const {
217   return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
218 }
219 
220 DefinedOrUnknownSVal SymbolicRegion::getExtent(SValBuilder &svalBuilder) const {
221   return nonloc::SymbolVal(svalBuilder.getSymbolManager().getExtentSymbol(this));
222 }
223 
224 DefinedOrUnknownSVal StringRegion::getExtent(SValBuilder &svalBuilder) const {
225   return svalBuilder.makeIntVal(getStringLiteral()->getByteLength()+1,
226                                 svalBuilder.getArrayIndexType());
227 }
228 
229 ObjCIvarRegion::ObjCIvarRegion(const ObjCIvarDecl *ivd, const MemRegion* sReg)
230   : DeclRegion(ivd, sReg, ObjCIvarRegionKind) {}
231 
232 const ObjCIvarDecl *ObjCIvarRegion::getDecl() const {
233   return cast<ObjCIvarDecl>(D);
234 }
235 
236 QualType ObjCIvarRegion::getValueType() const {
237   return getDecl()->getType();
238 }
239 
240 QualType CXXBaseObjectRegion::getValueType() const {
241   return QualType(getDecl()->getTypeForDecl(), 0);
242 }
243 
244 //===----------------------------------------------------------------------===//
245 // FoldingSet profiling.
246 //===----------------------------------------------------------------------===//
247 
248 void MemSpaceRegion::Profile(llvm::FoldingSetNodeID& ID) const {
249   ID.AddInteger((unsigned)getKind());
250 }
251 
252 void StackSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
253   ID.AddInteger((unsigned)getKind());
254   ID.AddPointer(getStackFrame());
255 }
256 
257 void StaticGlobalSpaceRegion::Profile(llvm::FoldingSetNodeID &ID) const {
258   ID.AddInteger((unsigned)getKind());
259   ID.AddPointer(getCodeRegion());
260 }
261 
262 void StringRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
263                                  const StringLiteral* Str,
264                                  const MemRegion* superRegion) {
265   ID.AddInteger((unsigned) StringRegionKind);
266   ID.AddPointer(Str);
267   ID.AddPointer(superRegion);
268 }
269 
270 void ObjCStringRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
271                                      const ObjCStringLiteral* Str,
272                                      const MemRegion* superRegion) {
273   ID.AddInteger((unsigned) ObjCStringRegionKind);
274   ID.AddPointer(Str);
275   ID.AddPointer(superRegion);
276 }
277 
278 void AllocaRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
279                                  const Expr *Ex, unsigned cnt,
280                                  const MemRegion *superRegion) {
281   ID.AddInteger((unsigned) AllocaRegionKind);
282   ID.AddPointer(Ex);
283   ID.AddInteger(cnt);
284   ID.AddPointer(superRegion);
285 }
286 
287 void AllocaRegion::Profile(llvm::FoldingSetNodeID& ID) const {
288   ProfileRegion(ID, Ex, Cnt, superRegion);
289 }
290 
291 void CompoundLiteralRegion::Profile(llvm::FoldingSetNodeID& ID) const {
292   CompoundLiteralRegion::ProfileRegion(ID, CL, superRegion);
293 }
294 
295 void CompoundLiteralRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
296                                           const CompoundLiteralExpr *CL,
297                                           const MemRegion* superRegion) {
298   ID.AddInteger((unsigned) CompoundLiteralRegionKind);
299   ID.AddPointer(CL);
300   ID.AddPointer(superRegion);
301 }
302 
303 void CXXThisRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
304                                   const PointerType *PT,
305                                   const MemRegion *sRegion) {
306   ID.AddInteger((unsigned) CXXThisRegionKind);
307   ID.AddPointer(PT);
308   ID.AddPointer(sRegion);
309 }
310 
311 void CXXThisRegion::Profile(llvm::FoldingSetNodeID &ID) const {
312   CXXThisRegion::ProfileRegion(ID, ThisPointerTy, superRegion);
313 }
314 
315 void ObjCIvarRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
316                                    const ObjCIvarDecl *ivd,
317                                    const MemRegion* superRegion) {
318   DeclRegion::ProfileRegion(ID, ivd, superRegion, ObjCIvarRegionKind);
319 }
320 
321 void DeclRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, const Decl *D,
322                                const MemRegion* superRegion, Kind k) {
323   ID.AddInteger((unsigned) k);
324   ID.AddPointer(D);
325   ID.AddPointer(superRegion);
326 }
327 
328 void DeclRegion::Profile(llvm::FoldingSetNodeID& ID) const {
329   DeclRegion::ProfileRegion(ID, D, superRegion, getKind());
330 }
331 
332 void VarRegion::Profile(llvm::FoldingSetNodeID &ID) const {
333   VarRegion::ProfileRegion(ID, getDecl(), superRegion);
334 }
335 
336 void SymbolicRegion::ProfileRegion(llvm::FoldingSetNodeID& ID, SymbolRef sym,
337                                    const MemRegion *sreg) {
338   ID.AddInteger((unsigned) MemRegion::SymbolicRegionKind);
339   ID.Add(sym);
340   ID.AddPointer(sreg);
341 }
342 
343 void SymbolicRegion::Profile(llvm::FoldingSetNodeID& ID) const {
344   SymbolicRegion::ProfileRegion(ID, sym, getSuperRegion());
345 }
346 
347 void ElementRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
348                                   QualType ElementType, SVal Idx,
349                                   const MemRegion* superRegion) {
350   ID.AddInteger(MemRegion::ElementRegionKind);
351   ID.Add(ElementType);
352   ID.AddPointer(superRegion);
353   Idx.Profile(ID);
354 }
355 
356 void ElementRegion::Profile(llvm::FoldingSetNodeID& ID) const {
357   ElementRegion::ProfileRegion(ID, ElementType, Index, superRegion);
358 }
359 
360 void FunctionTextRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
361                                        const NamedDecl *FD,
362                                        const MemRegion*) {
363   ID.AddInteger(MemRegion::FunctionTextRegionKind);
364   ID.AddPointer(FD);
365 }
366 
367 void FunctionTextRegion::Profile(llvm::FoldingSetNodeID& ID) const {
368   FunctionTextRegion::ProfileRegion(ID, FD, superRegion);
369 }
370 
371 void BlockTextRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
372                                     const BlockDecl *BD, CanQualType,
373                                     const AnalysisDeclContext *AC,
374                                     const MemRegion*) {
375   ID.AddInteger(MemRegion::BlockTextRegionKind);
376   ID.AddPointer(BD);
377 }
378 
379 void BlockTextRegion::Profile(llvm::FoldingSetNodeID& ID) const {
380   BlockTextRegion::ProfileRegion(ID, BD, locTy, AC, superRegion);
381 }
382 
383 void BlockDataRegion::ProfileRegion(llvm::FoldingSetNodeID& ID,
384                                     const BlockTextRegion *BC,
385                                     const LocationContext *LC,
386                                     unsigned BlkCount,
387                                     const MemRegion *sReg) {
388   ID.AddInteger(MemRegion::BlockDataRegionKind);
389   ID.AddPointer(BC);
390   ID.AddPointer(LC);
391   ID.AddInteger(BlkCount);
392   ID.AddPointer(sReg);
393 }
394 
395 void BlockDataRegion::Profile(llvm::FoldingSetNodeID& ID) const {
396   BlockDataRegion::ProfileRegion(ID, BC, LC, BlockCount, getSuperRegion());
397 }
398 
399 void CXXTempObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
400                                         Expr const *Ex,
401                                         const MemRegion *sReg) {
402   ID.AddPointer(Ex);
403   ID.AddPointer(sReg);
404 }
405 
406 void CXXTempObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
407   ProfileRegion(ID, Ex, getSuperRegion());
408 }
409 
410 void CXXBaseObjectRegion::ProfileRegion(llvm::FoldingSetNodeID &ID,
411                                         const CXXRecordDecl *RD,
412                                         bool IsVirtual,
413                                         const MemRegion *SReg) {
414   ID.AddPointer(RD);
415   ID.AddBoolean(IsVirtual);
416   ID.AddPointer(SReg);
417 }
418 
419 void CXXBaseObjectRegion::Profile(llvm::FoldingSetNodeID &ID) const {
420   ProfileRegion(ID, getDecl(), isVirtual(), superRegion);
421 }
422 
423 //===----------------------------------------------------------------------===//
424 // Region anchors.
425 //===----------------------------------------------------------------------===//
426 
427 void GlobalsSpaceRegion::anchor() { }
428 void HeapSpaceRegion::anchor() { }
429 void UnknownSpaceRegion::anchor() { }
430 void StackLocalsSpaceRegion::anchor() { }
431 void StackArgumentsSpaceRegion::anchor() { }
432 void TypedRegion::anchor() { }
433 void TypedValueRegion::anchor() { }
434 void CodeTextRegion::anchor() { }
435 void SubRegion::anchor() { }
436 
437 //===----------------------------------------------------------------------===//
438 // Region pretty-printing.
439 //===----------------------------------------------------------------------===//
440 
441 void MemRegion::dump() const {
442   dumpToStream(llvm::errs());
443 }
444 
445 std::string MemRegion::getString() const {
446   std::string s;
447   llvm::raw_string_ostream os(s);
448   dumpToStream(os);
449   return os.str();
450 }
451 
452 void MemRegion::dumpToStream(raw_ostream &os) const {
453   os << "<Unknown Region>";
454 }
455 
456 void AllocaRegion::dumpToStream(raw_ostream &os) const {
457   os << "alloca{" << (const void*) Ex << ',' << Cnt << '}';
458 }
459 
460 void FunctionTextRegion::dumpToStream(raw_ostream &os) const {
461   os << "code{" << getDecl()->getDeclName().getAsString() << '}';
462 }
463 
464 void BlockTextRegion::dumpToStream(raw_ostream &os) const {
465   os << "block_code{" << (const void*) this << '}';
466 }
467 
468 void BlockDataRegion::dumpToStream(raw_ostream &os) const {
469   os << "block_data{" << BC;
470   os << "; ";
471   for (BlockDataRegion::referenced_vars_iterator
472          I = referenced_vars_begin(),
473          E = referenced_vars_end(); I != E; ++I)
474     os << "(" << I.getCapturedRegion() << "," <<
475                  I.getOriginalRegion() << ") ";
476   os << '}';
477 }
478 
479 void CompoundLiteralRegion::dumpToStream(raw_ostream &os) const {
480   // FIXME: More elaborate pretty-printing.
481   os << "{ " << (const void*) CL <<  " }";
482 }
483 
484 void CXXTempObjectRegion::dumpToStream(raw_ostream &os) const {
485   os << "temp_object{" << getValueType().getAsString() << ','
486      << (const void*) Ex << '}';
487 }
488 
489 void CXXBaseObjectRegion::dumpToStream(raw_ostream &os) const {
490   os << "base{" << superRegion << ',' << getDecl()->getName() << '}';
491 }
492 
493 void CXXThisRegion::dumpToStream(raw_ostream &os) const {
494   os << "this";
495 }
496 
497 void ElementRegion::dumpToStream(raw_ostream &os) const {
498   os << "element{" << superRegion << ','
499      << Index << ',' << getElementType().getAsString() << '}';
500 }
501 
502 void FieldRegion::dumpToStream(raw_ostream &os) const {
503   os << superRegion << "->" << *getDecl();
504 }
505 
506 void ObjCIvarRegion::dumpToStream(raw_ostream &os) const {
507   os << "ivar{" << superRegion << ',' << *getDecl() << '}';
508 }
509 
510 void StringRegion::dumpToStream(raw_ostream &os) const {
511   Str->printPretty(os, 0, PrintingPolicy(getContext().getLangOpts()));
512 }
513 
514 void ObjCStringRegion::dumpToStream(raw_ostream &os) const {
515   Str->printPretty(os, 0, PrintingPolicy(getContext().getLangOpts()));
516 }
517 
518 void SymbolicRegion::dumpToStream(raw_ostream &os) const {
519   os << "SymRegion{" << sym << '}';
520 }
521 
522 void VarRegion::dumpToStream(raw_ostream &os) const {
523   os << *cast<VarDecl>(D);
524 }
525 
526 void RegionRawOffset::dump() const {
527   dumpToStream(llvm::errs());
528 }
529 
530 void RegionRawOffset::dumpToStream(raw_ostream &os) const {
531   os << "raw_offset{" << getRegion() << ',' << getOffset().getQuantity() << '}';
532 }
533 
534 void StaticGlobalSpaceRegion::dumpToStream(raw_ostream &os) const {
535   os << "StaticGlobalsMemSpace{" << CR << '}';
536 }
537 
538 void GlobalInternalSpaceRegion::dumpToStream(raw_ostream &os) const {
539   os << "GlobalInternalSpaceRegion";
540 }
541 
542 void GlobalSystemSpaceRegion::dumpToStream(raw_ostream &os) const {
543   os << "GlobalSystemSpaceRegion";
544 }
545 
546 void GlobalImmutableSpaceRegion::dumpToStream(raw_ostream &os) const {
547   os << "GlobalImmutableSpaceRegion";
548 }
549 
550 void HeapSpaceRegion::dumpToStream(raw_ostream &os) const {
551   os << "HeapSpaceRegion";
552 }
553 
554 void UnknownSpaceRegion::dumpToStream(raw_ostream &os) const {
555   os << "UnknownSpaceRegion";
556 }
557 
558 void StackArgumentsSpaceRegion::dumpToStream(raw_ostream &os) const {
559   os << "StackArgumentsSpaceRegion";
560 }
561 
562 void StackLocalsSpaceRegion::dumpToStream(raw_ostream &os) const {
563   os << "StackLocalsSpaceRegion";
564 }
565 
566 bool MemRegion::canPrintPretty() const {
567   return canPrintPrettyAsExpr();
568 }
569 
570 bool MemRegion::canPrintPrettyAsExpr() const {
571   return false;
572 }
573 
574 void MemRegion::printPretty(raw_ostream &os) const {
575   assert(canPrintPretty() && "This region cannot be printed pretty.");
576   os << "'";
577   printPrettyAsExpr(os);
578   os << "'";
579   return;
580 }
581 
582 void MemRegion::printPrettyAsExpr(raw_ostream &os) const {
583   llvm_unreachable("This region cannot be printed pretty.");
584   return;
585 }
586 
587 bool VarRegion::canPrintPrettyAsExpr() const {
588   return true;
589 }
590 
591 void VarRegion::printPrettyAsExpr(raw_ostream &os) const {
592   os << getDecl()->getName();
593 }
594 
595 bool ObjCIvarRegion::canPrintPrettyAsExpr() const {
596   return true;
597 }
598 
599 void ObjCIvarRegion::printPrettyAsExpr(raw_ostream &os) const {
600   os << getDecl()->getName();
601 }
602 
603 bool FieldRegion::canPrintPretty() const {
604   return true;
605 }
606 
607 bool FieldRegion::canPrintPrettyAsExpr() const {
608   return superRegion->canPrintPrettyAsExpr();
609 }
610 
611 void FieldRegion::printPrettyAsExpr(raw_ostream &os) const {
612   assert(canPrintPrettyAsExpr());
613   superRegion->printPrettyAsExpr(os);
614   os << "." << getDecl()->getName();
615 }
616 
617 void FieldRegion::printPretty(raw_ostream &os) const {
618   if (canPrintPrettyAsExpr()) {
619     os << "\'";
620     printPrettyAsExpr(os);
621     os << "'";
622   } else {
623     os << "field " << "\'" << getDecl()->getName() << "'";
624   }
625   return;
626 }
627 
628 bool CXXBaseObjectRegion::canPrintPrettyAsExpr() const {
629   return superRegion->canPrintPrettyAsExpr();
630 }
631 
632 void CXXBaseObjectRegion::printPrettyAsExpr(raw_ostream &os) const {
633   superRegion->printPrettyAsExpr(os);
634 }
635 
636 //===----------------------------------------------------------------------===//
637 // MemRegionManager methods.
638 //===----------------------------------------------------------------------===//
639 
640 template <typename REG>
641 const REG *MemRegionManager::LazyAllocate(REG*& region) {
642   if (!region) {
643     region = (REG*) A.Allocate<REG>();
644     new (region) REG(this);
645   }
646 
647   return region;
648 }
649 
650 template <typename REG, typename ARG>
651 const REG *MemRegionManager::LazyAllocate(REG*& region, ARG a) {
652   if (!region) {
653     region = (REG*) A.Allocate<REG>();
654     new (region) REG(this, a);
655   }
656 
657   return region;
658 }
659 
660 const StackLocalsSpaceRegion*
661 MemRegionManager::getStackLocalsRegion(const StackFrameContext *STC) {
662   assert(STC);
663   StackLocalsSpaceRegion *&R = StackLocalsSpaceRegions[STC];
664 
665   if (R)
666     return R;
667 
668   R = A.Allocate<StackLocalsSpaceRegion>();
669   new (R) StackLocalsSpaceRegion(this, STC);
670   return R;
671 }
672 
673 const StackArgumentsSpaceRegion *
674 MemRegionManager::getStackArgumentsRegion(const StackFrameContext *STC) {
675   assert(STC);
676   StackArgumentsSpaceRegion *&R = StackArgumentsSpaceRegions[STC];
677 
678   if (R)
679     return R;
680 
681   R = A.Allocate<StackArgumentsSpaceRegion>();
682   new (R) StackArgumentsSpaceRegion(this, STC);
683   return R;
684 }
685 
686 const GlobalsSpaceRegion
687 *MemRegionManager::getGlobalsRegion(MemRegion::Kind K,
688                                     const CodeTextRegion *CR) {
689   if (!CR) {
690     if (K == MemRegion::GlobalSystemSpaceRegionKind)
691       return LazyAllocate(SystemGlobals);
692     if (K == MemRegion::GlobalImmutableSpaceRegionKind)
693       return LazyAllocate(ImmutableGlobals);
694     assert(K == MemRegion::GlobalInternalSpaceRegionKind);
695     return LazyAllocate(InternalGlobals);
696   }
697 
698   assert(K == MemRegion::StaticGlobalSpaceRegionKind);
699   StaticGlobalSpaceRegion *&R = StaticsGlobalSpaceRegions[CR];
700   if (R)
701     return R;
702 
703   R = A.Allocate<StaticGlobalSpaceRegion>();
704   new (R) StaticGlobalSpaceRegion(this, CR);
705   return R;
706 }
707 
708 const HeapSpaceRegion *MemRegionManager::getHeapRegion() {
709   return LazyAllocate(heap);
710 }
711 
712 const MemSpaceRegion *MemRegionManager::getUnknownRegion() {
713   return LazyAllocate(unknown);
714 }
715 
716 const MemSpaceRegion *MemRegionManager::getCodeRegion() {
717   return LazyAllocate(code);
718 }
719 
720 //===----------------------------------------------------------------------===//
721 // Constructing regions.
722 //===----------------------------------------------------------------------===//
723 const StringRegion* MemRegionManager::getStringRegion(const StringLiteral* Str){
724   return getSubRegion<StringRegion>(Str, getGlobalsRegion());
725 }
726 
727 const ObjCStringRegion *
728 MemRegionManager::getObjCStringRegion(const ObjCStringLiteral* Str){
729   return getSubRegion<ObjCStringRegion>(Str, getGlobalsRegion());
730 }
731 
732 /// Look through a chain of LocationContexts to either find the
733 /// StackFrameContext that matches a DeclContext, or find a VarRegion
734 /// for a variable captured by a block.
735 static llvm::PointerUnion<const StackFrameContext *, const VarRegion *>
736 getStackOrCaptureRegionForDeclContext(const LocationContext *LC,
737                                       const DeclContext *DC,
738                                       const VarDecl *VD) {
739   while (LC) {
740     if (const StackFrameContext *SFC = dyn_cast<StackFrameContext>(LC)) {
741       if (cast<DeclContext>(SFC->getDecl()) == DC)
742         return SFC;
743     }
744     if (const BlockInvocationContext *BC =
745         dyn_cast<BlockInvocationContext>(LC)) {
746       const BlockDataRegion *BR =
747         static_cast<const BlockDataRegion*>(BC->getContextData());
748       // FIXME: This can be made more efficient.
749       for (BlockDataRegion::referenced_vars_iterator
750            I = BR->referenced_vars_begin(),
751            E = BR->referenced_vars_end(); I != E; ++I) {
752         if (const VarRegion *VR = dyn_cast<VarRegion>(I.getOriginalRegion()))
753           if (VR->getDecl() == VD)
754             return cast<VarRegion>(I.getCapturedRegion());
755       }
756     }
757 
758     LC = LC->getParent();
759   }
760   return (const StackFrameContext*)0;
761 }
762 
763 const VarRegion* MemRegionManager::getVarRegion(const VarDecl *D,
764                                                 const LocationContext *LC) {
765   const MemRegion *sReg = 0;
766 
767   if (D->hasGlobalStorage() && !D->isStaticLocal()) {
768 
769     // First handle the globals defined in system headers.
770     if (C.getSourceManager().isInSystemHeader(D->getLocation())) {
771       // Whitelist the system globals which often DO GET modified, assume the
772       // rest are immutable.
773       if (D->getName().find("errno") != StringRef::npos)
774         sReg = getGlobalsRegion(MemRegion::GlobalSystemSpaceRegionKind);
775       else
776         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
777 
778     // Treat other globals as GlobalInternal unless they are constants.
779     } else {
780       QualType GQT = D->getType();
781       const Type *GT = GQT.getTypePtrOrNull();
782       // TODO: We could walk the complex types here and see if everything is
783       // constified.
784       if (GT && GQT.isConstQualified() && GT->isArithmeticType())
785         sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
786       else
787         sReg = getGlobalsRegion();
788     }
789 
790   // Finally handle static locals.
791   } else {
792     // FIXME: Once we implement scope handling, we will need to properly lookup
793     // 'D' to the proper LocationContext.
794     const DeclContext *DC = D->getDeclContext();
795     llvm::PointerUnion<const StackFrameContext *, const VarRegion *> V =
796       getStackOrCaptureRegionForDeclContext(LC, DC, D);
797 
798     if (V.is<const VarRegion*>())
799       return V.get<const VarRegion*>();
800 
801     const StackFrameContext *STC = V.get<const StackFrameContext*>();
802 
803     if (!STC)
804       sReg = getUnknownRegion();
805     else {
806       if (D->hasLocalStorage()) {
807         sReg = isa<ParmVarDecl>(D) || isa<ImplicitParamDecl>(D)
808                ? static_cast<const MemRegion*>(getStackArgumentsRegion(STC))
809                : static_cast<const MemRegion*>(getStackLocalsRegion(STC));
810       }
811       else {
812         assert(D->isStaticLocal());
813         const Decl *STCD = STC->getDecl();
814         if (isa<FunctionDecl>(STCD) || isa<ObjCMethodDecl>(STCD))
815           sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
816                                   getFunctionTextRegion(cast<NamedDecl>(STCD)));
817         else if (const BlockDecl *BD = dyn_cast<BlockDecl>(STCD)) {
818           // FIXME: The fallback type here is totally bogus -- though it should
819           // never be queried, it will prevent uniquing with the real
820           // BlockTextRegion. Ideally we'd fix the AST so that we always had a
821           // signature.
822           QualType T;
823           if (const TypeSourceInfo *TSI = BD->getSignatureAsWritten())
824             T = TSI->getType();
825           else
826             T = getContext().getFunctionNoProtoType(getContext().VoidTy);
827 
828           const BlockTextRegion *BTR =
829             getBlockTextRegion(BD, C.getCanonicalType(T),
830                                STC->getAnalysisDeclContext());
831           sReg = getGlobalsRegion(MemRegion::StaticGlobalSpaceRegionKind,
832                                   BTR);
833         }
834         else {
835           sReg = getGlobalsRegion();
836         }
837       }
838     }
839   }
840 
841   return getSubRegion<VarRegion>(D, sReg);
842 }
843 
844 const VarRegion *MemRegionManager::getVarRegion(const VarDecl *D,
845                                                 const MemRegion *superR) {
846   return getSubRegion<VarRegion>(D, superR);
847 }
848 
849 const BlockDataRegion *
850 MemRegionManager::getBlockDataRegion(const BlockTextRegion *BC,
851                                      const LocationContext *LC,
852                                      unsigned blockCount) {
853   const MemRegion *sReg = 0;
854   const BlockDecl *BD = BC->getDecl();
855   if (!BD->hasCaptures()) {
856     // This handles 'static' blocks.
857     sReg = getGlobalsRegion(MemRegion::GlobalImmutableSpaceRegionKind);
858   }
859   else {
860     if (LC) {
861       // FIXME: Once we implement scope handling, we want the parent region
862       // to be the scope.
863       const StackFrameContext *STC = LC->getCurrentStackFrame();
864       assert(STC);
865       sReg = getStackLocalsRegion(STC);
866     }
867     else {
868       // We allow 'LC' to be NULL for cases where want BlockDataRegions
869       // without context-sensitivity.
870       sReg = getUnknownRegion();
871     }
872   }
873 
874   return getSubRegion<BlockDataRegion>(BC, LC, blockCount, sReg);
875 }
876 
877 const CXXTempObjectRegion *
878 MemRegionManager::getCXXStaticTempObjectRegion(const Expr *Ex) {
879   return getSubRegion<CXXTempObjectRegion>(
880       Ex, getGlobalsRegion(MemRegion::GlobalInternalSpaceRegionKind, NULL));
881 }
882 
883 const CompoundLiteralRegion*
884 MemRegionManager::getCompoundLiteralRegion(const CompoundLiteralExpr *CL,
885                                            const LocationContext *LC) {
886 
887   const MemRegion *sReg = 0;
888 
889   if (CL->isFileScope())
890     sReg = getGlobalsRegion();
891   else {
892     const StackFrameContext *STC = LC->getCurrentStackFrame();
893     assert(STC);
894     sReg = getStackLocalsRegion(STC);
895   }
896 
897   return getSubRegion<CompoundLiteralRegion>(CL, sReg);
898 }
899 
900 const ElementRegion*
901 MemRegionManager::getElementRegion(QualType elementType, NonLoc Idx,
902                                    const MemRegion* superRegion,
903                                    ASTContext &Ctx){
904 
905   QualType T = Ctx.getCanonicalType(elementType).getUnqualifiedType();
906 
907   llvm::FoldingSetNodeID ID;
908   ElementRegion::ProfileRegion(ID, T, Idx, superRegion);
909 
910   void *InsertPos;
911   MemRegion* data = Regions.FindNodeOrInsertPos(ID, InsertPos);
912   ElementRegion* R = cast_or_null<ElementRegion>(data);
913 
914   if (!R) {
915     R = (ElementRegion*) A.Allocate<ElementRegion>();
916     new (R) ElementRegion(T, Idx, superRegion);
917     Regions.InsertNode(R, InsertPos);
918   }
919 
920   return R;
921 }
922 
923 const FunctionTextRegion *
924 MemRegionManager::getFunctionTextRegion(const NamedDecl *FD) {
925   return getSubRegion<FunctionTextRegion>(FD, getCodeRegion());
926 }
927 
928 const BlockTextRegion *
929 MemRegionManager::getBlockTextRegion(const BlockDecl *BD, CanQualType locTy,
930                                      AnalysisDeclContext *AC) {
931   return getSubRegion<BlockTextRegion>(BD, locTy, AC, getCodeRegion());
932 }
933 
934 
935 /// getSymbolicRegion - Retrieve or create a "symbolic" memory region.
936 const SymbolicRegion *MemRegionManager::getSymbolicRegion(SymbolRef sym) {
937   return getSubRegion<SymbolicRegion>(sym, getUnknownRegion());
938 }
939 
940 const SymbolicRegion *MemRegionManager::getSymbolicHeapRegion(SymbolRef Sym) {
941   return getSubRegion<SymbolicRegion>(Sym, getHeapRegion());
942 }
943 
944 const FieldRegion*
945 MemRegionManager::getFieldRegion(const FieldDecl *d,
946                                  const MemRegion* superRegion){
947   return getSubRegion<FieldRegion>(d, superRegion);
948 }
949 
950 const ObjCIvarRegion*
951 MemRegionManager::getObjCIvarRegion(const ObjCIvarDecl *d,
952                                     const MemRegion* superRegion) {
953   return getSubRegion<ObjCIvarRegion>(d, superRegion);
954 }
955 
956 const CXXTempObjectRegion*
957 MemRegionManager::getCXXTempObjectRegion(Expr const *E,
958                                          LocationContext const *LC) {
959   const StackFrameContext *SFC = LC->getCurrentStackFrame();
960   assert(SFC);
961   return getSubRegion<CXXTempObjectRegion>(E, getStackLocalsRegion(SFC));
962 }
963 
964 /// Checks whether \p BaseClass is a valid virtual or direct non-virtual base
965 /// class of the type of \p Super.
966 static bool isValidBaseClass(const CXXRecordDecl *BaseClass,
967                              const TypedValueRegion *Super,
968                              bool IsVirtual) {
969   BaseClass = BaseClass->getCanonicalDecl();
970 
971   const CXXRecordDecl *Class = Super->getValueType()->getAsCXXRecordDecl();
972   if (!Class)
973     return true;
974 
975   if (IsVirtual)
976     return Class->isVirtuallyDerivedFrom(BaseClass);
977 
978   for (const auto &I : Class->bases()) {
979     if (I.getType()->getAsCXXRecordDecl()->getCanonicalDecl() == BaseClass)
980       return true;
981   }
982 
983   return false;
984 }
985 
986 const CXXBaseObjectRegion *
987 MemRegionManager::getCXXBaseObjectRegion(const CXXRecordDecl *RD,
988                                          const MemRegion *Super,
989                                          bool IsVirtual) {
990   if (isa<TypedValueRegion>(Super)) {
991     assert(isValidBaseClass(RD, dyn_cast<TypedValueRegion>(Super), IsVirtual));
992     (void)&isValidBaseClass;
993 
994     if (IsVirtual) {
995       // Virtual base regions should not be layered, since the layout rules
996       // are different.
997       while (const CXXBaseObjectRegion *Base =
998                dyn_cast<CXXBaseObjectRegion>(Super)) {
999         Super = Base->getSuperRegion();
1000       }
1001       assert(Super && !isa<MemSpaceRegion>(Super));
1002     }
1003   }
1004 
1005   return getSubRegion<CXXBaseObjectRegion>(RD, IsVirtual, Super);
1006 }
1007 
1008 const CXXThisRegion*
1009 MemRegionManager::getCXXThisRegion(QualType thisPointerTy,
1010                                    const LocationContext *LC) {
1011   const StackFrameContext *STC = LC->getCurrentStackFrame();
1012   assert(STC);
1013   const PointerType *PT = thisPointerTy->getAs<PointerType>();
1014   assert(PT);
1015   return getSubRegion<CXXThisRegion>(PT, getStackArgumentsRegion(STC));
1016 }
1017 
1018 const AllocaRegion*
1019 MemRegionManager::getAllocaRegion(const Expr *E, unsigned cnt,
1020                                   const LocationContext *LC) {
1021   const StackFrameContext *STC = LC->getCurrentStackFrame();
1022   assert(STC);
1023   return getSubRegion<AllocaRegion>(E, cnt, getStackLocalsRegion(STC));
1024 }
1025 
1026 const MemSpaceRegion *MemRegion::getMemorySpace() const {
1027   const MemRegion *R = this;
1028   const SubRegion* SR = dyn_cast<SubRegion>(this);
1029 
1030   while (SR) {
1031     R = SR->getSuperRegion();
1032     SR = dyn_cast<SubRegion>(R);
1033   }
1034 
1035   return dyn_cast<MemSpaceRegion>(R);
1036 }
1037 
1038 bool MemRegion::hasStackStorage() const {
1039   return isa<StackSpaceRegion>(getMemorySpace());
1040 }
1041 
1042 bool MemRegion::hasStackNonParametersStorage() const {
1043   return isa<StackLocalsSpaceRegion>(getMemorySpace());
1044 }
1045 
1046 bool MemRegion::hasStackParametersStorage() const {
1047   return isa<StackArgumentsSpaceRegion>(getMemorySpace());
1048 }
1049 
1050 bool MemRegion::hasGlobalsOrParametersStorage() const {
1051   const MemSpaceRegion *MS = getMemorySpace();
1052   return isa<StackArgumentsSpaceRegion>(MS) ||
1053          isa<GlobalsSpaceRegion>(MS);
1054 }
1055 
1056 // getBaseRegion strips away all elements and fields, and get the base region
1057 // of them.
1058 const MemRegion *MemRegion::getBaseRegion() const {
1059   const MemRegion *R = this;
1060   while (true) {
1061     switch (R->getKind()) {
1062       case MemRegion::ElementRegionKind:
1063       case MemRegion::FieldRegionKind:
1064       case MemRegion::ObjCIvarRegionKind:
1065       case MemRegion::CXXBaseObjectRegionKind:
1066         R = cast<SubRegion>(R)->getSuperRegion();
1067         continue;
1068       default:
1069         break;
1070     }
1071     break;
1072   }
1073   return R;
1074 }
1075 
1076 bool MemRegion::isSubRegionOf(const MemRegion *R) const {
1077   return false;
1078 }
1079 
1080 //===----------------------------------------------------------------------===//
1081 // View handling.
1082 //===----------------------------------------------------------------------===//
1083 
1084 const MemRegion *MemRegion::StripCasts(bool StripBaseCasts) const {
1085   const MemRegion *R = this;
1086   while (true) {
1087     switch (R->getKind()) {
1088     case ElementRegionKind: {
1089       const ElementRegion *ER = cast<ElementRegion>(R);
1090       if (!ER->getIndex().isZeroConstant())
1091         return R;
1092       R = ER->getSuperRegion();
1093       break;
1094     }
1095     case CXXBaseObjectRegionKind:
1096       if (!StripBaseCasts)
1097         return R;
1098       R = cast<CXXBaseObjectRegion>(R)->getSuperRegion();
1099       break;
1100     default:
1101       return R;
1102     }
1103   }
1104 }
1105 
1106 const SymbolicRegion *MemRegion::getSymbolicBase() const {
1107   const SubRegion *SubR = dyn_cast<SubRegion>(this);
1108 
1109   while (SubR) {
1110     if (const SymbolicRegion *SymR = dyn_cast<SymbolicRegion>(SubR))
1111       return SymR;
1112     SubR = dyn_cast<SubRegion>(SubR->getSuperRegion());
1113   }
1114   return 0;
1115 }
1116 
1117 // FIXME: Merge with the implementation of the same method in Store.cpp
1118 static bool IsCompleteType(ASTContext &Ctx, QualType Ty) {
1119   if (const RecordType *RT = Ty->getAs<RecordType>()) {
1120     const RecordDecl *D = RT->getDecl();
1121     if (!D->getDefinition())
1122       return false;
1123   }
1124 
1125   return true;
1126 }
1127 
1128 RegionRawOffset ElementRegion::getAsArrayOffset() const {
1129   CharUnits offset = CharUnits::Zero();
1130   const ElementRegion *ER = this;
1131   const MemRegion *superR = NULL;
1132   ASTContext &C = getContext();
1133 
1134   // FIXME: Handle multi-dimensional arrays.
1135 
1136   while (ER) {
1137     superR = ER->getSuperRegion();
1138 
1139     // FIXME: generalize to symbolic offsets.
1140     SVal index = ER->getIndex();
1141     if (Optional<nonloc::ConcreteInt> CI = index.getAs<nonloc::ConcreteInt>()) {
1142       // Update the offset.
1143       int64_t i = CI->getValue().getSExtValue();
1144 
1145       if (i != 0) {
1146         QualType elemType = ER->getElementType();
1147 
1148         // If we are pointing to an incomplete type, go no further.
1149         if (!IsCompleteType(C, elemType)) {
1150           superR = ER;
1151           break;
1152         }
1153 
1154         CharUnits size = C.getTypeSizeInChars(elemType);
1155         offset += (i * size);
1156       }
1157 
1158       // Go to the next ElementRegion (if any).
1159       ER = dyn_cast<ElementRegion>(superR);
1160       continue;
1161     }
1162 
1163     return NULL;
1164   }
1165 
1166   assert(superR && "super region cannot be NULL");
1167   return RegionRawOffset(superR, offset);
1168 }
1169 
1170 
1171 /// Returns true if \p Base is an immediate base class of \p Child
1172 static bool isImmediateBase(const CXXRecordDecl *Child,
1173                             const CXXRecordDecl *Base) {
1174   // Note that we do NOT canonicalize the base class here, because
1175   // ASTRecordLayout doesn't either. If that leads us down the wrong path,
1176   // so be it; at least we won't crash.
1177   for (const auto &I : Child->bases()) {
1178     if (I.getType()->getAsCXXRecordDecl() == Base)
1179       return true;
1180   }
1181 
1182   return false;
1183 }
1184 
1185 RegionOffset MemRegion::getAsOffset() const {
1186   const MemRegion *R = this;
1187   const MemRegion *SymbolicOffsetBase = 0;
1188   int64_t Offset = 0;
1189 
1190   while (1) {
1191     switch (R->getKind()) {
1192     case GenericMemSpaceRegionKind:
1193     case StackLocalsSpaceRegionKind:
1194     case StackArgumentsSpaceRegionKind:
1195     case HeapSpaceRegionKind:
1196     case UnknownSpaceRegionKind:
1197     case StaticGlobalSpaceRegionKind:
1198     case GlobalInternalSpaceRegionKind:
1199     case GlobalSystemSpaceRegionKind:
1200     case GlobalImmutableSpaceRegionKind:
1201       // Stores can bind directly to a region space to set a default value.
1202       assert(Offset == 0 && !SymbolicOffsetBase);
1203       goto Finish;
1204 
1205     case FunctionTextRegionKind:
1206     case BlockTextRegionKind:
1207     case BlockDataRegionKind:
1208       // These will never have bindings, but may end up having values requested
1209       // if the user does some strange casting.
1210       if (Offset != 0)
1211         SymbolicOffsetBase = R;
1212       goto Finish;
1213 
1214     case SymbolicRegionKind:
1215     case AllocaRegionKind:
1216     case CompoundLiteralRegionKind:
1217     case CXXThisRegionKind:
1218     case StringRegionKind:
1219     case ObjCStringRegionKind:
1220     case VarRegionKind:
1221     case CXXTempObjectRegionKind:
1222       // Usual base regions.
1223       goto Finish;
1224 
1225     case ObjCIvarRegionKind:
1226       // This is a little strange, but it's a compromise between
1227       // ObjCIvarRegions having unknown compile-time offsets (when using the
1228       // non-fragile runtime) and yet still being distinct, non-overlapping
1229       // regions. Thus we treat them as "like" base regions for the purposes
1230       // of computing offsets.
1231       goto Finish;
1232 
1233     case CXXBaseObjectRegionKind: {
1234       const CXXBaseObjectRegion *BOR = cast<CXXBaseObjectRegion>(R);
1235       R = BOR->getSuperRegion();
1236 
1237       QualType Ty;
1238       bool RootIsSymbolic = false;
1239       if (const TypedValueRegion *TVR = dyn_cast<TypedValueRegion>(R)) {
1240         Ty = TVR->getDesugaredValueType(getContext());
1241       } else if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(R)) {
1242         // If our base region is symbolic, we don't know what type it really is.
1243         // Pretend the type of the symbol is the true dynamic type.
1244         // (This will at least be self-consistent for the life of the symbol.)
1245         Ty = SR->getSymbol()->getType()->getPointeeType();
1246         RootIsSymbolic = true;
1247       }
1248 
1249       const CXXRecordDecl *Child = Ty->getAsCXXRecordDecl();
1250       if (!Child) {
1251         // We cannot compute the offset of the base class.
1252         SymbolicOffsetBase = R;
1253       }
1254 
1255       if (RootIsSymbolic) {
1256         // Base layers on symbolic regions may not be type-correct.
1257         // Double-check the inheritance here, and revert to a symbolic offset
1258         // if it's invalid (e.g. due to a reinterpret_cast).
1259         if (BOR->isVirtual()) {
1260           if (!Child->isVirtuallyDerivedFrom(BOR->getDecl()))
1261             SymbolicOffsetBase = R;
1262         } else {
1263           if (!isImmediateBase(Child, BOR->getDecl()))
1264             SymbolicOffsetBase = R;
1265         }
1266       }
1267 
1268       // Don't bother calculating precise offsets if we already have a
1269       // symbolic offset somewhere in the chain.
1270       if (SymbolicOffsetBase)
1271         continue;
1272 
1273       CharUnits BaseOffset;
1274       const ASTRecordLayout &Layout = getContext().getASTRecordLayout(Child);
1275       if (BOR->isVirtual())
1276         BaseOffset = Layout.getVBaseClassOffset(BOR->getDecl());
1277       else
1278         BaseOffset = Layout.getBaseClassOffset(BOR->getDecl());
1279 
1280       // The base offset is in chars, not in bits.
1281       Offset += BaseOffset.getQuantity() * getContext().getCharWidth();
1282       break;
1283     }
1284     case ElementRegionKind: {
1285       const ElementRegion *ER = cast<ElementRegion>(R);
1286       R = ER->getSuperRegion();
1287 
1288       QualType EleTy = ER->getValueType();
1289       if (!IsCompleteType(getContext(), EleTy)) {
1290         // We cannot compute the offset of the base class.
1291         SymbolicOffsetBase = R;
1292         continue;
1293       }
1294 
1295       SVal Index = ER->getIndex();
1296       if (Optional<nonloc::ConcreteInt> CI =
1297               Index.getAs<nonloc::ConcreteInt>()) {
1298         // Don't bother calculating precise offsets if we already have a
1299         // symbolic offset somewhere in the chain.
1300         if (SymbolicOffsetBase)
1301           continue;
1302 
1303         int64_t i = CI->getValue().getSExtValue();
1304         // This type size is in bits.
1305         Offset += i * getContext().getTypeSize(EleTy);
1306       } else {
1307         // We cannot compute offset for non-concrete index.
1308         SymbolicOffsetBase = R;
1309       }
1310       break;
1311     }
1312     case FieldRegionKind: {
1313       const FieldRegion *FR = cast<FieldRegion>(R);
1314       R = FR->getSuperRegion();
1315 
1316       const RecordDecl *RD = FR->getDecl()->getParent();
1317       if (RD->isUnion() || !RD->isCompleteDefinition()) {
1318         // We cannot compute offset for incomplete type.
1319         // For unions, we could treat everything as offset 0, but we'd rather
1320         // treat each field as a symbolic offset so they aren't stored on top
1321         // of each other, since we depend on things in typed regions actually
1322         // matching their types.
1323         SymbolicOffsetBase = R;
1324       }
1325 
1326       // Don't bother calculating precise offsets if we already have a
1327       // symbolic offset somewhere in the chain.
1328       if (SymbolicOffsetBase)
1329         continue;
1330 
1331       // Get the field number.
1332       unsigned idx = 0;
1333       for (RecordDecl::field_iterator FI = RD->field_begin(),
1334              FE = RD->field_end(); FI != FE; ++FI, ++idx)
1335         if (FR->getDecl() == *FI)
1336           break;
1337 
1338       const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
1339       // This is offset in bits.
1340       Offset += Layout.getFieldOffset(idx);
1341       break;
1342     }
1343     }
1344   }
1345 
1346  Finish:
1347   if (SymbolicOffsetBase)
1348     return RegionOffset(SymbolicOffsetBase, RegionOffset::Symbolic);
1349   return RegionOffset(R, Offset);
1350 }
1351 
1352 //===----------------------------------------------------------------------===//
1353 // BlockDataRegion
1354 //===----------------------------------------------------------------------===//
1355 
1356 std::pair<const VarRegion *, const VarRegion *>
1357 BlockDataRegion::getCaptureRegions(const VarDecl *VD) {
1358   MemRegionManager &MemMgr = *getMemRegionManager();
1359   const VarRegion *VR = 0;
1360   const VarRegion *OriginalVR = 0;
1361 
1362   if (!VD->hasAttr<BlocksAttr>() && VD->hasLocalStorage()) {
1363     VR = MemMgr.getVarRegion(VD, this);
1364     OriginalVR = MemMgr.getVarRegion(VD, LC);
1365   }
1366   else {
1367     if (LC) {
1368       VR = MemMgr.getVarRegion(VD, LC);
1369       OriginalVR = VR;
1370     }
1371     else {
1372       VR = MemMgr.getVarRegion(VD, MemMgr.getUnknownRegion());
1373       OriginalVR = MemMgr.getVarRegion(VD, LC);
1374     }
1375   }
1376   return std::make_pair(VR, OriginalVR);
1377 }
1378 
1379 void BlockDataRegion::LazyInitializeReferencedVars() {
1380   if (ReferencedVars)
1381     return;
1382 
1383   AnalysisDeclContext *AC = getCodeRegion()->getAnalysisDeclContext();
1384   AnalysisDeclContext::referenced_decls_iterator I, E;
1385   std::tie(I, E) = AC->getReferencedBlockVars(BC->getDecl());
1386 
1387   if (I == E) {
1388     ReferencedVars = (void*) 0x1;
1389     return;
1390   }
1391 
1392   MemRegionManager &MemMgr = *getMemRegionManager();
1393   llvm::BumpPtrAllocator &A = MemMgr.getAllocator();
1394   BumpVectorContext BC(A);
1395 
1396   typedef BumpVector<const MemRegion*> VarVec;
1397   VarVec *BV = (VarVec*) A.Allocate<VarVec>();
1398   new (BV) VarVec(BC, E - I);
1399   VarVec *BVOriginal = (VarVec*) A.Allocate<VarVec>();
1400   new (BVOriginal) VarVec(BC, E - I);
1401 
1402   for ( ; I != E; ++I) {
1403     const VarRegion *VR = 0;
1404     const VarRegion *OriginalVR = 0;
1405     std::tie(VR, OriginalVR) = getCaptureRegions(*I);
1406     assert(VR);
1407     assert(OriginalVR);
1408     BV->push_back(VR, BC);
1409     BVOriginal->push_back(OriginalVR, BC);
1410   }
1411 
1412   ReferencedVars = BV;
1413   OriginalVars = BVOriginal;
1414 }
1415 
1416 BlockDataRegion::referenced_vars_iterator
1417 BlockDataRegion::referenced_vars_begin() const {
1418   const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
1419 
1420   BumpVector<const MemRegion*> *Vec =
1421     static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);
1422 
1423   if (Vec == (void*) 0x1)
1424     return BlockDataRegion::referenced_vars_iterator(0, 0);
1425 
1426   BumpVector<const MemRegion*> *VecOriginal =
1427     static_cast<BumpVector<const MemRegion*>*>(OriginalVars);
1428 
1429   return BlockDataRegion::referenced_vars_iterator(Vec->begin(),
1430                                                    VecOriginal->begin());
1431 }
1432 
1433 BlockDataRegion::referenced_vars_iterator
1434 BlockDataRegion::referenced_vars_end() const {
1435   const_cast<BlockDataRegion*>(this)->LazyInitializeReferencedVars();
1436 
1437   BumpVector<const MemRegion*> *Vec =
1438     static_cast<BumpVector<const MemRegion*>*>(ReferencedVars);
1439 
1440   if (Vec == (void*) 0x1)
1441     return BlockDataRegion::referenced_vars_iterator(0, 0);
1442 
1443   BumpVector<const MemRegion*> *VecOriginal =
1444     static_cast<BumpVector<const MemRegion*>*>(OriginalVars);
1445 
1446   return BlockDataRegion::referenced_vars_iterator(Vec->end(),
1447                                                    VecOriginal->end());
1448 }
1449 
1450 const VarRegion *BlockDataRegion::getOriginalRegion(const VarRegion *R) const {
1451   for (referenced_vars_iterator I = referenced_vars_begin(),
1452                                 E = referenced_vars_end();
1453        I != E; ++I) {
1454     if (I.getCapturedRegion() == R)
1455       return I.getOriginalRegion();
1456   }
1457   return 0;
1458 }
1459 
1460 //===----------------------------------------------------------------------===//
1461 // RegionAndSymbolInvalidationTraits
1462 //===----------------------------------------------------------------------===//
1463 
1464 void RegionAndSymbolInvalidationTraits::setTrait(SymbolRef Sym,
1465                                                  InvalidationKinds IK) {
1466   SymTraitsMap[Sym] |= IK;
1467 }
1468 
1469 void RegionAndSymbolInvalidationTraits::setTrait(const MemRegion *MR,
1470                                                  InvalidationKinds IK) {
1471   assert(MR);
1472   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
1473     setTrait(SR->getSymbol(), IK);
1474   else
1475     MRTraitsMap[MR] |= IK;
1476 }
1477 
1478 bool RegionAndSymbolInvalidationTraits::hasTrait(SymbolRef Sym,
1479                                                  InvalidationKinds IK) {
1480   const_symbol_iterator I = SymTraitsMap.find(Sym);
1481   if (I != SymTraitsMap.end())
1482     return I->second & IK;
1483 
1484   return false;
1485 }
1486 
1487 bool RegionAndSymbolInvalidationTraits::hasTrait(const MemRegion *MR,
1488                                                  InvalidationKinds IK) {
1489   if (!MR)
1490     return false;
1491 
1492   if (const SymbolicRegion *SR = dyn_cast<SymbolicRegion>(MR))
1493     return hasTrait(SR->getSymbol(), IK);
1494 
1495   const_region_iterator I = MRTraitsMap.find(MR);
1496   if (I != MRTraitsMap.end())
1497     return I->second & IK;
1498 
1499   return false;
1500 }
1501