Index: clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h =================================================================== --- clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h +++ clang/include/clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h @@ -83,6 +83,31 @@ /// It's false, if and only if we expect a single identifier, such as /// `getenv`. It's true for `std::swap`, or `my::detail::container::data`. bool hasQualifiedNameParts() const { return QualifiedName.size() > 1; } + + /// Returns true if the CallEvent is a call to a function that matches + /// the CallDescription. + /// + /// Note that this function is not intended to be used to match Obj-C method + /// calls. + /// Note that you should very much not use these overloads. Use the + /// CallDescriptionMap even for matching a single Call signature. It provides + /// caching for subsequent lookups. + bool matches(const CallEvent &Call) const; + + /// Returns true whether the CallEvent is any of the CallDescriptions supplied + /// as a parameter. + template + static bool matches(const CallEvent &Call, const FirstCallDesc &First, + const CallDescs &...Rest) { + static_assert(std::is_same::value, ""); + if (First.matches(Call)) + return true; + return matches(Call, Rest...); + } + template <> + bool matches(const CallEvent &Call, const CallDescription &First) { + return First.matches(Call); + } }; /// An immutable map from CallDescriptions to arbitrary data. Provides a unified @@ -113,7 +138,7 @@ // Slow path: linear lookup. // TODO: Implement some sort of fast path. for (const std::pair &I : LinearMap) - if (Call.isCalled(I.first)) + if (I.first.matches(Call)) return &I.second; return nullptr; Index: clang/lib/StaticAnalyzer/Core/CallDescription.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/CallDescription.cpp +++ clang/lib/StaticAnalyzer/Core/CallDescription.cpp @@ -14,6 +14,7 @@ #include "clang/StaticAnalyzer/Core/PathSensitive/CallDescription.h" #include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h" +#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" #include "llvm/ADT/ArrayRef.h" #include "llvm/ADT/Optional.h" @@ -46,3 +47,85 @@ Optional RequiredArgs /*= None*/, Optional RequiredParams /*= None*/) : CallDescription(0, QualifiedName, RequiredArgs, RequiredParams) {} + +bool ento::CallDescription::matches(const CallEvent &Call) const { + // FIXME: Add ObjC Message support. + if (Call.getKind() == CE_ObjCMessage) + return false; + + const auto *FD = dyn_cast_or_null(Call.getDecl()); + if (!FD) + return false; + + if (Flags & CDF_MaybeBuiltin) { + return CheckerContext::isCLibraryFunction(FD, getFunctionName()) && + (!RequiredArgs || RequiredArgs <= Call.getNumArgs()) && + (!RequiredParams || RequiredParams <= Call.parameters().size()); + } + + if (!II.hasValue()) { + II = &Call.getState()->getStateManager().getContext().Idents.get( + getFunctionName()); + } + + const auto MatchNameOnly = [](const CallDescription &CD, + const NamedDecl *ND) -> bool { + DeclarationName Name = ND->getDeclName(); + if (const auto *II = Name.getAsIdentifierInfo()) + return II == CD.II.getValue(); // Fast case. + + // Fallback to the slow stringification and comparison for: + // C++ overloaded operators, constructors, destructors, etc. + // FIXME This comparison is way SLOWER than comparing pointers. + // At some point in the future, we should compare FunctionDecl pointers. + return Name.getAsString() == CD.getFunctionName(); + }; + + const auto ExactMatchArgAndParamCounts = + [](const CallEvent &Call, const CallDescription &CD) -> bool { + const bool ArgsMatch = + !CD.RequiredArgs || CD.RequiredArgs == Call.getNumArgs(); + const bool ParamsMatch = + !CD.RequiredParams || CD.RequiredParams == Call.parameters().size(); + return ArgsMatch && ParamsMatch; + }; + + const auto MatchQualifiedNameParts = [](const CallDescription &CD, + const Decl *D) -> bool { + const auto FindNextNamespaceOrRecord = + [](const DeclContext *Ctx) -> const DeclContext * { + while (Ctx && !isa(Ctx)) + Ctx = Ctx->getParent(); + return Ctx; + }; + + auto QualifierPartsIt = CD.begin_qualified_name_parts(); + const auto QualifierPartsEndIt = CD.end_qualified_name_parts(); + + // Match namespace and record names. Skip unrelated names if they don't + // match. + const DeclContext *Ctx = FindNextNamespaceOrRecord(D->getDeclContext()); + for (; Ctx && QualifierPartsIt != QualifierPartsEndIt; + Ctx = FindNextNamespaceOrRecord(Ctx->getParent())) { + // If not matched just continue and try matching for the next one. + if (cast(Ctx)->getName() != *QualifierPartsIt) + continue; + ++QualifierPartsIt; + } + + // We matched if we consumed all expected qualifier segments. + return QualifierPartsIt == QualifierPartsEndIt; + }; + + // Let's start matching... + if (!ExactMatchArgAndParamCounts(Call, *this)) + return false; + + if (!MatchNameOnly(*this, FD)) + return false; + + if (!hasQualifiedNameParts()) + return true; + + return MatchQualifiedNameParts(*this, FD); +} Index: clang/lib/StaticAnalyzer/Core/CallEvent.cpp =================================================================== --- clang/lib/StaticAnalyzer/Core/CallEvent.cpp +++ clang/lib/StaticAnalyzer/Core/CallEvent.cpp @@ -304,85 +304,7 @@ } bool CallEvent::isCalled(const CallDescription &CD) const { - // FIXME: Add ObjC Message support. - if (getKind() == CE_ObjCMessage) - return false; - - const auto *FD = dyn_cast_or_null(getDecl()); - if (!FD) - return false; - - if (CD.Flags & CDF_MaybeBuiltin) { - return CheckerContext::isCLibraryFunction(FD, CD.getFunctionName()) && - (!CD.RequiredArgs || CD.RequiredArgs <= getNumArgs()) && - (!CD.RequiredParams || CD.RequiredParams <= parameters().size()); - } - - if (!CD.II.hasValue()) { - CD.II = &getState()->getStateManager().getContext().Idents.get( - CD.getFunctionName()); - } - - const auto MatchNameOnly = [](const CallDescription &CD, - const NamedDecl *ND) -> bool { - DeclarationName Name = ND->getDeclName(); - if (const auto *II = Name.getAsIdentifierInfo()) - return II == CD.II.getValue(); // Fast case. - - // Fallback to the slow stringification and comparison for: - // C++ overloaded operators, constructors, destructors, etc. - // FIXME This comparison is way SLOWER than comparing pointers. - // At some point in the future, we should compare FunctionDecl pointers. - return Name.getAsString() == CD.getFunctionName(); - }; - - const auto ExactMatchArgAndParamCounts = - [](const CallEvent &Call, const CallDescription &CD) -> bool { - const bool ArgsMatch = - !CD.RequiredArgs || CD.RequiredArgs == Call.getNumArgs(); - const bool ParamsMatch = - !CD.RequiredParams || CD.RequiredParams == Call.parameters().size(); - return ArgsMatch && ParamsMatch; - }; - - const auto MatchQualifiedNameParts = [](const CallDescription &CD, - const Decl *D) -> bool { - const auto FindNextNamespaceOrRecord = - [](const DeclContext *Ctx) -> const DeclContext * { - while (Ctx && !isa(Ctx)) - Ctx = Ctx->getParent(); - return Ctx; - }; - - auto QualifierPartsIt = CD.begin_qualified_name_parts(); - const auto QualifierPartsEndIt = CD.end_qualified_name_parts(); - - // Match namespace and record names. Skip unrelated names if they don't - // match. - const DeclContext *Ctx = FindNextNamespaceOrRecord(D->getDeclContext()); - for (; Ctx && QualifierPartsIt != QualifierPartsEndIt; - Ctx = FindNextNamespaceOrRecord(Ctx->getParent())) { - // If not matched just continue and try matching for the next one. - if (cast(Ctx)->getName() != *QualifierPartsIt) - continue; - ++QualifierPartsIt; - } - - // We matched if we consumed all expected qualifier segments. - return QualifierPartsIt == QualifierPartsEndIt; - }; - - // Let's start matching... - if (!ExactMatchArgAndParamCounts(*this, CD)) - return false; - - if (!MatchNameOnly(CD, FD)) - return false; - - if (!CD.hasQualifiedNameParts()) - return true; - - return MatchQualifiedNameParts(CD, FD); + return CD.matches(*this); } SVal CallEvent::getArgSVal(unsigned Index) const {