[analyzer] NFC: Use construction contexts for finding the target region for the construction.

[NoQ]

Summary

Previously, we were scanning the CFG forward in order to find out which CFG element contains the expression which is being initialized by the current constructor. Now we have all the context that we needed directly in the CFG (woohoo). As shown in the previous patches in the stack of patches, the new context thing is pretty easy to extend to more cases that we previously didn't support at all. More refactoring would follow soon.

[NoQ]

Rebase.

[NoQ]

Rebase.

include/clang/Analysis/CFG.h

const ConstructionContext *getPersistentCopy(BumpVectorContext &C) const {
     ConstructionContext *CC = C.getAllocator().Allocate<ConstructionContext>();
     *CC = *this;
     return CC;
   }
 
   const CXXConstructExpr *getConstructor() const {
     return Constructor;
   }
+  TriggerTy getTrigger() const {
+    return Trigger;
+  }
   const Stmt *getTriggerStmt() const {
     return Trigger.dyn_cast<Stmt *>();
   }
   const CXXCtorInitializer *getTriggerInit() const {
     return Trigger.dyn_cast<CXXCtorInitializer *>();
   }
 
 private:
public:
   const CXXConstructExpr *getConstructor() const {
     return getConstructionContext()->getConstructor();;
   }
 
   QualType getType() const {
     return getConstructor()->getType();
   }
 
+  ConstructionContext::TriggerTy getTrigger() const {
+    return getConstructionContext()->getTrigger();
+  }
+
   const Stmt *getTriggerStmt() const {
     return getConstructionContext()->getTriggerStmt();
   }
 
   const CXXCtorInitializer *getTriggerInit() const {
     return getConstructionContext()->getTriggerInit();
   }
 

include/clang/StaticAnalyzer/Core/PathSensitive/ExprEngine.h

private:
 
   /// For a DeclStmt or CXXInitCtorInitializer, walk backward in the current CFG
   /// block to find the constructor expression that directly constructed into
   /// the storage for this statement. Returns null if the constructor for this
   /// statement created a temporary object region rather than directly
   /// constructing into an existing region.
   const CXXConstructExpr *findDirectConstructorForCurrentCFGElement();
 
-  /// For a CXXConstructExpr, walk forward in the current CFG block to find the
-  /// CFGElement for the DeclStmt or CXXInitCtorInitializer or CXXNewExpr which
-  /// is directly constructed by this constructor. Returns None if the current
-  /// constructor expression did not directly construct into an existing
-  /// region.
-  Optional<CFGElement> findElementDirectlyInitializedByCurrentConstructor();
-
   /// For a given constructor, look forward in the current CFG block to
   /// determine the region into which an object will be constructed by \p CE.
   /// When the lookahead fails, a temporary region is returned, and the
   /// IsConstructorWithImproperlyModeledTargetRegion flag is set in \p CallOpts.
   const MemRegion *getRegionForConstructedObject(const CXXConstructExpr *CE,
                                                  ExplodedNode *Pred,
                                                  EvalCallOptions &CallOpts);
 

lib/StaticAnalyzer/Core/ExprEngineCXX.cpp

 
 const MemRegion *
 ExprEngine::getRegionForConstructedObject(const CXXConstructExpr *CE,
                                           ExplodedNode *Pred,
                                           EvalCallOptions &CallOpts) {
   const LocationContext *LCtx = Pred->getLocationContext();
   ProgramStateRef State = Pred->getState();
 
-  // See if we're constructing an existing region by looking at the next
-  // element in the CFG.
-
-  if (auto Elem = findElementDirectlyInitializedByCurrentConstructor()) {
-    if (Optional<CFGStmt> StmtElem = Elem->getAs<CFGStmt>()) {
-      if (const CXXNewExpr *CNE = dyn_cast<CXXNewExpr>(StmtElem->getStmt())) {
+  // See if we're constructing an existing region by looking at the
+  // current construction context.
+  const NodeBuilderContext &CurrBldrCtx = getBuilderContext();
+  const CFGBlock *B = CurrBldrCtx.getBlock();
+  const CFGElement &E = (*B)[currStmtIdx];
+  if (auto CC = E.getAs<CFGConstructor>()) {
+    if (const Stmt *TriggerStmt = CC->getTriggerStmt()) {
+      if (const CXXNewExpr *CNE = dyn_cast<CXXNewExpr>(TriggerStmt)) {
         if (AMgr.getAnalyzerOptions().mayInlineCXXAllocator()) {
           // TODO: Detect when the allocator returns a null pointer.
           // Constructor shall not be called in this case.
           if (const SubRegion *MR = dyn_cast_or_null<SubRegion>(
                   getCXXNewAllocatorValue(State, CNE, LCtx).getAsRegion())) {
             if (CNE->isArray()) {
               // TODO: In fact, we need to call the constructor for every
               // allocated element, not just the first one!
               CallOpts.IsArrayConstructorOrDestructor = true;
               return getStoreManager().GetElementZeroRegion(
                   MR, CNE->getType()->getPointeeType());
             }
             return MR;
           }
         }
-      } else if (auto *DS = dyn_cast<DeclStmt>(StmtElem->getStmt())) {
+      } else if (auto *DS = dyn_cast<DeclStmt>(TriggerStmt)) {
         if (const auto *Var = dyn_cast<VarDecl>(DS->getSingleDecl())) {
           if (Var->getInit() && Var->getInit()->IgnoreImplicit() == CE) {
             SVal LValue = State->getLValue(Var, LCtx);
             QualType Ty = Var->getType();
             LValue = makeZeroElementRegion(State, LValue, Ty, CallOpts);
             return LValue.getAsRegion();
           }
         }
-      } else {
-        llvm_unreachable("Unexpected directly initialized element!");
       }
-    } else if (Optional<CFGInitializer> InitElem = Elem->getAs<CFGInitializer>()) {
-      const CXXCtorInitializer *Init = InitElem->getInitializer();
+      // TODO: Consider other directly initialized elements.
+    } else if (const CXXCtorInitializer *Init = CC->getTriggerInit()) {
       assert(Init->isAnyMemberInitializer());
       const CXXMethodDecl *CurCtor = cast<CXXMethodDecl>(LCtx->getDecl());
       Loc ThisPtr =
       getSValBuilder().getCXXThis(CurCtor, LCtx->getCurrentStackFrame());
       SVal ThisVal = State->getSVal(ThisPtr);
 
       const ValueDecl *Field;
       SVal FieldVal;
ExprEngine::getRegionForConstructedObject(const CXXConstructExpr *CE,
   }
   // If we couldn't find an existing region to construct into, assume we're
   // constructing a temporary. Notify the caller of our failure.
   CallOpts.IsConstructorWithImproperlyModeledTargetRegion = true;
   MemRegionManager &MRMgr = getSValBuilder().getRegionManager();
   return MRMgr.getCXXTempObjectRegion(CE, LCtx);
 }
 
-/// Returns true if the initializer for \Elem can be a direct
-/// constructor.
-static bool canHaveDirectConstructor(CFGElement Elem){
-  // DeclStmts and CXXCtorInitializers for fields can be directly constructed.
-
-  if (Optional<CFGStmt> StmtElem = Elem.getAs<CFGStmt>()) {
-    if (isa<DeclStmt>(StmtElem->getStmt())) {
-      return true;
-    }
-    if (isa<CXXNewExpr>(StmtElem->getStmt())) {
-      return true;
-    }
-  }
-
-  if (Elem.getKind() == CFGElement::Initializer) {
-    return true;
-  }
-
-  return false;
-}
-
-Optional<CFGElement>
-ExprEngine::findElementDirectlyInitializedByCurrentConstructor() {
-  const NodeBuilderContext &CurrBldrCtx = getBuilderContext();
-  // See if we're constructing an existing region by looking at the next
-  // element in the CFG.
-  const CFGBlock *B = CurrBldrCtx.getBlock();
-  // TODO: Retrieve construction target from CFGConstructor directly.
-  assert(
-      (*B)[currStmtIdx].getAs<CFGConstructor>() ||
-      isa<CXXConstructExpr>(((*B)[currStmtIdx]).castAs<CFGStmt>().getStmt()));
-  unsigned int NextStmtIdx = currStmtIdx + 1;
-  if (NextStmtIdx >= B->size())
-    return None;
-
-  CFGElement Next = (*B)[NextStmtIdx];
-
-  // Is this a destructor? If so, we might be in the middle of an assignment
-  // to a local or member: look ahead one more element to see what we find.
-  while (Next.getAs<CFGImplicitDtor>() && NextStmtIdx + 1 < B->size()) {
-    ++NextStmtIdx;
-    Next = (*B)[NextStmtIdx];
-  }
-
-  if (canHaveDirectConstructor(Next))
-    return Next;
-
-  return None;
-}
-
 const CXXConstructExpr *
 ExprEngine::findDirectConstructorForCurrentCFGElement() {
   // Go backward in the CFG to see if the previous element (ignoring
   // destructors) was a CXXConstructExpr. If so, that constructor
   // was constructed directly into an existing region.
   // This process is essentially the inverse of that performed in
   // findElementDirectlyInitializedByCurrentConstructor().
   if (currStmtIdx == 0)
     return nullptr;
 
   const CFGBlock *B = getBuilderContext().getBlock();
-  assert(canHaveDirectConstructor((*B)[currStmtIdx]));
 
   unsigned int PreviousStmtIdx = currStmtIdx - 1;
   CFGElement Previous = (*B)[PreviousStmtIdx];
 
   while (Previous.getAs<CFGImplicitDtor>() && PreviousStmtIdx > 0) {
     --PreviousStmtIdx;
     Previous = (*B)[PreviousStmtIdx];
   }