[analyzer] DynamicTypeInfo: Simplify the API

[Charusso]

Summary

DynamicTypeInfo -> Optional<DynamicTypeInfo>,
which removes the method bool isValid().

[NoQ]

I actually like the idea, it makes it consistent with other maps. But you'll need to clean up memory management here. Given that you can't modify the state in getDynamicTypeInfo(), i guess you'll have to resort to smart pointers.

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

53–57

Do i have to do a delete manually every time i call this function?

96

Who is responsible for deallocating this memory?

[Charusso]

• No comment.

[Charusso]

Sorry, I was sure it is working as expected.

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

53–57

Well, from now you do not.

[NoQ]

Yup, optional sounds perfect.

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h

 #include "llvm/ADT/ImmutableMap.h"
 #include "llvm/ADT/Optional.h"
 #include <utility>
 
 namespace clang {
 namespace ento {
 
 /// Get dynamic type information for the region \p MR.
-DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR);
+const DynamicTypeInfo *getDynamicTypeInfo(ProgramStateRef State,
+                                          const MemRegion *MR);
 
 /// Get raw dynamic type information for the region \p MR.
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR);
 
 /// Get dynamic cast information from \p CastFromTy to \p CastToTy of \p MR.
 const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
-                                   DynamicTypeInfo NewTy);
+                                   const DynamicTypeInfo *NewTy);
 
 /// Set dynamic type information of the region; return the new state.
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    QualType NewTy, bool CanBeSubClassed = true);
 
 /// Set dynamic type and cast information of the region; return the new state.
 ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,

clang/include/clang/StaticAnalyzer/Core/PathSensitive/DynamicTypeInfo.h

 
 namespace clang {
 namespace ento {
 
 /// Stores the currently inferred strictest bound on the runtime type
 /// of a region in a given state along the analysis path.
 class DynamicTypeInfo {
 public:
-  DynamicTypeInfo() : DynTy(QualType()) {}
+  DynamicTypeInfo() : Ty(QualType()) {}
 
-  DynamicTypeInfo(QualType Ty, bool CanBeSub = true)
-      : DynTy(Ty), CanBeASubClass(CanBeSub) {}
+  DynamicTypeInfo(QualType Ty, bool CanBeASubClass = true)
+      : Ty(Ty), CanBeASubClass(CanBeASubClass) {}
 
   /// Returns false if the type information is precise (the type 'DynTy' is
   /// the only type in the lattice), true otherwise.
   bool canBeASubClass() const { return CanBeASubClass; }
 
-  /// Returns true if the dynamic type info is available.
-  bool isValid() const { return !DynTy.isNull(); }
-
   /// Returns the currently inferred upper bound on the runtime type.
-  QualType getType() const { return DynTy; }
+  QualType getType() const { return Ty; }
 
   bool operator==(const DynamicTypeInfo &RHS) const {
-    return DynTy == RHS.DynTy && CanBeASubClass == RHS.CanBeASubClass;
+    return Ty == RHS.Ty && CanBeASubClass == RHS.CanBeASubClass;
   }
 
   void Profile(llvm::FoldingSetNodeID &ID) const {
-    ID.Add(DynTy);
+    ID.Add(Ty);
     ID.AddBoolean(CanBeASubClass);
   }
 
 private:
-  QualType DynTy;
+  QualType Ty;
   bool CanBeASubClass;
 };
 
 } // namespace ento
 } // namespace clang
 
 #endif // LLVM_CLANG_STATICANALYZER_CORE_PATHSENSITIVE_DYNAMICTYPEINFO_H

clang/lib/StaticAnalyzer/Checkers/DynamicTypeChecker.cpp

void DynamicTypeChecker::reportTypeError(QualType DynamicType,
   C.emitReport(std::move(R));
 }
 
 PathDiagnosticPieceRef DynamicTypeChecker::DynamicTypeBugVisitor::VisitNode(
     const ExplodedNode *N, BugReporterContext &BRC, PathSensitiveBugReport &) {
   ProgramStateRef State = N->getState();
   ProgramStateRef StatePrev = N->getFirstPred()->getState();
 
-  DynamicTypeInfo TrackedType = getDynamicTypeInfo(State, Reg);
-  DynamicTypeInfo TrackedTypePrev = getDynamicTypeInfo(StatePrev, Reg);
-  if (!TrackedType.isValid())
+  const DynamicTypeInfo *TrackedType = getDynamicTypeInfo(State, Reg);
+  const DynamicTypeInfo *TrackedTypePrev = getDynamicTypeInfo(StatePrev, Reg);
+  if (!TrackedType)
     return nullptr;
 
-  if (TrackedTypePrev.isValid() &&
-      TrackedTypePrev.getType() == TrackedType.getType())
+  if (TrackedTypePrev && TrackedTypePrev->getType() == TrackedType->getType())
     return nullptr;
 
   // Retrieve the associated statement.
   const Stmt *S = N->getStmtForDiagnostics();
   if (!S)
     return nullptr;
 
   const LangOptions &LangOpts = BRC.getASTContext().getLangOpts();
 
   SmallString<256> Buf;
   llvm::raw_svector_ostream OS(Buf);
   OS << "Type '";
-  QualType::print(TrackedType.getType().getTypePtr(), Qualifiers(), OS,
+  QualType::print(TrackedType->getType().getTypePtr(), Qualifiers(), OS,
                   LangOpts, llvm::Twine());
   OS << "' is inferred from ";
 
   if (const auto *ExplicitCast = dyn_cast<ExplicitCastExpr>(S)) {
     OS << "explicit cast (from '";
     QualType::print(ExplicitCast->getSubExpr()->getType().getTypePtr(),
                     Qualifiers(), OS, LangOpts, llvm::Twine());
     OS << "' to '";
void DynamicTypeChecker::checkPostStmt(const ImplicitCastExpr *CE,
   if (CE->getCastKind() != CK_BitCast)
     return;
 
   const MemRegion *Region = C.getSVal(CE).getAsRegion();
   if (!Region)
     return;
 
   ProgramStateRef State = C.getState();
-  DynamicTypeInfo DynTypeInfo = getDynamicTypeInfo(State, Region);
-
-  if (!DynTypeInfo.isValid())
+  const DynamicTypeInfo *DynTypeInfo = getDynamicTypeInfo(State, Region);
+  if (!DynTypeInfo)
     return;
 
-  QualType DynType = DynTypeInfo.getType();
+  QualType DynType = DynTypeInfo->getType();
   QualType StaticType = CE->getType();
 
   const auto *DynObjCType = DynType->getAs<ObjCObjectPointerType>();
   const auto *StaticObjCType = StaticType->getAs<ObjCObjectPointerType>();
 
   if (!DynObjCType || !StaticObjCType)
     return;
 
   if (!hasDefinition(DynObjCType) || !hasDefinition(StaticObjCType))
     return;
 
   ASTContext &ASTCtxt = C.getASTContext();
 
   // Strip kindeofness to correctly detect subtyping relationships.
   DynObjCType = DynObjCType->stripObjCKindOfTypeAndQuals(ASTCtxt);
   StaticObjCType = StaticObjCType->stripObjCKindOfTypeAndQuals(ASTCtxt);
 
   // Specialized objects are handled by the generics checker.
   if (StaticObjCType->isSpecialized())
     return;
 
   if (ASTCtxt.canAssignObjCInterfaces(StaticObjCType, DynObjCType))
     return;
 
-  if (DynTypeInfo.canBeASubClass() &&
+  if (DynTypeInfo->canBeASubClass() &&
       ASTCtxt.canAssignObjCInterfaces(DynObjCType, StaticObjCType))
     return;
 
   reportTypeError(DynType, StaticType, Region, CE, C);
 }
 
 void ento::registerDynamicTypeChecker(CheckerManager &mgr) {
   mgr.registerChecker<DynamicTypeChecker>();
 }
 
 bool ento::shouldRegisterDynamicTypeChecker(const LangOptions &LO) {
   return true;
 }

clang/lib/StaticAnalyzer/Checkers/DynamicTypePropagation.cpp

if (D && D->hasRelatedResultType()) {
         break;
       }
       case OMF_init: {
         // Assume, the result of the init method has the same dynamic type as
         // the receiver and propagate the dynamic type info.
         const MemRegion *RecReg = Msg->getReceiverSVal().getAsRegion();
         if (!RecReg)
           return;
-        DynamicTypeInfo RecDynType = getDynamicTypeInfo(State, RecReg);
+        const DynamicTypeInfo *RecDynType = getDynamicTypeInfo(State, RecReg);
         C.addTransition(setDynamicTypeInfo(State, RetReg, RecDynType));
         break;
       }
       }
     }
     return;
   }
 
DynamicTypePropagation::getBetterObjCType(const Expr *CastE,
   const MemRegion *ToR = C.getSVal(CastE).getAsRegion();
   assert(ToR);
 
   // Get the old and new types.
   const ObjCObjectPointerType *NewTy =
       CastE->getType()->getAs<ObjCObjectPointerType>();
   if (!NewTy)
     return nullptr;
-  QualType OldDTy = getDynamicTypeInfo(C.getState(), ToR).getType();
+
+  QualType OldDTy;
+  if (const DynamicTypeInfo *DTI = getDynamicTypeInfo(C.getState(), ToR))
+    OldDTy = DTI->getType();
+
   if (OldDTy.isNull()) {
     return NewTy;
   }
+
   const ObjCObjectPointerType *OldTy =
     OldDTy->getAs<ObjCObjectPointerType>();
   if (!OldTy)
     return nullptr;
 
   // Id the old type is 'id', the new one is more precise.
   if (OldTy->isObjCIdType() && !NewTy->isObjCIdType())
     return NewTy;

clang/lib/StaticAnalyzer/Checkers/IteratorChecker.cpp

for (const auto *Method : CRD->methods()) {
     }
   }
   return false;
 }
 
 const CXXRecordDecl *getCXXRecordDecl(ProgramStateRef State,
                                       const MemRegion *Reg) {
   auto TI = getDynamicTypeInfo(State, Reg);
-  if (!TI.isValid())
+  if (!TI)
     return nullptr;
 
-  auto Type = TI.getType();
+  auto Type = TI->getType();
   if (const auto *RefT = Type->getAs<ReferenceType>()) {
     Type = RefT->getPointeeType();
   }
 
   return Type->getUnqualifiedDesugaredType()->getAsCXXRecordDecl();
 }
 
 SymbolRef getContainerBegin(ProgramStateRef State, const MemRegion *Cont) {

clang/lib/StaticAnalyzer/Core/CallEvent.cpp

if (!MD->isVirtual())
     return AnyFunctionCall::getRuntimeDefinition();
 
   // Do we know the implicit 'this' object being called?
   const MemRegion *R = getCXXThisVal().getAsRegion();
   if (!R)
     return {};
 
   // Do we know anything about the type of 'this'?
-  DynamicTypeInfo DynType = getDynamicTypeInfo(getState(), R);
-  if (!DynType.isValid())
+  const DynamicTypeInfo *DynType = getDynamicTypeInfo(getState(), R);
+  if (!DynType)
     return {};
 
   // Is the type a C++ class? (This is mostly a defensive check.)
-  QualType RegionType = DynType.getType()->getPointeeType();
+  QualType RegionType = DynType->getType()->getPointeeType();
   assert(!RegionType.isNull() && "DynamicTypeInfo should always be a pointer.");
 
   const CXXRecordDecl *RD = RegionType->getAsCXXRecordDecl();
   if (!RD || !RD->hasDefinition())
     return {};
 
   // Find the decl for this method in that class.
   const CXXMethodDecl *Result = MD->getCorrespondingMethodInClass(RD, true);
if (!Result) {
     //assert(!MD->getParent()->isDerivedFrom(RD) && "Bad DynamicTypeInfo");
 
     return {};
   }
 
   // Does the decl that we found have an implementation?
   const FunctionDecl *Definition;
   if (!Result->hasBody(Definition)) {
-    if (!DynType.canBeASubClass())
+    if (!DynType->canBeASubClass())
       return AnyFunctionCall::getRuntimeDefinition();
     return {};
   }
 
   // We found a definition. If we're not sure that this devirtualization is
   // actually what will happen at runtime, make sure to provide the region so
   // that ExprEngine can decide what to do with it.
-  if (DynType.canBeASubClass())
+  if (DynType->canBeASubClass())
     return RuntimeDefinition(Definition, R->StripCasts());
   return RuntimeDefinition(Definition, /*DispatchRegion=*/nullptr);
 }
 
 void CXXInstanceCall::getInitialStackFrameContents(
                                             const StackFrameContext *CalleeCtx,
                                             BindingsTy &Bindings) const {
   AnyFunctionCall::getInitialStackFrameContents(CalleeCtx, Bindings);
if (!SupersType.isNull()) {
       // Super always means the type of immediate predecessor to the method
       // where the call occurs.
       ReceiverT = cast<ObjCObjectPointerType>(SupersType);
     } else {
       Receiver = getReceiverSVal().getAsRegion();
       if (!Receiver)
         return {};
 
-      DynamicTypeInfo DTI = getDynamicTypeInfo(getState(), Receiver);
-      if (!DTI.isValid()) {
+      const DynamicTypeInfo *DTI = getDynamicTypeInfo(getState(), Receiver);
+      if (!DTI) {
         assert(isa<AllocaRegion>(Receiver) &&
                "Unhandled untyped region class!");
         return {};
       }
 
-      QualType DynType = DTI.getType();
-      CanBeSubClassed = DTI.canBeASubClass();
+      QualType DynType = DTI->getType();
+      CanBeSubClassed = DTI->canBeASubClass();
       ReceiverT = dyn_cast<ObjCObjectPointerType>(DynType.getCanonicalType());
 
       if (ReceiverT && CanBeSubClassed)
         if (ObjCInterfaceDecl *IDecl = ReceiverT->getInterfaceDecl())
           if (!canBeOverridenInSubclass(IDecl, Sel))
             CanBeSubClassed = false;
     }
 

clang/lib/StaticAnalyzer/Core/DynamicType.cpp

 
 /// A map from symbols to cast informations.
 REGISTER_MAP_WITH_PROGRAMSTATE(DynamicCastMap, const clang::ento::MemRegion *,
                                CastSet)
 
 namespace clang {
 namespace ento {
 
-DynamicTypeInfo getDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR) {
-  MR = MR->StripCasts();
+static const MemRegion *getSimplifiedRegion(const MemRegion *MR) {
+  return MR->StripCasts();
+}
+
+const DynamicTypeInfo *getDynamicTypeInfo(ProgramStateRef State,
+                                          const MemRegion *MR) {
+  MR = getSimplifiedRegion(MR);
 
   // Look up the dynamic type in the GDM.
   if (const DynamicTypeInfo *DTI = State->get<DynamicTypeMap>(MR))
-    return *DTI;
+    return DTI;
 
   // Otherwise, fall back to what we know about the region.
   if (const auto *TR = dyn_cast<TypedRegion>(MR))
-    return DynamicTypeInfo(TR->getLocationType(), /*CanBeSub=*/false);
+    return new DynamicTypeInfo(TR->getLocationType(), /*CanBeSub=*/false);
 
-  if (const auto *SR = dyn_cast<SymbolicRegion>(MR)) {
-    SymbolRef Sym = SR->getSymbol();
-    return DynamicTypeInfo(Sym->getType());
-  }
+  if (const auto *SR = dyn_cast<SymbolicRegion>(MR))
+    return new DynamicTypeInfo(SR->getSymbol()->getType());
 
-  return {};
+  return nullptr;
 }
 
 const DynamicTypeInfo *getRawDynamicTypeInfo(ProgramStateRef State,
                                              const MemRegion *MR) {
   return State->get<DynamicTypeMap>(MR);
 }
 
 const DynamicCastInfo *getDynamicCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy) {
   const auto *Lookup = State->get<DynamicCastMap>().lookup(MR);
   if (!Lookup)
     return nullptr;
 
   for (const DynamicCastInfo &Cast : *Lookup)
     if (Cast.equals(CastFromTy, CastToTy))
       return &Cast;
 
   return nullptr;
 }
 
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
-                                   DynamicTypeInfo NewTy) {
-  State = State->set<DynamicTypeMap>(MR->StripCasts(), NewTy);
+                                   const DynamicTypeInfo *NewTy) {
+  assert((NewTy->getType()->isAnyPointerType() ||
+          NewTy->getType()->isReferenceType()) &&
+         "DynamicTypeInfo should always be a pointer.");
+  MR = getSimplifiedRegion(MR);
+  State = State->set<DynamicTypeMap>(MR, *NewTy);
   assert(State);
   return State;
 }
 
 ProgramStateRef setDynamicTypeInfo(ProgramStateRef State, const MemRegion *MR,
                                    QualType NewTy, bool CanBeSubClassed) {
-  return setDynamicTypeInfo(State, MR, DynamicTypeInfo(NewTy, CanBeSubClassed));
+  return setDynamicTypeInfo(State, MR,
+                            new DynamicTypeInfo(NewTy, CanBeSubClassed));
 }
 
 ProgramStateRef setDynamicTypeAndCastInfo(ProgramStateRef State,
                                           const MemRegion *MR,
                                           QualType CastFromTy,
                                           QualType CastToTy,
                                           bool CastSucceeds) {
   if (!MR)
static void printDynamicTypesJson(raw_ostream &Out, ProgramStateRef State,
 
   ++Space;
   Out << '[' << NL;
   for (DynamicTypeMapTy::iterator I = Map.begin(); I != Map.end(); ++I) {
     const MemRegion *MR = I->first;
     const DynamicTypeInfo &DTI = I->second;
     Indent(Out, Space, IsDot)
         << "{ \"region\": \"" << MR << "\", \"dyn_type\": ";
-    if (!DTI.isValid()) {
+    if (DTI.getType().isNull()) {
       Out << "null";
     } else {
       Out << '\"' << DTI.getType()->getPointeeType().getAsString()
           << "\", \"sub_classable\": "
           << (DTI.canBeASubClass() ? "true" : "false");
     }
     Out << " }";