//===- SemaChecking.cpp - Extra Semantic Checking -------------------------===//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

//

//  This file implements extra semantic analysis beyond what is enforced

//  by the C type system.

//

//===----------------------------------------------------------------------===//

#include "clang/AST/APValue.h"

#include "clang/AST/ASTContext.h"

#include "clang/AST/Attr.h"

#include "clang/AST/AttrIterator.h"

#include "clang/AST/CharUnits.h"

#include "clang/AST/Decl.h"

#include "clang/AST/DeclBase.h"

#include "clang/AST/DeclCXX.h"

#include "clang/AST/DeclObjC.h"

#include "clang/AST/DeclarationName.h"

#include "clang/AST/EvaluatedExprVisitor.h"

#include "clang/AST/Expr.h"

#include "clang/AST/ExprCXX.h"

#include "clang/AST/ExprObjC.h"

#include "clang/AST/ExprOpenMP.h"

#include "clang/AST/FormatString.h"

#include "clang/AST/NSAPI.h"

#include "clang/AST/NonTrivialTypeVisitor.h"

#include "clang/AST/OperationKinds.h"

#include "clang/AST/RecordLayout.h"

#include "clang/AST/Stmt.h"

#include "clang/AST/TemplateBase.h"

#include "clang/AST/Type.h"

#include "clang/AST/TypeLoc.h"

#include "clang/AST/UnresolvedSet.h"

#include "clang/Basic/AddressSpaces.h"

#include "clang/Basic/CharInfo.h"

#include "clang/Basic/Diagnostic.h"

#include "clang/Basic/IdentifierTable.h"

#include "clang/Basic/LLVM.h"

#include "clang/Basic/LangOptions.h"

#include "clang/Basic/OpenCLOptions.h"

#include "clang/Basic/OperatorKinds.h"

#include "clang/Basic/PartialDiagnostic.h"

#include "clang/Basic/SourceLocation.h"

#include "clang/Basic/SourceManager.h"

#include "clang/Basic/Specifiers.h"

#include "clang/Basic/SyncScope.h"

#include "clang/Basic/TargetBuiltins.h"

#include "clang/Basic/TargetCXXABI.h"

#include "clang/Basic/TargetInfo.h"

#include "clang/Basic/TypeTraits.h"

#include "clang/Lex/Lexer.h" // TODO: Extract static functions to fix layering.

#include "clang/Sema/Initialization.h"

#include "clang/Sema/Lookup.h"

#include "clang/Sema/Ownership.h"

#include "clang/Sema/Scope.h"

#include "clang/Sema/ScopeInfo.h"

#include "clang/Sema/Sema.h"

#include "clang/Sema/SemaInternal.h"

#include "llvm/ADT/APFloat.h"

#include "llvm/ADT/APInt.h"

#include "llvm/ADT/APSInt.h"

#include "llvm/ADT/ArrayRef.h"

#include "llvm/ADT/DenseMap.h"

#include "llvm/ADT/FoldingSet.h"

#include "llvm/ADT/STLExtras.h"

#include "llvm/ADT/SmallBitVector.h"

#include "llvm/ADT/SmallPtrSet.h"

#include "llvm/ADT/SmallString.h"

#include "llvm/ADT/SmallVector.h"

#include "llvm/ADT/StringExtras.h"

#include "llvm/ADT/StringRef.h"

#include "llvm/ADT/StringSet.h"

#include "llvm/ADT/StringSwitch.h"

#include "llvm/Support/AtomicOrdering.h"

#include "llvm/Support/Casting.h"

#include "llvm/Support/Compiler.h"

#include "llvm/Support/ConvertUTF.h"

#include "llvm/Support/ErrorHandling.h"

#include "llvm/Support/Format.h"

#include "llvm/Support/Locale.h"

#include "llvm/Support/MathExtras.h"

#include "llvm/Support/SaveAndRestore.h"

#include "llvm/Support/raw_ostream.h"

#include "llvm/TargetParser/RISCVTargetParser.h"

#include "llvm/TargetParser/Triple.h"

#include <algorithm>

#include <bitset>

#include <cassert>

#include <cctype>

#include <cstddef>

#include <cstdint>

#include <functional>

#include <limits>

#include <optional>

#include <string>

#include <tuple>

#include <utility>

using namespace clang;

using namespace sema;

SourceLocation Sema::getLocationOfStringLiteralByte(const StringLiteral *SL,

                                                    unsigned ByteNo) const {

  return SL->getLocationOfByte(ByteNo, getSourceManager(), LangOpts,

                               Context.getTargetInfo());

}

static constexpr unsigned short combineFAPK(Sema::FormatArgumentPassingKind A,

                                            Sema::FormatArgumentPassingKind B) {

  return (A << 8) | B;

}

/// Checks that a call expression's argument count is at least the desired

/// number. This is useful when doing custom type-checking on a variadic

/// function. Returns true on error.

static bool checkArgCountAtLeast(Sema &S, CallExpr *Call,

                                 unsigned MinArgCount) {

  unsigned ArgCount = Call->getNumArgs();

  if (ArgCount >= MinArgCount)

    return false;

  return S.Diag(Call->getEndLoc(), diag::err_typecheck_call_too_few_args)

         << 0 /*function call*/ << MinArgCount << ArgCount

         << /*is non object*/ 0 << Call->getSourceRange();

}

/// Checks that a call expression's argument count is at most the desired

/// number. This is useful when doing custom type-checking on a variadic

/// function. Returns true on error.

static bool checkArgCountAtMost(Sema &S, CallExpr *Call, unsigned MaxArgCount) {

  unsigned ArgCount = Call->getNumArgs();

  if (ArgCount <= MaxArgCount)

    return false;

  return S.Diag(Call->getEndLoc(),

                diag::err_typecheck_call_too_many_args_at_most)

         << 0 /*function call*/ << MaxArgCount << ArgCount

         << /*is non object*/ 0 << Call->getSourceRange();

}

/// Checks that a call expression's argument count is in the desired range. This

/// is useful when doing custom type-checking on a variadic function. Returns

/// true on error.

static bool checkArgCountRange(Sema &S, CallExpr *Call, unsigned MinArgCount,

                               unsigned MaxArgCount) {

  return checkArgCountAtLeast(S, Call, MinArgCount) ||

         checkArgCountAtMost(S, Call, MaxArgCount);

}

/// Checks that a call expression's argument count is the desired number.

/// This is useful when doing custom type-checking.  Returns true on error.

static bool checkArgCount(Sema &S, CallExpr *Call, unsigned DesiredArgCount) {

  unsigned ArgCount = Call->getNumArgs();

  if (ArgCount == DesiredArgCount)

    return false;

  if (checkArgCountAtLeast(S, Call, DesiredArgCount))

    return true;

  assert(ArgCount > DesiredArgCount && "should have diagnosed this");

  // Highlight all the excess arguments.

  SourceRange Range(Call->getArg(DesiredArgCount)->getBeginLoc(),

                    Call->getArg(ArgCount - 1)->getEndLoc());

  return S.Diag(Range.getBegin(), diag::err_typecheck_call_too_many_args)

         << 0 /*function call*/ << DesiredArgCount << ArgCount

         << /*is non object*/ 0 << Call->getArg(1)->getSourceRange();

}

static bool convertArgumentToType(Sema &S, Expr *&Value, QualType Ty) {

  if (Value->isTypeDependent())

    return false;

  InitializedEntity Entity =

      InitializedEntity::InitializeParameter(S.Context, Ty, false);

  ExprResult Result =

      S.PerformCopyInitialization(Entity, SourceLocation(), Value);

  if (Result.isInvalid())

    return true;

  Value = Result.get();

  return false;

}

/// Check that the first argument to __builtin_annotation is an integer

/// and the second argument is a non-wide string literal.

static bool SemaBuiltinAnnotation(Sema &S, CallExpr *TheCall) {

  if (checkArgCount(S, TheCall, 2))

    return true;

  // First argument should be an integer.

  Expr *ValArg = TheCall->getArg(0);

  QualType Ty = ValArg->getType();

  if (!Ty->isIntegerType()) {

    S.Diag(ValArg->getBeginLoc(), diag::err_builtin_annotation_first_arg)

        << ValArg->getSourceRange();

    return true;

  }

  // Second argument should be a constant string.

  Expr *StrArg = TheCall->getArg(1)->IgnoreParenCasts();

  StringLiteral *Literal = dyn_cast<StringLiteral>(StrArg);

  if (!Literal || !Literal->isOrdinary()) {

    S.Diag(StrArg->getBeginLoc(), diag::err_builtin_annotation_second_arg)

        << StrArg->getSourceRange();

    return true;

  }

  TheCall->setType(Ty);

  return false;

}

static bool SemaBuiltinMSVCAnnotation(Sema &S, CallExpr *TheCall) {

  // We need at least one argument.

  if (TheCall->getNumArgs() < 1) {

    S.Diag(TheCall->getEndLoc(), diag::err_typecheck_call_too_few_args_at_least)

        << 0 << 1 << TheCall->getNumArgs() << /*is non object*/ 0

        << TheCall->getCallee()->getSourceRange();

    return true;

  }

  // All arguments should be wide string literals.

  for (Expr *Arg : TheCall->arguments()) {

    auto *Literal = dyn_cast<StringLiteral>(Arg->IgnoreParenCasts());

    if (!Literal || !Literal->isWide()) {

      S.Diag(Arg->getBeginLoc(), diag::err_msvc_annotation_wide_str)

          << Arg->getSourceRange();

      return true;

    }

  }

  return false;

}

/// Check that the argument to __builtin_addressof is a glvalue, and set the

/// result type to the corresponding pointer type.

static bool SemaBuiltinAddressof(Sema &S, CallExpr *TheCall) {

  if (checkArgCount(S, TheCall, 1))

    return true;

  ExprResult Arg(TheCall->getArg(0));

  QualType ResultType = S.CheckAddressOfOperand(Arg, TheCall->getBeginLoc());

  if (ResultType.isNull())

    return true;

  TheCall->setArg(0, Arg.get());

  TheCall->setType(ResultType);

  return false;

}

/// Check that the argument to __builtin_function_start is a function.

static bool SemaBuiltinFunctionStart(Sema &S, CallExpr *TheCall) {

  if (checkArgCount(S, TheCall, 1))

    return true;

  ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(TheCall->getArg(0));

  if (Arg.isInvalid())

    return true;

  TheCall->setArg(0, Arg.get());

  const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(

      Arg.get()->getAsBuiltinConstantDeclRef(S.getASTContext()));

  if (!FD) {

    S.Diag(TheCall->getBeginLoc(), diag::err_function_start_invalid_type)

        << TheCall->getSourceRange();

    return true;

  }

  return !S.checkAddressOfFunctionIsAvailable(FD, /*Complain=*/true,

                                              TheCall->getBeginLoc());

}

/// Check the number of arguments and set the result type to

/// the argument type.

static bool SemaBuiltinPreserveAI(Sema &S, CallExpr *TheCall) {

  if (checkArgCount(S, TheCall, 1))

    return true;

  TheCall->setType(TheCall->getArg(0)->getType());

  return false;

}

/// Check that the value argument for __builtin_is_aligned(value, alignment) and

/// __builtin_aligned_{up,down}(value, alignment) is an integer or a pointer

/// type (but not a function pointer) and that the alignment is a power-of-two.

static bool SemaBuiltinAlignment(Sema &S, CallExpr *TheCall, unsigned ID) {

  if (checkArgCount(S, TheCall, 2))

    return true;

  clang::Expr *Source = TheCall->getArg(0);

  bool IsBooleanAlignBuiltin = ID == Builtin::BI__builtin_is_aligned;

  auto IsValidIntegerType = [](QualType Ty) {

    return Ty->isIntegerType() && !Ty->isEnumeralType() && !Ty->isBooleanType();

  };

  QualType SrcTy = Source->getType();

  // We should also be able to use it with arrays (but not functions!).

  if (SrcTy->canDecayToPointerType() && SrcTy->isArrayType()) {

    SrcTy = S.Context.getDecayedType(SrcTy);

  }

  if ((!SrcTy->isPointerType() && !IsValidIntegerType(SrcTy)) ||

      SrcTy->isFunctionPointerType()) {

    // FIXME: this is not quite the right error message since we don't allow

    // floating point types, or member pointers.

    S.Diag(Source->getExprLoc(), diag::err_typecheck_expect_scalar_operand)

        << SrcTy;

    return true;

  }

  clang::Expr *AlignOp = TheCall->getArg(1);

  if (!IsValidIntegerType(AlignOp->getType())) {

    S.Diag(AlignOp->getExprLoc(), diag::err_typecheck_expect_int)

        << AlignOp->getType();

    return true;

  }

  Expr::EvalResult AlignResult;

  unsigned MaxAlignmentBits = S.Context.getIntWidth(SrcTy) - 1;

  // We can't check validity of alignment if it is value dependent.

  if (!AlignOp->isValueDependent() &&

      AlignOp->EvaluateAsInt(AlignResult, S.Context,

                             Expr::SE_AllowSideEffects)) {

    llvm::APSInt AlignValue = AlignResult.Val.getInt();

    llvm::APSInt MaxValue(

        llvm::APInt::getOneBitSet(MaxAlignmentBits + 1, MaxAlignmentBits));

    if (AlignValue < 1) {

      S.Diag(AlignOp->getExprLoc(), diag::err_alignment_too_small) << 1;

      return true;

    }

    if (llvm::APSInt::compareValues(AlignValue, MaxValue) > 0) {

      S.Diag(AlignOp->getExprLoc(), diag::err_alignment_too_big)

          << toString(MaxValue, 10);

      return true;

    }

    if (!AlignValue.isPowerOf2()) {

      S.Diag(AlignOp->getExprLoc(), diag::err_alignment_not_power_of_two);

      return true;

    }

    if (AlignValue == 1) {

      S.Diag(AlignOp->getExprLoc(), diag::warn_alignment_builtin_useless)

          << IsBooleanAlignBuiltin;

    }

  }

  ExprResult SrcArg = S.PerformCopyInitialization(

      InitializedEntity::InitializeParameter(S.Context, SrcTy, false),

      SourceLocation(), Source);

  if (SrcArg.isInvalid())

    return true;

  TheCall->setArg(0, SrcArg.get());

  ExprResult AlignArg =

      S.PerformCopyInitialization(InitializedEntity::InitializeParameter(

                                      S.Context, AlignOp->getType(), false),

                                  SourceLocation(), AlignOp);

  if (AlignArg.isInvalid())

    return true;

  TheCall->setArg(1, AlignArg.get());

  // For align_up/align_down, the return type is the same as the (potentially

  // decayed) argument type including qualifiers. For is_aligned(), the result

  // is always bool.

  TheCall->setType(IsBooleanAlignBuiltin ? S.Context.BoolTy : SrcTy);

  return false;

}

static bool SemaBuiltinOverflow(Sema &S, CallExpr *TheCall,

                                unsigned BuiltinID) {

  if (checkArgCount(S, TheCall, 3))

    return true;

  std::pair<unsigned, const char *> Builtins[] = {

    { Builtin::BI__builtin_add_overflow, "ckd_add" },

    { Builtin::BI__builtin_sub_overflow, "ckd_sub" },

    { Builtin::BI__builtin_mul_overflow, "ckd_mul" },

  };

  bool CkdOperation = llvm::any_of(Builtins, [&](const std::pair<unsigned,

    const char *> &P) {

    return BuiltinID == P.first && TheCall->getExprLoc().isMacroID() &&

         Lexer::getImmediateMacroName(TheCall->getExprLoc(),

         S.getSourceManager(), S.getLangOpts()) == P.second;

  });

  auto ValidCkdIntType = [](QualType QT) {

    // A valid checked integer type is an integer type other than a plain char,

    // bool, a bit-precise type, or an enumeration type.

    if (const auto *BT = QT.getCanonicalType()->getAs<BuiltinType>())

      return (BT->getKind() >= BuiltinType::Short &&

           BT->getKind() <= BuiltinType::Int128) || (

           BT->getKind() >= BuiltinType::UShort &&

           BT->getKind() <= BuiltinType::UInt128) ||

           BT->getKind() == BuiltinType::UChar ||

           BT->getKind() == BuiltinType::SChar;

    return false;

  };

  // First two arguments should be integers.

  for (unsigned I = 0; I < 2; ++I) {

    ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(TheCall->getArg(I));

    if (Arg.isInvalid()) return true;

    TheCall->setArg(I, Arg.get());

    QualType Ty = Arg.get()->getType();

    bool IsValid = CkdOperation ? ValidCkdIntType(Ty) : Ty->isIntegerType();

    if (!IsValid) {

      S.Diag(Arg.get()->getBeginLoc(), diag::err_overflow_builtin_must_be_int)

          << CkdOperation << Ty << Arg.get()->getSourceRange();

      return true;

    }

  }

  // Third argument should be a pointer to a non-const integer.

  // IRGen correctly handles volatile, restrict, and address spaces, and

  // the other qualifiers aren't possible.

  {

    ExprResult Arg = S.DefaultFunctionArrayLvalueConversion(TheCall->getArg(2));

    if (Arg.isInvalid()) return true;

    TheCall->setArg(2, Arg.get());

    QualType Ty = Arg.get()->getType();

    const auto *PtrTy = Ty->getAs<PointerType>();

    if (!PtrTy ||

        !PtrTy->getPointeeType()->isIntegerType() ||

        (!ValidCkdIntType(PtrTy->getPointeeType()) && CkdOperation) ||

        PtrTy->getPointeeType().isConstQualified()) {

      S.Diag(Arg.get()->getBeginLoc(),

             diag::err_overflow_builtin_must_be_ptr_int)

        << CkdOperation << Ty << Arg.get()->getSourceRange();

      return true;

    }

  }

  // Disallow signed bit-precise integer args larger than 128 bits to mul

  // function until we improve backend support.

  if (BuiltinID == Builtin::BI__builtin_mul_overflow) {

    for (unsigned I = 0; I < 3; ++I) {

      const auto Arg = TheCall->getArg(I);

      // Third argument will be a pointer.

      auto Ty = I < 2 ? Arg->getType() : Arg->getType()->getPointeeType();

      if (Ty->isBitIntType() && Ty->isSignedIntegerType() &&

          S.getASTContext().getIntWidth(Ty) > 128)

        return S.Diag(Arg->getBeginLoc(),

                      diag::err_overflow_builtin_bit_int_max_size)

               << 128;

    }

  }

  return false;

}

namespace {

struct BuiltinDumpStructGenerator {

  Sema &S;

  CallExpr *TheCall;

  SourceLocation Loc = TheCall->getBeginLoc();

  SmallVector<Expr *, 32> Actions;

  DiagnosticErrorTrap ErrorTracker;

  PrintingPolicy Policy;

  BuiltinDumpStructGenerator(Sema &S, CallExpr *TheCall)

      : S(S), TheCall(TheCall), ErrorTracker(S.getDiagnostics()),

        Policy(S.Context.getPrintingPolicy()) {

    Policy.AnonymousTagLocations = false;

  }

  Expr *makeOpaqueValueExpr(Expr *Inner) {

    auto *OVE = new (S.Context)

        OpaqueValueExpr(Loc, Inner->getType(), Inner->getValueKind(),

                        Inner->getObjectKind(), Inner);

    Actions.push_back(OVE);

    return OVE;

  }

  Expr *getStringLiteral(llvm::StringRef Str) {

    Expr *Lit = S.Context.getPredefinedStringLiteralFromCache(Str);

    // Wrap the literal in parentheses to attach a source location.

    return new (S.Context) ParenExpr(Loc, Loc, Lit);

  }

  bool callPrintFunction(llvm::StringRef Format,

                         llvm::ArrayRef<Expr *> Exprs = {}) {

    SmallVector<Expr *, 8> Args;

    assert(TheCall->getNumArgs() >= 2);

    Args.reserve((TheCall->getNumArgs() - 2) + /*Format*/ 1 + Exprs.size());

    Args.assign(TheCall->arg_begin() + 2, TheCall->arg_end());

    Args.push_back(getStringLiteral(Format));

    Args.insert(Args.end(), Exprs.begin(), Exprs.end());

    // Register a note to explain why we're performing the call.

    Sema::CodeSynthesisContext Ctx;

    Ctx.Kind = Sema::CodeSynthesisContext::BuildingBuiltinDumpStructCall;

    Ctx.PointOfInstantiation = Loc;

    Ctx.CallArgs = Args.data();

    Ctx.NumCallArgs = Args.size();

    S.pushCodeSynthesisContext(Ctx);

    ExprResult RealCall =

        S.BuildCallExpr(/*Scope=*/nullptr, TheCall->getArg(1),

                        TheCall->getBeginLoc(), Args, TheCall->getRParenLoc());

    S.popCodeSynthesisContext();

    if (!RealCall.isInvalid())

      Actions.push_back(RealCall.get());

    // Bail out if we've hit any errors, even if we managed to build the

    // call. We don't want to produce more than one error.

    return RealCall.isInvalid() || ErrorTracker.hasErrorOccurred();

  }

  Expr *getIndentString(unsigned Depth) {

    if (!Depth)

      return nullptr;

    llvm::SmallString<32> Indent;

    Indent.resize(Depth * Policy.Indentation, ' ');

    return getStringLiteral(Indent);

  }

  Expr *getTypeString(QualType T) {

    return getStringLiteral(T.getAsString(Policy));

  }

  bool appendFormatSpecifier(QualType T, llvm::SmallVectorImpl<char> &Str) {

    llvm::raw_svector_ostream OS(Str);

    // Format 'bool', 'char', 'signed char', 'unsigned char' as numbers, rather

    // than trying to print a single character.

    if (auto *BT = T->getAs<BuiltinType>()) {

      switch (BT->getKind()) {

      case BuiltinType::Bool:

        OS << "%d";

        return true;

      case BuiltinType::Char_U:

      case BuiltinType::UChar:

        OS << "%hhu";

        return true;

      case BuiltinType::Char_S:

      case BuiltinType::SChar:

        OS << "%hhd";

        return true;

      default:

        break;

      }

    }

    analyze_printf::PrintfSpecifier Specifier;

    if (Specifier.fixType(T, S.getLangOpts(), S.Context, /*IsObjCLiteral=*/false)) {

      // We were able to guess how to format this.

      if (Specifier.getConversionSpecifier().getKind() ==

          analyze_printf::PrintfConversionSpecifier::sArg) {

        // Wrap double-quotes around a '%s' specifier and limit its maximum

        // length. Ideally we'd also somehow escape special characters in the

        // contents but printf doesn't support that.

        // FIXME: '%s' formatting is not safe in general.

        OS << '"';

        Specifier.setPrecision(analyze_printf::OptionalAmount(32u));

        Specifier.toString(OS);

        OS << '"';

        // FIXME: It would be nice to include a '...' if the string doesn't fit

        // in the length limit.

      } else {

        Specifier.toString(OS);

      }

      return true;

    }

    if (T->isPointerType()) {

      // Format all pointers with '%p'.

      OS << "%p";

      return true;

    }

    return false;

  }

  bool dumpUnnamedRecord(const RecordDecl *RD, Expr *E, unsigned Depth) {

    Expr *IndentLit = getIndentString(Depth);

    Expr *TypeLit = getTypeString(S.Context.getRecordType(RD));

    if (IndentLit ? callPrintFunction("%s%s", {IndentLit, TypeLit})

                  : callPrintFunction("%s", {TypeLit}))

      return true;

    return dumpRecordValue(RD, E, IndentLit, Depth);

  }

  // Dump a record value. E should be a pointer or lvalue referring to an RD.

  bool dumpRecordValue(const RecordDecl *RD, Expr *E, Expr *RecordIndent,

                       unsigned Depth) {

    // FIXME: Decide what to do if RD is a union. At least we should probably

    // turn off printing `const char*` members with `%s`, because that is very

    // likely to crash if that's not the active member. Whatever we decide, we

    // should document it.

    // Build an OpaqueValueExpr so we can refer to E more than once without

    // triggering re-evaluation.

    Expr *RecordArg = makeOpaqueValueExpr(E);

    bool RecordArgIsPtr = RecordArg->getType()->isPointerType();

    if (callPrintFunction(" {\n"))

      return true;

    // Dump each base class, regardless of whether they're aggregates.

    if (const auto *CXXRD = dyn_cast<CXXRecordDecl>(RD)) {

      for (const auto &Base : CXXRD->bases()) {

        QualType BaseType =

            RecordArgIsPtr ? S.Context.getPointerType(Base.getType())

                           : S.Context.getLValueReferenceType(Base.getType());

        ExprResult BasePtr = S.BuildCStyleCastExpr(

            Loc, S.Context.getTrivialTypeSourceInfo(BaseType, Loc), Loc,

            RecordArg);

        if (BasePtr.isInvalid() ||

            dumpUnnamedRecord(Base.getType()->getAsRecordDecl(), BasePtr.get(),

                              Depth + 1))

          return true;

      }

    }

    Expr *FieldIndentArg = getIndentString(Depth + 1);

    // Dump each field.

    for (auto *D : RD->decls()) {

      auto *IFD = dyn_cast<IndirectFieldDecl>(D);

      auto *FD = IFD ? IFD->getAnonField() : dyn_cast<FieldDecl>(D);

      if (!FD || FD->isUnnamedBitfield() || FD->isAnonymousStructOrUnion())

        continue;

      llvm::SmallString<20> Format = llvm::StringRef("%s%s %s ");

      llvm::SmallVector<Expr *, 5> Args = {FieldIndentArg,

                                           getTypeString(FD->getType()),

                                           getStringLiteral(FD->getName())};

      if (FD->isBitField()) {

        Format += ": %zu ";

        QualType SizeT = S.Context.getSizeType();

        llvm::APInt BitWidth(S.Context.getIntWidth(SizeT),

                             FD->getBitWidthValue(S.Context));

        Args.push_back(IntegerLiteral::Create(S.Context, BitWidth, SizeT, Loc));

      }

      Format += "=";

      ExprResult Field =

          IFD ? S.BuildAnonymousStructUnionMemberReference(

                    CXXScopeSpec(), Loc, IFD,

                    DeclAccessPair::make(IFD, AS_public), RecordArg, Loc)

              : S.BuildFieldReferenceExpr(

                    RecordArg, RecordArgIsPtr, Loc, CXXScopeSpec(), FD,

                    DeclAccessPair::make(FD, AS_public),

                    DeclarationNameInfo(FD->getDeclName(), Loc));

      if (Field.isInvalid())

        return true;

      auto *InnerRD = FD->getType()->getAsRecordDecl();

      auto *InnerCXXRD = dyn_cast_or_null<CXXRecordDecl>(InnerRD);

      if (InnerRD && (!InnerCXXRD || InnerCXXRD->isAggregate())) {

        // Recursively print the values of members of aggregate record type.

        if (callPrintFunction(Format, Args) ||

            dumpRecordValue(InnerRD, Field.get(), FieldIndentArg, Depth + 1))

          return true;

      } else {

        Format += " ";

        if (appendFormatSpecifier(FD->getType(), Format)) {

          // We know how to print this field.

          Args.push_back(Field.get());

        } else {

          // We don't know how to print this field. Print out its address

          // with a format specifier that a smart tool will be able to

          // recognize and treat specially.

          Format += "*%p";

          ExprResult FieldAddr =

              S.BuildUnaryOp(nullptr, Loc, UO_AddrOf, Field.get());

          if (FieldAddr.isInvalid())

            return true;

          Args.push_back(FieldAddr.get());

        }

        Format += "\n";

        if (callPrintFunction(Format, Args))

          return true;

      }

    }

    return RecordIndent ? callPrintFunction("%s}\n", RecordIndent)

                        : callPrintFunction("}\n");

  }

  Expr *buildWrapper() {

    auto *Wrapper = PseudoObjectExpr::Create(S.Context, TheCall, Actions,

                                             PseudoObjectExpr::NoResult);

    TheCall->setType(Wrapper->getType());

    TheCall->setValueKind(Wrapper->getValueKind());

    return Wrapper;

  }

};

} // namespace

static ExprResult SemaBuiltinDumpStruct(Sema &S, CallExpr *TheCall) {

  if (checkArgCountAtLeast(S, TheCall, 2))

    return ExprError();

  ExprResult PtrArgResult = S.DefaultLvalueConversion(TheCall->getArg(0));

  if (PtrArgResult.isInvalid())

    return ExprError();

  TheCall->setArg(0, PtrArgResult.get());

  // First argument should be a pointer to a struct.

  QualType PtrArgType = PtrArgResult.get()->getType();

  if (!PtrArgType->isPointerType() ||

      !PtrArgType->getPointeeType()->isRecordType()) {

    S.Diag(PtrArgResult.get()->getBeginLoc(),

           diag::err_expected_struct_pointer_argument)

        << 1 << TheCall->getDirectCallee() << PtrArgType;

    return ExprError();

  }

  QualType Pointee = PtrArgType->getPointeeType();

  const RecordDecl *RD = Pointee->getAsRecordDecl();

  // Try to instantiate the class template as appropriate; otherwise, access to

  // its data() may lead to a crash.

  if (S.RequireCompleteType(PtrArgResult.get()->getBeginLoc(), Pointee,

                            diag::err_incomplete_type))

    return ExprError();

  // Second argument is a callable, but we can't fully validate it until we try

  // calling it.

  QualType FnArgType = TheCall->getArg(1)->getType();

  if (!FnArgType->isFunctionType() && !FnArgType->isFunctionPointerType() &&

      !FnArgType->isBlockPointerType() &&

      !(S.getLangOpts().CPlusPlus && FnArgType->isRecordType())) {

    auto *BT = FnArgType->getAs<BuiltinType>();

    switch (BT ? BT->getKind() : BuiltinType::Void) {

    case BuiltinType::Dependent:

    case BuiltinType::Overload:

    case BuiltinType::BoundMember:

    case BuiltinType::PseudoObject:

    case BuiltinType::UnknownAny:

    case BuiltinType::BuiltinFn:

      // This might be a callable.

      break;

    default:

      S.Diag(TheCall->getArg(1)->getBeginLoc(),

             diag::err_expected_callable_argument)

          << 2 << TheCall->getDirectCallee() << FnArgType;

      return ExprError();

    }

  }

  BuiltinDumpStructGenerator Generator(S, TheCall);

  // Wrap parentheses around the given pointer. This is not necessary for

  // correct code generation, but it means that when we pretty-print the call

  // arguments in our diagnostics we will produce '(&s)->n' instead of the

  // incorrect '&s->n'.

  Expr *PtrArg = PtrArgResult.get();

  PtrArg = new (S.Context)

      ParenExpr(PtrArg->getBeginLoc(),

                S.getLocForEndOfToken(PtrArg->getEndLoc()), PtrArg);

  if (Generator.dumpUnnamedRecord(RD, PtrArg, 0))

    return ExprError();

  return Generator.buildWrapper();

}

static bool SemaBuiltinCallWithStaticChain(Sema &S, CallExpr *BuiltinCall) {

  if (checkArgCount(S, BuiltinCall, 2))

    return true;

  SourceLocation BuiltinLoc = BuiltinCall->getBeginLoc();

  Expr *Builtin = BuiltinCall->getCallee()->IgnoreImpCasts();

  Expr *Call = BuiltinCall->getArg(0);

  Expr *Chain = BuiltinCall->getArg(1);

  if (Call->getStmtClass() != Stmt::CallExprClass) {

    S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_not_call)

        << Call->getSourceRange();

    return true;

  }

  auto CE = cast<CallExpr>(Call);

  if (CE->getCallee()->getType()->isBlockPointerType()) {

    S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_block_call)

        << Call->getSourceRange();

    return true;

  }

  const Decl *TargetDecl = CE->getCalleeDecl();

  if (const FunctionDecl *FD = dyn_cast_or_null<FunctionDecl>(TargetDecl))

    if (FD->getBuiltinID()) {

      S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_builtin_call)

          << Call->getSourceRange();

      return true;

    }

  if (isa<CXXPseudoDestructorExpr>(CE->getCallee()->IgnoreParens())) {

    S.Diag(BuiltinLoc, diag::err_first_argument_to_cwsc_pdtor_call)

        << Call->getSourceRange();

    return true;

  }

  ExprResult ChainResult = S.UsualUnaryConversions(Chain);

  if (ChainResult.isInvalid())

    return true;

  if (!ChainResult.get()->getType()->isPointerType()) {

    S.Diag(BuiltinLoc, diag::err_second_argument_to_cwsc_not_pointer)

        << Chain->getSourceRange();

    return true;

  }

  QualType ReturnTy = CE->getCallReturnType(S.Context);

  QualType ArgTys[2] = { ReturnTy, ChainResult.get()->getType() };

  QualType BuiltinTy = S.Context.getFunctionType(

      ReturnTy, ArgTys, FunctionProtoType::ExtProtoInfo());

  QualType BuiltinPtrTy = S.Context.getPointerType(BuiltinTy);

  Builtin =

      S.ImpCastExprToType(Builtin, BuiltinPtrTy, CK_BuiltinFnToFnPtr).get();

  BuiltinCall->setType(CE->getType());

  BuiltinCall->setValueKind(CE->getValueKind());

  BuiltinCall->setObjectKind(CE->getObjectKind());

  BuiltinCall->setCallee(Builtin);

  BuiltinCall->setArg(1, ChainResult.get());

  return false;

}

namespace {

class ScanfDiagnosticFormatHandler

    : public analyze_format_string::FormatStringHandler {

  // Accepts the argument index (relative to the first destination index) of the

  // argument whose size we want.

  using ComputeSizeFunction =

      llvm::function_ref<std::optional<llvm::APSInt>(unsigned)>;

  // Accepts the argument index (relative to the first destination index), the

  // destination size, and the source size).

  using DiagnoseFunction =

      llvm::function_ref<void(unsigned, unsigned, unsigned)>;

  ComputeSizeFunction ComputeSizeArgument;

  DiagnoseFunction Diagnose;

public:

  ScanfDiagnosticFormatHandler(ComputeSizeFunction ComputeSizeArgument,

                               DiagnoseFunction Diagnose)

      : ComputeSizeArgument(ComputeSizeArgument), Diagnose(Diagnose) {}

  bool HandleScanfSpecifier(const analyze_scanf::ScanfSpecifier &FS,

                            const char *StartSpecifier,

                            unsigned specifierLen) override {

    if (!FS.consumesDataArgument())

      return true;

    unsigned NulByte = 0;

    switch ((FS.getConversionSpecifier().getKind())) {

    default:

      return true;

    case analyze_format_string::ConversionSpecifier::sArg:

    case analyze_format_string::ConversionSpecifier::ScanListArg:

      NulByte = 1;

      break;

    case analyze_format_string::ConversionSpecifier::cArg:

      break;

    }

    analyze_format_string::OptionalAmount FW = FS.getFieldWidth();

    if (FW.getHowSpecified() !=

        analyze_format_string::OptionalAmount::HowSpecified::Constant)

      return true;

    unsigned SourceSize = FW.getConstantAmount() + NulByte;

    std::optional<llvm::APSInt> DestSizeAPS =

        ComputeSizeArgument(FS.getArgIndex());

    if (!DestSizeAPS)

      return true;

    unsigned DestSize = DestSizeAPS->getZExtValue();

    if (DestSize < SourceSize)

      Diagnose(FS.getArgIndex(), DestSize, SourceSize);

    return true;

  }

};

class EstimateSizeFormatHandler

    : public analyze_format_string::FormatStringHandler {

  size_t Size;

  /// Whether the format string contains Linux kernel's format specifier

  /// extension.

  bool IsKernelCompatible = true;

public:

  EstimateSizeFormatHandler(StringRef Format)

      : Size(std::min(Format.find(0), Format.size()) +

             1 /* null byte always written by sprintf */) {}

  bool HandlePrintfSpecifier(const analyze_printf::PrintfSpecifier &FS,

                             const char *, unsigned SpecifierLen,

                             const TargetInfo &) override {

    const size_t FieldWidth = computeFieldWidth(FS);

    const size_t Precision = computePrecision(FS);