Determine if a member call is virtual in the Clang AST

Question

I'd like to write an analyzer that counts virtual function calls by looking at the C++ AST (output of -ast-dump), but I'm having difficulty determining which function calls are virtual and which are not. Here's an example piece of code:

struct A {
    A() {}
    virtual int foo() { return 0; }
};
struct B : public A {
    B() {}
    //virtual int foo() { return 3; }
};

struct C : public B {
    C() {}
    virtual int foo() { return 1; }
};

int test(C* c) { 
    return c->foo() + c->B::foo() + c->A::foo();
}

In my initial implementation, I simply check whether or not the function being called is virtual using expr->getMethodDecl()->isVirtual() but (from what I understand) the calls in c->B::foo() and c->A::foo() are not actually virtual so it isn't sufficient to ask if the function being called is virtual.

When I dump the AST from this piece of code, I get the following tree for test:

`-FunctionDecl 0x1d33620 <line:19:1, line:21:1> line:19:5 test 'int (C *)'
  |-ParmVarDecl 0x1d33558 <col:10, col:13> col:13 used c 'C *'
  `-CompoundStmt 0x1d339f0 <col:16, line:21:1>
    `-ReturnStmt 0x1d339e0 <line:20:5, col:47>
      `-BinaryOperator 0x1d339c0 <col:12, col:47> 'int' '+'
        |-BinaryOperator 0x1d338a8 <col:12, col:33> 'int' '+'
        | |-CXXMemberCallExpr 0x1d33778 <col:12, col:19> 'int'
        | | `-MemberExpr 0x1d33748 <col:12, col:15> '<bound member function type>' ->foo 0x1d31c80
        | |   `-ImplicitCastExpr 0x1d33730 <col:12> 'C *' <LValueToRValue>
        | |     `-DeclRefExpr 0x1d33710 <col:12> 'C *' lvalue ParmVar 0x1d33558 'c' 'C *'
        | `-CXXMemberCallExpr 0x1d33848 <col:23, col:33> 'int'
        |   `-MemberExpr 0x1d33800 <col:23, col:29> '<bound member function type>' ->foo 0x1d02400
        |     `-ImplicitCastExpr 0x1d33888 <col:23> 'A *' <UncheckedDerivedToBase (A)>
        |       `-ImplicitCastExpr 0x1d33868 <col:23> 'B *' <UncheckedDerivedToBase (B)>
        |         `-ImplicitCastExpr 0x1d337d8 <col:23> 'C *' <LValueToRValue>
        |           `-DeclRefExpr 0x1d33798 <col:23> 'C *' lvalue ParmVar 0x1d33558 'c' 'C *'
        `-CXXMemberCallExpr 0x1d33978 <col:37, col:47> 'int'
          `-MemberExpr 0x1d33930 <col:37, col:43> '<bound member function type>' ->foo 0x1d02400
            `-ImplicitCastExpr 0x1d33998 <col:37> 'A *' <UncheckedDerivedToBase (B -> A)>
              `-ImplicitCastExpr 0x1d33908 <col:37> 'C *' <LValueToRValue>
                `-DeclRefExpr 0x1d338c8 <col:37> 'C *' lvalue ParmVar 0x1d33558 'c' 'C *'

From looking this, it seems that the UncheckedDerivedToBase cast is marking places where the function call is non-virtual. Is this always the case? Should I always consider a call of the form CXXMemberCallExpr (MemberExpr (ImplicitCastExpr<UncheckedDerivedToBase> e))) to be a non-virtual call? Are there other patterns that would indicate non-virtual function calls? Is there any more robust way to determine this fact?

EDIT: Some more investigation suggests that the above hypothesis that UncheckedDerivedToBase is not sufficient. This code:

struct A {
    virtual int foo() { return 100; }
};
struct B : public A {
    virtual int foo() { return 10; }
};

int test(B* b) {
    return b->foo() + b->B::foo();
}

seem to produce exactly the same AST node (at least indistinguishable on the console) for both calls, but the semantics should be different according to the standard if b is actually a derived class, e.g. C above.

Answer 1

The distinguishing factor is hasQualifier on the MemberExpr of the callee object. If hasQualifier is true, then the function call is non-virtual.