clang 22.0.0git
ASTUtils.cpp
Go to the documentation of this file.
1//=======- ASTUtils.cpp ------------------------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "ASTUtils.h"
10#include "PtrTypesSemantics.h"
11#include "clang/AST/Attr.h"
12#include "clang/AST/Decl.h"
13#include "clang/AST/DeclCXX.h"
14#include "clang/AST/ExprCXX.h"
15#include "clang/AST/ExprObjC.h"
17#include <optional>
18
19namespace clang {
20
24
26 const Expr *E, bool StopAtFirstRefCountedObj,
28 std::function<bool(const clang::QualType)> isSafePtrType,
29 std::function<bool(const clang::Expr *, bool)> callback) {
30 while (E) {
31 if (auto *DRE = dyn_cast<DeclRefExpr>(E)) {
32 if (auto *VD = dyn_cast_or_null<VarDecl>(DRE->getDecl())) {
33 auto QT = VD->getType();
34 auto IsImmortal = safeGetName(VD) == "NSApp";
35 if (VD->hasGlobalStorage() && (IsImmortal || QT.isConstQualified()))
36 return callback(E, true);
37 }
38 }
39 if (auto *tempExpr = dyn_cast<MaterializeTemporaryExpr>(E)) {
40 E = tempExpr->getSubExpr();
41 continue;
42 }
43 if (auto *tempExpr = dyn_cast<CXXBindTemporaryExpr>(E)) {
44 E = tempExpr->getSubExpr();
45 continue;
46 }
47 if (auto *tempExpr = dyn_cast<CXXConstructExpr>(E)) {
48 if (auto *C = tempExpr->getConstructor()) {
49 if (auto *Class = C->getParent(); Class && isSafePtr(Class))
50 return callback(E, true);
51 break;
52 }
53 }
54 if (auto *TempExpr = dyn_cast<CXXUnresolvedConstructExpr>(E)) {
55 if (isSafePtrType(TempExpr->getTypeAsWritten()))
56 return callback(TempExpr, true);
57 }
58 if (auto *POE = dyn_cast<PseudoObjectExpr>(E)) {
59 if (auto *RF = POE->getResultExpr()) {
60 E = RF;
61 continue;
62 }
63 }
64 if (auto *tempExpr = dyn_cast<ParenExpr>(E)) {
65 E = tempExpr->getSubExpr();
66 continue;
67 }
68 if (auto *OpaqueValue = dyn_cast<OpaqueValueExpr>(E)) {
69 E = OpaqueValue->getSourceExpr();
70 continue;
71 }
72 if (auto *Expr = dyn_cast<ConditionalOperator>(E)) {
73 return tryToFindPtrOrigin(Expr->getTrueExpr(), StopAtFirstRefCountedObj,
74 isSafePtr, isSafePtrType, callback) &&
75 tryToFindPtrOrigin(Expr->getFalseExpr(), StopAtFirstRefCountedObj,
76 isSafePtr, isSafePtrType, callback);
77 }
78 if (auto *cast = dyn_cast<CastExpr>(E)) {
79 if (StopAtFirstRefCountedObj) {
80 if (auto *ConversionFunc =
81 dyn_cast_or_null<FunctionDecl>(cast->getConversionFunction())) {
82 if (isCtorOfSafePtr(ConversionFunc))
83 return callback(E, true);
84 }
85 if (isa<CXXFunctionalCastExpr>(E) && isSafePtrType(cast->getType()))
86 return callback(E, true);
87 }
88 // FIXME: This can give false "origin" that would lead to false negatives
89 // in checkers. See https://reviews.llvm.org/D37023 for reference.
90 E = cast->getSubExpr();
91 continue;
92 }
93 if (auto *call = dyn_cast<CallExpr>(E)) {
94 if (auto *Callee = call->getCalleeDecl()) {
95 if (Callee->hasAttr<CFReturnsRetainedAttr>() ||
96 Callee->hasAttr<NSReturnsRetainedAttr>()) {
97 return callback(E, true);
98 }
99 }
100
101 if (auto *memberCall = dyn_cast<CXXMemberCallExpr>(call)) {
102 if (auto *decl = memberCall->getMethodDecl()) {
103 std::optional<bool> IsGetterOfRefCt = isGetterOfSafePtr(decl);
104 if (IsGetterOfRefCt && *IsGetterOfRefCt) {
105 E = memberCall->getImplicitObjectArgument();
106 if (StopAtFirstRefCountedObj) {
107 return callback(E, true);
108 }
109 continue;
110 }
111 }
112 }
113
114 if (auto *operatorCall = dyn_cast<CXXOperatorCallExpr>(E)) {
115 if (auto *Callee = operatorCall->getDirectCallee()) {
116 auto ClsName = safeGetName(Callee->getParent());
117 if (isRefType(ClsName) || isCheckedPtr(ClsName) ||
118 isRetainPtrOrOSPtr(ClsName) || ClsName == "unique_ptr" ||
119 ClsName == "UniqueRef" || ClsName == "WeakPtr" ||
120 ClsName == "WeakRef") {
121 if (operatorCall->getNumArgs() == 1) {
122 E = operatorCall->getArg(0);
123 continue;
124 }
125 }
126 }
127 }
128
129 if (call->isCallToStdMove() && call->getNumArgs() == 1) {
130 E = call->getArg(0)->IgnoreParenCasts();
131 continue;
132 }
133
134 if (auto *callee = call->getDirectCallee()) {
135 if (isCtorOfSafePtr(callee)) {
136 if (StopAtFirstRefCountedObj)
137 return callback(E, true);
138
139 E = call->getArg(0);
140 continue;
141 }
142
143 if (isSafePtrType(callee->getReturnType()))
144 return callback(E, true);
145
146 if (isSingleton(callee))
147 return callback(E, true);
148
149 if (callee->isInStdNamespace() && safeGetName(callee) == "forward") {
150 E = call->getArg(0);
151 continue;
152 }
153
154 if (isPtrConversion(callee)) {
155 E = call->getArg(0);
156 continue;
157 }
158
159 auto Name = safeGetName(callee);
160 if (Name == "__builtin___CFStringMakeConstantString" ||
161 Name == "NSClassFromString")
162 return callback(E, true);
163 } else if (auto *CalleeE = call->getCallee()) {
164 if (auto *E = dyn_cast<DeclRefExpr>(CalleeE->IgnoreParenCasts())) {
165 if (isSingleton(E->getFoundDecl()))
166 return callback(E, true);
167 }
168 }
169
170 // Sometimes, canonical type erroneously turns Ref<T> into T.
171 // Workaround this problem by checking again if the original type was
172 // a SubstTemplateTypeParmType of a safe smart pointer type (e.g. Ref).
173 if (auto *CalleeDecl = call->getCalleeDecl()) {
174 if (auto *FD = dyn_cast<FunctionDecl>(CalleeDecl)) {
175 auto RetType = FD->getReturnType();
176 if (auto *Subst = dyn_cast<SubstTemplateTypeParmType>(RetType)) {
177 if (auto *SubstType = Subst->desugar().getTypePtr()) {
178 if (auto *RD = dyn_cast<RecordType>(SubstType)) {
179 if (auto *CXX = dyn_cast<CXXRecordDecl>(RD->getOriginalDecl()))
180 if (isSafePtr(CXX))
181 return callback(E, true);
182 }
183 }
184 }
185 }
186 }
187 }
188 if (auto *ObjCMsgExpr = dyn_cast<ObjCMessageExpr>(E)) {
189 if (auto *Method = ObjCMsgExpr->getMethodDecl()) {
190 if (isSafePtrType(Method->getReturnType()))
191 return callback(E, true);
192 }
193 auto Selector = ObjCMsgExpr->getSelector();
194 auto NameForFirstSlot = Selector.getNameForSlot(0);
195 if ((NameForFirstSlot == "class" || NameForFirstSlot == "superclass") &&
197 return callback(E, true);
198 }
199 if (auto *ObjCDict = dyn_cast<ObjCDictionaryLiteral>(E))
200 return callback(ObjCDict, true);
201 if (auto *ObjCArray = dyn_cast<ObjCArrayLiteral>(E))
202 return callback(ObjCArray, true);
203 if (auto *ObjCStr = dyn_cast<ObjCStringLiteral>(E))
204 return callback(ObjCStr, true);
205 if (auto *unaryOp = dyn_cast<UnaryOperator>(E)) {
206 // FIXME: Currently accepts ANY unary operator. Is it OK?
207 E = unaryOp->getSubExpr();
208 continue;
209 }
210 if (auto *BoxedExpr = dyn_cast<ObjCBoxedExpr>(E)) {
211 if (StopAtFirstRefCountedObj)
212 return callback(BoxedExpr, true);
213 E = BoxedExpr->getSubExpr();
214 continue;
215 }
216 break;
217 }
218 // Some other expression.
219 return callback(E, false);
220}
221
222bool isASafeCallArg(const Expr *E) {
223 assert(E);
224 if (auto *Ref = dyn_cast<DeclRefExpr>(E)) {
225 auto *FoundDecl = Ref->getFoundDecl();
226 if (auto *D = dyn_cast_or_null<VarDecl>(FoundDecl)) {
227 if (isa<ParmVarDecl>(D) || D->isLocalVarDecl())
228 return true;
229 if (auto *ImplicitP = dyn_cast<ImplicitParamDecl>(D)) {
230 auto Kind = ImplicitP->getParameterKind();
231 if (Kind == ImplicitParamKind::ObjCSelf ||
235 return true;
236 }
237 } else if (auto *BD = dyn_cast_or_null<BindingDecl>(FoundDecl)) {
238 VarDecl *VD = BD->getHoldingVar();
239 if (VD && (isa<ParmVarDecl>(VD) || VD->isLocalVarDecl()))
240 return true;
241 }
242 }
244 return true; // A temporary lives until the end of this statement.
246 return true;
247
248 // TODO: checker for method calls on non-refcounted objects
249 return isa<CXXThisExpr>(E);
250}
251
252bool isNullPtr(const clang::Expr *E) {
254 return true;
255 if (auto *Int = dyn_cast_or_null<IntegerLiteral>(E)) {
256 if (Int->getValue().isZero())
257 return true;
258 }
259 return false;
260}
261
263 if (auto *MCE = dyn_cast<CXXMemberCallExpr>(E)) {
264 if (auto *Callee = MCE->getDirectCallee()) {
265 auto Name = safeGetName(Callee);
266 if (Name == "get" || Name == "ptr")
267 E = MCE->getImplicitObjectArgument();
268 if (isa<CXXConversionDecl>(Callee))
269 E = MCE->getImplicitObjectArgument();
270 }
271 } else if (auto *OCE = dyn_cast<CXXOperatorCallExpr>(E)) {
272 if (OCE->getOperator() == OO_Star && OCE->getNumArgs() == 1)
273 E = OCE->getArg(0);
274 }
275 const ValueDecl *D = nullptr;
276 if (auto *ME = dyn_cast<MemberExpr>(E))
277 D = ME->getMemberDecl();
278 else if (auto *IVR = dyn_cast<ObjCIvarRefExpr>(E))
279 D = IVR->getDecl();
280 if (!D)
281 return false;
282 auto T = D->getType();
283 return isOwnerPtrType(T) && T.isConstQualified();
284}
285
287 auto *ME = dyn_cast<MemberExpr>(E);
288 if (!ME)
289 return false;
290 auto *Base = ME->getBase();
291 if (!Base)
292 return false;
293 if (!isa<CXXThisExpr>(Base->IgnoreParenCasts()))
294 return false;
295 auto *D = ME->getMemberDecl();
296 if (!D)
297 return false;
298 auto T = D->getType();
299 auto *CXXRD = T->getAsCXXRecordDecl();
300 if (!CXXRD)
301 return false;
302 auto result = isCheckedPtrCapable(CXXRD);
303 return result && *result;
304}
305
307 : public ConstStmtVisitor<EnsureFunctionVisitor, bool> {
308public:
309 bool VisitStmt(const Stmt *S) {
310 for (const Stmt *Child : S->children()) {
311 if (Child && !Visit(Child))
312 return false;
313 }
314 return true;
315 }
316
317 bool VisitReturnStmt(const ReturnStmt *RS) {
318 if (auto *RV = RS->getRetValue()) {
319 RV = RV->IgnoreParenCasts();
320 if (isNullPtr(RV))
321 return true;
322 return isConstOwnerPtrMemberExpr(RV);
323 }
324 return false;
325 }
326};
327
329 auto *MCE = dyn_cast<CXXMemberCallExpr>(E);
330 if (!MCE)
331 return false;
332 auto *Callee = MCE->getDirectCallee();
333 if (!Callee)
334 return false;
335 auto *Body = Callee->getBody();
336 if (!Body || Callee->isVirtualAsWritten())
337 return false;
338 auto [CacheIt, IsNew] = Cache.insert(std::make_pair(Callee, false));
339 if (IsNew)
340 CacheIt->second = EnsureFunctionVisitor().Visit(Body);
341 return CacheIt->second;
342}
343
344} // namespace clang
Defines the C++ Decl subclasses, other than those for templates (found in DeclTemplate....
Defines the clang::Expr interface and subclasses for C++ expressions.
Represents a C++ struct/union/class.
Definition DeclCXX.h:258
ConstStmtVisitor - This class implements a simple visitor for Stmt subclasses.
Decl - This represents one declaration (or definition), e.g.
Definition DeclBase.h:86
bool isACallToEnsureFn(const Expr *E) const
Definition ASTUtils.cpp:328
bool VisitReturnStmt(const ReturnStmt *RS)
Definition ASTUtils.cpp:317
bool VisitStmt(const Stmt *S)
Definition ASTUtils.cpp:309
This represents one expression.
Definition Expr.h:112
Expr * IgnoreParenCasts() LLVM_READONLY
Skip past any parentheses and casts which might surround this expression until reaching a fixed point...
Definition Expr.cpp:3090
A (possibly-)qualified type.
Definition TypeBase.h:937
ReturnStmt - This represents a return, optionally of an expression: return; return 4;.
Definition Stmt.h:3160
Expr * getRetValue()
Definition Stmt.h:3187
Smart pointer class that efficiently represents Objective-C method names.
StringRef getNameForSlot(unsigned argIndex) const
Retrieve the name at a given position in the selector.
unsigned getNumArgs() const
Stmt - This represents one statement.
Definition Stmt.h:85
child_range children()
Definition Stmt.cpp:295
Represent the declaration of a variable (in which case it is an lvalue) a function (in which case it ...
Definition Decl.h:712
QualType getType() const
Definition Decl.h:723
Represents a variable declaration or definition.
Definition Decl.h:926
bool isLocalVarDecl() const
Returns true for local variable declarations other than parameters.
Definition Decl.h:1253
const internal::VariadicAllOfMatcher< Decl > decl
Matches declarations.
The JSON file list parser is used to communicate input to InstallAPI.
bool isCtorOfSafePtr(const clang::FunctionDecl *F)
bool isa(CodeGen::Address addr)
Definition Address.h:330
bool isExprToGetCheckedPtrCapableMember(const clang::Expr *E)
Definition ASTUtils.cpp:286
bool isPtrConversion(const FunctionDecl *F)
std::optional< bool > isCheckedPtrCapable(const clang::CXXRecordDecl *R)
bool tryToFindPtrOrigin(const Expr *E, bool StopAtFirstRefCountedObj, std::function< bool(const clang::CXXRecordDecl *)> isSafePtr, std::function< bool(const clang::QualType)> isSafePtrType, std::function< bool(const clang::Expr *, bool)> callback)
This function de-facto defines a set of transformations that we consider safe (in heuristical sense).
Definition ASTUtils.cpp:25
bool isASafeCallArg(const Expr *E)
For E referring to a ref-countable/-counted pointer/reference we return whether it's a safe call argu...
Definition ASTUtils.cpp:222
const FunctionProtoType * T
bool isRefCounted(const CXXRecordDecl *R)
bool isOwnerPtrType(const clang::QualType T)
std::optional< bool > isGetterOfSafePtr(const CXXMethodDecl *M)
bool isRetainPtrOrOSPtr(const std::string &Name)
bool isRefType(const std::string &Name)
bool isSafePtr(clang::CXXRecordDecl *Decl)
Definition ASTUtils.cpp:21
std::string safeGetName(const T *ASTNode)
Definition ASTUtils.h:90
bool isSingleton(const NamedDecl *F)
bool isNullPtr(const clang::Expr *E)
Definition ASTUtils.cpp:252
bool isCheckedPtr(const std::string &Name)
U cast(CodeGen::Address addr)
Definition Address.h:327
@ Class
The "class" keyword introduces the elaborated-type-specifier.
Definition TypeBase.h:5876
@ CXXThis
Parameter for C++ 'this' argument.
Definition Decl.h:1734
@ CXXVTT
Parameter for C++ virtual table pointers.
Definition Decl.h:1737
@ ObjCSelf
Parameter for Objective-C 'self' argument.
Definition Decl.h:1728
@ ObjCCmd
Parameter for Objective-C '_cmd' argument.
Definition Decl.h:1731
bool isConstOwnerPtrMemberExpr(const clang::Expr *E)
Definition ASTUtils.cpp:262
int const char * function
Definition c++config.h:31