clang  10.0.0svn
LLVMConventionsChecker.cpp
Go to the documentation of this file.
1 //=== LLVMConventionsChecker.cpp - Check LLVM codebase conventions ---*- C++ -*-
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This defines LLVMConventionsChecker, a bunch of small little checks
10 // for checking specific coding conventions in the LLVM/Clang codebase.
11 //
12 //===----------------------------------------------------------------------===//
13 
15 #include "clang/AST/DeclTemplate.h"
16 #include "clang/AST/StmtVisitor.h"
19 #include "llvm/ADT/SmallString.h"
20 #include "llvm/Support/raw_ostream.h"
21 
22 using namespace clang;
23 using namespace ento;
24 
25 //===----------------------------------------------------------------------===//
26 // Generic type checking routines.
27 //===----------------------------------------------------------------------===//
28 
29 static bool IsLLVMStringRef(QualType T) {
30  const RecordType *RT = T->getAs<RecordType>();
31  if (!RT)
32  return false;
33 
34  return StringRef(QualType(RT, 0).getAsString()) == "class StringRef";
35 }
36 
37 /// Check whether the declaration is semantically inside the top-level
38 /// namespace named by ns.
39 static bool InNamespace(const Decl *D, StringRef NS) {
40  const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(D->getDeclContext());
41  if (!ND)
42  return false;
43  const IdentifierInfo *II = ND->getIdentifier();
44  if (!II || !II->getName().equals(NS))
45  return false;
46  return isa<TranslationUnitDecl>(ND->getDeclContext());
47 }
48 
49 static bool IsStdString(QualType T) {
50  if (const ElaboratedType *QT = T->getAs<ElaboratedType>())
51  T = QT->getNamedType();
52 
53  const TypedefType *TT = T->getAs<TypedefType>();
54  if (!TT)
55  return false;
56 
57  const TypedefNameDecl *TD = TT->getDecl();
58 
59  if (!TD->isInStdNamespace())
60  return false;
61 
62  return TD->getName() == "string";
63 }
64 
65 static bool IsClangType(const RecordDecl *RD) {
66  return RD->getName() == "Type" && InNamespace(RD, "clang");
67 }
68 
69 static bool IsClangDecl(const RecordDecl *RD) {
70  return RD->getName() == "Decl" && InNamespace(RD, "clang");
71 }
72 
73 static bool IsClangStmt(const RecordDecl *RD) {
74  return RD->getName() == "Stmt" && InNamespace(RD, "clang");
75 }
76 
77 static bool IsClangAttr(const RecordDecl *RD) {
78  return RD->getName() == "Attr" && InNamespace(RD, "clang");
79 }
80 
81 static bool IsStdVector(QualType T) {
83  if (!TS)
84  return false;
85 
86  TemplateName TM = TS->getTemplateName();
88 
89  if (!TD || !InNamespace(TD, "std"))
90  return false;
91 
92  return TD->getName() == "vector";
93 }
94 
95 static bool IsSmallVector(QualType T) {
97  if (!TS)
98  return false;
99 
100  TemplateName TM = TS->getTemplateName();
101  TemplateDecl *TD = TM.getAsTemplateDecl();
102 
103  if (!TD || !InNamespace(TD, "llvm"))
104  return false;
105 
106  return TD->getName() == "SmallVector";
107 }
108 
109 //===----------------------------------------------------------------------===//
110 // CHECK: a StringRef should not be bound to a temporary std::string whose
111 // lifetime is shorter than the StringRef's.
112 //===----------------------------------------------------------------------===//
113 
114 namespace {
115 class StringRefCheckerVisitor : public StmtVisitor<StringRefCheckerVisitor> {
116  const Decl *DeclWithIssue;
117  BugReporter &BR;
118  const CheckerBase *Checker;
119 
120 public:
121  StringRefCheckerVisitor(const Decl *declWithIssue, BugReporter &br,
122  const CheckerBase *checker)
123  : DeclWithIssue(declWithIssue), BR(br), Checker(checker) {}
124  void VisitChildren(Stmt *S) {
125  for (Stmt *Child : S->children())
126  if (Child)
127  Visit(Child);
128  }
129  void VisitStmt(Stmt *S) { VisitChildren(S); }
130  void VisitDeclStmt(DeclStmt *DS);
131 private:
132  void VisitVarDecl(VarDecl *VD);
133 };
134 } // end anonymous namespace
135 
136 static void CheckStringRefAssignedTemporary(const Decl *D, BugReporter &BR,
137  const CheckerBase *Checker) {
138  StringRefCheckerVisitor walker(D, BR, Checker);
139  walker.Visit(D->getBody());
140 }
141 
142 void StringRefCheckerVisitor::VisitDeclStmt(DeclStmt *S) {
143  VisitChildren(S);
144 
145  for (auto *I : S->decls())
146  if (VarDecl *VD = dyn_cast<VarDecl>(I))
147  VisitVarDecl(VD);
148 }
149 
150 void StringRefCheckerVisitor::VisitVarDecl(VarDecl *VD) {
151  Expr *Init = VD->getInit();
152  if (!Init)
153  return;
154 
155  // Pattern match for:
156  // StringRef x = call() (where call returns std::string)
157  if (!IsLLVMStringRef(VD->getType()))
158  return;
159  ExprWithCleanups *Ex1 = dyn_cast<ExprWithCleanups>(Init);
160  if (!Ex1)
161  return;
162  CXXConstructExpr *Ex2 = dyn_cast<CXXConstructExpr>(Ex1->getSubExpr());
163  if (!Ex2 || Ex2->getNumArgs() != 1)
164  return;
165  ImplicitCastExpr *Ex3 = dyn_cast<ImplicitCastExpr>(Ex2->getArg(0));
166  if (!Ex3)
167  return;
168  CXXConstructExpr *Ex4 = dyn_cast<CXXConstructExpr>(Ex3->getSubExpr());
169  if (!Ex4 || Ex4->getNumArgs() != 1)
170  return;
171  ImplicitCastExpr *Ex5 = dyn_cast<ImplicitCastExpr>(Ex4->getArg(0));
172  if (!Ex5)
173  return;
174  CXXBindTemporaryExpr *Ex6 = dyn_cast<CXXBindTemporaryExpr>(Ex5->getSubExpr());
175  if (!Ex6 || !IsStdString(Ex6->getType()))
176  return;
177 
178  // Okay, badness! Report an error.
179  const char *desc = "StringRef should not be bound to temporary "
180  "std::string that it outlives";
181  PathDiagnosticLocation VDLoc =
182  PathDiagnosticLocation::createBegin(VD, BR.getSourceManager());
183  BR.EmitBasicReport(DeclWithIssue, Checker, desc, "LLVM Conventions", desc,
184  VDLoc, Init->getSourceRange());
185 }
186 
187 //===----------------------------------------------------------------------===//
188 // CHECK: Clang AST nodes should not have fields that can allocate
189 // memory.
190 //===----------------------------------------------------------------------===//
191 
192 static bool AllocatesMemory(QualType T) {
193  return IsStdVector(T) || IsStdString(T) || IsSmallVector(T);
194 }
195 
196 // This type checking could be sped up via dynamic programming.
197 static bool IsPartOfAST(const CXXRecordDecl *R) {
198  if (IsClangStmt(R) || IsClangType(R) || IsClangDecl(R) || IsClangAttr(R))
199  return true;
200 
201  for (const auto &BS : R->bases()) {
202  QualType T = BS.getType();
203  if (const RecordType *baseT = T->getAs<RecordType>()) {
204  CXXRecordDecl *baseD = cast<CXXRecordDecl>(baseT->getDecl());
205  if (IsPartOfAST(baseD))
206  return true;
207  }
208  }
209 
210  return false;
211 }
212 
213 namespace {
214 class ASTFieldVisitor {
215  SmallVector<FieldDecl*, 10> FieldChain;
216  const CXXRecordDecl *Root;
217  BugReporter &BR;
218  const CheckerBase *Checker;
219 
220 public:
221  ASTFieldVisitor(const CXXRecordDecl *root, BugReporter &br,
222  const CheckerBase *checker)
223  : Root(root), BR(br), Checker(checker) {}
224 
225  void Visit(FieldDecl *D);
226  void ReportError(QualType T);
227 };
228 } // end anonymous namespace
229 
230 static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR,
231  const CheckerBase *Checker) {
232  if (!IsPartOfAST(R))
233  return;
234 
235  for (auto *I : R->fields()) {
236  ASTFieldVisitor walker(R, BR, Checker);
237  walker.Visit(I);
238  }
239 }
240 
241 void ASTFieldVisitor::Visit(FieldDecl *D) {
242  FieldChain.push_back(D);
243 
244  QualType T = D->getType();
245 
246  if (AllocatesMemory(T))
247  ReportError(T);
248 
249  if (const RecordType *RT = T->getAs<RecordType>()) {
250  const RecordDecl *RD = RT->getDecl()->getDefinition();
251  for (auto *I : RD->fields())
252  Visit(I);
253  }
254 
255  FieldChain.pop_back();
256 }
257 
258 void ASTFieldVisitor::ReportError(QualType T) {
259  SmallString<1024> buf;
260  llvm::raw_svector_ostream os(buf);
261 
262  os << "AST class '" << Root->getName() << "' has a field '"
263  << FieldChain.front()->getName() << "' that allocates heap memory";
264  if (FieldChain.size() > 1) {
265  os << " via the following chain: ";
266  bool isFirst = true;
267  for (SmallVectorImpl<FieldDecl*>::iterator I=FieldChain.begin(),
268  E=FieldChain.end(); I!=E; ++I) {
269  if (!isFirst)
270  os << '.';
271  else
272  isFirst = false;
273  os << (*I)->getName();
274  }
275  }
276  os << " (type " << FieldChain.back()->getType().getAsString() << ")";
277 
278  // Note that this will fire for every translation unit that uses this
279  // class. This is suboptimal, but at least scan-build will merge
280  // duplicate HTML reports. In the future we need a unified way of merging
281  // duplicate reports across translation units. For C++ classes we cannot
282  // just report warnings when we see an out-of-line method definition for a
283  // class, as that heuristic doesn't always work (the complete definition of
284  // the class may be in the header file, for example).
285  PathDiagnosticLocation L = PathDiagnosticLocation::createBegin(
286  FieldChain.front(), BR.getSourceManager());
287  BR.EmitBasicReport(Root, Checker, "AST node allocates heap memory",
288  "LLVM Conventions", os.str(), L);
289 }
290 
291 //===----------------------------------------------------------------------===//
292 // LLVMConventionsChecker
293 //===----------------------------------------------------------------------===//
294 
295 namespace {
296 class LLVMConventionsChecker : public Checker<
297  check::ASTDecl<CXXRecordDecl>,
298  check::ASTCodeBody > {
299 public:
300  void checkASTDecl(const CXXRecordDecl *R, AnalysisManager& mgr,
301  BugReporter &BR) const {
302  if (R->isCompleteDefinition())
303  CheckASTMemory(R, BR, this);
304  }
305 
306  void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
307  BugReporter &BR) const {
308  CheckStringRefAssignedTemporary(D, BR, this);
309  }
310 };
311 }
312 
313 void ento::registerLLVMConventionsChecker(CheckerManager &mgr) {
314  mgr.registerChecker<LLVMConventionsChecker>();
315 }
316 
317 bool ento::shouldRegisterLLVMConventionsChecker(const LangOptions &LO) {
318  return true;
319 }
const Expr * getSubExpr() const
Definition: Expr.h:938
Represents a type that was referred to using an elaborated type keyword, e.g., struct S...
Definition: Type.h:5205
A (possibly-)qualified type.
Definition: Type.h:643
base_class_range bases()
Definition: DeclCXX.h:589
static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR, const CheckerBase *Checker)
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition: DeclBase.h:986
Stmt - This represents one statement.
Definition: Stmt.h:66
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:88
Defines the C++ template declaration subclasses.
Represent a C++ namespace.
Definition: Decl.h:522
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1422
bool isCompleteDefinition() const
Return true if this decl has its body fully specified.
Definition: Decl.h:3238
Represents a variable declaration or definition.
Definition: Decl.h:827
const T * getAs() const
Member-template getAs<specific type>&#39;.
Definition: Type.h:6858
Represents an expression – generally a full-expression – that introduces cleanups to be run at the ...
Definition: ExprCXX.h:3306
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:269
Represents a struct/union/class.
Definition: Decl.h:3662
One of these records is kept for each identifier that is lexed.
TemplateDecl * getAsTemplateDecl() const
Retrieve the underlying template declaration that this template name refers to, if known...
RecordDecl * getDefinition() const
Returns the RecordDecl that actually defines this struct/union/class.
Definition: Decl.h:3867
field_range fields() const
Definition: Decl.h:3877
Represents a member of a struct/union/class.
Definition: Decl.h:2643
TemplateName getTemplateName() const
Retrieve the name of the template that we are specializing.
Definition: Type.h:4980
Expr * getSubExpr()
Definition: Expr.h:3177
Keeps track of the various options that can be enabled, which controls the dialect of C or C++ that i...
Definition: LangOptions.h:49
child_range children()
Definition: Stmt.cpp:223
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1373
static bool IsPartOfAST(const CXXRecordDecl *R)
static bool IsStdString(QualType T)
This represents one expression.
Definition: Expr.h:108
llvm::StringRef getAsString(SyncScope S)
Definition: SyncScope.h:50
DeclContext * getDeclContext()
Definition: DeclBase.h:438
Represents a C++ template name within the type system.
Definition: TemplateName.h:187
static bool IsClangType(const RecordDecl *RD)
QualType getType() const
Definition: Expr.h:137
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
static bool IsSmallVector(QualType T)
DeclStmt - Adaptor class for mixing declarations with statements and expressions. ...
Definition: Stmt.h:1213
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:182
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
Definition: Expr.h:3249
static bool IsStdVector(QualType T)
static bool IsClangDecl(const RecordDecl *RD)
static bool IsClangStmt(const RecordDecl *RD)
StringRef getName() const
Return the actual identifier string.
Base class for declarations which introduce a typedef-name.
Definition: Decl.h:2985
Dataflow Directional Tag Classes.
The base class of all kinds of template declarations (e.g., class, function, etc.).
Definition: DeclTemplate.h:387
const Expr * getInit() const
Definition: Decl.h:1234
static bool InNamespace(const Decl *D, StringRef NS)
Check whether the declaration is semantically inside the top-level namespace named by ns...
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4444
static bool IsLLVMStringRef(QualType T)
Expr * getArg(unsigned Arg)
Return the specified argument.
Definition: ExprCXX.h:1573
decl_range decls()
Definition: Stmt.h:1261
TypedefNameDecl * getDecl() const
Definition: Type.h:4206
Represents a C++ struct/union/class.
Definition: DeclCXX.h:255
static void CheckStringRefAssignedTemporary(const Decl *D, BugReporter &BR, const CheckerBase *Checker)
SourceRange getSourceRange() const LLVM_READONLY
SourceLocation tokens are not useful in isolation - they are low level value objects created/interpre...
Definition: Stmt.cpp:262
static bool AllocatesMemory(QualType T)
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:275
Represents a type template specialization; the template must be a class template, a type alias templa...
Definition: Type.h:4917
QualType getType() const
Definition: Decl.h:655
unsigned getNumArgs() const
Return the number of arguments to the constructor call.
Definition: ExprCXX.h:1570
bool isInStdNamespace() const
Definition: DeclBase.cpp:357
static bool IsClangAttr(const RecordDecl *RD)