clang 17.0.0git
LLVMConventionsChecker.cpp
Go to the documentation of this file.
1//=== LLVMConventionsChecker.cpp - Check LLVM codebase conventions ---*- C++ -*-
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8//
9// This defines LLVMConventionsChecker, a bunch of small little checks
10// for checking specific coding conventions in the LLVM/Clang codebase.
11//
12//===----------------------------------------------------------------------===//
13
19#include "llvm/ADT/SmallString.h"
20#include "llvm/Support/raw_ostream.h"
21
22using namespace clang;
23using namespace ento;
24
25//===----------------------------------------------------------------------===//
26// Generic type checking routines.
27//===----------------------------------------------------------------------===//
28
29static bool IsLLVMStringRef(QualType T) {
30 const RecordType *RT = T->getAs<RecordType>();
31 if (!RT)
32 return false;
33
34 return StringRef(QualType(RT, 0).getAsString()) == "class StringRef";
35}
36
37/// Check whether the declaration is semantically inside the top-level
38/// namespace named by ns.
39static bool InNamespace(const Decl *D, StringRef NS) {
40 const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(D->getDeclContext());
41 if (!ND)
42 return false;
43 const IdentifierInfo *II = ND->getIdentifier();
44 if (!II || !II->getName().equals(NS))
45 return false;
46 return isa<TranslationUnitDecl>(ND->getDeclContext());
47}
48
49static bool IsStdString(QualType T) {
50 if (const ElaboratedType *QT = T->getAs<ElaboratedType>())
51 T = QT->getNamedType();
52
53 const TypedefType *TT = T->getAs<TypedefType>();
54 if (!TT)
55 return false;
56
57 const TypedefNameDecl *TD = TT->getDecl();
58
59 if (!TD->isInStdNamespace())
60 return false;
61
62 return TD->getName() == "string";
63}
64
65static bool IsClangType(const RecordDecl *RD) {
66 return RD->getName() == "Type" && InNamespace(RD, "clang");
67}
68
69static bool IsClangDecl(const RecordDecl *RD) {
70 return RD->getName() == "Decl" && InNamespace(RD, "clang");
71}
72
73static bool IsClangStmt(const RecordDecl *RD) {
74 return RD->getName() == "Stmt" && InNamespace(RD, "clang");
75}
76
77static bool IsClangAttr(const RecordDecl *RD) {
78 return RD->getName() == "Attr" && InNamespace(RD, "clang");
79}
80
81static bool IsStdVector(QualType T) {
83 if (!TS)
84 return false;
85
88
89 if (!TD || !InNamespace(TD, "std"))
90 return false;
91
92 return TD->getName() == "vector";
93}
94
95static bool IsSmallVector(QualType T) {
97 if (!TS)
98 return false;
99
100 TemplateName TM = TS->getTemplateName();
102
103 if (!TD || !InNamespace(TD, "llvm"))
104 return false;
105
106 return TD->getName() == "SmallVector";
107}
108
109//===----------------------------------------------------------------------===//
110// CHECK: a StringRef should not be bound to a temporary std::string whose
111// lifetime is shorter than the StringRef's.
112//===----------------------------------------------------------------------===//
113
114namespace {
115class StringRefCheckerVisitor : public StmtVisitor<StringRefCheckerVisitor> {
116 const Decl *DeclWithIssue;
117 BugReporter &BR;
118 const CheckerBase *Checker;
119
120public:
121 StringRefCheckerVisitor(const Decl *declWithIssue, BugReporter &br,
122 const CheckerBase *checker)
123 : DeclWithIssue(declWithIssue), BR(br), Checker(checker) {}
124 void VisitChildren(Stmt *S) {
125 for (Stmt *Child : S->children())
126 if (Child)
127 Visit(Child);
128 }
129 void VisitStmt(Stmt *S) { VisitChildren(S); }
130 void VisitDeclStmt(DeclStmt *DS);
131private:
132 void VisitVarDecl(VarDecl *VD);
133};
134} // end anonymous namespace
135
137 const CheckerBase *Checker) {
138 StringRefCheckerVisitor walker(D, BR, Checker);
139 walker.Visit(D->getBody());
140}
141
142void StringRefCheckerVisitor::VisitDeclStmt(DeclStmt *S) {
143 VisitChildren(S);
144
145 for (auto *I : S->decls())
146 if (VarDecl *VD = dyn_cast<VarDecl>(I))
147 VisitVarDecl(VD);
148}
149
150void StringRefCheckerVisitor::VisitVarDecl(VarDecl *VD) {
151 Expr *Init = VD->getInit();
152 if (!Init)
153 return;
154
155 // Pattern match for:
156 // StringRef x = call() (where call returns std::string)
157 if (!IsLLVMStringRef(VD->getType()))
158 return;
159 ExprWithCleanups *Ex1 = dyn_cast<ExprWithCleanups>(Init);
160 if (!Ex1)
161 return;
162 CXXConstructExpr *Ex2 = dyn_cast<CXXConstructExpr>(Ex1->getSubExpr());
163 if (!Ex2 || Ex2->getNumArgs() != 1)
164 return;
165 ImplicitCastExpr *Ex3 = dyn_cast<ImplicitCastExpr>(Ex2->getArg(0));
166 if (!Ex3)
167 return;
168 CXXConstructExpr *Ex4 = dyn_cast<CXXConstructExpr>(Ex3->getSubExpr());
169 if (!Ex4 || Ex4->getNumArgs() != 1)
170 return;
171 ImplicitCastExpr *Ex5 = dyn_cast<ImplicitCastExpr>(Ex4->getArg(0));
172 if (!Ex5)
173 return;
174 CXXBindTemporaryExpr *Ex6 = dyn_cast<CXXBindTemporaryExpr>(Ex5->getSubExpr());
175 if (!Ex6 || !IsStdString(Ex6->getType()))
176 return;
177
178 // Okay, badness! Report an error.
179 const char *desc = "StringRef should not be bound to temporary "
180 "std::string that it outlives";
183 BR.EmitBasicReport(DeclWithIssue, Checker, desc, "LLVM Conventions", desc,
184 VDLoc, Init->getSourceRange());
185}
186
187//===----------------------------------------------------------------------===//
188// CHECK: Clang AST nodes should not have fields that can allocate
189// memory.
190//===----------------------------------------------------------------------===//
191
192static bool AllocatesMemory(QualType T) {
193 return IsStdVector(T) || IsStdString(T) || IsSmallVector(T);
194}
195
196// This type checking could be sped up via dynamic programming.
197static bool IsPartOfAST(const CXXRecordDecl *R) {
198 if (IsClangStmt(R) || IsClangType(R) || IsClangDecl(R) || IsClangAttr(R))
199 return true;
200
201 for (const auto &BS : R->bases()) {
202 QualType T = BS.getType();
203 if (const RecordType *baseT = T->getAs<RecordType>()) {
204 CXXRecordDecl *baseD = cast<CXXRecordDecl>(baseT->getDecl());
205 if (IsPartOfAST(baseD))
206 return true;
207 }
208 }
209
210 return false;
211}
212
213namespace {
214class ASTFieldVisitor {
216 const CXXRecordDecl *Root;
217 BugReporter &BR;
218 const CheckerBase *Checker;
219
220public:
221 ASTFieldVisitor(const CXXRecordDecl *root, BugReporter &br,
222 const CheckerBase *checker)
223 : Root(root), BR(br), Checker(checker) {}
224
225 void Visit(FieldDecl *D);
226 void ReportError(QualType T);
227};
228} // end anonymous namespace
229
230static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR,
231 const CheckerBase *Checker) {
232 if (!IsPartOfAST(R))
233 return;
234
235 for (auto *I : R->fields()) {
236 ASTFieldVisitor walker(R, BR, Checker);
237 walker.Visit(I);
238 }
239}
240
241void ASTFieldVisitor::Visit(FieldDecl *D) {
242 FieldChain.push_back(D);
243
244 QualType T = D->getType();
245
246 if (AllocatesMemory(T))
247 ReportError(T);
248
249 if (const RecordType *RT = T->getAs<RecordType>()) {
250 const RecordDecl *RD = RT->getDecl()->getDefinition();
251 for (auto *I : RD->fields())
252 Visit(I);
253 }
254
255 FieldChain.pop_back();
256}
257
258void ASTFieldVisitor::ReportError(QualType T) {
260 llvm::raw_svector_ostream os(buf);
261
262 os << "AST class '" << Root->getName() << "' has a field '"
263 << FieldChain.front()->getName() << "' that allocates heap memory";
264 if (FieldChain.size() > 1) {
265 os << " via the following chain: ";
266 bool isFirst = true;
267 for (SmallVectorImpl<FieldDecl*>::iterator I=FieldChain.begin(),
268 E=FieldChain.end(); I!=E; ++I) {
269 if (!isFirst)
270 os << '.';
271 else
272 isFirst = false;
273 os << (*I)->getName();
274 }
275 }
276 os << " (type " << FieldChain.back()->getType() << ")";
277
278 // Note that this will fire for every translation unit that uses this
279 // class. This is suboptimal, but at least scan-build will merge
280 // duplicate HTML reports. In the future we need a unified way of merging
281 // duplicate reports across translation units. For C++ classes we cannot
282 // just report warnings when we see an out-of-line method definition for a
283 // class, as that heuristic doesn't always work (the complete definition of
284 // the class may be in the header file, for example).
286 FieldChain.front(), BR.getSourceManager());
287 BR.EmitBasicReport(Root, Checker, "AST node allocates heap memory",
288 "LLVM Conventions", os.str(), L);
289}
290
291//===----------------------------------------------------------------------===//
292// LLVMConventionsChecker
293//===----------------------------------------------------------------------===//
294
295namespace {
296class LLVMConventionsChecker : public Checker<
297 check::ASTDecl<CXXRecordDecl>,
298 check::ASTCodeBody > {
299public:
300 void checkASTDecl(const CXXRecordDecl *R, AnalysisManager& mgr,
301 BugReporter &BR) const {
302 if (R->isCompleteDefinition())
303 CheckASTMemory(R, BR, this);
304 }
305
306 void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
307 BugReporter &BR) const {
309 }
310};
311}
312
313void ento::registerLLVMConventionsChecker(CheckerManager &mgr) {
314 mgr.registerChecker<LLVMConventionsChecker>();
315}
316
317bool ento::shouldRegisterLLVMConventionsChecker(const CheckerManager &mgr) {
318 return true;
319}
Defines the C++ template declaration subclasses.
static bool IsStdVector(QualType T)
static bool IsClangType(const RecordDecl *RD)
static bool AllocatesMemory(QualType T)
static bool IsClangStmt(const RecordDecl *RD)
static bool InNamespace(const Decl *D, StringRef NS)
Check whether the declaration is semantically inside the top-level namespace named by ns.
static bool IsClangAttr(const RecordDecl *RD)
static bool IsStdString(QualType T)
static bool IsClangDecl(const RecordDecl *RD)
static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR, const CheckerBase *Checker)
static bool IsPartOfAST(const CXXRecordDecl *R)
static bool IsSmallVector(QualType T)
static void CheckStringRefAssignedTemporary(const Decl *D, BugReporter &BR, const CheckerBase *Checker)
static bool IsLLVMStringRef(QualType T)
Represents binding an expression to a temporary.
Definition: ExprCXX.h:1470
Represents a call to a C++ constructor.
Definition: ExprCXX.h:1518
Expr * getArg(unsigned Arg)
Return the specified argument.
Definition: ExprCXX.h:1669
unsigned getNumArgs() const
Return the number of arguments to the constructor call.
Definition: ExprCXX.h:1666
Represents a C++ struct/union/class.
Definition: DeclCXX.h:254
base_class_range bases()
Definition: DeclCXX.h:602
Expr * getSubExpr()
Definition: Expr.h:3532
DeclStmt - Adaptor class for mixing declarations with statements and expressions.
Definition: Stmt.h:1311
Decl - This represents one declaration (or definition), e.g.
Definition: DeclBase.h:83
bool isInStdNamespace() const
Definition: DeclBase.cpp:403
virtual Stmt * getBody() const
getBody - If this Decl represents a declaration for a body of code, such as a function or method defi...
Definition: DeclBase.h:1052
DeclContext * getDeclContext()
Definition: DeclBase.h:441
Represents a type that was referred to using an elaborated type keyword, e.g., struct S,...
Definition: Type.h:5650
Represents an expression – generally a full-expression – that introduces cleanups to be run at the en...
Definition: ExprCXX.h:3420
This represents one expression.
Definition: Expr.h:110
QualType getType() const
Definition: Expr.h:142
Represents a member of a struct/union/class.
Definition: Decl.h:2943
const Expr * getSubExpr() const
Definition: Expr.h:1028
One of these records is kept for each identifier that is lexed.
StringRef getName() const
Return the actual identifier string.
ImplicitCastExpr - Allows us to explicitly represent implicit type conversions, which have no direct ...
Definition: Expr.h:3629
IdentifierInfo * getIdentifier() const
Get the identifier that names this declaration, if there is one.
Definition: Decl.h:268
StringRef getName() const
Get the name of identifier for this declaration as a StringRef.
Definition: Decl.h:274
Represent a C++ namespace.
Definition: Decl.h:544
A (possibly-)qualified type.
Definition: Type.h:736
Represents a struct/union/class.
Definition: Decl.h:3996
field_range fields() const
Definition: Decl.h:4223
RecordDecl * getDefinition() const
Returns the RecordDecl that actually defines this struct/union/class.
Definition: Decl.h:4208
A helper class that allows the use of isa/cast/dyncast to detect TagType objects of structs/unions/cl...
Definition: Type.h:4828
RetTy Visit(PTR(Stmt) S, ParamTys... P)
Definition: StmtVisitor.h:43
StmtVisitor - This class implements a simple visitor for Stmt subclasses.
Definition: StmtVisitor.h:184
Stmt - This represents one statement.
Definition: Stmt.h:72
bool isCompleteDefinition() const
Return true if this decl has its body fully specified.
Definition: Decl.h:3541
The base class of all kinds of template declarations (e.g., class, function, etc.).
Definition: DeclTemplate.h:407
Represents a C++ template name within the type system.
Definition: TemplateName.h:202
TemplateDecl * getAsTemplateDecl() const
Retrieve the underlying template declaration that this template name refers to, if known.
Represents a type template specialization; the template must be a class template, a type alias templa...
Definition: Type.h:5368
TemplateName getTemplateName() const
Retrieve the name of the template that we are specializing.
Definition: Type.h:5434
const T * getAs() const
Member-template getAs<specific type>'.
Definition: Type.h:7404
Base class for declarations which introduce a typedef-name.
Definition: Decl.h:3288
TypedefNameDecl * getDecl() const
Definition: Type.h:4558
QualType getType() const
Definition: Decl.h:714
Represents a variable declaration or definition.
Definition: Decl.h:915
const Expr * getInit() const
Definition: Decl.h:1327
BugReporter is a utility class for generating PathDiagnostics for analysis.
Definition: BugReporter.h:585
const SourceManager & getSourceManager()
Definition: BugReporter.h:616
void EmitBasicReport(const Decl *DeclWithIssue, const CheckerBase *Checker, StringRef BugName, StringRef BugCategory, StringRef BugStr, PathDiagnosticLocation Loc, ArrayRef< SourceRange > Ranges=std::nullopt, ArrayRef< FixItHint > Fixits=std::nullopt)
CHECKER * registerChecker(AT &&... Args)
Used to register checkers.
static PathDiagnosticLocation createBegin(const Decl *D, const SourceManager &SM)
Create a location for the beginning of the declaration.
llvm::StringRef getAsString(SyncScope S)
Definition: SyncScope.h:55