PtrTypesSemantics.h

Go to the documentation of this file.

//=======- PtrTypesSemantics.cpp ---------------------------------*- C++ -*-==//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
 
#ifndef LLVM_CLANG_ANALYZER_WEBKIT_PTRTYPESEMANTICS_H
#define LLVM_CLANG_ANALYZER_WEBKIT_PTRTYPESEMANTICS_H
 
#include "llvm/ADT/APInt.h"
#include "llvm/ADT/DenseMap.h"
#include "llvm/ADT/DenseSet.h"
#include "llvm/ADT/PointerUnion.h"
#include "llvm/ADT/SmallVector.h"
#include <optional>
#include <string>
 
namespace clang {
class CXXBaseSpecifier;
class CXXMethodDecl;
class CXXRecordDecl;
class Decl;
class FieldDecl;
class FunctionDecl;
class NamedDecl;
class QualType;
class RecordType;
class Stmt;
class TranslationUnitDecl;
class Type;
class TypedefDecl;
class VarDecl;
 
// Ref-countability of a type is implicitly defined by Ref<T> and RefPtr<T>
// implementation. It can be modeled as: type T having public methods ref() and
// deref()
 
// In WebKit there are two ref-counted templated smart pointers: RefPtr<T> and
// Ref<T>.
 
/// \returns CXXRecordDecl of the base if the type has ref as a public method,
/// nullptr if not, std::nullopt if inconclusive.
std::optional<const clang::CXXRecordDecl *>
hasPublicMethodInBase(const CXXBaseSpecifier *Base,
                      llvm::StringRef NameToMatch);
 
/// \returns true if \p Class is ref-countable, false if not, std::nullopt if
/// inconclusive.
std::optional<bool> isRefCountable(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is checked-pointer compatible, false if not,
/// std::nullopt if inconclusive.
std::optional<bool> isCheckedPtrCapable(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class implements the CanBorrow protocol, meaning a
/// Borrow<T> can be taken on it, false if not, std::nullopt if inconclusive.
std::optional<bool> isBorrowable(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is a Borrow<T>, false if not.
bool isBorrow(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p T is a Borrow<T>.
bool isBorrowType(const clang::QualType T);
 
/// \returns the innermost type reached by stripping every pointer/reference
/// layer from \p T; \p T itself if it has none; a null type if \p T is null.
clang::QualType pointeeType(clang::QualType T);
 
/// \returns the type a Borrow<T> specialization \p T borrows, or a null type
/// if \p T is not a template specialization whose first argument is a type.
clang::QualType borrowedType(clang::QualType T);
 
/// \returns true if a value of type \p T is a pointer/reference/view.
bool isView(const clang::QualType T);
 
/// \returns true if \p Class declares reference semantics structurally: it is
/// annotated [[gsl::Pointer]] (explicitly, or by Sema's inference for
/// standard types), derives from std::ranges::view_interface, is a standard
/// iterator adaptor, or is nested inside such a class, as the iterators of
/// standard views are.
bool isStdView(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is ref-counted, false if not.
bool isRefCounted(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is a CheckedPtr / CheckedRef, false if not.
bool isCheckedPtr(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is a RetainPtr, false if not.
bool isRetainPtrOrOSPtr(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is a weak smart pointer (WeakPtr, InlineWeakPtr,
/// etc...), false if not.
bool isWeakPtr(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is a smart pointer (RefPtr, WeakPtr, etc...),
/// false if not.
bool isSmartPtr(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p Class is ref-countable AND not ref-counted, false if
/// not, std::nullopt if inconclusive.
std::optional<bool> isUncounted(const clang::QualType T);
 
/// \returns true if \p Class is CheckedPtr capable AND not checked, false if
/// not, std::nullopt if inconclusive.
std::optional<bool> isUnchecked(const clang::QualType T);
 
/// An inter-procedural analysis facility that detects CF types with the
/// underlying pointer type.
class RetainTypeChecker {
  llvm::DenseMap<const RecordType *, const TypedefDecl *> CFPointees;
  llvm::DenseSet<const Type *> RecordlessTypes;
  bool IsARCEnabled{false};
  bool DefaultSynthProperties{true};
 
public:
  void visitTranslationUnitDecl(const TranslationUnitDecl *);
  void visitTypedef(const TypedefDecl *);
  bool isUnretained(const QualType, bool ignoreARC = false);
  bool isARCEnabled() const { return IsARCEnabled; }
  bool defaultSynthProperties() const { return DefaultSynthProperties; }
  const TypedefDecl *getCanonicalDecl(QualType);
};
 
/// \returns true if \p Class is ref-countable AND not ref-counted, false if
/// not, std::nullopt if inconclusive.
std::optional<bool> isUncounted(const clang::CXXRecordDecl* Class);
 
/// \returns true if \p Class is CheckedPtr capable AND not checked, false if
/// not, std::nullopt if inconclusive.
std::optional<bool> isUnchecked(const clang::CXXRecordDecl *Class);
 
/// \returns true if \p T is either a raw pointer or reference to an uncounted
/// class, false if not, std::nullopt if inconclusive.
std::optional<bool> isUncountedPtr(const clang::QualType T);
 
/// \returns true if \p T is either a raw pointer or reference to an unchecked
/// class, false if not, std::nullopt if inconclusive.
std::optional<bool> isUncheckedPtr(const clang::QualType T);
 
/// \returns true if \p T is a RefPtr, Ref, CheckedPtr, CheckedRef, or its
/// variant, false if not.
bool isRefOrCheckedPtrType(const clang::QualType T);
 
/// \returns true if \p T is a RetainPtr, false if not.
bool isRetainPtrOrOSPtrType(const clang::QualType T);
 
/// \returns true if \p T is a RefPtr, Ref, CheckedPtr, CheckedRef, or
/// unique_ptr, false if not.
bool isOwnerPtrType(const clang::QualType T);
 
/// \returns true if \p F creates ref-countable object from uncounted parameter,
/// false if not.
bool isCtorOfRefCounted(const clang::FunctionDecl *F);
 
/// \returns true if \p F creates checked ptr object from uncounted parameter,
/// false if not.
bool isCtorOfCheckedPtr(const clang::FunctionDecl *F);
 
/// \returns true if \p F creates ref-countable or checked ptr object from
/// uncounted parameter, false if not.
bool isCtorOfSafePtr(const clang::FunctionDecl *F);
 
/// \returns true if \p F is std::move or WTF::move.
bool isStdOrWTFMove(const clang::FunctionDecl *F);
 
/// \returns true if \p Name is RefPtr, Ref, or its variant, false if not.
bool isRefType(const std::string &Name);
 
/// \returns true if \p Name is CheckedRef or CheckedPtr, false if not.
bool isCheckedPtr(const std::string &Name);
 
/// \returns true if \p Name is Borrow, false if not.
bool isBorrow(const std::string &Name);
 
/// \returns true if \p Name is RetainPtr or its variant, false if not.
bool isRetainPtrOrOSPtr(const std::string &Name);
 
/// \returns true if \p Name is an owning smart pointer such as Ref, CheckedPtr,
/// and unique_ptr.
bool isOwnerPtr(const std::string &Name);
 
/// \returns true if \p Name is unique_ptr, UniqueRef, or LazyUniqueRef.
bool isUniquePtr(const std::string &Name);
 
/// \returns true if \p Name is a smart pointer type name, false if not.
bool isSmartPtrClass(const std::string &Name);
 
/// \returns true if \p M is getter of a ref-counted class, false if not.
std::optional<bool> isGetterOfSafePtr(const clang::CXXMethodDecl *Method);
 
/// \returns true if \p M is a getter of unique_ptr, UniqueRef, or
/// LazyUniqueRef, false if not.
bool isGetterOfUniquePtr(const clang::CXXMethodDecl *Method);
 
/// \returns true if \p F is a conversion between ref-countable or ref-counted
/// pointer types.
bool isPtrConversion(const FunctionDecl *F);
 
/// \returns true if \p F's return type is annotated with
/// [[clang::annotate_type("webkit.nodelete")]].
bool isNoDeleteFunction(const FunctionDecl *F);
 
/// \returns true if \p F is a builtin function which is considered trivial.
bool isTrivialBuiltinFunction(const FunctionDecl *F);
 
/// \returns true if \p F is a static singleton function.
bool isSingleton(const NamedDecl *F);
 
/// Explains why TrivialFunctionAnalysis rejected a statement, so that a
/// diagnostic can blame the code that is actually responsible.
struct NonTrivialityReason {
  /// The innermost non-trivial statement inside the analyzed function's own
  /// body. Without this, a diagnostic would have to blame the whole enclosing
  /// statement, which often reads as an accusation against an innocent callee
  /// that merely happens to appear first, e.g. the std::min in
  /// `x = std::min(a, unsafe())`.
  const Stmt *OffendingStmt = nullptr;
 
  /// One function in the chain of calls that leads from OffendingStmt to the
  /// code that could destruct an object.
  struct Frame {
    const FunctionDecl *Callee = nullptr;
    /// The innermost non-trivial statement inside Callee's body. Null when
    /// Callee has no visible definition, or is rejected without looking at its
    /// body, e.g. because it is virtual or takes a parameter by value that
    /// could destruct an object.
    const Stmt *OffendingStmt = nullptr;
  };
 
  /// The callees that could not be proven free of destruction, outermost
  /// first: the first frame is called from OffendingStmt, each subsequent frame
  /// is called from the previous frame's OffendingStmt, and the last frame is
  /// where the destruction actually happens or a function without a visible
  /// definition. Empty when OffendingStmt destructs an object by itself, e.g.
  /// a delete expression or a local variable with a non-trivial destructor.
  llvm::SmallVector<Frame> CallStack;
};
 
/// An inter-procedural analysis facility that detects functions with "trivial"
/// behavior with respect to reference counting, such as simple field getters.
class TrivialFunctionAnalysis {
public:
  /// \returns true if \p D is a "trivial" function.
  bool isTrivial(const Decl *D) const { return isTrivialImpl(D, TheCache); }
  bool isTrivial(const Stmt *S) const { return isTrivialImpl(S, TheCache); }
  bool hasTrivialDtor(const VarDecl *VD) const {
    return hasTrivialDtorImpl(VD, TheCache);
  }
  const FieldDecl *fieldWithNonTrivialCtor(const CXXRecordDecl *RD) const {
    return fieldWithNonTrivialCtorImpl(RD, TheCache);
  }
  const FieldDecl *fieldWithNonTrivialDtor(const CXXRecordDecl *RD) const {
    return fieldWithNonTrivialDtorImpl(RD, TheCache);
  }
 
  /// \returns why \p S is not trivial. Runs on a private, empty cache because
  /// pinpointing the root cause requires descending into callees that a shared
  /// cache would short-circuit. Only call this when about to emit a diagnostic.
  static NonTrivialityReason computeReason(const Stmt *S);
 
private:
  friend class TrivialFunctionAnalysisVisitor;
 
  using CacheTy =
      llvm::DenseMap<llvm::PointerUnion<const Decl *, const Stmt *>, bool>;
  mutable CacheTy TheCache{};
 
  static bool isTrivialImpl(const Decl *D, CacheTy &Cache);
  static bool isTrivialImpl(const Stmt *S, CacheTy &Cache);
  static bool hasTrivialDtorImpl(const VarDecl *VD, CacheTy &Cache);
  static const FieldDecl *fieldWithNonTrivialCtorImpl(const CXXRecordDecl *RD,
                                                      CacheTy &Cache);
  static const FieldDecl *fieldWithNonTrivialDtorImpl(const CXXRecordDecl *RD,
                                                      CacheTy &Cache);
};
 
} // namespace clang
 
#endif