RawPtrRefSafetyModel.h

Go to the documentation of this file.

//=======- RawPtrRefSafetyModel.h -------------------------------*- C++ -*-==//
//
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
// See https://llvm.org/LICENSE.txt for license information.
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
//
//===----------------------------------------------------------------------===//
 
#ifndef LLVM_CLANG_ANALYZER_WEBKIT_RAWPTRREFSAFETYMODEL_H
#define LLVM_CLANG_ANALYZER_WEBKIT_RAWPTRREFSAFETYMODEL_H
 
#include "DiagOutputUtils.h"
#include "PtrTypesSemantics.h"
#include "clang/AST/Type.h"
#include "llvm/Support/raw_ostream.h"
#include <memory>
#include <optional>
#include <string>
 
namespace clang {
class CXXRecordDecl;
class Decl;
class Expr;
class QualType;
class SourceManager;
 
/// Models one WebKit pointer-safety policy: ref-counted (RefPtr), checked
/// (CheckedPtr), or retainable (RetainPtr/OSPtr).
///
/// It captures the family-specific "what is a safe/unsafe pointer" questions
/// that are shared by the various RawPtrRef* checkers, independently of how
/// each checker traverses the AST (call arguments, local variables, members,
/// lambda captures, ...). This lets a single policy be defined once and reused
/// across every traversal.
class PtrRefSafetyModel {
public:
  virtual ~PtrRefSafetyModel() = default;
 
  /// \returns whether \p QT itself is an unsafe (smart-pointer-capable but not
  /// managed) type, false if not, std::nullopt if inconclusive.
  virtual std::optional<bool> isUnsafeType(QualType QT) const = 0;
 
  /// \returns whether \p QT is a pointer/reference/view to an analyzed type,
  /// false if not, std::nullopt if inconclusive. \p IgnoreARC requests that
  /// Objective-C ARC be ignored when deciding retainability.
  virtual std::optional<bool> isUnsafePtr(QualType QT,
                                          bool IgnoreARC = false) const = 0;
 
  /// \returns whether \p Record is a safe smart pointer for this policy.
  virtual bool isSafePtr(const CXXRecordDecl *Record) const = 0;
 
  /// \returns whether \p T is a safe smart pointer type for this policy.
  virtual bool isSafePtrType(QualType T) const = 0;
 
  /// \returns whether \p Name is the name of a safe smart pointer class for
  /// this policy.
  virtual bool isPtrType(const std::string &Name) const = 0;
 
  /// \returns whether \p E is known to produce a safe value for this policy.
  /// \p PtrIsLifetimeBoundToOrigin is whether the traversal that reached \p E
  /// followed at least one [[clang::lifetimebound]] edge.
  virtual bool isSafeExpr(const Expr *, bool PtrIsLifetimeBoundToOrigin) const {
    return false;
  }
 
  /// \returns whether this policy checks for destruction of an object's
  /// interior while the object itself stays alive (borrow checking), rather
  /// than for deallocation of the object (the smart pointer policies).
  virtual bool checksForInteriorDestruction() const { return false; }
 
  /// \returns whether this policy checks assignment through indirection, such
  /// as *out = _ or arr[0] = _. (Direct assignment to a named variable is
  /// always checked.)
  ///
  /// FIXME: Make this flag true in all analyses and then remove it.
  virtual bool recognizesIndirectStores() const { return false; }
 
  /// \returns whether \p D refers to a declaration that is safe by construction
  /// for this policy (e.g. immortal system-header globals).
  virtual bool isSafeDecl(const Decl *, const SourceManager &) const {
    return false;
  }
 
  /// \returns a human readable name for the safe type category, used in
  /// diagnostics (e.g. "RefPtr-capable type").
  virtual const char *typeName() const = 0;
 
  /// Prints a phrase describing why the reported value is unsafe, completing a
  /// sentence of the form "Local variable 'x' is a ". \p Origin is the
  /// expression the value was traced back to, or null when the trace found
  /// none. \p SinkType is the type of the reported location.
  virtual void describeHazard(llvm::raw_ostream &Os, const Expr *,
                              QualType SinkType) const {
    auto *VarType = SinkType.getTypePtr();
    auto *DesugaredType = VarType->getUnqualifiedDesugaredType();
    bool IsPtr = isa<PointerType, ObjCObjectPointerType>(DesugaredType);
    Os << "raw " << (IsPtr ? "pointer" : "reference") << " to ";
    Os << typeName() << " ";
    printTypeName(Os, SinkType);
  }
 
  /// \returns the RetainTypeChecker backing this policy, or nullptr if the
  /// policy does not track retain/OS types.
  virtual RetainTypeChecker *retainTypeChecker() const { return nullptr; }
};
 
/// Applies the memory-management exemptions that hold for a variable, member,
/// or lambda capture (but not for a call argument) before consulting \p Model:
/// a __strong / __weak Objective-C storage location is memory managed and thus
/// safe. \returns whether \p T is an unsafe pointer in such a storage context.
std::optional<bool> isUnsafePtrForStorage(const PtrRefSafetyModel &Model,
                                          QualType T, bool IgnoreARC = false);
 
/// \returns a policy that treats ref-counted / checked pointers as safe.
std::unique_ptr<PtrRefSafetyModel> makeRefPtrSafetyModel();
 
/// \returns a policy that treats checked pointers as safe.
std::unique_ptr<PtrRefSafetyModel> makeCheckedPtrSafetyModel();
 
/// \returns a policy that treats RetainPtr / OSPtr as safe.
std::unique_ptr<PtrRefSafetyModel> makeRetainPtrSafetyModel();
 
/// \returns a policy that treats a loan on a CanBorrow object's interior as
/// safe only when it is guarded by a Borrow<T>.
std::unique_ptr<PtrRefSafetyModel> makeBorrowSafetyModel();
 
} // namespace clang
 
#endif