//=======- ASTUtils.cpp ------------------------------------------*- C++ -*-==// // // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. // See https://llvm.org/LICENSE.txt for license information. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception // //===----------------------------------------------------------------------===// #include "ASTUtils.h" #include "PtrTypesSemantics.h" #include "clang/AST/Attr.h" #include "clang/AST/Decl.h" #include "clang/AST/DeclCXX.h" #include "clang/AST/ExprCXX.h" #include "clang/AST/ExprObjC.h" #include "clang/AST/StmtVisitor.h" #include namespace clang { bool isSafePtr(clang::CXXRecordDecl *Decl) { return isRefCounted(Decl) || isCheckedPtr(Decl); } bool tryToFindPtrOrigin( const Expr *E, bool StopAtFirstRefCountedObj, std::function isSafePtr, std::function isSafePtrType, std::function callback) { while (E) { if (auto *DRE = dyn_cast(E)) { if (auto *VD = dyn_cast_or_null(DRE->getDecl())) { auto QT = VD->getType(); if (VD->hasGlobalStorage() && QT.isConstQualified()) { return callback(E, true); } } } if (auto *tempExpr = dyn_cast(E)) { E = tempExpr->getSubExpr(); continue; } if (auto *tempExpr = dyn_cast(E)) { E = tempExpr->getSubExpr(); continue; } if (auto *tempExpr = dyn_cast(E)) { if (auto *C = tempExpr->getConstructor()) { if (auto *Class = C->getParent(); Class && isSafePtr(Class)) return callback(E, true); break; } } if (auto *TempExpr = dyn_cast(E)) { if (isSafePtrType(TempExpr->getTypeAsWritten())) return callback(TempExpr, true); } if (auto *POE = dyn_cast(E)) { if (auto *RF = POE->getResultExpr()) { E = RF; continue; } } if (auto *tempExpr = dyn_cast(E)) { E = tempExpr->getSubExpr(); continue; } if (auto *OpaqueValue = dyn_cast(E)) { E = OpaqueValue->getSourceExpr(); continue; } if (auto *Expr = dyn_cast(E)) { return tryToFindPtrOrigin(Expr->getTrueExpr(), StopAtFirstRefCountedObj, isSafePtr, isSafePtrType, callback) && tryToFindPtrOrigin(Expr->getFalseExpr(), StopAtFirstRefCountedObj, isSafePtr, isSafePtrType, callback); } if (auto *cast = dyn_cast(E)) { if (StopAtFirstRefCountedObj) { if (auto *ConversionFunc = dyn_cast_or_null(cast->getConversionFunction())) { if (isCtorOfSafePtr(ConversionFunc)) return callback(E, true); } if (isa(E) && isSafePtrType(cast->getType())) return callback(E, true); } // FIXME: This can give false "origin" that would lead to false negatives // in checkers. See https://reviews.llvm.org/D37023 for reference. E = cast->getSubExpr(); continue; } if (auto *call = dyn_cast(E)) { if (auto *Callee = call->getCalleeDecl()) { if (Callee->hasAttr() || Callee->hasAttr()) { return callback(E, true); } } if (auto *memberCall = dyn_cast(call)) { if (auto *decl = memberCall->getMethodDecl()) { std::optional IsGetterOfRefCt = isGetterOfSafePtr(decl); if (IsGetterOfRefCt && *IsGetterOfRefCt) { E = memberCall->getImplicitObjectArgument(); if (StopAtFirstRefCountedObj) { return callback(E, true); } continue; } } } if (auto *operatorCall = dyn_cast(E)) { if (auto *Callee = operatorCall->getDirectCallee()) { auto ClsName = safeGetName(Callee->getParent()); if (isRefType(ClsName) || isCheckedPtr(ClsName) || isRetainPtrOrOSPtr(ClsName) || ClsName == "unique_ptr" || ClsName == "UniqueRef" || ClsName == "WeakPtr" || ClsName == "WeakRef") { if (operatorCall->getNumArgs() == 1) { E = operatorCall->getArg(0); continue; } } } } if (call->isCallToStdMove() && call->getNumArgs() == 1) { E = call->getArg(0)->IgnoreParenCasts(); continue; } if (auto *callee = call->getDirectCallee()) { if (isCtorOfSafePtr(callee)) { if (StopAtFirstRefCountedObj) return callback(E, true); E = call->getArg(0); continue; } if (isSafePtrType(callee->getReturnType())) return callback(E, true); if (isSingleton(callee)) return callback(E, true); if (callee->isInStdNamespace() && safeGetName(callee) == "forward") { E = call->getArg(0); continue; } if (isPtrConversion(callee)) { E = call->getArg(0); continue; } auto Name = safeGetName(callee); if (Name == "__builtin___CFStringMakeConstantString" || Name == "NSClassFromString") return callback(E, true); } else if (auto *CalleeE = call->getCallee()) { if (auto *E = dyn_cast(CalleeE->IgnoreParenCasts())) { if (isSingleton(E->getFoundDecl())) return callback(E, true); } } // Sometimes, canonical type erroneously turns Ref into T. // Workaround this problem by checking again if the original type was // a SubstTemplateTypeParmType of a safe smart pointer type (e.g. Ref). if (auto *CalleeDecl = call->getCalleeDecl()) { if (auto *FD = dyn_cast(CalleeDecl)) { auto RetType = FD->getReturnType(); if (auto *Subst = dyn_cast(RetType)) { if (auto *SubstType = Subst->desugar().getTypePtr()) { if (auto *RD = dyn_cast(SubstType)) { if (auto *CXX = dyn_cast(RD->getOriginalDecl())) if (isSafePtr(CXX)) return callback(E, true); } } } } } } if (auto *ObjCMsgExpr = dyn_cast(E)) { if (auto *Method = ObjCMsgExpr->getMethodDecl()) { if (isSafePtrType(Method->getReturnType())) return callback(E, true); } auto Selector = ObjCMsgExpr->getSelector(); auto NameForFirstSlot = Selector.getNameForSlot(0); if ((NameForFirstSlot == "class" || NameForFirstSlot == "superclass") && !Selector.getNumArgs()) return callback(E, true); } if (auto *ObjCDict = dyn_cast(E)) return callback(ObjCDict, true); if (auto *ObjCArray = dyn_cast(E)) return callback(ObjCArray, true); if (auto *ObjCStr = dyn_cast(E)) return callback(ObjCStr, true); if (auto *unaryOp = dyn_cast(E)) { // FIXME: Currently accepts ANY unary operator. Is it OK? E = unaryOp->getSubExpr(); continue; } if (auto *BoxedExpr = dyn_cast(E)) { E = BoxedExpr->getSubExpr(); continue; } break; } // Some other expression. return callback(E, false); } bool isASafeCallArg(const Expr *E) { assert(E); if (auto *Ref = dyn_cast(E)) { auto *FoundDecl = Ref->getFoundDecl(); if (auto *D = dyn_cast_or_null(FoundDecl)) { if (isa(D) || D->isLocalVarDecl()) return true; if (auto *ImplicitP = dyn_cast(D)) { auto Kind = ImplicitP->getParameterKind(); if (Kind == ImplicitParamKind::ObjCSelf || Kind == ImplicitParamKind::ObjCCmd || Kind == ImplicitParamKind::CXXThis || Kind == ImplicitParamKind::CXXVTT) return true; } } else if (auto *BD = dyn_cast_or_null(FoundDecl)) { VarDecl *VD = BD->getHoldingVar(); if (VD && (isa(VD) || VD->isLocalVarDecl())) return true; } } if (isa(E)) return true; // A temporary lives until the end of this statement. if (isConstOwnerPtrMemberExpr(E)) return true; // TODO: checker for method calls on non-refcounted objects return isa(E); } bool isNullPtr(const clang::Expr *E) { if (isa(E) || isa(E)) return true; if (auto *Int = dyn_cast_or_null(E)) { if (Int->getValue().isZero()) return true; } return false; } bool isConstOwnerPtrMemberExpr(const clang::Expr *E) { if (auto *MCE = dyn_cast(E)) { if (auto *Callee = MCE->getDirectCallee()) { auto Name = safeGetName(Callee); if (Name == "get" || Name == "ptr") E = MCE->getImplicitObjectArgument(); if (isa(Callee)) E = MCE->getImplicitObjectArgument(); } } else if (auto *OCE = dyn_cast(E)) { if (OCE->getOperator() == OO_Star && OCE->getNumArgs() == 1) E = OCE->getArg(0); } const ValueDecl *D = nullptr; if (auto *ME = dyn_cast(E)) D = ME->getMemberDecl(); else if (auto *IVR = dyn_cast(E)) D = IVR->getDecl(); if (!D) return false; auto T = D->getType(); return isOwnerPtrType(T) && T.isConstQualified(); } bool isExprToGetCheckedPtrCapableMember(const clang::Expr *E) { auto *ME = dyn_cast(E); if (!ME) return false; auto *Base = ME->getBase(); if (!Base) return false; if (!isa(Base->IgnoreParenCasts())) return false; auto *D = ME->getMemberDecl(); if (!D) return false; auto T = D->getType(); auto *CXXRD = T->getAsCXXRecordDecl(); if (!CXXRD) return false; auto result = isCheckedPtrCapable(CXXRD); return result && *result; } class EnsureFunctionVisitor : public ConstStmtVisitor { public: bool VisitStmt(const Stmt *S) { for (const Stmt *Child : S->children()) { if (Child && !Visit(Child)) return false; } return true; } bool VisitReturnStmt(const ReturnStmt *RS) { if (auto *RV = RS->getRetValue()) { RV = RV->IgnoreParenCasts(); if (isNullPtr(RV)) return true; return isConstOwnerPtrMemberExpr(RV); } return false; } }; bool EnsureFunctionAnalysis::isACallToEnsureFn(const clang::Expr *E) const { auto *MCE = dyn_cast(E); if (!MCE) return false; auto *Callee = MCE->getDirectCallee(); if (!Callee) return false; auto *Body = Callee->getBody(); if (!Body || Callee->isVirtualAsWritten()) return false; auto [CacheIt, IsNew] = Cache.insert(std::make_pair(Callee, false)); if (IsNew) CacheIt->second = EnsureFunctionVisitor().Visit(Body); return CacheIt->second; } } // namespace clang