https://github.com/rniwa created https://github.com/llvm/llvm-project/pull/220882
Treat calling a non-trivial function with the result of copyRef() or any other function which returns a safe pointer type as an argument as safe. >From f0ade1f7a5787e01e0f4ab8e116bf4b8783c15b1 Mon Sep 17 00:00:00 2001 From: Ryosuke Niwa <[email protected]> Date: Thu, 3 Sep 2026 20:27:27 +0900 Subject: [PATCH] [alpha.webkit.UncheckedCallArgsChecker] Treat copyRef() in a call argument as safe Treat calling a non-trivial function with the result of copyRef() or any other function which returns a safe pointer type as an argument as safe. --- .../Checkers/WebKit/ASTUtils.cpp | 3 +++ .../Checkers/WebKit/PtrTypesSemantics.cpp | 3 +++ .../Analysis/Checkers/WebKit/mock-types.h | 1 + .../Checkers/WebKit/unchecked-call-arg.cpp | 23 +++++++++++++++++++ 4 files changed, 30 insertions(+) diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp index 5fd2ff87bce8d..e8f69f1aac757 100644 --- a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp @@ -104,6 +104,9 @@ bool tryToFindPtrOrigin( } } + if (isSafePtrType(call->getType())) + return callback(E, true); + if (auto *memberCall = dyn_cast<CXXMemberCallExpr>(call)) { if (auto *decl = memberCall->getMethodDecl()) { std::optional<bool> IsGetterOfRefCt = isGetterOfSafePtr(decl); diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp index d5fb88a15b6de..37347c51d4ca2 100644 --- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp @@ -219,6 +219,9 @@ static bool isPtrOfType(const clang::QualType T, Predicate Pred) { } else if (auto *DTS = type->getAs<DeducedTemplateSpecializationType>()) { auto *Decl = DTS->getTemplateName().getAsTemplateDecl(); return Decl && Pred(Decl->getNameAsString()); + } else if (auto *RD = type->getAs<RecordType>()) { + auto *Decl = RD->getDecl(); + return Decl && Pred(Decl->getNameAsString()); } else break; } diff --git a/clang/test/Analysis/Checkers/WebKit/mock-types.h b/clang/test/Analysis/Checkers/WebKit/mock-types.h index dea16f534ba2b..9ed5ecab88c6e 100644 --- a/clang/test/Analysis/Checkers/WebKit/mock-types.h +++ b/clang/test/Analysis/Checkers/WebKit/mock-types.h @@ -318,6 +318,7 @@ template <typename T, typename PtrTraits = RawPtrTraits<T>, typename RefDerefTra T *operator->() const { return PtrTraits::unwrap(t); } operator T &() const { return *PtrTraits::unwrap(t); } T* leakRef() { return PtrTraits::exchange(t, nullptr); } + [[nodiscard]] Ref copyRef() const { return Ref(*t); } }; template <typename T> Ref<T> adoptRef(T& t) { diff --git a/clang/test/Analysis/Checkers/WebKit/unchecked-call-arg.cpp b/clang/test/Analysis/Checkers/WebKit/unchecked-call-arg.cpp index b3a338f767afd..c919888d22491 100644 --- a/clang/test/Analysis/Checkers/WebKit/unchecked-call-arg.cpp +++ b/clang/test/Analysis/Checkers/WebKit/unchecked-call-arg.cpp @@ -1,5 +1,7 @@ // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncheckedCallArgsChecker -verify %s +#include "mock-types.h" + void WTFCrash(void); enum class Tag : bool { Value }; @@ -37,3 +39,24 @@ void doWorkWithObject(const CheckedObject&); void bar() { doWorkWithObject(CheckedObject()); } + +namespace refptr_checked_ptr_capable { + +class CheckedRefCounted { +public: + void ref() const; + void deref() const; + void incrementCheckedPtrCount() const; + void decrementCheckedPtrCount() const; +}; + +void receive(CheckedRefCounted&); +struct Foo { + Ref<CheckedRefCounted> m_obj; + + void foo() { + receive(m_obj.copyRef()); + } +}; + +} // namespace refptr_checked_ptr_capable _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
