[clang] Add the support for calling Ref::ptr accessor. (PR #80919)

[Ryosuke Niwa via cfe-commits]

https://github.com/rniwa created https://github.com/llvm/llvm-project/pull/80919

This accessor returns a pointer from Ref type and is therefore safe.

>From 63a64cf22e5e470db3426688a2517c2fef64fd46 Mon Sep 17 00:00:00 2001
From: Ryosuke Niwa <rniwa at webkit.org>
Date: Tue, 6 Feb 2024 17:56:01 -0800
Subject: [PATCH] Add the support for calling Ref::ptr accessor.

This accessor returns a pointer from Ref type and is therefore safe.
---
 .../Checkers/WebKit/PtrTypesSemantics.cpp     |  1 +
 .../Checkers/WebKit/ref-ptr-accessor.cpp      | 86 +++++++++++++++++++
 2 files changed, 87 insertions(+)
 create mode 100644 clang/test/Analysis/Checkers/WebKit/ref-ptr-accessor.cpp

diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
index c1f180f31338cb..4bc3f7a8c9c3ce 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
@@ -148,6 +148,7 @@ std::optional<bool> isGetterOfRefCounted(const CXXMethodDecl* M)
 
     if (((className == "Ref" || className == "RefPtr") &&
          methodName == "get") ||
+        (className == "Ref" && methodName == "ptr") ||
         ((className == "String" || className == "AtomString" ||
           className == "AtomStringImpl" || className == "UniqueString" ||
           className == "UniqueStringImpl" || className == "Identifier") &&
diff --git a/clang/test/Analysis/Checkers/WebKit/ref-ptr-accessor.cpp b/clang/test/Analysis/Checkers/WebKit/ref-ptr-accessor.cpp
new file mode 100644
index 00000000000000..d3185a9f2d58a4
--- /dev/null
+++ b/clang/test/Analysis/Checkers/WebKit/ref-ptr-accessor.cpp
@@ -0,0 +1,86 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncountedCallArgsChecker -verify %s
+// expected-no-diagnostics
+
+template<typename T>
+class Ref {
+public:
+    ~Ref()
+    {
+        if (auto* ptr = m_ptr)
+            ptr->deref();
+        m_ptr = nullptr;
+    }
+
+    Ref(T& object)
+        : m_ptr(&object)
+    {
+        object.ref();
+    }
+
+    Ref(const Ref& other)
+        : m_ptr(other.ptr())
+    {
+        m_ptr->ref();
+    }
+
+    template<typename X> Ref(const Ref<X>& other)
+        : m_ptr(other.ptr())
+    {
+        m_ptr->ref();
+    }
+
+    Ref(Ref&& other)
+        : m_ptr(&other.leakRef())
+    {
+    }
+
+    template<typename X>
+    Ref(Ref<X>&& other)
+        : m_ptr(&other.leakRef())
+    {
+    }
+
+    T* operator->() const { return m_ptr; }
+    T* ptr() const { return m_ptr; }
+    T& get() const { return *m_ptr; }
+    operator T&() const { return *m_ptr; }
+    bool operator!() const { return !*m_ptr; }
+
+    T& leakRef()
+    {
+        T& result = *m_ptr;
+        m_ptr = nullptr;
+        return result;
+    }
+
+private:
+    template<typename U> friend inline Ref<U> adoptRef(U&);
+
+    enum AdoptTag { Adopt };
+    Ref(T& object, AdoptTag)
+        : m_ptr(&object)
+    {
+    }
+
+    T* m_ptr;
+};
+
+class Node {
+public:
+    static Ref<Node> create();
+    virtual ~Node();
+
+    void ref() const;
+    void deref() const;
+
+protected:
+    explicit Node();
+};
+
+void someFunction(Node*);
+
+void testFunction()
+{
+    Ref node = Node::create();
+    someFunction(node.ptr());
+}