[clang] Allow default arguments to be evaluated like other arguments. (PR #80956)

[Ryosuke Niwa via cfe-commits]

https://github.com/rniwa created https://github.com/llvm/llvm-project/pull/80956

This PR aligns the evaluation of default arguments with other kinds of arguments by extracting the expressions within them as argument values to be evaluated.

>From 9d3f7377901539abeef949c1b33a99b1278900d8 Mon Sep 17 00:00:00 2001
From: Ryosuke Niwa <rniwa at webkit.org>
Date: Wed, 7 Feb 2024 00:57:00 -0800
Subject: [PATCH] Allow default arguments to be evaluated like other arguments.

This PR aligns the evaluation of default arguments with other kinds of arguments
by extracting the expressions within them as argument values to be evaluated.
---
 .../WebKit/UncountedCallArgsChecker.cpp       |  3 ++
 .../ref-countable-default-arg-nullptr.cpp     | 45 +++++++++++++++++++
 2 files changed, 48 insertions(+)
 create mode 100644 clang/test/Analysis/Checkers/WebKit/ref-countable-default-arg-nullptr.cpp

diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedCallArgsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedCallArgsChecker.cpp
index 31ccae8b097b89..7cb0e4680d9e9e 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedCallArgsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/UncountedCallArgsChecker.cpp
@@ -91,6 +91,9 @@ class UncountedCallArgsChecker
 
         const auto *Arg = CE->getArg(ArgIdx);
 
+        if (auto *defaultArg = dyn_cast<CXXDefaultArgExpr>(Arg))
+          Arg = defaultArg->getExpr();
+
         std::pair<const clang::Expr *, bool> ArgOrigin =
             tryToFindPtrOrigin(Arg, true);
 
diff --git a/clang/test/Analysis/Checkers/WebKit/ref-countable-default-arg-nullptr.cpp b/clang/test/Analysis/Checkers/WebKit/ref-countable-default-arg-nullptr.cpp
new file mode 100644
index 00000000000000..cd38b335dcf85e
--- /dev/null
+++ b/clang/test/Analysis/Checkers/WebKit/ref-countable-default-arg-nullptr.cpp
@@ -0,0 +1,45 @@
+// RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncountedCallArgsChecker -verify %s
+
+template <typename T>
+class RefPtr {
+public:
+  RefPtr(T* ptr)
+    : m_ptr(ptr)
+  {
+    if (m_ptr)
+      m_ptr->ref();
+  }
+
+  ~RefPtr()
+  {
+    if (m_ptr)
+      m_ptr->deref();
+  }
+
+  T* get() { return m_ptr; }
+
+private:
+  T* m_ptr;
+};
+
+class Obj {
+public:
+  static Obj* get();
+  static RefPtr<Obj> create();
+  void ref() const;
+  void deref() const;
+};
+
+void someFunction(Obj*, Obj* = nullptr);
+void otherFunction(Obj*, Obj* = Obj::get());
+// expected-warning at -1{{Call argument is uncounted and unsafe [alpha.webkit.UncountedCallArgsChecker]}}
+void anotherFunction(Obj*, Obj* = Obj::create().get());
+
+void otherFunction() {
+  someFunction(nullptr);
+  someFunction(Obj::get());
+  // expected-warning at -1{{Call argument is uncounted and unsafe [alpha.webkit.UncountedCallArgsChecker]}}
+  someFunction(Obj::create().get());
+  otherFunction(nullptr);
+  anotherFunction(nullptr);
+}