[clang] 71478ec - [WebKit Checkers] Treat const Objective-C ivar as a safe origin (#126353)

[via cfe-commits]

Author: Ryosuke Niwa
Date: 2025-02-11T10:00:09-08:00
New Revision: 71478ecdb48075051e6e746c4c51b9caeb4c21b6

URL: https://github.com/llvm/llvm-project/commit/71478ecdb48075051e6e746c4c51b9caeb4c21b6
DIFF: https://github.com/llvm/llvm-project/commit/71478ecdb48075051e6e746c4c51b9caeb4c21b6.diff

LOG: [WebKit Checkers] Treat const Objective-C ivar as a safe origin (#126353)

Like const C++ member variables, treat const Ref, RefPtr, CheckedRef,
CheckedPtr Objective-C ivars as a safe pointer origin in WebKit
checkers.

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
    clang/test/Analysis/Checkers/WebKit/uncounted-obj-arg.mm

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
index abf5d3ec193a4..5d28982c41fc4 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
@@ -163,10 +163,11 @@ bool isConstOwnerPtrMemberExpr(const clang::Expr *E) {
     if (OCE->getOperator() == OO_Star && OCE->getNumArgs() == 1)
       E = OCE->getArg(0);
   }
-  auto *ME = dyn_cast<MemberExpr>(E);
-  if (!ME)
-    return false;
-  auto *D = ME->getMemberDecl();
+  const ValueDecl *D = nullptr;
+  if (auto *ME = dyn_cast<MemberExpr>(E))
+    D = ME->getMemberDecl();
+  else if (auto *IVR = dyn_cast<ObjCIvarRefExpr>(E))
+    D = IVR->getDecl();
   if (!D)
     return false;
   auto T = D->getType();

diff  --git a/clang/test/Analysis/Checkers/WebKit/uncounted-obj-arg.mm b/clang/test/Analysis/Checkers/WebKit/uncounted-obj-arg.mm
index 9ad1880e9d118..08319016023e3 100644
--- a/clang/test/Analysis/Checkers/WebKit/uncounted-obj-arg.mm
+++ b/clang/test/Analysis/Checkers/WebKit/uncounted-obj-arg.mm
@@ -1,11 +1,14 @@
 // RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncountedCallArgsChecker -verify %s
-// expected-no-diagnostics
 
 #import "mock-types.h"
 #import "mock-system-header.h"
 #import "../../Inputs/system-header-simulator-for-objc-dealloc.h"
 
- at interface Foo : NSObject
+ at interface Foo : NSObject {
+  const Ref<RefCountable> _obj1;
+  const RefPtr<RefCountable> _obj2;
+  Ref<RefCountable> _obj3;
+}
 
 @property (nonatomic, readonly) RefPtr<RefCountable> countable;
 
@@ -17,6 +20,11 @@ @implementation Foo
 
 - (void)execute {
   self._protectedRefCountable->method();
+  _obj1->method();
+  _obj1.get().method();
+  (*_obj2).method();
+  _obj3->method();
+  // expected-warning at -1{{Call argument for 'this' parameter is uncounted and unsafe}}
 }
 
 - (RefPtr<RefCountable>)_protectedRefCountable {
@@ -30,6 +38,7 @@ - (void)execute {
   void ref() const;
   void deref() const;
   Ref<RefCountedObject> copy() const;
+  void method();
 };
 
 @interface WrapperObj : NSObject