[clang] [alpha.webkit.UncountedCallArgsChecker] Crash in printArgument (PR #210411)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang-static-analyzer-1

Author: Ryosuke Niwa (rniwa)

<details>
<summary>Changes</summary>

The crash was caused by missing nullptr check for Decl used to get printing policy. Fixed the bug by replacing the use of Decl with BugManager to get the policy.

---
Full diff: https://github.com/llvm/llvm-project/pull/210411.diff


2 Files Affected:

- (modified) clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp (+5-6) 
- (modified) clang/test/Analysis/Checkers/WebKit/call-args.cpp (+10) 


``````````diff
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
index 3859ade53db2e..b15567ecf144a 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
@@ -389,7 +389,7 @@ class RawPtrRefCallArgsChecker
 
     const std::string paramName = safeGetName(Param);
     Os << "Function argument";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     if (!paramName.empty() || Callee)
       Os << " (";
     if (!paramName.empty()) {
@@ -442,7 +442,7 @@ class RawPtrRefCallArgsChecker
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
     Os << "Function argument";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     Os << " (parameter 'this'";
     if (Callee) {
       Os << " to ";
@@ -467,7 +467,7 @@ class RawPtrRefCallArgsChecker
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
     Os << "Receiver";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     if (Callee) {
       Os << " (to ";
       printQuotedQualifiedName(Os, Callee);
@@ -483,12 +483,11 @@ class RawPtrRefCallArgsChecker
     BR->emitReport(std::move(Report));
   }
 
-  void printArgument(llvm::raw_svector_ostream &Os, const Expr *Arg,
-                     const Decl *D) const {
+  void printArgument(llvm::raw_svector_ostream &Os, const Expr *Arg) const {
     SmallString<100> Buf;
     llvm::raw_svector_ostream ArgOs(Buf);
     Arg->printPretty(ArgOs, /*Helper=*/nullptr,
-                     D->getASTContext().getPrintingPolicy());
+                     BR->getContext().getPrintingPolicy());
     StringRef ArgCode = ArgOs.str();
     if (ArgCode.contains('\n'))
       return;
diff --git a/clang/test/Analysis/Checkers/WebKit/call-args.cpp b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
index 4beab9303178f..5e9f1591692e6 100644
--- a/clang/test/Analysis/Checkers/WebKit/call-args.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
@@ -586,3 +586,13 @@ namespace call_with_weak_ptr {
   };
 
 }
+
+namespace call_arg_outside_decl {
+
+  RefCountable* provide();
+  bool consume(RefCountable*);
+
+  bool global_init = consume(provide());
+  // expected-warning at -1{{Function argument 'provide()' (to 'call_arg_outside_decl::consume') is a raw pointer to RefPtr-capable type 'RefCountable'}}
+
+}

``````````

</details>


https://github.com/llvm/llvm-project/pull/210411