[clang] 3fc4fca - [alpha.webkit.UncountedCallArgsChecker] Crash in printArgument (#210411)

[via cfe-commits]

Author: Ryosuke Niwa
Date: 2026-07-18T01:26:01-07:00
New Revision: 3fc4fcade6164fc6b9dcf0d6d0d6fa9cf6e47dfc

URL: https://github.com/llvm/llvm-project/commit/3fc4fcade6164fc6b9dcf0d6d0d6fa9cf6e47dfc
DIFF: https://github.com/llvm/llvm-project/commit/3fc4fcade6164fc6b9dcf0d6d0d6fa9cf6e47dfc.diff

LOG: [alpha.webkit.UncountedCallArgsChecker] Crash in printArgument (#210411)

The crash was caused by missing nullptr check for Decl used to get
printing policy. Fixed the bug by replacing the use of Decl with
BugManager to get the policy.

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
    clang/test/Analysis/Checkers/WebKit/call-args.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
index 3859ade53db2e..b15567ecf144a 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefCallArgsChecker.cpp
@@ -389,7 +389,7 @@ class RawPtrRefCallArgsChecker
 
     const std::string paramName = safeGetName(Param);
     Os << "Function argument";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     if (!paramName.empty() || Callee)
       Os << " (";
     if (!paramName.empty()) {
@@ -442,7 +442,7 @@ class RawPtrRefCallArgsChecker
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
     Os << "Function argument";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     Os << " (parameter 'this'";
     if (Callee) {
       Os << " to ";
@@ -467,7 +467,7 @@ class RawPtrRefCallArgsChecker
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
     Os << "Receiver";
-    printArgument(Os, CallArg, DeclWithIssue);
+    printArgument(Os, CallArg);
     if (Callee) {
       Os << " (to ";
       printQuotedQualifiedName(Os, Callee);
@@ -483,12 +483,11 @@ class RawPtrRefCallArgsChecker
     BR->emitReport(std::move(Report));
   }
 
-  void printArgument(llvm::raw_svector_ostream &Os, const Expr *Arg,
-                     const Decl *D) const {
+  void printArgument(llvm::raw_svector_ostream &Os, const Expr *Arg) const {
     SmallString<100> Buf;
     llvm::raw_svector_ostream ArgOs(Buf);
     Arg->printPretty(ArgOs, /*Helper=*/nullptr,
-                     D->getASTContext().getPrintingPolicy());
+                     BR->getContext().getPrintingPolicy());
     StringRef ArgCode = ArgOs.str();
     if (ArgCode.contains('\n'))
       return;

diff  --git a/clang/test/Analysis/Checkers/WebKit/call-args.cpp b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
index 4beab9303178f..5e9f1591692e6 100644
--- a/clang/test/Analysis/Checkers/WebKit/call-args.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
@@ -586,3 +586,13 @@ namespace call_with_weak_ptr {
   };
 
 }
+
+namespace call_arg_outside_decl {
+
+  RefCountable* provide();
+  bool consume(RefCountable*);
+
+  bool global_init = consume(provide());
+  // expected-warning at -1{{Function argument 'provide()' (to 'call_arg_outside_decl::consume') is a raw pointer to RefPtr-capable type 'RefCountable'}}
+
+}