[clang] fd2f25d - [WebKit Checkers][NFC] Thread the sink type through the local vars checker (#224862)

[via cfe-commits]

Author: geoffreygaren
Date: 2026-09-19T15:50:10-07:00
New Revision: fd2f25d59643fac8c3249c3a48c25565df9af8f2

URL: https://github.com/llvm/llvm-project/commit/fd2f25d59643fac8c3249c3a48c25565df9af8f2
DIFF: https://github.com/llvm/llvm-project/commit/fd2f25d59643fac8c3249c3a48c25565df9af8f2.diff

LOG: [WebKit Checkers][NFC] Thread the sink type through the local vars checker (#224862)

So an upcoming borrow checker can track assignment through indirection.

For example, in `out = &vec`, where `out`'s declared type is
`Vector<char>*&`, the relevant sink type is `Vector<char>*`.

Assisted-by: Claude

Added: 
    

Modified: 
    clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp

Removed: 
    


################################################################################
diff  --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
index f27915bfd25d6..b83f1e3ea00b7 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/RawPtrRefLocalVarsChecker.cpp
@@ -249,7 +249,7 @@ class RawPtrRefLocalVarsChecker
       bool VisitVarDecl(VarDecl *V) override {
         auto *Init = V->getInit();
         if (V->isLocalVarDecl())
-          Checker->visitVarDecl(V, Init, DeclWithIssue);
+          Checker->visitVarDecl(V, V->getType(), Init, DeclWithIssue);
         return true;
       }
 
@@ -257,7 +257,8 @@ class RawPtrRefLocalVarsChecker
         if (BO->isAssignmentOp()) {
           if (auto *VarRef = dyn_cast<DeclRefExpr>(BO->getLHS())) {
             if (auto *V = dyn_cast<VarDecl>(VarRef->getDecl()))
-              Checker->visitVarDecl(V, BO->getRHS(), DeclWithIssue);
+              Checker->visitVarDecl(V, V->getType(), BO->getRHS(),
+                                    DeclWithIssue);
           }
         }
         return true;
@@ -314,7 +315,7 @@ class RawPtrRefLocalVarsChecker
     visitor.TraverseDecl(const_cast<TranslationUnitDecl *>(TUD));
   }
 
-  void visitVarDecl(const VarDecl *V, const Expr *Value,
+  void visitVarDecl(const VarDecl *V, QualType SinkType, const Expr *Value,
                     const Decl *DeclWithIssue) const {
     if (shouldSkipVarDecl(V))
       return;
@@ -327,15 +328,15 @@ class RawPtrRefLocalVarsChecker
         std::optional<bool> IsUncountedPtr = isUnsafePtr(Binding->getType());
         if (!IsUncountedPtr || !*IsUncountedPtr)
           continue;
-        reportBug(V, nullptr, BD, DeclWithIssue);
+        reportBug(V, V->getType(), nullptr, BD, DeclWithIssue);
       }
     }
 
-    std::optional<bool> IsUncountedPtr = isUnsafePtr(V->getType());
+    std::optional<bool> IsUncountedPtr = isUnsafePtr(SinkType);
     if (IsUncountedPtr && *IsUncountedPtr) {
       if (Value && isPtrOriginSafe(V, Value, DeclWithIssue))
         return;
-      reportBug(V, Value, nullptr, DeclWithIssue);
+      reportBug(V, SinkType, Value, nullptr, DeclWithIssue);
     }
   }
 
@@ -419,8 +420,8 @@ class RawPtrRefLocalVarsChecker
     return BR->getSourceManager().isInSystemHeader(V->getLocation());
   }
 
-  void reportBug(const VarDecl *V, const Expr *Value, const Decl *BindingDecl,
-                 const Decl *DeclWithIssue) const {
+  void reportBug(const VarDecl *V, QualType SinkType, const Expr *Value,
+                 const Decl *BindingDecl, const Decl *DeclWithIssue) const {
     assert(V);
     SmallString<100> Buf;
     llvm::raw_svector_ostream Os(Buf);
@@ -429,7 +430,7 @@ class RawPtrRefLocalVarsChecker
       Os << "Parameter ";
       printQuotedQualifiedName(Os, V);
       Os << " is a ";
-      printPointerTypeAndType(Os, V->getType());
+      printPointerTypeAndType(Os, SinkType);
 
       SourceLocation ExprLoc = (Value) ? Value->getExprLoc() : V->getLocation();
       PathDiagnosticLocation BSLoc(ExprLoc, BR->getSourceManager());
@@ -452,7 +453,7 @@ class RawPtrRefLocalVarsChecker
       else
         printQuotedQualifiedName(Os, V);
       Os << " is a ";
-      printPointerTypeAndType(Os, V->getType());
+      printPointerTypeAndType(Os, SinkType);
 
       PathDiagnosticLocation BSLoc(V->getLocation(), BR->getSourceManager());
       auto Report = std::make_unique<BasicBugReport>(Bug, Os.str(), BSLoc);