[clang] [alpha.webkit.UncountedCallArgsChecker] Don't treat a call returning a reference to a smart pointer as a safe origin (PR #229301)

[via cfe-commits]

llvmorg-github-actions[bot] wrote:


<!--LLVM PR SUMMARY COMMENT-->

@llvm/pr-subscribers-clang

Author: Fady Farag (iidmsa)

<details>
<summary>Changes</summary>

Previously, when walking a call argument or a local variable's initializer back to its origin, `tryToFindPtrOriginImpl` treated any call whose type is a smart pointer type as safe. That is correct for a call returning a smart pointer by value, but a call returning a reference to a smart pointer has the same type, which caused a missing warning for any raw pointer/reference obtained through it. This only treats such a call as safe when it returns by value.

---
Full diff: https://github.com/llvm/llvm-project/pull/229301.diff


3 Files Affected:

- (modified) clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp (+1-1) 
- (modified) clang/test/Analysis/Checkers/WebKit/call-args.cpp (+33) 
- (modified) clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp (+32) 


``````````diff
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
index a1dae480f85b2..21f4275acc4ac 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
@@ -277,7 +277,7 @@ static bool tryToFindPtrOriginImpl(
         }
       }
 
-      if (isSafePtrType(call->getType()))
+      if (call->isPRValue() && isSafePtrType(call->getType()))
         return callback(E, /*IsSafe=*/true,
                         OriginDependsOnFullExpressionTemporary,
                         PtrIsLifetimeBoundToOrigin);
diff --git a/clang/test/Analysis/Checkers/WebKit/call-args.cpp b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
index b4dc1b1038ef5..de90a3bc268f9 100644
--- a/clang/test/Analysis/Checkers/WebKit/call-args.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/call-args.cpp
@@ -543,3 +543,36 @@ namespace call_arg_outside_decl {
   // expected-warning at -1{{Function argument 'provide()' (to 'call_arg_outside_decl::consume') is a raw pointer to RefPtr-capable type 'RefCountable'}}
 
 }
+
+namespace call_returning_reference_to_smart_pointer {
+
+  template <typename T> struct Vector {
+    T& operator[](unsigned);
+    T* m_buffer;
+  };
+
+  class Owner {
+  public:
+    const RefPtr<RefCountable>& referenceGetter() const { return m_obj; }
+    RefPtr<RefCountable> valueGetter() const { return m_obj; }
+
+    void callThroughReferenceGetter() {
+      referenceGetter()->method();
+      // expected-warning at -1{{Function argument 'this->referenceGetter()' (parameter 'this' to 'RefCountable::method') is a raw pointer to RefPtr-capable type 'RefCountable'}}
+    }
+
+    void callThroughValueGetter() {
+      valueGetter()->method();
+    }
+
+    void callThroughVectorElement() {
+      m_items[0]->method();
+      // expected-warning at -1{{Function argument 'this->m_items[0]' (parameter 'this' to 'RefCountable::method') is a raw pointer to RefPtr-capable type 'RefCountable'}}
+    }
+
+  private:
+    RefPtr<RefCountable> m_obj;
+    Vector<Ref<RefCountable>> m_items;
+  };
+
+} // namespace call_returning_reference_to_smart_pointer
diff --git a/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp b/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp
index 7f086f13f68e4..6c1299998e646 100644
--- a/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp
@@ -945,3 +945,35 @@ void unrelated_temporary_traces_to_guardian(RefCountable &obj) {
 }
 
 } // namespace short_lived_temporaries
+
+namespace call_returning_reference_to_smart_pointer {
+
+template <typename T> struct Vector {
+  T& operator[](unsigned);
+  T* m_buffer;
+};
+
+class Owner {
+public:
+  const RefPtr<RefCountable>& referenceGetter() const { return m_obj; }
+
+  void localFromReferenceGetter() {
+    RefCountable *obj = referenceGetter().get();
+    // expected-warning at -1{{Local variable 'obj' is a raw pointer to RefPtr-capable type 'RefCountable' [alpha.webkit.UncountedLocalVarsChecker]}}
+    someFunction();
+    obj->method();
+  }
+
+  void localFromVectorElement() {
+    RefCountable *obj = m_items[0].ptr();
+    // expected-warning at -1{{Local variable 'obj' is a raw pointer to RefPtr-capable type 'RefCountable' [alpha.webkit.UncountedLocalVarsChecker]}}
+    someFunction();
+    obj->method();
+  }
+
+private:
+  RefPtr<RefCountable> m_obj;
+  Vector<Ref<RefCountable>> m_items;
+};
+
+} // namespace call_returning_reference_to_smart_pointer

``````````

</details>


https://github.com/llvm/llvm-project/pull/229301