1 //=== LLVMConventionsChecker.cpp - Check LLVM codebase conventions ---*- C++ -*-
3 // The LLVM Compiler Infrastructure
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
8 //===----------------------------------------------------------------------===//
10 // This defines LLVMConventionsChecker, a bunch of small little checks
11 // for checking specific coding conventions in the LLVM/Clang codebase.
13 //===----------------------------------------------------------------------===//
15 #include "ClangSACheckers.h"
16 #include "clang/AST/DeclTemplate.h"
17 #include "clang/AST/StmtVisitor.h"
18 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
19 #include "clang/StaticAnalyzer/Core/Checker.h"
20 #include "llvm/ADT/SmallString.h"
21 #include "llvm/Support/raw_ostream.h"
23 using namespace clang;
26 //===----------------------------------------------------------------------===//
27 // Generic type checking routines.
28 //===----------------------------------------------------------------------===//
30 static bool IsLLVMStringRef(QualType T) {
31 const RecordType *RT = T->getAs<RecordType>();
35 return StringRef(QualType(RT, 0).getAsString()) ==
39 /// Check whether the declaration is semantically inside the top-level
40 /// namespace named by ns.
41 static bool InNamespace(const Decl *D, StringRef NS) {
42 const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(D->getDeclContext());
45 const IdentifierInfo *II = ND->getIdentifier();
46 if (!II || !II->getName().equals(NS))
48 return isa<TranslationUnitDecl>(ND->getDeclContext());
51 static bool IsStdString(QualType T) {
52 if (const ElaboratedType *QT = T->getAs<ElaboratedType>())
53 T = QT->getNamedType();
55 const TypedefType *TT = T->getAs<TypedefType>();
59 const TypedefNameDecl *TD = TT->getDecl();
61 if (!TD->isInStdNamespace())
64 return TD->getName() == "string";
67 static bool IsClangType(const RecordDecl *RD) {
68 return RD->getName() == "Type" && InNamespace(RD, "clang");
71 static bool IsClangDecl(const RecordDecl *RD) {
72 return RD->getName() == "Decl" && InNamespace(RD, "clang");
75 static bool IsClangStmt(const RecordDecl *RD) {
76 return RD->getName() == "Stmt" && InNamespace(RD, "clang");
79 static bool IsClangAttr(const RecordDecl *RD) {
80 return RD->getName() == "Attr" && InNamespace(RD, "clang");
83 static bool IsStdVector(QualType T) {
84 const TemplateSpecializationType *TS = T->getAs<TemplateSpecializationType>();
88 TemplateName TM = TS->getTemplateName();
89 TemplateDecl *TD = TM.getAsTemplateDecl();
91 if (!TD || !InNamespace(TD, "std"))
94 return TD->getName() == "vector";
97 static bool IsSmallVector(QualType T) {
98 const TemplateSpecializationType *TS = T->getAs<TemplateSpecializationType>();
102 TemplateName TM = TS->getTemplateName();
103 TemplateDecl *TD = TM.getAsTemplateDecl();
105 if (!TD || !InNamespace(TD, "llvm"))
108 return TD->getName() == "SmallVector";
111 //===----------------------------------------------------------------------===//
112 // CHECK: a StringRef should not be bound to a temporary std::string whose
113 // lifetime is shorter than the StringRef's.
114 //===----------------------------------------------------------------------===//
117 class StringRefCheckerVisitor : public StmtVisitor<StringRefCheckerVisitor> {
118 const Decl *DeclWithIssue;
120 const CheckerBase *Checker;
123 StringRefCheckerVisitor(const Decl *declWithIssue, BugReporter &br,
124 const CheckerBase *checker)
125 : DeclWithIssue(declWithIssue), BR(br), Checker(checker) {}
126 void VisitChildren(Stmt *S) {
127 for (Stmt *Child : S->children())
131 void VisitStmt(Stmt *S) { VisitChildren(S); }
132 void VisitDeclStmt(DeclStmt *DS);
134 void VisitVarDecl(VarDecl *VD);
136 } // end anonymous namespace
138 static void CheckStringRefAssignedTemporary(const Decl *D, BugReporter &BR,
139 const CheckerBase *Checker) {
140 StringRefCheckerVisitor walker(D, BR, Checker);
141 walker.Visit(D->getBody());
144 void StringRefCheckerVisitor::VisitDeclStmt(DeclStmt *S) {
147 for (auto *I : S->decls())
148 if (VarDecl *VD = dyn_cast<VarDecl>(I))
152 void StringRefCheckerVisitor::VisitVarDecl(VarDecl *VD) {
153 Expr *Init = VD->getInit();
157 // Pattern match for:
158 // StringRef x = call() (where call returns std::string)
159 if (!IsLLVMStringRef(VD->getType()))
161 ExprWithCleanups *Ex1 = dyn_cast<ExprWithCleanups>(Init);
164 CXXConstructExpr *Ex2 = dyn_cast<CXXConstructExpr>(Ex1->getSubExpr());
165 if (!Ex2 || Ex2->getNumArgs() != 1)
167 ImplicitCastExpr *Ex3 = dyn_cast<ImplicitCastExpr>(Ex2->getArg(0));
170 CXXConstructExpr *Ex4 = dyn_cast<CXXConstructExpr>(Ex3->getSubExpr());
171 if (!Ex4 || Ex4->getNumArgs() != 1)
173 ImplicitCastExpr *Ex5 = dyn_cast<ImplicitCastExpr>(Ex4->getArg(0));
176 CXXBindTemporaryExpr *Ex6 = dyn_cast<CXXBindTemporaryExpr>(Ex5->getSubExpr());
177 if (!Ex6 || !IsStdString(Ex6->getType()))
180 // Okay, badness! Report an error.
181 const char *desc = "StringRef should not be bound to temporary "
182 "std::string that it outlives";
183 PathDiagnosticLocation VDLoc =
184 PathDiagnosticLocation::createBegin(VD, BR.getSourceManager());
185 BR.EmitBasicReport(DeclWithIssue, Checker, desc, "LLVM Conventions", desc,
186 VDLoc, Init->getSourceRange());
189 //===----------------------------------------------------------------------===//
190 // CHECK: Clang AST nodes should not have fields that can allocate
192 //===----------------------------------------------------------------------===//
194 static bool AllocatesMemory(QualType T) {
195 return IsStdVector(T) || IsStdString(T) || IsSmallVector(T);
198 // This type checking could be sped up via dynamic programming.
199 static bool IsPartOfAST(const CXXRecordDecl *R) {
200 if (IsClangStmt(R) || IsClangType(R) || IsClangDecl(R) || IsClangAttr(R))
203 for (const auto &BS : R->bases()) {
204 QualType T = BS.getType();
205 if (const RecordType *baseT = T->getAs<RecordType>()) {
206 CXXRecordDecl *baseD = cast<CXXRecordDecl>(baseT->getDecl());
207 if (IsPartOfAST(baseD))
216 class ASTFieldVisitor {
217 SmallVector<FieldDecl*, 10> FieldChain;
218 const CXXRecordDecl *Root;
220 const CheckerBase *Checker;
223 ASTFieldVisitor(const CXXRecordDecl *root, BugReporter &br,
224 const CheckerBase *checker)
225 : Root(root), BR(br), Checker(checker) {}
227 void Visit(FieldDecl *D);
228 void ReportError(QualType T);
230 } // end anonymous namespace
232 static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR,
233 const CheckerBase *Checker) {
237 for (auto *I : R->fields()) {
238 ASTFieldVisitor walker(R, BR, Checker);
243 void ASTFieldVisitor::Visit(FieldDecl *D) {
244 FieldChain.push_back(D);
246 QualType T = D->getType();
248 if (AllocatesMemory(T))
251 if (const RecordType *RT = T->getAs<RecordType>()) {
252 const RecordDecl *RD = RT->getDecl()->getDefinition();
253 for (auto *I : RD->fields())
257 FieldChain.pop_back();
260 void ASTFieldVisitor::ReportError(QualType T) {
261 SmallString<1024> buf;
262 llvm::raw_svector_ostream os(buf);
264 os << "AST class '" << Root->getName() << "' has a field '"
265 << FieldChain.front()->getName() << "' that allocates heap memory";
266 if (FieldChain.size() > 1) {
267 os << " via the following chain: ";
269 for (SmallVectorImpl<FieldDecl*>::iterator I=FieldChain.begin(),
270 E=FieldChain.end(); I!=E; ++I) {
275 os << (*I)->getName();
278 os << " (type " << FieldChain.back()->getType().getAsString() << ")";
280 // Note that this will fire for every translation unit that uses this
281 // class. This is suboptimal, but at least scan-build will merge
282 // duplicate HTML reports. In the future we need a unified way of merging
283 // duplicate reports across translation units. For C++ classes we cannot
284 // just report warnings when we see an out-of-line method definition for a
285 // class, as that heuristic doesn't always work (the complete definition of
286 // the class may be in the header file, for example).
287 PathDiagnosticLocation L = PathDiagnosticLocation::createBegin(
288 FieldChain.front(), BR.getSourceManager());
289 BR.EmitBasicReport(Root, Checker, "AST node allocates heap memory",
290 "LLVM Conventions", os.str(), L);
293 //===----------------------------------------------------------------------===//
294 // LLVMConventionsChecker
295 //===----------------------------------------------------------------------===//
298 class LLVMConventionsChecker : public Checker<
299 check::ASTDecl<CXXRecordDecl>,
300 check::ASTCodeBody > {
302 void checkASTDecl(const CXXRecordDecl *R, AnalysisManager& mgr,
303 BugReporter &BR) const {
304 if (R->isCompleteDefinition())
305 CheckASTMemory(R, BR, this);
308 void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
309 BugReporter &BR) const {
310 CheckStringRefAssignedTemporary(D, BR, this);
315 void ento::registerLLVMConventionsChecker(CheckerManager &mgr) {
316 mgr.registerChecker<LLVMConventionsChecker>();