1 //=== LLVMConventionsChecker.cpp - Check LLVM codebase conventions ---*- C++ -*-
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This defines LLVMConventionsChecker, a bunch of small little checks
11 // for checking specific coding conventions in the LLVM/Clang codebase.
12 //
13 //===----------------------------------------------------------------------===//
14
15 #include "ClangSACheckers.h"
16 #include "clang/StaticAnalyzer/Core/Checker.h"
17 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
18 #include "clang/AST/DeclTemplate.h"
19 #include "clang/AST/StmtVisitor.h"
20 #include <string>
21 #include "llvm/ADT/StringRef.h"
22
23 using namespace clang;
24 using namespace ento;
25
26 //===----------------------------------------------------------------------===//
27 // Generic type checking routines.
28 //===----------------------------------------------------------------------===//
29
IsLLVMStringRef(QualType T)30 static bool IsLLVMStringRef(QualType T) {
31 const RecordType *RT = T->getAs<RecordType>();
32 if (!RT)
33 return false;
34
35 return llvm::StringRef(QualType(RT, 0).getAsString()) ==
36 "class llvm::StringRef";
37 }
38
39 /// Check whether the declaration is semantically inside the top-level
40 /// namespace named by ns.
InNamespace(const Decl * D,llvm::StringRef NS)41 static bool InNamespace(const Decl *D, llvm::StringRef NS) {
42 const NamespaceDecl *ND = dyn_cast<NamespaceDecl>(D->getDeclContext());
43 if (!ND)
44 return false;
45 const IdentifierInfo *II = ND->getIdentifier();
46 if (!II || !II->getName().equals(NS))
47 return false;
48 return isa<TranslationUnitDecl>(ND->getDeclContext());
49 }
50
IsStdString(QualType T)51 static bool IsStdString(QualType T) {
52 if (const ElaboratedType *QT = T->getAs<ElaboratedType>())
53 T = QT->getNamedType();
54
55 const TypedefType *TT = T->getAs<TypedefType>();
56 if (!TT)
57 return false;
58
59 const TypedefNameDecl *TD = TT->getDecl();
60
61 if (!InNamespace(TD, "std"))
62 return false;
63
64 return TD->getName() == "string";
65 }
66
IsClangType(const RecordDecl * RD)67 static bool IsClangType(const RecordDecl *RD) {
68 return RD->getName() == "Type" && InNamespace(RD, "clang");
69 }
70
IsClangDecl(const RecordDecl * RD)71 static bool IsClangDecl(const RecordDecl *RD) {
72 return RD->getName() == "Decl" && InNamespace(RD, "clang");
73 }
74
IsClangStmt(const RecordDecl * RD)75 static bool IsClangStmt(const RecordDecl *RD) {
76 return RD->getName() == "Stmt" && InNamespace(RD, "clang");
77 }
78
IsClangAttr(const RecordDecl * RD)79 static bool IsClangAttr(const RecordDecl *RD) {
80 return RD->getName() == "Attr" && InNamespace(RD, "clang");
81 }
82
IsStdVector(QualType T)83 static bool IsStdVector(QualType T) {
84 const TemplateSpecializationType *TS = T->getAs<TemplateSpecializationType>();
85 if (!TS)
86 return false;
87
88 TemplateName TM = TS->getTemplateName();
89 TemplateDecl *TD = TM.getAsTemplateDecl();
90
91 if (!TD || !InNamespace(TD, "std"))
92 return false;
93
94 return TD->getName() == "vector";
95 }
96
IsSmallVector(QualType T)97 static bool IsSmallVector(QualType T) {
98 const TemplateSpecializationType *TS = T->getAs<TemplateSpecializationType>();
99 if (!TS)
100 return false;
101
102 TemplateName TM = TS->getTemplateName();
103 TemplateDecl *TD = TM.getAsTemplateDecl();
104
105 if (!TD || !InNamespace(TD, "llvm"))
106 return false;
107
108 return TD->getName() == "SmallVector";
109 }
110
111 //===----------------------------------------------------------------------===//
112 // CHECK: a llvm::StringRef should not be bound to a temporary std::string whose
113 // lifetime is shorter than the StringRef's.
114 //===----------------------------------------------------------------------===//
115
116 namespace {
117 class StringRefCheckerVisitor : public StmtVisitor<StringRefCheckerVisitor> {
118 BugReporter &BR;
119 public:
StringRefCheckerVisitor(BugReporter & br)120 StringRefCheckerVisitor(BugReporter &br) : BR(br) {}
VisitChildren(Stmt * S)121 void VisitChildren(Stmt *S) {
122 for (Stmt::child_iterator I = S->child_begin(), E = S->child_end() ;
123 I != E; ++I)
124 if (Stmt *child = *I)
125 Visit(child);
126 }
VisitStmt(Stmt * S)127 void VisitStmt(Stmt *S) { VisitChildren(S); }
128 void VisitDeclStmt(DeclStmt *DS);
129 private:
130 void VisitVarDecl(VarDecl *VD);
131 };
132 } // end anonymous namespace
133
CheckStringRefAssignedTemporary(const Decl * D,BugReporter & BR)134 static void CheckStringRefAssignedTemporary(const Decl *D, BugReporter &BR) {
135 StringRefCheckerVisitor walker(BR);
136 walker.Visit(D->getBody());
137 }
138
VisitDeclStmt(DeclStmt * S)139 void StringRefCheckerVisitor::VisitDeclStmt(DeclStmt *S) {
140 VisitChildren(S);
141
142 for (DeclStmt::decl_iterator I = S->decl_begin(), E = S->decl_end();I!=E; ++I)
143 if (VarDecl *VD = dyn_cast<VarDecl>(*I))
144 VisitVarDecl(VD);
145 }
146
VisitVarDecl(VarDecl * VD)147 void StringRefCheckerVisitor::VisitVarDecl(VarDecl *VD) {
148 Expr *Init = VD->getInit();
149 if (!Init)
150 return;
151
152 // Pattern match for:
153 // llvm::StringRef x = call() (where call returns std::string)
154 if (!IsLLVMStringRef(VD->getType()))
155 return;
156 ExprWithCleanups *Ex1 = dyn_cast<ExprWithCleanups>(Init);
157 if (!Ex1)
158 return;
159 CXXConstructExpr *Ex2 = dyn_cast<CXXConstructExpr>(Ex1->getSubExpr());
160 if (!Ex2 || Ex2->getNumArgs() != 1)
161 return;
162 ImplicitCastExpr *Ex3 = dyn_cast<ImplicitCastExpr>(Ex2->getArg(0));
163 if (!Ex3)
164 return;
165 CXXConstructExpr *Ex4 = dyn_cast<CXXConstructExpr>(Ex3->getSubExpr());
166 if (!Ex4 || Ex4->getNumArgs() != 1)
167 return;
168 ImplicitCastExpr *Ex5 = dyn_cast<ImplicitCastExpr>(Ex4->getArg(0));
169 if (!Ex5)
170 return;
171 CXXBindTemporaryExpr *Ex6 = dyn_cast<CXXBindTemporaryExpr>(Ex5->getSubExpr());
172 if (!Ex6 || !IsStdString(Ex6->getType()))
173 return;
174
175 // Okay, badness! Report an error.
176 const char *desc = "StringRef should not be bound to temporary "
177 "std::string that it outlives";
178
179 BR.EmitBasicReport(desc, "LLVM Conventions", desc,
180 VD->getLocStart(), Init->getSourceRange());
181 }
182
183 //===----------------------------------------------------------------------===//
184 // CHECK: Clang AST nodes should not have fields that can allocate
185 // memory.
186 //===----------------------------------------------------------------------===//
187
AllocatesMemory(QualType T)188 static bool AllocatesMemory(QualType T) {
189 return IsStdVector(T) || IsStdString(T) || IsSmallVector(T);
190 }
191
192 // This type checking could be sped up via dynamic programming.
IsPartOfAST(const CXXRecordDecl * R)193 static bool IsPartOfAST(const CXXRecordDecl *R) {
194 if (IsClangStmt(R) || IsClangType(R) || IsClangDecl(R) || IsClangAttr(R))
195 return true;
196
197 for (CXXRecordDecl::base_class_const_iterator I = R->bases_begin(),
198 E = R->bases_end(); I!=E; ++I) {
199 CXXBaseSpecifier BS = *I;
200 QualType T = BS.getType();
201 if (const RecordType *baseT = T->getAs<RecordType>()) {
202 CXXRecordDecl *baseD = cast<CXXRecordDecl>(baseT->getDecl());
203 if (IsPartOfAST(baseD))
204 return true;
205 }
206 }
207
208 return false;
209 }
210
211 namespace {
212 class ASTFieldVisitor {
213 llvm::SmallVector<FieldDecl*, 10> FieldChain;
214 const CXXRecordDecl *Root;
215 BugReporter &BR;
216 public:
ASTFieldVisitor(const CXXRecordDecl * root,BugReporter & br)217 ASTFieldVisitor(const CXXRecordDecl *root, BugReporter &br)
218 : Root(root), BR(br) {}
219
220 void Visit(FieldDecl *D);
221 void ReportError(QualType T);
222 };
223 } // end anonymous namespace
224
CheckASTMemory(const CXXRecordDecl * R,BugReporter & BR)225 static void CheckASTMemory(const CXXRecordDecl *R, BugReporter &BR) {
226 if (!IsPartOfAST(R))
227 return;
228
229 for (RecordDecl::field_iterator I = R->field_begin(), E = R->field_end();
230 I != E; ++I) {
231 ASTFieldVisitor walker(R, BR);
232 walker.Visit(*I);
233 }
234 }
235
Visit(FieldDecl * D)236 void ASTFieldVisitor::Visit(FieldDecl *D) {
237 FieldChain.push_back(D);
238
239 QualType T = D->getType();
240
241 if (AllocatesMemory(T))
242 ReportError(T);
243
244 if (const RecordType *RT = T->getAs<RecordType>()) {
245 const RecordDecl *RD = RT->getDecl()->getDefinition();
246 for (RecordDecl::field_iterator I = RD->field_begin(), E = RD->field_end();
247 I != E; ++I)
248 Visit(*I);
249 }
250
251 FieldChain.pop_back();
252 }
253
ReportError(QualType T)254 void ASTFieldVisitor::ReportError(QualType T) {
255 llvm::SmallString<1024> buf;
256 llvm::raw_svector_ostream os(buf);
257
258 os << "AST class '" << Root->getName() << "' has a field '"
259 << FieldChain.front()->getName() << "' that allocates heap memory";
260 if (FieldChain.size() > 1) {
261 os << " via the following chain: ";
262 bool isFirst = true;
263 for (llvm::SmallVectorImpl<FieldDecl*>::iterator I=FieldChain.begin(),
264 E=FieldChain.end(); I!=E; ++I) {
265 if (!isFirst)
266 os << '.';
267 else
268 isFirst = false;
269 os << (*I)->getName();
270 }
271 }
272 os << " (type " << FieldChain.back()->getType().getAsString() << ")";
273 os.flush();
274
275 // Note that this will fire for every translation unit that uses this
276 // class. This is suboptimal, but at least scan-build will merge
277 // duplicate HTML reports. In the future we need a unified way of merging
278 // duplicate reports across translation units. For C++ classes we cannot
279 // just report warnings when we see an out-of-line method definition for a
280 // class, as that heuristic doesn't always work (the complete definition of
281 // the class may be in the header file, for example).
282 BR.EmitBasicReport("AST node allocates heap memory", "LLVM Conventions",
283 os.str(), FieldChain.front()->getLocStart());
284 }
285
286 //===----------------------------------------------------------------------===//
287 // LLVMConventionsChecker
288 //===----------------------------------------------------------------------===//
289
290 namespace {
291 class LLVMConventionsChecker : public Checker<
292 check::ASTDecl<CXXRecordDecl>,
293 check::ASTCodeBody > {
294 public:
checkASTDecl(const CXXRecordDecl * R,AnalysisManager & mgr,BugReporter & BR) const295 void checkASTDecl(const CXXRecordDecl *R, AnalysisManager& mgr,
296 BugReporter &BR) const {
297 if (R->isDefinition())
298 CheckASTMemory(R, BR);
299 }
300
checkASTCodeBody(const Decl * D,AnalysisManager & mgr,BugReporter & BR) const301 void checkASTCodeBody(const Decl *D, AnalysisManager& mgr,
302 BugReporter &BR) const {
303 CheckStringRefAssignedTemporary(D, BR);
304 }
305 };
306 }
307
registerLLVMConventionsChecker(CheckerManager & mgr)308 void ento::registerLLVMConventionsChecker(CheckerManager &mgr) {
309 mgr.registerChecker<LLVMConventionsChecker>();
310 }
311