Author: Fady Farag Date: 2026-10-05T23:20:17-07:00 New Revision: d18154cf690af40274856f0d9a0f350738543c2d
URL: https://github.com/llvm/llvm-project/commit/d18154cf690af40274856f0d9a0f350738543c2d DIFF: https://github.com/llvm/llvm-project/commit/d18154cf690af40274856f0d9a0f350738543c2d.diff LOG: [alpha.webkit.UncountedCallArgsChecker] Don't treat a call returning a reference to a smart pointer as a safe origin (#229301) Previously, when walking a call argument or a local variable's initializer back to its origin, `tryToFindPtrOriginImpl` treated any call whose type is a smart pointer type as safe. That is correct for a call returning a smart pointer by value, but a call returning a reference to a smart pointer has the same type, which caused a missing warning for any raw pointer/reference obtained through it. This only treats such a call as safe when it returns by value. Added: Modified: clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp clang/test/Analysis/Checkers/WebKit/call-args.cpp clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp Removed: ################################################################################ diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp index a1dae480f85b2..21f4275acc4ac 100644 --- a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp +++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp @@ -277,7 +277,7 @@ static bool tryToFindPtrOriginImpl( } } - if (isSafePtrType(call->getType())) + if (call->isPRValue() && isSafePtrType(call->getType())) return callback(E, /*IsSafe=*/true, OriginDependsOnFullExpressionTemporary, PtrIsLifetimeBoundToOrigin); diff --git a/clang/test/Analysis/Checkers/WebKit/call-args.cpp b/clang/test/Analysis/Checkers/WebKit/call-args.cpp index b4dc1b1038ef5..de90a3bc268f9 100644 --- a/clang/test/Analysis/Checkers/WebKit/call-args.cpp +++ b/clang/test/Analysis/Checkers/WebKit/call-args.cpp @@ -543,3 +543,36 @@ namespace call_arg_outside_decl { // expected-warning@-1{{Function argument 'provide()' (to 'call_arg_outside_decl::consume') is a raw pointer to RefPtr-capable type 'RefCountable'}} } + +namespace call_returning_reference_to_smart_pointer { + + template <typename T> struct Vector { + T& operator[](unsigned); + T* m_buffer; + }; + + class Owner { + public: + const RefPtr<RefCountable>& referenceGetter() const { return m_obj; } + RefPtr<RefCountable> valueGetter() const { return m_obj; } + + void callThroughReferenceGetter() { + referenceGetter()->method(); + // expected-warning@-1{{Function argument 'this->referenceGetter()' (parameter 'this' to 'RefCountable::method') is a raw pointer to RefPtr-capable type 'RefCountable'}} + } + + void callThroughValueGetter() { + valueGetter()->method(); + } + + void callThroughVectorElement() { + m_items[0]->method(); + // expected-warning@-1{{Function argument 'this->m_items[0]' (parameter 'this' to 'RefCountable::method') is a raw pointer to RefPtr-capable type 'RefCountable'}} + } + + private: + RefPtr<RefCountable> m_obj; + Vector<Ref<RefCountable>> m_items; + }; + +} // namespace call_returning_reference_to_smart_pointer diff --git a/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp b/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp index 7f086f13f68e4..6c1299998e646 100644 --- a/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp +++ b/clang/test/Analysis/Checkers/WebKit/uncounted-local-vars.cpp @@ -945,3 +945,35 @@ void unrelated_temporary_traces_to_guardian(RefCountable &obj) { } } // namespace short_lived_temporaries + +namespace call_returning_reference_to_smart_pointer { + +template <typename T> struct Vector { + T& operator[](unsigned); + T* m_buffer; +}; + +class Owner { +public: + const RefPtr<RefCountable>& referenceGetter() const { return m_obj; } + + void localFromReferenceGetter() { + RefCountable *obj = referenceGetter().get(); + // expected-warning@-1{{Local variable 'obj' is a raw pointer to RefPtr-capable type 'RefCountable' [alpha.webkit.UncountedLocalVarsChecker]}} + someFunction(); + obj->method(); + } + + void localFromVectorElement() { + RefCountable *obj = m_items[0].ptr(); + // expected-warning@-1{{Local variable 'obj' is a raw pointer to RefPtr-capable type 'RefCountable' [alpha.webkit.UncountedLocalVarsChecker]}} + someFunction(); + obj->method(); + } + +private: + RefPtr<RefCountable> m_obj; + Vector<Ref<RefCountable>> m_items; +}; + +} // namespace call_returning_reference_to_smart_pointer _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
