1 //=======- RefCntblBaseVirtualDtor.cpp ---------------------------*- C++ -*-==// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 9 #include "DiagOutputUtils.h" 10 #include "PtrTypesSemantics.h" 11 #include "clang/AST/CXXInheritance.h" 12 #include "clang/AST/RecursiveASTVisitor.h" 13 #include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h" 14 #include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h" 15 #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" 16 #include "clang/StaticAnalyzer/Core/Checker.h" 17 #include <optional> 18 19 using namespace clang; 20 using namespace ento; 21 22 namespace { 23 class RefCntblBaseVirtualDtorChecker 24 : public Checker<check::ASTDecl<TranslationUnitDecl>> { 25 private: 26 BugType Bug; 27 mutable BugReporter *BR; 28 29 public: 30 RefCntblBaseVirtualDtorChecker() 31 : Bug(this, 32 "Reference-countable base class doesn't have virtual destructor", 33 "WebKit coding guidelines") {} 34 35 void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &MGR, 36 BugReporter &BRArg) const { 37 BR = &BRArg; 38 39 // The calls to checkAST* from AnalysisConsumer don't 40 // visit template instantiations or lambda classes. We 41 // want to visit those, so we make our own RecursiveASTVisitor. 42 struct LocalVisitor : public RecursiveASTVisitor<LocalVisitor> { 43 const RefCntblBaseVirtualDtorChecker *Checker; 44 explicit LocalVisitor(const RefCntblBaseVirtualDtorChecker *Checker) 45 : Checker(Checker) { 46 assert(Checker); 47 } 48 49 bool shouldVisitTemplateInstantiations() const { return true; } 50 bool shouldVisitImplicitCode() const { return false; } 51 52 bool VisitCXXRecordDecl(const CXXRecordDecl *RD) { 53 Checker->visitCXXRecordDecl(RD); 54 return true; 55 } 56 }; 57 58 LocalVisitor visitor(this); 59 visitor.TraverseDecl(const_cast<TranslationUnitDecl *>(TUD)); 60 } 61 62 void visitCXXRecordDecl(const CXXRecordDecl *RD) const { 63 if (shouldSkipDecl(RD)) 64 return; 65 66 CXXBasePaths Paths; 67 Paths.setOrigin(RD); 68 69 const CXXBaseSpecifier *ProblematicBaseSpecifier = nullptr; 70 const CXXRecordDecl *ProblematicBaseClass = nullptr; 71 72 const auto IsPublicBaseRefCntblWOVirtualDtor = 73 [RD, &ProblematicBaseSpecifier, 74 &ProblematicBaseClass](const CXXBaseSpecifier *Base, CXXBasePath &) { 75 const auto AccSpec = Base->getAccessSpecifier(); 76 if (AccSpec == AS_protected || AccSpec == AS_private || 77 (AccSpec == AS_none && RD->isClass())) 78 return false; 79 80 llvm::Optional<const CXXRecordDecl *> RefCntblBaseRD = 81 isRefCountable(Base); 82 if (!RefCntblBaseRD || !(*RefCntblBaseRD)) 83 return false; 84 85 const auto *Dtor = (*RefCntblBaseRD)->getDestructor(); 86 if (!Dtor || !Dtor->isVirtual()) { 87 ProblematicBaseSpecifier = Base; 88 ProblematicBaseClass = *RefCntblBaseRD; 89 return true; 90 } 91 92 return false; 93 }; 94 95 if (RD->lookupInBases(IsPublicBaseRefCntblWOVirtualDtor, Paths, 96 /*LookupInDependent =*/true)) { 97 reportBug(RD, ProblematicBaseSpecifier, ProblematicBaseClass); 98 } 99 } 100 101 bool shouldSkipDecl(const CXXRecordDecl *RD) const { 102 if (!RD->isThisDeclarationADefinition()) 103 return true; 104 105 if (RD->isImplicit()) 106 return true; 107 108 if (RD->isLambda()) 109 return true; 110 111 // If the construct doesn't have a source file, then it's not something 112 // we want to diagnose. 113 const auto RDLocation = RD->getLocation(); 114 if (!RDLocation.isValid()) 115 return true; 116 117 const auto Kind = RD->getTagKind(); 118 if (Kind != TTK_Struct && Kind != TTK_Class) 119 return true; 120 121 // Ignore CXXRecords that come from system headers. 122 if (BR->getSourceManager().getFileCharacteristic(RDLocation) != 123 SrcMgr::C_User) 124 return true; 125 126 return false; 127 } 128 129 void reportBug(const CXXRecordDecl *DerivedClass, 130 const CXXBaseSpecifier *BaseSpec, 131 const CXXRecordDecl *ProblematicBaseClass) const { 132 assert(DerivedClass); 133 assert(BaseSpec); 134 assert(ProblematicBaseClass); 135 136 SmallString<100> Buf; 137 llvm::raw_svector_ostream Os(Buf); 138 139 Os << (ProblematicBaseClass->isClass() ? "Class" : "Struct") << " "; 140 printQuotedQualifiedName(Os, ProblematicBaseClass); 141 142 Os << " is used as a base of " 143 << (DerivedClass->isClass() ? "class" : "struct") << " "; 144 printQuotedQualifiedName(Os, DerivedClass); 145 146 Os << " but doesn't have virtual destructor"; 147 148 PathDiagnosticLocation BSLoc(BaseSpec->getSourceRange().getBegin(), 149 BR->getSourceManager()); 150 auto Report = std::make_unique<BasicBugReport>(Bug, Os.str(), BSLoc); 151 Report->addRange(BaseSpec->getSourceRange()); 152 BR->emitReport(std::move(Report)); 153 } 154 }; 155 } // namespace 156 157 void ento::registerRefCntblBaseVirtualDtorChecker(CheckerManager &Mgr) { 158 Mgr.registerChecker<RefCntblBaseVirtualDtorChecker>(); 159 } 160 161 bool ento::shouldRegisterRefCntblBaseVirtualDtorChecker( 162 const CheckerManager &mgr) { 163 return true; 164 } 165