DXR is a code search and navigation tool aimed at making sense of large projects. It supports full-text and regex searches as well as structural queries.

Header

Mercurial (409f3966645a)

VCS Links

Line Code
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256
/* This Source Code Form is subject to the terms of the Mozilla Public
 * License, v. 2.0. If a copy of the MPL was not distributed with this
 * file, You can obtain one at http://mozilla.org/MPL/2.0/. */

#include "DanglingOnTemporaryChecker.h"
#include "CustomMatchers.h"
#include "VariableUsageHelpers.h"

void DanglingOnTemporaryChecker::registerMatchers(MatchFinder *AstMatcher) {
  ////////////////////////////////////////
  // Quick annotation conflict checkers //
  ////////////////////////////////////////

  AstMatcher->addMatcher(
      // This is a matcher on a method declaration,
      cxxMethodDecl(
          // which is marked as no dangling on temporaries,
          noDanglingOnTemporaries(),

          // and which is && ref-qualified.
          isRValueRefQualified(),

          decl().bind("invalidMethodRefQualified")),
      this);

  AstMatcher->addMatcher(
      // This is a matcher on a method declaration,
      cxxMethodDecl(
          // which is marked as no dangling on temporaries,
          noDanglingOnTemporaries(),

          // which returns a primitive type,
          returns(builtinType()),

          // and which doesn't return a pointer.
          unless(returns(pointerType())),

          decl().bind("invalidMethodPointer")),
      this);

  //////////////////
  // Main checker //
  //////////////////

  auto hasParentCall = hasParent(expr(
      anyOf(cxxOperatorCallExpr(
                // If we're in a lamda, we may have an operator call expression
                // ancestor in the AST, but the temporary we're matching
                // against is not going to have the same lifetime as the
                // constructor call.
                unless(has(expr(ignoreTrivials(lambdaExpr())))),
                expr().bind("parentOperatorCallExpr")),
            callExpr(
                // If we're in a lamda, we may have a call expression
                // ancestor in the AST, but the temporary we're matching
                // against is not going to have the same lifetime as the
                // function call.
                unless(has(expr(ignoreTrivials(lambdaExpr())))),
                expr().bind("parentCallExpr")),
            objcMessageExpr(
                // If we're in a lamda, we may have an objc message expression
                // ancestor in the AST, but the temporary we're matching
                // against is not going to have the same lifetime as the
                // function call.
                unless(has(expr(ignoreTrivials(lambdaExpr())))),
                expr().bind("parentObjCMessageExpr")),
            cxxConstructExpr(
                // If we're in a lamda, we may have a construct expression
                // ancestor in the AST, but the temporary we're matching
                // against is not going to have the same lifetime as the
                // constructor call.
                unless(has(expr(ignoreTrivials(lambdaExpr())))),
                expr().bind("parentConstructExpr")))));

  AstMatcher->addMatcher(
      // This is a matcher on a method call,
      cxxMemberCallExpr(
          // which is in first party code,
          isFirstParty(),

          // and which is performed on a temporary,
          on(allOf(unless(hasType(pointerType())), isTemporary(),
                   // but which is not `this`.
                   unless(cxxThisExpr()))),

          // and which is marked as no dangling on temporaries.
          callee(cxxMethodDecl(noDanglingOnTemporaries())),

          expr().bind("memberCallExpr"),

          // We optionally match a parent call expression or a parent construct
          // expression because using a temporary inside a call is fine as long
          // as the pointer doesn't escape the function call.
          anyOf(
              // This is the case where the call is the direct parent, so we
              // know that the member call expression is the argument.
              allOf(hasParentCall, expr().bind("parentCallArg")),

              // This is the case where the call is not the direct parent, so we
              // get its child to know in which argument tree we are.
              hasAncestor(expr(hasParentCall, expr().bind("parentCallArg"))),
              // To make it optional.
              anything())),
      this);
}

void DanglingOnTemporaryChecker::check(const MatchFinder::MatchResult &Result) {
  ///////////////////////////////////////
  // Quick annotation conflict checker //
  ///////////////////////////////////////

  const char *ErrorInvalidRefQualified = "methods annotated with "
                                         "MOZ_NO_DANGLING_ON_TEMPORARIES "
                                         "cannot be && ref-qualified";

  const char *ErrorInvalidPointer = "methods annotated with "
                                    "MOZ_NO_DANGLING_ON_TEMPORARIES must "
                                    "return a pointer";

  if (auto InvalidRefQualified =
          Result.Nodes.getNodeAs<CXXMethodDecl>("invalidMethodRefQualified")) {
    diag(InvalidRefQualified->getLocation(), ErrorInvalidRefQualified,
         DiagnosticIDs::Error);
    return;
  }

  if (auto InvalidPointer =
          Result.Nodes.getNodeAs<CXXMethodDecl>("invalidMethodPointer")) {
    diag(InvalidPointer->getLocation(), ErrorInvalidPointer,
         DiagnosticIDs::Error);
    return;
  }

  //////////////////
  // Main checker //
  //////////////////

  const char *Error = "calling `%0` on a temporary, potentially allowing use "
                      "after free of the raw pointer";

  const char *EscapeStmtNote =
      "the raw pointer escapes the function scope here";

  const ObjCMessageExpr *ParentObjCMessageExpr =
      Result.Nodes.getNodeAs<ObjCMessageExpr>("parentObjCMessageExpr");

  // We don't care about cases in ObjC message expressions.
  if (ParentObjCMessageExpr) {
    return;
  }

  const CXXMemberCallExpr *MemberCall =
      Result.Nodes.getNodeAs<CXXMemberCallExpr>("memberCallExpr");

  const CallExpr *ParentCallExpr =
      Result.Nodes.getNodeAs<CallExpr>("parentCallExpr");
  const CXXConstructExpr *ParentConstructExpr =
      Result.Nodes.getNodeAs<CXXConstructExpr>("parentConstructExpr");
  const CXXOperatorCallExpr *ParentOperatorCallExpr =
      Result.Nodes.getNodeAs<CXXOperatorCallExpr>("parentOperatorCallExpr");
  const Expr *ParentCallArg = Result.Nodes.getNodeAs<Expr>("parentCallArg");

  // Just in case.
  if (!MemberCall) {
    return;
  }

  // If we have a parent call, we check whether or not we escape the function
  // being called.
  if (ParentOperatorCallExpr || ParentCallExpr || ParentConstructExpr) {
    // Just in case.
    if (!ParentCallArg) {
      return;
    }

    // No default constructor so we can't construct it using if/else.
    auto FunctionEscapeData =
        ParentOperatorCallExpr
            ? escapesFunction(ParentCallArg, ParentOperatorCallExpr)
            : ParentCallExpr
                  ? escapesFunction(ParentCallArg, ParentCallExpr)
                  : escapesFunction(ParentCallArg, ParentConstructExpr);

    // If there was an error in the escapesFunction call.
    if (std::error_code ec = FunctionEscapeData.getError()) {
      // FIXME: For now we ignore the variadic case and just consider that the
      // argument doesn't escape the function. Same for the case where we can't
      // find the function declaration or if the function is builtin.
      if (static_cast<EscapesFunctionError>(ec.value()) ==
              EscapesFunctionError::FunctionIsVariadic ||
          static_cast<EscapesFunctionError>(ec.value()) ==
              EscapesFunctionError::FunctionDeclNotFound ||
          static_cast<EscapesFunctionError>(ec.value()) ==
              EscapesFunctionError::FunctionIsBuiltin) {
        return;
      }

      // We emit the internal checker error and return.
      diag(MemberCall->getExprLoc(),
           std::string(ec.category().name()) + " error: " + ec.message(),
           DiagnosticIDs::Error);
      return;
    }

    // We deconstruct the function escape data.
    const Stmt *EscapeStmt;
    const Decl *EscapeDecl;
    std::tie(EscapeStmt, EscapeDecl) = *FunctionEscapeData;

    // If we didn't escape a parent function, we're done: we don't emit any
    // diagnostic.
    if (!EscapeStmt || !EscapeDecl) {
      return;
    }

    // We emit the error diagnostic indicating that we are calling the method
    // temporary.
    diag(MemberCall->getExprLoc(), Error, DiagnosticIDs::Error)
        << MemberCall->getMethodDecl()->getName()
        << MemberCall->getSourceRange();

    // We indicate the escape statement.
    diag(EscapeStmt->getLocStart(), EscapeStmtNote, DiagnosticIDs::Note)
        << EscapeStmt->getSourceRange();

    // We build the escape note along with its source range.
    StringRef EscapeDeclNote;
    SourceRange EscapeDeclRange;
    if (isa<ParmVarDecl>(EscapeDecl)) {
      EscapeDeclNote = "through the parameter declared here";
      EscapeDeclRange = EscapeDecl->getSourceRange();
    } else if (isa<VarDecl>(EscapeDecl)) {
      EscapeDeclNote = "through the variable declared here";
      EscapeDeclRange = EscapeDecl->getSourceRange();
    } else if (isa<FieldDecl>(EscapeDecl)) {
      EscapeDeclNote = "through the field declared here";
      EscapeDeclRange = EscapeDecl->getSourceRange();
    } else if (auto FuncDecl = dyn_cast<FunctionDecl>(EscapeDecl)) {
      EscapeDeclNote = "through the return value of the function declared here";
      EscapeDeclRange = FuncDecl->getReturnTypeSourceRange();
    } else {
      return;
    }

    // We emit the declaration note indicating through which decl the argument
    // escapes.
    diag(EscapeDecl->getLocation(), EscapeDeclNote, DiagnosticIDs::Note)
        << EscapeDeclRange;
  } else {
    // We emit the error diagnostic indicating that we are calling the method
    // temporary.
    diag(MemberCall->getExprLoc(), Error, DiagnosticIDs::Error)
        << MemberCall->getMethodDecl()->getName()
        << MemberCall->getSourceRange();
  }
}