[WebKit checkers] Add an annotation for pointer conversion. #141277
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This PR adds the WebKit checker support for [[clang::annotate_type("webkit.pointerconversion")]].
When this attribute is set on the return value of a function, the function is treated as safe to
call anywhere and the return value's pointer origin is the argument.`
llvmbot
added
clang
Member
|
@llvm/pr-subscribers-clang Author: Ryosuke Niwa (rniwa) ChangesThis PR adds the WebKit checker support for [[clang::annotate_type("webkit.pointerconversion")]]. When this attribute is set on the return value of a function, the function is treated as safe to call anywhere and the return value's pointer origin is the argument.` Full diff: https://github.com/llvm/llvm-project/pull/141277.diff 2 Files Affected:
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
index 4ddd11495f534..cd33476344a34 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
@@ -468,6 +468,18 @@ bool isPtrConversion(const FunctionDecl *F) {
FunctionName == "checked_objc_cast")
return true;
+ auto ReturnType = F->getReturnType();
+ if (auto *Type = ReturnType.getTypePtrOrNull()) {
+ if (auto *AttrType = dyn_cast<AttributedType>(Type)) {
+ if (auto *Attr = AttrType->getAttr()) {
+ if (auto *AnnotateType = dyn_cast<AnnotateTypeAttr>(Attr)) {
+ if (AnnotateType->getAnnotation() == "webkit.pointerconversion")
+ return true;
+ }
+ }
+ }
+ }
+
return false;
}
diff --git a/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp b/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
index a87446564870c..9f6dbade3c746 100644
--- a/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
@@ -1,5 +1,4 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncountedCallArgsChecker -verify %s
-// expected-no-diagnostics
class Base {
public:
@@ -44,6 +43,12 @@ inline Target* uncheckedDowncast(Source* source)
return static_cast<Target*>(source);
}
+template<typename Target, typename Source>
+Target* [[clang::annotate_type("webkit.pointerconversion")]] newCastFunction(Source*);
+
+template<typename Target, typename Source>
+Target* [[clang::annotate_type("unrelated-annotation")]] badCastFunction(Source*);
+
template<typename... Types>
String toString(const Types&... values);
@@ -52,5 +57,8 @@ void foo(OtherObject* other)
dynamicDowncast<SubDerived>(other->obj());
checkedDowncast<SubDerived>(other->obj());
uncheckedDowncast<SubDerived>(other->obj());
+ newCastFunction<SubDerived>(other->obj());
+ badCastFunction<SubDerived>(other->obj());
+ // expected-warning@-1{{Call argument is uncounted and unsafe}}
toString(other->obj());
}
|
Member
|
@llvm/pr-subscribers-clang-static-analyzer-1 Author: Ryosuke Niwa (rniwa) ChangesThis PR adds the WebKit checker support for [[clang::annotate_type("webkit.pointerconversion")]]. When this attribute is set on the return value of a function, the function is treated as safe to call anywhere and the return value's pointer origin is the argument.` Full diff: https://github.com/llvm/llvm-project/pull/141277.diff 2 Files Affected:
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
index 4ddd11495f534..cd33476344a34 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
@@ -468,6 +468,18 @@ bool isPtrConversion(const FunctionDecl *F) {
FunctionName == "checked_objc_cast")
return true;
+ auto ReturnType = F->getReturnType();
+ if (auto *Type = ReturnType.getTypePtrOrNull()) {
+ if (auto *AttrType = dyn_cast<AttributedType>(Type)) {
+ if (auto *Attr = AttrType->getAttr()) {
+ if (auto *AnnotateType = dyn_cast<AnnotateTypeAttr>(Attr)) {
+ if (AnnotateType->getAnnotation() == "webkit.pointerconversion")
+ return true;
+ }
+ }
+ }
+ }
+
return false;
}
diff --git a/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp b/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
index a87446564870c..9f6dbade3c746 100644
--- a/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
+++ b/clang/test/Analysis/Checkers/WebKit/call-args-safe-functions.cpp
@@ -1,5 +1,4 @@
// RUN: %clang_analyze_cc1 -analyzer-checker=alpha.webkit.UncountedCallArgsChecker -verify %s
-// expected-no-diagnostics
class Base {
public:
@@ -44,6 +43,12 @@ inline Target* uncheckedDowncast(Source* source)
return static_cast<Target*>(source);
}
+template<typename Target, typename Source>
+Target* [[clang::annotate_type("webkit.pointerconversion")]] newCastFunction(Source*);
+
+template<typename Target, typename Source>
+Target* [[clang::annotate_type("unrelated-annotation")]] badCastFunction(Source*);
+
template<typename... Types>
String toString(const Types&... values);
@@ -52,5 +57,8 @@ void foo(OtherObject* other)
dynamicDowncast<SubDerived>(other->obj());
checkedDowncast<SubDerived>(other->obj());
uncheckedDowncast<SubDerived>(other->obj());
+ newCastFunction<SubDerived>(other->obj());
+ badCastFunction<SubDerived>(other->obj());
+ // expected-warning@-1{{Call argument is uncounted and unsafe}}
toString(other->obj());
}
|
ziqingluo-90
reviewed
Jun 6, 2025
| } | ||
|
|
||
| template<typename Target, typename Source> | ||
| Target* [[clang::annotate_type("webkit.pointerconversion")]] newCastFunction(Source*); |
Contributor
There was a problem hiding this comment.
If this function is a member function, will you accidentally take the implicit this object as the original argument?
Contributor
Author
There was a problem hiding this comment.
I don't think so. I added a test case for that.
… a class member function.
Contributor
Author
|
Thanks for the review! |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR adds the WebKit checker support for [[clang::annotate_type("webkit.pointerconversion")]].
When this attribute is set on the return value of a function, the function is treated as safe to call anywhere and the return value's pointer origin is the argument.`