https://github.com/rniwa updated
https://github.com/llvm/llvm-project/pull/158012
>From 4300ba25baa26edd6996ced22b1d52025dbba86b Mon Sep 17 00:00:00 2001
From: Ryosuke Niwa <rn...@webkit.org>
Date: Thu, 11 Sep 2025 01:23:50 -0700
Subject: [PATCH] [WebKit checkers] Treat function pointers with "Singleton"
suffix as singleton.
Also add test cases for a member function pointer and a pointer to static
member function.
The former should always emit a warning since we only allow static member
function to return a singleton.
---
.../Checkers/WebKit/ASTUtils.cpp | 5 ++++
.../Checkers/WebKit/PtrTypesSemantics.cpp | 2 +-
.../Checkers/WebKit/PtrTypesSemantics.h | 3 +-
.../Checkers/WebKit/unretained-call-args.mm | 28 +++++++++++++++++++
4 files changed, 36 insertions(+), 2 deletions(-)
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
index 6f13d552b4b44..b629de3254ed3 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/ASTUtils.cpp
@@ -160,6 +160,11 @@ bool tryToFindPtrOrigin(
if (Name == "__builtin___CFStringMakeConstantString" ||
Name == "NSClassFromString")
return callback(E, true);
+ } else if (auto *CalleeE = call->getCallee()) {
+ if (auto *E = dyn_cast<DeclRefExpr>(CalleeE->IgnoreParenCasts())) {
+ if (isSingleton(E->getFoundDecl()))
+ return callback(E, true);
+ }
}
// Sometimes, canonical type erroneously turns Ref<T> into T.
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
index 56747d72136e3..90b2343b4be77 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.cpp
@@ -479,7 +479,7 @@ bool isTrivialBuiltinFunction(const FunctionDecl *F) {
Name.starts_with("os_log") || Name.starts_with("_os_log");
}
-bool isSingleton(const FunctionDecl *F) {
+bool isSingleton(const NamedDecl *F) {
assert(F);
// FIXME: check # of params == 1
if (auto *MethodDecl = dyn_cast<CXXMethodDecl>(F)) {
diff --git a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.h
b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.h
index 3c9560cb8059b..d2095d07e1434 100644
--- a/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.h
+++ b/clang/lib/StaticAnalyzer/Checkers/WebKit/PtrTypesSemantics.h
@@ -21,6 +21,7 @@ class CXXMethodDecl;
class CXXRecordDecl;
class Decl;
class FunctionDecl;
+class NamedDecl;
class QualType;
class RecordType;
class Stmt;
@@ -156,7 +157,7 @@ bool isPtrConversion(const FunctionDecl *F);
bool isTrivialBuiltinFunction(const FunctionDecl *F);
/// \returns true if \p F is a static singleton function.
-bool isSingleton(const FunctionDecl *F);
+bool isSingleton(const NamedDecl *F);
/// An inter-procedural analysis facility that detects functions with "trivial"
/// behavior with respect to reference counting, such as simple field getters.
diff --git a/clang/test/Analysis/Checkers/WebKit/unretained-call-args.mm
b/clang/test/Analysis/Checkers/WebKit/unretained-call-args.mm
index f39822ee2a8c6..75eead070fdf9 100644
--- a/clang/test/Analysis/Checkers/WebKit/unretained-call-args.mm
+++ b/clang/test/Analysis/Checkers/WebKit/unretained-call-args.mm
@@ -438,6 +438,34 @@ void use_const_local() {
} // namespace const_global
+namespace var_decl_ref_singleton {
+
+static Class initSomeObject() { return nil; }
+static Class (*getSomeObjectClassSingleton)() = initSomeObject;
+
+bool foo(NSString *obj) {
+ return [obj isKindOfClass:getSomeObjectClassSingleton()];
+}
+
+class Bar {
+public:
+ Class someObject();
+ static Class staticSomeObject();
+};
+typedef Class (Bar::*SomeObjectSingleton)();
+
+bool bar(NSObject *obj, Bar *bar, SomeObjectSingleton someObjSingleton) {
+ return [obj isKindOfClass:(bar->*someObjSingleton)()];
+ // expected-warning@-1{{Call argument for parameter 'aClass' is unretained
and unsafe}}
+}
+
+bool baz(NSObject *obj) {
+ Class (*someObjectSingleton)() = Bar::staticSomeObject;
+ return [obj isKindOfClass:someObjectSingleton()];
+}
+
+} // namespace var_decl_ref_singleton
+
namespace ns_retained_return_value {
NSString *provideNS() NS_RETURNS_RETAINED;
_______________________________________________
cfe-commits mailing list
cfe-commits@lists.llvm.org
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
