Coverage Report

Created: 2022-01-25 06:29

/Users/buildslave/jenkins/workspace/coverage/llvm-project/clang/lib/StaticAnalyzer/Checkers/DirectIvarAssignment.cpp
Line
Count
Source (jump to first uncovered line)
1
//=- DirectIvarAssignment.cpp - Check rules on ObjC properties -*- C++ ----*-==//
2
//
3
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4
// See https://llvm.org/LICENSE.txt for license information.
5
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6
//
7
//===----------------------------------------------------------------------===//
8
//
9
//  Check that Objective C properties are set with the setter, not though a
10
//      direct assignment.
11
//
12
//  Two versions of a checker exist: one that checks all methods and the other
13
//      that only checks the methods annotated with
14
//      __attribute__((annotate("objc_no_direct_instance_variable_assignment")))
15
//
16
//  The checker does not warn about assignments to Ivars, annotated with
17
//       __attribute__((objc_allow_direct_instance_variable_assignment"))). This
18
//      annotation serves as a false positive suppression mechanism for the
19
//      checker. The annotation is allowed on properties and Ivars.
20
//
21
//===----------------------------------------------------------------------===//
22
23
#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
24
#include "clang/AST/Attr.h"
25
#include "clang/AST/DeclObjC.h"
26
#include "clang/AST/StmtVisitor.h"
27
#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
28
#include "clang/StaticAnalyzer/Core/Checker.h"
29
#include "clang/StaticAnalyzer/Core/PathSensitive/AnalysisManager.h"
30
#include "llvm/ADT/DenseMap.h"
31
32
using namespace clang;
33
using namespace ento;
34
35
namespace {
36
37
/// The default method filter, which is used to filter out the methods on which
38
/// the check should not be performed.
39
///
40
/// Checks for the init, dealloc, and any other functions that might be allowed
41
/// to perform direct instance variable assignment based on their name.
42
13
static bool DefaultMethodFilter(const ObjCMethodDecl *M) {
43
13
  return M->getMethodFamily() == OMF_init ||
44
13
         
M->getMethodFamily() == OMF_dealloc12
||
45
13
         
M->getMethodFamily() == OMF_copy12
||
46
13
         
M->getMethodFamily() == OMF_mutableCopy11
||
47
13
         
M->getSelector().getNameForSlot(0).contains("init")11
||
48
13
         
M->getSelector().getNameForSlot(0).contains("Init")11
;
49
13
}
50
51
class DirectIvarAssignment :
52
  public Checker<check::ASTDecl<ObjCImplementationDecl> > {
53
54
  typedef llvm::DenseMap<const ObjCIvarDecl*,
55
                         const ObjCPropertyDecl*> IvarToPropertyMapTy;
56
57
  /// A helper class, which walks the AST and locates all assignments to ivars
58
  /// in the given function.
59
  class MethodCrawler : public ConstStmtVisitor<MethodCrawler> {
60
    const IvarToPropertyMapTy &IvarToPropMap;
61
    const ObjCMethodDecl *MD;
62
    const ObjCInterfaceDecl *InterfD;
63
    BugReporter &BR;
64
    const CheckerBase *Checker;
65
    LocationOrAnalysisDeclContext DCtx;
66
67
  public:
68
    MethodCrawler(const IvarToPropertyMapTy &InMap, const ObjCMethodDecl *InMD,
69
                  const ObjCInterfaceDecl *InID, BugReporter &InBR,
70
                  const CheckerBase *Checker, AnalysisDeclContext *InDCtx)
71
        : IvarToPropMap(InMap), MD(InMD), InterfD(InID), BR(InBR),
72
5
          Checker(Checker), DCtx(InDCtx) {}
73
74
10
    void VisitStmt(const Stmt *S) { VisitChildren(S); }
75
76
    void VisitBinaryOperator(const BinaryOperator *BO);
77
78
10
    void VisitChildren(const Stmt *S) {
79
10
      for (const Stmt *Child : S->children())
80
19
        if (Child)
81
19
          this->Visit(Child);
82
10
    }
83
  };
84
85
public:
86
  bool (*ShouldSkipMethod)(const ObjCMethodDecl *);
87
88
2
  DirectIvarAssignment() : ShouldSkipMethod(&DefaultMethodFilter) {}
89
90
  void checkASTDecl(const ObjCImplementationDecl *D, AnalysisManager& Mgr,
91
                    BugReporter &BR) const;
92
};
93
94
static const ObjCIvarDecl *findPropertyBackingIvar(const ObjCPropertyDecl *PD,
95
                                               const ObjCInterfaceDecl *InterD,
96
12
                                               ASTContext &Ctx) {
97
  // Check for synthesized ivars.
98
12
  ObjCIvarDecl *ID = PD->getPropertyIvarDecl();
99
12
  if (ID)
100
11
    return ID;
101
102
1
  ObjCInterfaceDecl *NonConstInterD = const_cast<ObjCInterfaceDecl*>(InterD);
103
104
  // Check for existing "_PropName".
105
1
  ID = NonConstInterD->lookupInstanceVariable(PD->getDefaultSynthIvarName(Ctx));
106
1
  if (ID)
107
1
    return ID;
108
109
  // Check for existing "PropName".
110
0
  IdentifierInfo *PropIdent = PD->getIdentifier();
111
0
  ID = NonConstInterD->lookupInstanceVariable(PropIdent);
112
113
0
  return ID;
114
1
}
115
116
void DirectIvarAssignment::checkASTDecl(const ObjCImplementationDecl *D,
117
                                       AnalysisManager& Mgr,
118
2
                                       BugReporter &BR) const {
119
2
  const ObjCInterfaceDecl *InterD = D->getClassInterface();
120
121
122
2
  IvarToPropertyMapTy IvarToPropMap;
123
124
  // Find all properties for this class.
125
12
  for (const auto *PD : InterD->instance_properties()) {
126
    // Find the corresponding IVar.
127
12
    const ObjCIvarDecl *ID = findPropertyBackingIvar(PD, InterD,
128
12
                                                     Mgr.getASTContext());
129
130
12
    if (!ID)
131
0
      continue;
132
133
    // Store the IVar to property mapping.
134
12
    IvarToPropMap[ID] = PD;
135
12
  }
136
137
2
  if (IvarToPropMap.empty())
138
0
    return;
139
140
28
  
for (const auto *M : D->instance_methods())2
{
141
28
    AnalysisDeclContext *DCtx = Mgr.getAnalysisDeclContext(M);
142
143
28
    if ((*ShouldSkipMethod)(M))
144
17
      continue;
145
146
11
    const Stmt *Body = M->getBody();
147
11
    if (M->isSynthesizedAccessorStub())
148
6
      continue;
149
5
    assert(Body);
150
151
0
    MethodCrawler MC(IvarToPropMap, M->getCanonicalDecl(), InterD, BR, this,
152
5
                     DCtx);
153
5
    MC.VisitStmt(Body);
154
5
  }
155
2
}
156
157
27
static bool isAnnotatedToAllowDirectAssignment(const Decl *D) {
158
27
  for (const auto *Ann : D->specific_attrs<AnnotateAttr>())
159
2
    if (Ann->getAnnotation() ==
160
2
        "objc_allow_direct_instance_variable_assignment")
161
2
      return true;
162
25
  return false;
163
27
}
164
165
void DirectIvarAssignment::MethodCrawler::VisitBinaryOperator(
166
14
                                                    const BinaryOperator *BO) {
167
14
  if (!BO->isAssignmentOp())
168
0
    return;
169
170
14
  const ObjCIvarRefExpr *IvarRef =
171
14
          dyn_cast<ObjCIvarRefExpr>(BO->getLHS()->IgnoreParenCasts());
172
173
14
  if (!IvarRef)
174
0
    return;
175
176
14
  if (const ObjCIvarDecl *D = IvarRef->getDecl()) {
177
14
    IvarToPropertyMapTy::const_iterator I = IvarToPropMap.find(D);
178
179
14
    if (I != IvarToPropMap.end()) {
180
14
      const ObjCPropertyDecl *PD = I->second;
181
      // Skip warnings on Ivars, annotated with
182
      // objc_allow_direct_instance_variable_assignment. This annotation serves
183
      // as a false positive suppression mechanism for the checker. The
184
      // annotation is allowed on properties and ivars.
185
14
      if (isAnnotatedToAllowDirectAssignment(PD) ||
186
14
          
isAnnotatedToAllowDirectAssignment(D)13
)
187
2
        return;
188
189
12
      ObjCMethodDecl *GetterMethod =
190
12
          InterfD->getInstanceMethod(PD->getGetterName());
191
12
      ObjCMethodDecl *SetterMethod =
192
12
          InterfD->getInstanceMethod(PD->getSetterName());
193
194
12
      if (SetterMethod && 
SetterMethod->getCanonicalDecl() == MD10
)
195
2
        return;
196
197
10
      if (GetterMethod && GetterMethod->getCanonicalDecl() == MD)
198
0
        return;
199
200
10
      BR.EmitBasicReport(
201
10
          MD, Checker, "Property access", categories::CoreFoundationObjectiveC,
202
10
          "Direct assignment to an instance variable backing a property; "
203
10
          "use the setter instead",
204
10
          PathDiagnosticLocation(IvarRef, BR.getSourceManager(), DCtx));
205
10
    }
206
14
  }
207
14
}
208
}
209
210
// Register the checker that checks for direct accesses in functions annotated
211
// with __attribute__((annotate("objc_no_direct_instance_variable_assignment"))).
212
15
static bool AttrFilter(const ObjCMethodDecl *M) {
213
15
  for (const auto *Ann : M->specific_attrs<AnnotateAttr>())
214
1
    if (Ann->getAnnotation() == "objc_no_direct_instance_variable_assignment")
215
1
      return false;
216
14
  return true;
217
15
}
218
219
// Register the checker that checks for direct accesses in all functions,
220
// except for the initialization and copy routines.
221
2
void ento::registerDirectIvarAssignment(CheckerManager &mgr) {
222
2
  auto Chk = mgr.registerChecker<DirectIvarAssignment>();
223
2
  if (mgr.getAnalyzerOptions().getCheckerBooleanOption(Chk,
224
2
                                                       "AnnotatedFunctions"))
225
1
    Chk->ShouldSkipMethod = &AttrFilter;
226
2
}
227
228
4
bool ento::shouldRegisterDirectIvarAssignment(const CheckerManager &mgr) {
229
4
  return true;
230
4
}