//===-- DeleteWithNonVirtualDtorChecker.cpp -----------------------*- C++ -*--//

//

// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.

// See https://llvm.org/LICENSE.txt for license information.

// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception

//

//===----------------------------------------------------------------------===//

//

// Defines a checker for the OOP52-CPP CERT rule: Do not delete a polymorphic

// object without a virtual destructor.

//

// Diagnostic flags -Wnon-virtual-dtor and -Wdelete-non-virtual-dtor report if

// an object with a virtual function but a non-virtual destructor exists or is

// deleted, respectively.

//

// This check exceeds them by comparing the dynamic and static types of the

// object at the point of destruction and only warns if it happens through a

// pointer to a base type without a virtual destructor. The check places a note

// at the last point where the conversion from derived to base happened.

//

//===----------------------------------------------------------------------===//

#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"

#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"

#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"

#include "clang/StaticAnalyzer/Core/Checker.h"

#include "clang/StaticAnalyzer/Core/CheckerManager.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CallEvent.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/DynamicType.h"

#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"

using namespace clang;

using namespace ento;

namespace {

class DeleteWithNonVirtualDtorChecker

    : public Checker<check::PreStmt<CXXDeleteExpr>> {

  mutable std::unique_ptr<BugType> BT;

  class DeleteBugVisitor : public BugReporterVisitor {

  public:

    DeleteBugVisitor() = default;

    void Profile(llvm::FoldingSetNodeID &ID) const override {

      static int X = 0;

      ID.AddPointer(&X);

    }

    PathDiagnosticPieceRef VisitNode(const ExplodedNode *N,

                                     BugReporterContext &BRC,

                                     PathSensitiveBugReport &BR) override;

  private:

    bool Satisfied = false;

  };

public:

  void checkPreStmt(const CXXDeleteExpr *DE, CheckerContext &C) const;

};

} // end anonymous namespace

void DeleteWithNonVirtualDtorChecker::checkPreStmt(const CXXDeleteExpr *DE,

                                                   CheckerContext &C) const {

  const Expr *DeletedObj = DE->getArgument();

  const MemRegion *MR = C.getSVal(DeletedObj).getAsRegion();

  if (!MR)

    return;

  const auto *BaseClassRegion = MR->getAs<TypedValueRegion>();

  const auto *DerivedClassRegion = MR->getBaseRegion()->getAs<SymbolicRegion>();

  if (!BaseClassRegion || 
!DerivedClassRegion19
)

    return;

  const auto *BaseClass = BaseClassRegion->getValueType()->getAsCXXRecordDecl();

  const auto *DerivedClass =

      DerivedClassRegion->getSymbol()->getType()->getPointeeCXXRecordDecl();

  if (!BaseClass || !DerivedClass)

    return;

  if (!BaseClass->hasDefinition() || !DerivedClass->hasDefinition())

    return;

  if (BaseClass->getDestructor()->isVirtual())

    return;

  if (!DerivedClass->isDerivedFrom(BaseClass))

    return;

  if (!BT)

    BT.reset(new BugType(this,

                         "Destruction of a polymorphic object with no "

                         "virtual destructor",

                         "Logic error"));

  ExplodedNode *N = C.generateNonFatalErrorNode();

  if (!N)

    return;

  auto R = std::make_unique<PathSensitiveBugReport>(*BT, BT->getDescription(), N);

  // Mark region of problematic base class for later use in the BugVisitor.

  R->markInteresting(BaseClassRegion);

  R->addVisitor(std::make_unique<DeleteBugVisitor>());

  C.emitReport(std::move(R));

}

PathDiagnosticPieceRef

DeleteWithNonVirtualDtorChecker::DeleteBugVisitor::VisitNode(

    const ExplodedNode *N, BugReporterContext &BRC,

    PathSensitiveBugReport &BR) {

  // Stop traversal after the first conversion was found on a path.

  if (Satisfied)

    return nullptr;

  const Stmt *S = N->getStmtForDiagnostics();

  if (!S)

    return nullptr;

  const auto *CastE = dyn_cast<CastExpr>(S);

  if (!CastE)

    return nullptr;

  // Only interested in DerivedToBase implicit casts.

  // Explicit casts can have different CastKinds.

  if (const auto *ImplCastE = dyn_cast<ImplicitCastExpr>(CastE)) {

    if (ImplCastE->getCastKind() != CK_DerivedToBase)

      return nullptr;

  }

  // Region associated with the current cast expression.

  const MemRegion *M = N->getSVal(CastE).getAsRegion();

  if (!M)

    return nullptr;

  // Check if target region was marked as problematic previously.

  if (!BR.isInteresting(M))

    return nullptr;

  // Stop traversal on this path.

  Satisfied = true;

  SmallString<256> Buf;

  llvm::raw_svector_ostream OS(Buf);

  OS << "Conversion from derived to base happened here";

  PathDiagnosticLocation Pos(S, BRC.getSourceManager(),

                             N->getLocationContext());

  return std::make_shared<PathDiagnosticEventPiece>(Pos, OS.str(), true);

}

void ento::registerDeleteWithNonVirtualDtorChecker(CheckerManager &mgr) {

  mgr.registerChecker<DeleteWithNonVirtualDtorChecker>();

}

bool ento::shouldRegisterDeleteWithNonVirtualDtorChecker(

                                                    const CheckerManager &mgr) {

  return true;

}