1//=======- PtrTypesSemantics.cpp ---------------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "PtrTypesSemantics.h"
10#include "ASTUtils.h"
11#include "clang/AST/Attr.h"
12#include "clang/AST/CXXInheritance.h"
13#include "clang/AST/Decl.h"
14#include "clang/AST/DeclCXX.h"
15#include "clang/AST/ExprCXX.h"
16#include "clang/AST/StmtVisitor.h"
17#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
18#include <optional>
19
20using namespace clang;
21
22namespace {
23
24bool hasPublicMethodInBaseClass(const CXXRecordDecl *R, StringRef NameToMatch) {
25 assert(R);
26 assert(R->hasDefinition());
27
28 for (const CXXMethodDecl *MD : R->methods()) {
29 const auto MethodName = safeGetName(ASTNode: MD);
30 if (MethodName == NameToMatch && MD->getAccess() == AS_public)
31 return true;
32 }
33 return false;
34}
35
36} // namespace
37
38namespace clang {
39
40std::optional<const clang::CXXRecordDecl *>
41hasPublicMethodInBase(const CXXBaseSpecifier *Base, StringRef NameToMatch) {
42 assert(Base);
43
44 const Type *T = Base->getType().getTypePtrOrNull();
45 if (!T)
46 return std::nullopt;
47
48 const CXXRecordDecl *R = T->getAsCXXRecordDecl();
49 if (!R) {
50 auto CT = Base->getType().getCanonicalType();
51 if (auto *TST = dyn_cast<TemplateSpecializationType>(Val&: CT)) {
52 auto TmplName = TST->getTemplateName();
53 if (!TmplName.isNull()) {
54 if (auto *TD = TmplName.getAsTemplateDecl())
55 R = dyn_cast_or_null<CXXRecordDecl>(Val: TD->getTemplatedDecl());
56 }
57 }
58 if (!R)
59 return std::nullopt;
60 }
61 if (!R->hasDefinition())
62 return std::nullopt;
63
64 return hasPublicMethodInBaseClass(R, NameToMatch) ? R : nullptr;
65}
66
67std::optional<bool> isSmartPtrCompatible(const CXXRecordDecl *R,
68 StringRef IncMethodName,
69 StringRef DecMethodName) {
70 assert(R);
71
72 R = R->getDefinition();
73 if (!R)
74 return std::nullopt;
75
76 bool hasRef = hasPublicMethodInBaseClass(R, NameToMatch: IncMethodName);
77 bool hasDeref = hasPublicMethodInBaseClass(R, NameToMatch: DecMethodName);
78 if (hasRef && hasDeref)
79 return true;
80
81 CXXBasePaths Paths;
82 Paths.setOrigin(const_cast<CXXRecordDecl *>(R));
83
84 bool AnyInconclusiveBase = false;
85 const auto hasPublicRefInBase = [&](const CXXBaseSpecifier *Base,
86 CXXBasePath &) {
87 auto hasRefInBase = clang::hasPublicMethodInBase(Base, NameToMatch: IncMethodName);
88 if (!hasRefInBase) {
89 AnyInconclusiveBase = true;
90 return false;
91 }
92 return (*hasRefInBase) != nullptr;
93 };
94
95 hasRef = hasRef || R->lookupInBases(BaseMatches: hasPublicRefInBase, Paths,
96 /*LookupInDependent =*/true);
97 if (AnyInconclusiveBase)
98 return std::nullopt;
99
100 Paths.clear();
101 const auto hasPublicDerefInBase = [&](const CXXBaseSpecifier *Base,
102 CXXBasePath &) {
103 auto hasDerefInBase = clang::hasPublicMethodInBase(Base, NameToMatch: DecMethodName);
104 if (!hasDerefInBase) {
105 AnyInconclusiveBase = true;
106 return false;
107 }
108 return (*hasDerefInBase) != nullptr;
109 };
110 hasDeref = hasDeref || R->lookupInBases(BaseMatches: hasPublicDerefInBase, Paths,
111 /*LookupInDependent =*/true);
112 if (AnyInconclusiveBase)
113 return std::nullopt;
114
115 return hasRef && hasDeref;
116}
117
118std::optional<bool> isRefCountable(const clang::CXXRecordDecl *R) {
119 return isSmartPtrCompatible(R, IncMethodName: "ref", DecMethodName: "deref");
120}
121
122std::optional<bool> isCheckedPtrCapable(const clang::CXXRecordDecl *R) {
123 return isSmartPtrCompatible(R, IncMethodName: "incrementCheckedPtrCount",
124 DecMethodName: "decrementCheckedPtrCount");
125}
126
127bool isRefType(const std::string &Name) {
128 return Name == "Ref" || Name == "RefAllowingPartiallyDestroyed" ||
129 Name == "RefPtr" || Name == "RefPtrAllowingPartiallyDestroyed";
130}
131
132bool isRetainPtrOrOSPtr(const std::string &Name) {
133 return Name == "RetainPtr" || Name == "RetainPtrArc" ||
134 Name == "OSObjectPtr" || Name == "OSObjectPtrArc";
135}
136
137bool isCheckedPtr(const std::string &Name) {
138 return Name == "CheckedPtr" || Name == "CheckedRef";
139}
140
141bool isOwnerPtr(const std::string &Name) {
142 return isRefType(Name) || isCheckedPtr(Name) || isRetainPtrOrOSPtr(Name) ||
143 Name == "unique_ptr" || Name == "UniqueRef" || Name == "LazyUniqueRef";
144}
145
146static bool isWeakPtrClass(const std::string &Name) {
147 return Name == "WeakPtr" || Name == "SingleThreadPackedWeakPtr" ||
148 Name == "SingleThreadWeakPtr" || Name == "ThreadSafeWeakPtr" ||
149 Name == "ThreadSafeWeakOrStrongPtr" || Name == "InlineWeakPtr";
150}
151
152bool isSmartPtrClass(const std::string &Name) {
153 return isRefType(Name) || isCheckedPtr(Name) || isRetainPtrOrOSPtr(Name) ||
154 isWeakPtrClass(Name) || Name == "WeakPtrFactory" ||
155 Name == "WeakPtrFactoryWithBitField" || Name == "WeakPtrImplBase" ||
156 Name == "WeakPtrImplBaseSingleThread" ||
157 Name == "ThreadSafeWeakOrStrongPtr" ||
158 Name == "ThreadSafeWeakPtrControlBlock" ||
159 Name == "ThreadSafeRefCountedAndCanMakeThreadSafeWeakPtr";
160}
161
162std::string getConstructorName(const clang::FunctionDecl *F) {
163 if (auto *Ctor = dyn_cast_or_null<CXXConstructorDecl>(Val: F))
164 return safeGetName(ASTNode: Ctor->getParent());
165 return safeGetName(ASTNode: F);
166}
167
168bool isCtorOfRefCounted(const clang::FunctionDecl *F) {
169 assert(F);
170 auto FunctionName = getConstructorName(F);
171 return isRefType(Name: FunctionName) || FunctionName == "adoptRef" ||
172 FunctionName == "UniqueRef" || FunctionName == "makeUniqueRef" ||
173 FunctionName == "makeUniqueRefWithoutFastMallocCheck"
174
175 || FunctionName == "String" || FunctionName == "AtomString" ||
176 FunctionName == "UniqueString"
177 // FIXME: Implement as attribute.
178 || FunctionName == "Identifier";
179}
180
181bool isCtorOfCheckedPtr(const clang::FunctionDecl *F) {
182 assert(F);
183 return isCheckedPtr(Name: getConstructorName(F));
184}
185
186bool isCtorOfRetainPtrOrOSPtr(const clang::FunctionDecl *F) {
187 auto FunctionName = getConstructorName(F);
188 return isRetainPtrOrOSPtr(Name: FunctionName) || FunctionName == "adoptNS" ||
189 FunctionName == "adoptNSNullable" || FunctionName == "adoptCF" ||
190 FunctionName == "adoptCFNullable" || FunctionName == "retainPtr" ||
191 FunctionName == "adoptNSArc" || FunctionName == "adoptOSObject" ||
192 FunctionName == "adoptOSObjectArc";
193}
194
195bool isCtorOfSafePtr(const clang::FunctionDecl *F) {
196 return isCtorOfRefCounted(F) || isCtorOfCheckedPtr(F) ||
197 isCtorOfRetainPtrOrOSPtr(F);
198}
199
200bool isStdOrWTFMove(const clang::FunctionDecl *F) {
201 auto FnName = safeGetName(ASTNode: F);
202 auto *Namespace = F->getParent();
203 if (!Namespace)
204 return false;
205 auto *TUDeck = Namespace->getParent();
206 if (!isa_and_nonnull<TranslationUnitDecl>(Val: TUDeck))
207 return false;
208 auto NsName = safeGetName(ASTNode: Namespace);
209 return (NsName == "WTF" || NsName == "std") && FnName == "move";
210}
211
212template <typename Predicate>
213static bool isPtrOfType(const clang::QualType T, Predicate Pred) {
214 QualType type = T;
215 while (!type.isNull()) {
216 if (auto *SpecialT = type->getAs<TemplateSpecializationType>()) {
217 auto *Decl = SpecialT->getTemplateName().getAsTemplateDecl();
218 return Decl && Pred(Decl->getNameAsString());
219 } else if (auto *DTS = type->getAs<DeducedTemplateSpecializationType>()) {
220 auto *Decl = DTS->getTemplateName().getAsTemplateDecl();
221 return Decl && Pred(Decl->getNameAsString());
222 } else
223 break;
224 }
225 return false;
226}
227
228bool isRefOrCheckedPtrType(const clang::QualType T) {
229 return isPtrOfType(
230 T, Pred: [](auto Name) { return isRefType(Name) || isCheckedPtr(Name); });
231}
232
233bool isRetainPtrOrOSPtrType(const clang::QualType T) {
234 return isPtrOfType(T, Pred: [](auto Name) { return isRetainPtrOrOSPtr(Name); });
235}
236
237bool isOwnerPtrType(const clang::QualType T) {
238 return isPtrOfType(T, Pred: [](auto Name) { return isOwnerPtr(Name); });
239}
240
241std::optional<bool> isUncounted(const QualType T) {
242 if (auto *Subst = dyn_cast<SubstTemplateTypeParmType>(Val: T)) {
243 if (auto *Decl = Subst->getAssociatedDecl()) {
244 if (isRefType(Name: safeGetName(ASTNode: Decl)))
245 return false;
246 }
247 }
248 return isUncounted(Class: T->getAsCXXRecordDecl());
249}
250
251std::optional<bool> isUnchecked(const QualType T) {
252 if (auto *Subst = dyn_cast<SubstTemplateTypeParmType>(Val: T)) {
253 if (auto *Decl = Subst->getAssociatedDecl()) {
254 if (isCheckedPtr(Name: safeGetName(ASTNode: Decl)))
255 return false;
256 }
257 }
258 return isUnchecked(Class: T->getAsCXXRecordDecl());
259}
260
261void RetainTypeChecker::visitTranslationUnitDecl(
262 const TranslationUnitDecl *TUD) {
263 IsARCEnabled = TUD->getLangOpts().ObjCAutoRefCount;
264 DefaultSynthProperties = TUD->getLangOpts().ObjCDefaultSynthProperties;
265}
266
267void RetainTypeChecker::visitTypedef(const TypedefDecl *TD) {
268 auto QT = TD->getUnderlyingType();
269 if (!QT->isPointerType())
270 return;
271
272 auto PointeeQT = QT->getPointeeType();
273 const RecordType *RT = PointeeQT->getAsCanonical<RecordType>();
274 if (!RT) {
275 if (TD->hasAttr<ObjCBridgeAttr>() || TD->hasAttr<ObjCBridgeMutableAttr>()) {
276 RecordlessTypes.insert(V: TD->getASTContext()
277 .getTypedefType(Keyword: ElaboratedTypeKeyword::None,
278 /*Qualifier=*/std::nullopt, Decl: TD)
279 .getTypePtr());
280 }
281 return;
282 }
283
284 for (auto *Redecl : RT->getDecl()->getMostRecentDecl()->redecls()) {
285 if (Redecl->getAttr<ObjCBridgeAttr>() ||
286 Redecl->getAttr<ObjCBridgeMutableAttr>()) {
287 CFPointees.insert(V: RT);
288 return;
289 }
290 }
291}
292
293bool RetainTypeChecker::isUnretained(const QualType QT, bool ignoreARC) {
294 if (ento::cocoa::isCocoaObjectRef(T: QT) && (!IsARCEnabled || ignoreARC))
295 return true;
296 if (auto *RT = dyn_cast_or_null<RecordType>(
297 Val: QT.getCanonicalType()->getPointeeType().getTypePtrOrNull()))
298 return CFPointees.contains(V: RT);
299 return RecordlessTypes.contains(V: QT.getTypePtr());
300}
301
302std::optional<bool> isUncounted(const CXXRecordDecl* Class)
303{
304 // Keep isRefCounted first as it's cheaper.
305 if (!Class || isRefCounted(Class))
306 return false;
307
308 std::optional<bool> IsRefCountable = isRefCountable(R: Class);
309 if (!IsRefCountable)
310 return std::nullopt;
311
312 return (*IsRefCountable);
313}
314
315std::optional<bool> isUnchecked(const CXXRecordDecl *Class) {
316 if (!Class || isCheckedPtr(Class))
317 return false; // Cheaper than below
318 return isCheckedPtrCapable(R: Class);
319}
320
321std::optional<bool> isUncountedPtr(const QualType T) {
322 if (T->isPointerType() || T->isReferenceType()) {
323 if (auto *CXXRD = T->getPointeeCXXRecordDecl())
324 return isUncounted(Class: CXXRD);
325 }
326 return false;
327}
328
329std::optional<bool> isUncheckedPtr(const QualType T) {
330 if (T->isPointerType() || T->isReferenceType()) {
331 if (auto *CXXRD = T->getPointeeCXXRecordDecl())
332 return isUnchecked(Class: CXXRD);
333 }
334 return false;
335}
336
337std::optional<bool> isGetterOfSafePtr(const CXXMethodDecl *M) {
338 assert(M);
339
340 const CXXRecordDecl *calleeMethodsClass = M->getParent();
341 std::string className = safeGetName(ASTNode: calleeMethodsClass);
342 std::string method = safeGetName(ASTNode: M);
343
344 if (isCheckedPtr(Name: className) && (method == "get" || method == "ptr"))
345 return true;
346
347 if ((isRefType(Name: className) && (method == "get" || method == "ptr")) ||
348 ((className == "String" || className == "AtomString" ||
349 className == "AtomStringImpl" || className == "UniqueString" ||
350 className == "UniqueStringImpl" || className == "Identifier") &&
351 method == "impl"))
352 return true;
353
354 if (isRetainPtrOrOSPtr(Name: className) && method == "get")
355 return true;
356
357 // Ref<T> -> T conversion
358 // FIXME: Currently allowing any Ref<T> -> whatever cast.
359 if (isRefType(Name: className)) {
360 if (auto *maybeRefToRawOperator = dyn_cast<CXXConversionDecl>(Val: M)) {
361 QualType QT = maybeRefToRawOperator->getConversionType();
362 const Type *T = QT.getTypePtrOrNull();
363 return T && (T->isPointerType() || T->isReferenceType());
364 }
365 }
366
367 if (isCheckedPtr(Name: className)) {
368 if (auto *maybeRefToRawOperator = dyn_cast<CXXConversionDecl>(Val: M)) {
369 QualType QT = maybeRefToRawOperator->getConversionType();
370 const Type *T = QT.getTypePtrOrNull();
371 return T && (T->isPointerType() || T->isReferenceType());
372 }
373 }
374
375 if (isRetainPtrOrOSPtr(Name: className)) {
376 if (auto *maybeRefToRawOperator = dyn_cast<CXXConversionDecl>(Val: M)) {
377 QualType QT = maybeRefToRawOperator->getConversionType();
378 const Type *T = QT.getTypePtrOrNull();
379 return T && (T->isPointerType() || T->isReferenceType() ||
380 T->isObjCObjectPointerType());
381 }
382 }
383 return false;
384}
385
386bool isRefCounted(const CXXRecordDecl *R) {
387 assert(R);
388 if (auto *TmplR = R->getTemplateInstantiationPattern()) {
389 // FIXME: String/AtomString/UniqueString
390 const auto &ClassName = safeGetName(ASTNode: TmplR);
391 return isRefType(Name: ClassName);
392 }
393 return false;
394}
395
396bool isCheckedPtr(const CXXRecordDecl *R) {
397 assert(R);
398 if (auto *TmplR = R->getTemplateInstantiationPattern()) {
399 const auto &ClassName = safeGetName(ASTNode: TmplR);
400 return isCheckedPtr(Name: ClassName);
401 }
402 return false;
403}
404
405bool isRetainPtrOrOSPtr(const CXXRecordDecl *R) {
406 assert(R);
407 if (auto *TmplR = R->getTemplateInstantiationPattern())
408 return isRetainPtrOrOSPtr(Name: safeGetName(ASTNode: TmplR));
409 return false;
410}
411
412bool isWeakPtr(const CXXRecordDecl *R) {
413 assert(R);
414 if (auto *TmplR = R->getTemplateInstantiationPattern())
415 return isWeakPtrClass(Name: safeGetName(ASTNode: TmplR));
416 return false;
417}
418
419bool isSmartPtr(const CXXRecordDecl *R) {
420 assert(R);
421 if (auto *TmplR = R->getTemplateInstantiationPattern())
422 return isSmartPtrClass(Name: safeGetName(ASTNode: TmplR));
423 return false;
424}
425
426enum class WebKitAnnotation : uint8_t {
427 None,
428 PointerConversion,
429 NoDelete,
430};
431
432static WebKitAnnotation typeAnnotationForReturnType(const FunctionDecl *FD) {
433 auto RetType = FD->getReturnType();
434 auto *Type = RetType.getTypePtrOrNull();
435 if (auto *MacroQualified = dyn_cast_or_null<MacroQualifiedType>(Val: Type))
436 Type = MacroQualified->desugar().getTypePtrOrNull();
437 auto *Attr = dyn_cast_or_null<AttributedType>(Val: Type);
438 if (!Attr)
439 return WebKitAnnotation::None;
440 auto *AnnotateType = dyn_cast_or_null<AnnotateTypeAttr>(Val: Attr->getAttr());
441 if (!AnnotateType)
442 return WebKitAnnotation::None;
443 auto Annotation = AnnotateType->getAnnotation();
444 if (Annotation == "webkit.pointerconversion")
445 return WebKitAnnotation::PointerConversion;
446 if (Annotation == "webkit.nodelete")
447 return WebKitAnnotation::NoDelete;
448 return WebKitAnnotation::None;
449}
450
451bool isPtrConversion(const FunctionDecl *F) {
452 assert(F);
453 if (isCtorOfRefCounted(F))
454 return true;
455
456 // FIXME: check # of params == 1
457 const auto FunctionName = safeGetName(ASTNode: F);
458 if (FunctionName == "getPtr" || FunctionName == "WeakPtr" ||
459 FunctionName == "dynamicDowncast" || FunctionName == "downcast" ||
460 FunctionName == "checkedDowncast" || FunctionName == "bit_cast" ||
461 FunctionName == "uncheckedDowncast" || FunctionName == "bitwise_cast" ||
462 FunctionName == "bridge_cast" || FunctionName == "bridge_id_cast" ||
463 FunctionName == "dynamic_cf_cast" || FunctionName == "checked_cf_cast" ||
464 FunctionName == "dynamic_objc_cast" ||
465 FunctionName == "checked_objc_cast")
466 return true;
467
468 if (typeAnnotationForReturnType(FD: F) == WebKitAnnotation::PointerConversion)
469 return true;
470
471 return false;
472}
473
474static bool isNoDeleteFunctionDecl(const FunctionDecl *F) {
475 return typeAnnotationForReturnType(FD: F) == WebKitAnnotation::NoDelete;
476}
477
478bool isNoDeleteFunction(const FunctionDecl *F) {
479 if (llvm::any_of(Range: F->redecls(), P: isNoDeleteFunctionDecl))
480 return true;
481
482 const auto *MD = dyn_cast<CXXMethodDecl>(Val: F);
483 if (!MD || !MD->isVirtual())
484 return false;
485
486 auto Overriders = llvm::to_vector(Range: MD->overridden_methods());
487 while (!Overriders.empty()) {
488 const auto *Fn = Overriders.pop_back_val();
489 llvm::append_range(C&: Overriders, R: Fn->overridden_methods());
490 if (isNoDeleteFunctionDecl(F: Fn))
491 return true;
492 }
493
494 return false;
495}
496
497bool isTrivialBuiltinFunction(const FunctionDecl *F) {
498 if (!F || !F->getDeclName().isIdentifier())
499 return false;
500 auto Name = F->getName();
501 return Name.starts_with(Prefix: "__builtin") || Name == "__libcpp_verbose_abort" ||
502 Name.starts_with(Prefix: "os_log") || Name.starts_with(Prefix: "_os_log");
503}
504
505bool isSingleton(const NamedDecl *F) {
506 assert(F);
507 // FIXME: check # of params == 1
508 if (auto *MethodDecl = dyn_cast<CXXMethodDecl>(Val: F)) {
509 if (!MethodDecl->isStatic())
510 return false;
511 }
512 const auto &NameStr = safeGetName(ASTNode: F);
513 StringRef Name = NameStr; // FIXME: Make safeGetName return StringRef.
514 return Name == "singleton" || Name.ends_with(Suffix: "Singleton");
515}
516
517// We only care about statements so let's use the simple
518// (non-recursive) visitor.
519class TrivialFunctionAnalysisVisitor
520 : public ConstStmtVisitor<TrivialFunctionAnalysisVisitor, bool> {
521
522 // Returns false if at least one child is non-trivial.
523 bool VisitChildren(const Stmt *S) {
524 for (const Stmt *Child : S->children()) {
525 if (Child && !Visit(S: Child)) {
526 if (OffendingStmt && !*OffendingStmt)
527 *OffendingStmt = Child;
528 return false;
529 }
530 }
531
532 return true;
533 }
534
535 template <typename StmtOrDecl, typename CheckFunction>
536 bool WithCachedResult(const StmtOrDecl *S, CheckFunction Function) {
537 auto CacheIt = Cache.find(S);
538 if (CacheIt != Cache.end() && !OffendingStmt)
539 return CacheIt->second;
540
541 // Treat a recursive statement to be trivial until proven otherwise.
542 auto [RecursiveIt, IsNew] = RecursiveFn.insert(std::make_pair(S, true));
543 if (!IsNew)
544 return RecursiveIt->second;
545
546 bool Result = Function();
547
548 if (!Result) {
549 for (auto &It : RecursiveFn)
550 It.second = false;
551 }
552 RecursiveIt = RecursiveFn.find(S);
553 assert(RecursiveIt != RecursiveFn.end());
554 Result = RecursiveIt->second;
555 RecursiveFn.erase(RecursiveIt);
556 Cache[S] = Result;
557
558 return Result;
559 }
560
561 bool CanTriviallyDestruct(QualType Ty) {
562 if (Ty.isNull())
563 return false;
564
565 // T*, T& or T&& does not run its destructor.
566 if (Ty->isPointerOrReferenceType())
567 return true;
568
569 // FIXME: Handle a case when there is a local autorelease pool.
570 if (Ty->isObjCObjectPointerType()) {
571 auto Type = Ty.isDestructedType();
572 if (Type == QualType::DK_objc_weak_lifetime || Type == QualType::DK_none)
573 return true;
574 // strong lifetime in ARC could dealloc an object.
575 }
576
577 // Fundamental types (integral, nullptr_t, etc...) don't have destructors.
578 if (Ty->isFundamentalType() || Ty->isIntegralOrEnumerationType())
579 return true;
580
581 if (const auto *R = Ty->getAsCXXRecordDecl()) {
582 // C++ trivially destructible classes are fine.
583 if (R->hasDefinition() && R->hasTrivialDestructor())
584 return true;
585
586 if (HasFieldWithNonTrivialDtor(Cls: R))
587 return false;
588
589 // For Webkit, side-effects are fine as long as we don't delete objects,
590 // so check recursively.
591 if (const auto *Dtor = R->getDestructor())
592 return IsFunctionTrivial(D: Dtor);
593 }
594
595 // Structs in C are trivial.
596 if (Ty->isRecordType())
597 return true;
598
599 // For arrays it depends on the element type.
600 // FIXME: We should really use ASTContext::getAsArrayType instead.
601 if (const auto *AT = Ty->getAsArrayTypeUnsafe())
602 return CanTriviallyDestruct(Ty: AT->getElementType());
603
604 return false; // Otherwise it's likely not trivial.
605 }
606
607 bool HasFieldWithNonTrivialDtor(const CXXRecordDecl *Cls) {
608 auto CacheIt = FieldDtorCache.find(Val: Cls);
609 if (CacheIt != FieldDtorCache.end())
610 return CacheIt->second;
611
612 bool Result = ([&] {
613 auto HasNonTrivialField = [&](const CXXRecordDecl *R) {
614 for (const FieldDecl *F : R->fields()) {
615 if (!CanTriviallyDestruct(Ty: F->getType()))
616 return true;
617 }
618 return false;
619 };
620
621 if (HasNonTrivialField(Cls))
622 return true;
623
624 if (!Cls->hasDefinition())
625 return false;
626
627 CXXBasePaths Paths;
628 Paths.setOrigin(const_cast<CXXRecordDecl *>(Cls));
629 return Cls->lookupInBases(
630 BaseMatches: [&](const CXXBaseSpecifier *B, CXXBasePath &) {
631 auto *T = B->getType().getTypePtrOrNull();
632 if (!T)
633 return false;
634 auto *R = T->getAsCXXRecordDecl();
635 return R && HasNonTrivialField(R);
636 },
637 Paths, /*LookupInDependent =*/true);
638 })();
639
640 FieldDtorCache[Cls] = Result;
641
642 return Result;
643 }
644
645public:
646 using CacheTy = TrivialFunctionAnalysis::CacheTy;
647
648 TrivialFunctionAnalysisVisitor(CacheTy &Cache,
649 const Stmt **OffendingStmt = nullptr)
650 : Cache(Cache), OffendingStmt(OffendingStmt) {}
651
652 bool IsFunctionTrivial(const Decl *D) {
653 const Stmt **SavedOffendingStmt = std::exchange(obj&: OffendingStmt, new_val: nullptr);
654 auto Result = WithCachedResult(S: D, Function: [&]() {
655 auto *FnDecl = dyn_cast<FunctionDecl>(Val: D);
656 auto *MethodDecl = dyn_cast<CXXMethodDecl>(Val: D);
657 auto *CtorDecl = dyn_cast<CXXConstructorDecl>(Val: D);
658 auto *DtorDecl = dyn_cast<CXXDestructorDecl>(Val: D);
659
660 if (FnDecl) {
661 if (isNoDeleteFunction(F: FnDecl))
662 return true;
663 if (MethodDecl && MethodDecl->isVirtual())
664 return false;
665 for (auto *Param : FnDecl->parameters()) {
666 if (!HasTrivialDestructor(VD: Param))
667 return false;
668 }
669 }
670 if (CtorDecl) {
671 for (auto *CtorInit : CtorDecl->inits()) {
672 if (!Visit(S: CtorInit->getInit()))
673 return false;
674 }
675 }
676 // An implicit or =default special member runs no user code when it is
677 // trivial in the C++ standard sense, so it cannot delete. Such a
678 // member's synthesized body is typically absent from the AST until
679 // codegen materialises it, which the generic null-body check below
680 // would otherwise conservatively classify as non-trivial.
681 if (MethodDecl && !MethodDecl->isUserProvided()) {
682 if (CtorDecl) {
683 const CXXRecordDecl *RD = CtorDecl->getParent();
684 if ((CtorDecl->isDefaultConstructor() &&
685 RD->hasTrivialDefaultConstructor()) ||
686 (CtorDecl->isCopyConstructor() &&
687 RD->hasTrivialCopyConstructor()) ||
688 (CtorDecl->isMoveConstructor() &&
689 RD->hasTrivialMoveConstructor()))
690 return true;
691 }
692 if (DtorDecl && DtorDecl->getParent()->hasTrivialDestructor())
693 return true;
694 }
695 const Stmt *Body = D->getBody();
696 if (!Body)
697 return false;
698 return Visit(S: Body);
699 });
700 OffendingStmt = SavedOffendingStmt;
701 return Result;
702 }
703
704 bool HasTrivialDestructor(const VarDecl *VD) {
705 return WithCachedResult(
706 S: VD, Function: [&] { return CanTriviallyDestruct(Ty: VD->getType()); });
707 }
708
709 bool IsStatementTrivial(const Stmt *S) {
710 auto CacheIt = Cache.find(Val: S);
711 if (CacheIt != Cache.end())
712 return CacheIt->second;
713 bool Result = Visit(S);
714 Cache[S] = Result;
715 return Result;
716 }
717
718 bool VisitStmt(const Stmt *S) {
719 // All statements are non-trivial unless overriden later.
720 // Don't even recurse into children by default.
721 return false;
722 }
723
724 bool VisitAttributedStmt(const AttributedStmt *AS) {
725 // Ignore attributes.
726 return Visit(S: AS->getSubStmt());
727 }
728
729 bool VisitCompoundStmt(const CompoundStmt *CS) {
730 // A compound statement is allowed as long each individual sub-statement
731 // is trivial.
732 return WithCachedResult(S: CS, Function: [&]() { return VisitChildren(S: CS); });
733 }
734
735 bool VisitCoroutineBodyStmt(const CoroutineBodyStmt *CBS) {
736 return WithCachedResult(S: CBS, Function: [&]() { return VisitChildren(S: CBS); });
737 }
738
739 bool VisitReturnStmt(const ReturnStmt *RS) {
740 // A return statement is allowed as long as the return value is trivial. A
741 // returned smart-pointer prvalue is special: under guaranteed copy elision
742 // the temporary *is* the function's return slot, so it is destructed by the
743 // caller, not here. Hence we may ignore that temporary's destructor.
744 if (auto *RV = RS->getRetValue())
745 return visitReturnValueElidingTemp(Arg: RV);
746 return true;
747 }
748
749 bool VisitDeclStmt(const DeclStmt *DS) {
750 for (auto &Decl : DS->decls()) {
751 // FIXME: Handle DecompositionDecls.
752 if (auto *VD = dyn_cast<VarDecl>(Val: Decl)) {
753 if (!HasTrivialDestructor(VD))
754 return false;
755 }
756 }
757 return VisitChildren(S: DS);
758 }
759 bool VisitDoStmt(const DoStmt *DS) { return VisitChildren(S: DS); }
760 bool VisitIfStmt(const IfStmt *IS) {
761 return WithCachedResult(S: IS, Function: [&]() { return VisitChildren(S: IS); });
762 }
763 bool VisitForStmt(const ForStmt *FS) {
764 return WithCachedResult(S: FS, Function: [&]() { return VisitChildren(S: FS); });
765 }
766 bool VisitCXXForRangeStmt(const CXXForRangeStmt *FS) {
767 return WithCachedResult(S: FS, Function: [&]() { return VisitChildren(S: FS); });
768 }
769 bool VisitWhileStmt(const WhileStmt *WS) {
770 return WithCachedResult(S: WS, Function: [&]() { return VisitChildren(S: WS); });
771 }
772 bool VisitSwitchStmt(const SwitchStmt *SS) { return VisitChildren(S: SS); }
773 bool VisitCaseStmt(const CaseStmt *CS) { return VisitChildren(S: CS); }
774 bool VisitDefaultStmt(const DefaultStmt *DS) { return VisitChildren(S: DS); }
775
776 // break, continue, goto, and label statements are always trivial.
777 bool VisitBreakStmt(const BreakStmt *) { return true; }
778 bool VisitContinueStmt(const ContinueStmt *) { return true; }
779 bool VisitGotoStmt(const GotoStmt *) { return true; }
780 bool VisitLabelStmt(const LabelStmt *) { return true; }
781
782 bool VisitUnaryOperator(const UnaryOperator *UO) {
783 // Unary operators are trivial if its operand is trivial except co_await.
784 return UO->getOpcode() != UO_Coawait && Visit(S: UO->getSubExpr());
785 }
786
787 bool VisitBinaryOperator(const BinaryOperator *BO) {
788 // Binary operators are trivial if their operands are trivial.
789 return Visit(S: BO->getLHS()) && Visit(S: BO->getRHS());
790 }
791
792 bool VisitCompoundAssignOperator(const CompoundAssignOperator *CAO) {
793 // Compound assignment operator such as |= is trivial if its
794 // subexpresssions are trivial.
795 return VisitChildren(S: CAO);
796 }
797
798 bool VisitArraySubscriptExpr(const ArraySubscriptExpr *ASE) {
799 return VisitChildren(S: ASE);
800 }
801
802 bool VisitConditionalOperator(const ConditionalOperator *CO) {
803 // Ternary operators are trivial if their conditions & values are trivial.
804 return VisitChildren(S: CO);
805 }
806
807 bool VisitAtomicExpr(const AtomicExpr *E) { return VisitChildren(S: E); }
808
809 bool VisitStaticAssertDecl(const StaticAssertDecl *SAD) {
810 // Any static_assert is considered trivial.
811 return true;
812 }
813
814 bool VisitCallExpr(const CallExpr *CE) {
815 if (!checkArguments(CE))
816 return false;
817
818 auto *Callee = CE->getDirectCallee();
819 if (!Callee)
820 return false;
821
822 if (isPtrConversion(F: Callee))
823 return true;
824
825 const auto &Name = safeGetName(ASTNode: Callee);
826
827 if (Callee->isInStdNamespace() &&
828 (Name == "addressof" || Name == "forward" || Name == "move"))
829 return true;
830
831 if (Name == "WTFCrashWithInfo" || Name == "WTFBreakpointTrap" ||
832 Name == "WTFReportBacktrace" ||
833 Name == "WTFCrashWithSecurityImplication" || Name == "WTFCrash" ||
834 Name == "WTFReportAssertionFailure" || Name == "isMainThread" ||
835 Name == "isMainThreadOrGCThread" || Name == "isMainRunLoop" ||
836 Name == "isWebThread" || Name == "isUIThread" ||
837 Name == "mayBeGCThread" || Name == "compilerFenceForCrash" ||
838 isTrivialBuiltinFunction(F: Callee))
839 return true;
840
841 return IsFunctionTrivial(D: Callee);
842 }
843
844 bool VisitGCCAsmStmt(const GCCAsmStmt *AS) {
845 return AS->getAsmString() == "brk #0xc471";
846 }
847
848 bool
849 VisitSubstNonTypeTemplateParmExpr(const SubstNonTypeTemplateParmExpr *E) {
850 // Non-type template paramter is compile time constant and trivial.
851 return true;
852 }
853
854 bool VisitUnaryExprOrTypeTraitExpr(const UnaryExprOrTypeTraitExpr *E) {
855 return VisitChildren(S: E);
856 }
857
858 bool VisitPredefinedExpr(const PredefinedExpr *E) {
859 // A predefined identifier such as "func" is considered trivial.
860 return true;
861 }
862
863 bool VisitOffsetOfExpr(const OffsetOfExpr *OE) {
864 // offsetof(T, D) is considered trivial.
865 return true;
866 }
867
868 bool VisitCXXMemberCallExpr(const CXXMemberCallExpr *MCE) {
869 if (!checkArguments(CE: MCE))
870 return false;
871
872 bool TrivialThis = Visit(S: MCE->getImplicitObjectArgument());
873 if (!TrivialThis)
874 return false;
875
876 auto *Callee = MCE->getMethodDecl();
877 if (!Callee)
878 return false;
879
880 if (isa<CXXDestructorDecl>(Val: Callee) &&
881 !CanTriviallyDestruct(Ty: MCE->getObjectType()))
882 return false;
883
884 auto Name = safeGetName(ASTNode: Callee);
885 if (Name == "ref" || Name == "incrementCheckedPtrCount")
886 return true;
887
888 std::optional<bool> IsGetterOfRefCounted = isGetterOfSafePtr(M: Callee);
889 if (IsGetterOfRefCounted && *IsGetterOfRefCounted)
890 return true;
891
892 // Recursively descend into the callee to confirm that it's trivial as well.
893 return IsFunctionTrivial(D: Callee);
894 }
895
896 bool VisitCXXOperatorCallExpr(const CXXOperatorCallExpr *OCE) {
897 if (!checkArguments(CE: OCE))
898 return false;
899 auto *Callee = OCE->getCalleeDecl();
900 if (!Callee)
901 return false;
902 // Recursively descend into the callee to confirm that it's trivial as well.
903 return IsFunctionTrivial(D: Callee);
904 }
905
906 bool VisitCXXRewrittenBinaryOperator(const CXXRewrittenBinaryOperator *Op) {
907 auto *SemanticExpr = Op->getSemanticForm();
908 return SemanticExpr && Visit(S: SemanticExpr);
909 }
910
911 bool VisitCXXDefaultArgExpr(const CXXDefaultArgExpr *E) {
912 if (auto *Expr = E->getExpr()) {
913 if (!Visit(S: Expr))
914 return false;
915 }
916 return true;
917 }
918
919 bool VisitCXXDefaultInitExpr(const CXXDefaultInitExpr *E) {
920 return Visit(S: E->getExpr());
921 }
922
923 bool checkArguments(const CallExpr *CE) {
924 for (const Expr *Arg : CE->arguments()) {
925 if (Arg && !Visit(S: Arg))
926 return false;
927 }
928 return true;
929 }
930
931 // Triviality check for a return value that may elide a smart-pointer
932 // temporary's destructor.
933 //
934 // This is only valid for *return values*: a returned class prvalue is
935 // constructed directly into the function's return slot (C++17 guaranteed copy
936 // elision), so the temporary is destructed by the caller rather than here.
937 //
938 // It is deliberately NOT applied to call/constructor arguments. An argument
939 // temporary's lifetime ends at the full-expression *in this function* (the
940 // caller destroys arguments, e.g. per the Itanium C++ ABI), so its destructor
941 // runs here and may invoke delete. Proving otherwise would require
942 // interprocedural ownership analysis, so arguments are checked normally.
943 bool visitReturnValueElidingTemp(const Expr *Arg) {
944 QualType OriginalQT = Arg->getType();
945 auto *Type = OriginalQT.getTypePtrOrNull();
946 if (!Type)
947 return Visit(S: Arg);
948 auto *CXXRD = Type->getAsCXXRecordDecl();
949 if (!CXXRD || !isSmartPtrClass(Name: safeGetName(ASTNode: CXXRD)))
950 return Visit(S: Arg);
951 Arg = Arg->IgnoreParenCasts();
952 if (!Arg->isPRValue())
953 return Visit(S: Arg);
954 if (auto *ExprWithClean = dyn_cast<ExprWithCleanups>(Val: Arg))
955 Arg = ExprWithClean->getSubExpr()->IgnoreParenCasts();
956 if (auto *BTE = dyn_cast<CXXBindTemporaryExpr>(Val: Arg)) {
957 // Only elide when the temporary *is* the returned object, i.e. it has the
958 // same smart-pointer type as the return value. Compare canonical,
959 // unqualified types rather than relying on exact QualType identity, which
960 // is sensitive to sugar (typedefs/aliases) and cv-qualifiers.
961 if (OriginalQT.getCanonicalType().getUnqualifiedType() ==
962 BTE->getType().getCanonicalType().getUnqualifiedType())
963 return Visit(S: BTE->getSubExpr());
964 }
965 return Visit(S: Arg);
966 }
967
968 bool VisitCXXConstructExpr(const CXXConstructExpr *CE) {
969 for (const Expr *Arg : CE->arguments()) {
970 if (Arg && !Visit(S: Arg))
971 return false;
972 }
973
974 // Recursively descend into the callee to confirm that it's trivial.
975 return IsFunctionTrivial(D: CE->getConstructor());
976 }
977
978 bool VisitCXXInheritedCtorInitExpr(const CXXInheritedCtorInitExpr *E) {
979 return IsFunctionTrivial(D: E->getConstructor());
980 }
981
982 bool VisitCXXNewExpr(const CXXNewExpr *NE) { return VisitChildren(S: NE); }
983
984 bool VisitImplicitCastExpr(const ImplicitCastExpr *ICE) {
985 return Visit(S: ICE->getSubExpr());
986 }
987
988 bool VisitExplicitCastExpr(const ExplicitCastExpr *ECE) {
989 return Visit(S: ECE->getSubExpr());
990 }
991
992 bool VisitMaterializeTemporaryExpr(const MaterializeTemporaryExpr *VMT) {
993 return Visit(S: VMT->getSubExpr());
994 }
995
996 bool VisitCXXBindTemporaryExpr(const CXXBindTemporaryExpr *BTE) {
997 if (auto *Temp = BTE->getTemporary()) {
998 if (!IsFunctionTrivial(D: Temp->getDestructor()))
999 return false;
1000 }
1001 return Visit(S: BTE->getSubExpr());
1002 }
1003
1004 bool VisitArrayInitLoopExpr(const ArrayInitLoopExpr *AILE) {
1005 return Visit(S: AILE->getCommonExpr()) && Visit(S: AILE->getSubExpr());
1006 }
1007
1008 bool VisitArrayInitIndexExpr(const ArrayInitIndexExpr *AIIE) {
1009 return true; // The current array index in VisitArrayInitLoopExpr is always
1010 // trivial.
1011 }
1012
1013 bool VisitOpaqueValueExpr(const OpaqueValueExpr *OVE) {
1014 return Visit(S: OVE->getSourceExpr());
1015 }
1016
1017 bool VisitExprWithCleanups(const ExprWithCleanups *EWC) {
1018 return Visit(S: EWC->getSubExpr());
1019 }
1020
1021 bool VisitParenExpr(const ParenExpr *PE) { return Visit(S: PE->getSubExpr()); }
1022
1023 bool VisitInitListExpr(const InitListExpr *ILE) {
1024 for (const Expr *Child : ILE->inits()) {
1025 if (Child && !Visit(S: Child))
1026 return false;
1027 }
1028 return true;
1029 }
1030
1031 bool VisitMemberExpr(const MemberExpr *ME) {
1032 // Field access is allowed but the base pointer may itself be non-trivial.
1033 return Visit(S: ME->getBase());
1034 }
1035
1036 bool VisitCXXThisExpr(const CXXThisExpr *CTE) {
1037 // The expression 'this' is always trivial, be it explicit or implicit.
1038 return true;
1039 }
1040
1041 bool VisitCXXNullPtrLiteralExpr(const CXXNullPtrLiteralExpr *E) {
1042 // nullptr is trivial.
1043 return true;
1044 }
1045
1046 bool VisitDeclRefExpr(const DeclRefExpr *DRE) {
1047 // The use of a variable is trivial.
1048 return true;
1049 }
1050
1051 // Constant literal expressions are always trivial
1052 bool VisitIntegerLiteral(const IntegerLiteral *E) { return true; }
1053 bool VisitFloatingLiteral(const FloatingLiteral *E) { return true; }
1054 bool VisitFixedPointLiteral(const FixedPointLiteral *E) { return true; }
1055 bool VisitCharacterLiteral(const CharacterLiteral *E) { return true; }
1056 bool VisitStringLiteral(const StringLiteral *E) { return true; }
1057 bool VisitCXXBoolLiteralExpr(const CXXBoolLiteralExpr *E) { return true; }
1058
1059 bool VisitConstantExpr(const ConstantExpr *CE) {
1060 // Constant expressions are trivial.
1061 return true;
1062 }
1063
1064 bool VisitImplicitValueInitExpr(const ImplicitValueInitExpr *IVIE) {
1065 // An implicit value initialization is trvial.
1066 return true;
1067 }
1068
1069private:
1070 CacheTy &Cache;
1071 CacheTy FieldDtorCache;
1072 CacheTy RecursiveFn;
1073 const Stmt **OffendingStmt;
1074};
1075
1076bool TrivialFunctionAnalysis::isTrivialImpl(
1077 const Decl *D, TrivialFunctionAnalysis::CacheTy &Cache,
1078 const Stmt **OffendingStmt) {
1079 TrivialFunctionAnalysisVisitor V(Cache, OffendingStmt);
1080 return V.IsFunctionTrivial(D);
1081}
1082
1083bool TrivialFunctionAnalysis::isTrivialImpl(
1084 const Stmt *S, TrivialFunctionAnalysis::CacheTy &Cache,
1085 const Stmt **OffendingStmt) {
1086 TrivialFunctionAnalysisVisitor V(Cache, OffendingStmt);
1087 return V.IsStatementTrivial(S);
1088}
1089
1090bool TrivialFunctionAnalysis::hasTrivialDtorImpl(const VarDecl *VD,
1091 CacheTy &Cache) {
1092 TrivialFunctionAnalysisVisitor V(Cache);
1093 return V.HasTrivialDestructor(VD);
1094}
1095
1096} // namespace clang
1097