1//=======- UncountedLocalVarsChecker.cpp -------------------------*- C++ -*-==//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "ASTUtils.h"
10#include "DiagOutputUtils.h"
11#include "PtrTypesSemantics.h"
12#include "RawPtrRefSafetyModel.h"
13#include "clang/AST/CXXInheritance.h"
14#include "clang/AST/Decl.h"
15#include "clang/AST/DeclCXX.h"
16#include "clang/AST/DynamicRecursiveASTVisitor.h"
17#include "clang/AST/ParentMapContext.h"
18#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
19#include "clang/Basic/SourceLocation.h"
20#include "clang/StaticAnalyzer/Checkers/BuiltinCheckerRegistration.h"
21#include "clang/StaticAnalyzer/Core/BugReporter/BugReporter.h"
22#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
23#include "clang/StaticAnalyzer/Core/Checker.h"
24#include <optional>
25
26using namespace clang;
27using namespace ento;
28
29namespace {
30
31// FIXME: should be defined by anotations in the future
32bool isRefcountedStringsHack(const VarDecl *V) {
33 assert(V);
34 auto safeClass = [](const std::string &className) {
35 return className == "String" || className == "AtomString" ||
36 className == "UniquedString" || className == "Identifier";
37 };
38 QualType QT = V->getType();
39 auto *T = QT.getTypePtr();
40 if (auto *CXXRD = T->getAsCXXRecordDecl()) {
41 if (safeClass(safeGetName(ASTNode: CXXRD)))
42 return true;
43 }
44 if (T->isPointerType() || T->isReferenceType()) {
45 if (auto *CXXRD = T->getPointeeCXXRecordDecl()) {
46 if (safeClass(safeGetName(ASTNode: CXXRD)))
47 return true;
48 }
49 }
50 return false;
51}
52
53struct GuardianVisitor : DynamicRecursiveASTVisitor {
54 const VarDecl *Guardian{nullptr};
55 bool GuardianIsRawPtrOrRef{false};
56
57 explicit GuardianVisitor(const VarDecl *Guardian,
58 bool GuardianIsRawPtrOrRef = false)
59 : Guardian(Guardian), GuardianIsRawPtrOrRef(GuardianIsRawPtrOrRef) {
60 assert(Guardian);
61 }
62
63 bool VisitBinaryOperator(BinaryOperator *BO) override {
64 if (BO->isAssignmentOp()) {
65 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: BO->getLHS())) {
66 if (VarRef->getDecl() == Guardian)
67 return false;
68 }
69 }
70 return true;
71 }
72
73 bool VisitCXXConstructExpr(CXXConstructExpr *CE) override {
74 auto *Ctor = CE->getConstructor();
75 if (!Ctor)
76 return false;
77 unsigned ArgIndex = 0;
78 for (auto *Arg : CE->arguments()) {
79 ParmVarDecl *Parm = nullptr;
80 if (ArgIndex < Ctor->getNumParams())
81 Parm = Ctor->getParamDecl(i: ArgIndex);
82 if (mutatesGuardian(Arg, ParmDecl: Parm))
83 return false;
84 ArgIndex++;
85 }
86 return true;
87 }
88
89 bool VisitCallExpr(CallExpr *CE) override {
90 auto *Callee = CE->getDirectCallee();
91 if (!Callee)
92 return false;
93 if (isPtrConversion(F: Callee))
94 return true;
95 if (auto *Method = dyn_cast<CXXMethodDecl>(Val: Callee)) {
96 if (isGetterOfSafePtr(Method).value_or(u: false))
97 return true;
98 }
99 unsigned ArgIndex = 0;
100 unsigned ArgOffset = isa<CXXOperatorCallExpr>(Val: CE);
101 for (auto *Arg : CE->arguments()) {
102 ParmVarDecl *Parm = nullptr;
103 if (ArgIndex >= ArgOffset) {
104 unsigned ParmIndex = ArgIndex - ArgOffset;
105 if (ParmIndex < Callee->getNumParams())
106 Parm = Callee->getParamDecl(i: ParmIndex);
107 }
108 if (mutatesGuardian(Arg, ParmDecl: Parm))
109 return false;
110 ArgIndex++;
111 }
112 return true;
113 }
114
115 bool VisitCXXMemberCallExpr(CXXMemberCallExpr *MCE) override {
116 if (GuardianIsRawPtrOrRef)
117 return true;
118 auto *Method = MCE->getMethodDecl();
119 auto ObjType = MCE->getObjectType();
120 if (ObjType.isConstQualified())
121 return true;
122 auto *ThisArg = MCE->getImplicitObjectArgument()->IgnoreParenCasts();
123 if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: ThisArg)) {
124 if (!isa<CXXConversionDecl>(Val: Method) && VarRef->getDecl() == Guardian)
125 return false;
126 }
127 return true;
128 }
129
130private:
131 bool mutatesGuardian(const Expr *Arg, const ParmVarDecl *ParmDecl) {
132 Arg = Arg->IgnoreParenCasts();
133 auto ArgType = ParmDecl ? ParmDecl->getType() : Arg->getType();
134 bool IsAddressOf = false;
135 if (auto *UO = dyn_cast<UnaryOperator>(Val: Arg);
136 UO && UO->getOpcode() == UO_AddrOf) {
137 Arg = UO->getSubExpr()->IgnoreParenCasts();
138 IsAddressOf = true;
139 }
140 auto *VarRef = dyn_cast<DeclRefExpr>(Val: Arg);
141 if (!VarRef || VarRef->getDecl() != Guardian)
142 return false;
143 if (GuardianIsRawPtrOrRef && !Guardian->getType()->isPointerType())
144 return false;
145 if (IsAddressOf) {
146 if (!ArgType->isPointerType())
147 return false;
148 return !ArgType->getPointeeType().isConstQualified();
149 }
150 if (GuardianIsRawPtrOrRef) {
151 if (!ArgType->isReferenceType())
152 return false;
153 return !ArgType.getNonReferenceType().isConstQualified();
154 }
155 return !ArgType.isConstQualified();
156 }
157};
158
159bool isGuardedScopeEmbeddedInGuardianScope(const VarDecl *Guarded,
160 const VarDecl *MaybeGuardian) {
161 assert(Guarded);
162 assert(MaybeGuardian);
163
164 if (!MaybeGuardian->isLocalVarDecl())
165 return false;
166
167 const CompoundStmt *guardiansClosestCompStmtAncestor = nullptr;
168
169 ASTContext &ctx = MaybeGuardian->getASTContext();
170
171 for (DynTypedNodeList guardianAncestors = ctx.getParents(Node: *MaybeGuardian);
172 !guardianAncestors.empty();
173 guardianAncestors = ctx.getParents(
174 Node: *guardianAncestors
175 .begin()) // FIXME - should we handle all of the parents?
176 ) {
177 for (auto &guardianAncestor : guardianAncestors) {
178 if (auto *CStmtParentAncestor = guardianAncestor.get<CompoundStmt>()) {
179 guardiansClosestCompStmtAncestor = CStmtParentAncestor;
180 break;
181 }
182 }
183 if (guardiansClosestCompStmtAncestor)
184 break;
185 }
186
187 if (!guardiansClosestCompStmtAncestor)
188 return false;
189
190 // We need to skip the first CompoundStmt to avoid situation when guardian is
191 // defined in the same scope as guarded variable.
192 const CompoundStmt *FirstCompondStmt = nullptr;
193 for (DynTypedNodeList guardedVarAncestors = ctx.getParents(Node: *Guarded);
194 !guardedVarAncestors.empty();
195 guardedVarAncestors = ctx.getParents(
196 Node: *guardedVarAncestors
197 .begin()) // FIXME - should we handle all of the parents?
198 ) {
199 for (auto &guardedVarAncestor : guardedVarAncestors) {
200 if (auto *CStmtAncestor = guardedVarAncestor.get<CompoundStmt>()) {
201 if (!FirstCompondStmt) {
202 FirstCompondStmt = CStmtAncestor;
203 continue;
204 }
205 if (CStmtAncestor == guardiansClosestCompStmtAncestor) {
206 GuardianVisitor guardianVisitor(MaybeGuardian);
207 auto *GuardedScope = const_cast<CompoundStmt *>(FirstCompondStmt);
208 return guardianVisitor.TraverseCompoundStmt(S: GuardedScope);
209 }
210 }
211 }
212 }
213
214 return false;
215}
216
217static const VarDecl *findAssignedVar(const Expr *DestExpr) {
218 while (DestExpr) {
219 DestExpr = DestExpr->IgnoreParenCasts();
220 if (auto *DRE = dyn_cast<DeclRefExpr>(Val: DestExpr))
221 return dyn_cast_or_null<VarDecl>(Val: DRE->getDecl());
222 if (auto *UO = dyn_cast<UnaryOperator>(Val: DestExpr);
223 UO && UO->getOpcode() == UO_Deref) {
224 DestExpr = UO->getSubExpr();
225 continue;
226 }
227 if (auto *ASE = dyn_cast<ArraySubscriptExpr>(Val: DestExpr)) {
228 DestExpr = ASE->getBase();
229 continue;
230 }
231 return nullptr;
232 }
233 return nullptr;
234}
235
236class RawPtrRefLocalVarsChecker
237 : public Checker<check::ASTDecl<TranslationUnitDecl>> {
238 BugType Bug;
239 EnsureFunctionAnalysis EFA;
240
241protected:
242 mutable BugReporter *BR;
243 const std::unique_ptr<PtrRefSafetyModel> Model;
244
245public:
246 RawPtrRefLocalVarsChecker(const char *description,
247 std::unique_ptr<PtrRefSafetyModel> Model)
248 : Bug(this, description, "WebKit coding guidelines"),
249 Model(std::move(Model)) {}
250
251 std::optional<bool> isUnsafePtr(QualType T) const {
252 return isUnsafePtrForStorage(Model: *Model, T);
253 }
254
255 void checkASTDecl(const TranslationUnitDecl *TUD, AnalysisManager &MGR,
256 BugReporter &BRArg) const {
257 BR = &BRArg;
258
259 // The calls to checkAST* from AnalysisConsumer don't
260 // visit template instantiations or lambda classes. We
261 // want to visit those, so we make our own RecursiveASTVisitor.
262 struct LocalVisitor : DynamicRecursiveASTVisitor {
263 const RawPtrRefLocalVarsChecker *Checker;
264 Decl *DeclWithIssue{nullptr};
265
266 TrivialFunctionAnalysis TFA;
267
268 explicit LocalVisitor(const RawPtrRefLocalVarsChecker *Checker)
269 : Checker(Checker) {
270 assert(Checker);
271 ShouldVisitTemplateInstantiations = true;
272 ShouldVisitImplicitCode = false;
273 }
274
275 bool TraverseDecl(Decl *D) override {
276 // A template pattern is checked through its instantiations, which are
277 // traversed from the TemplateDecl itself. In the pattern the callee of
278 // a call may still be an unresolved overload set and the type of an
279 // expression may still be dependent, neither of which can be reasoned
280 // about, so don't enter it at all.
281 if (D && !isa<TemplateDecl>(Val: D) && D->isTemplated())
282 return true;
283 llvm::SaveAndRestore SavedDecl(DeclWithIssue);
284 if (D && (isa<FunctionDecl>(Val: D) || isa<ObjCMethodDecl>(Val: D)))
285 DeclWithIssue = D;
286 return DynamicRecursiveASTVisitor::TraverseDecl(D);
287 }
288
289 bool TraverseLambdaExpr(LambdaExpr *L) override {
290 auto *FTD = L->getLambdaClass()->getDependentLambdaCallOperator();
291 if (!FTD)
292 return DynamicRecursiveASTVisitor::TraverseLambdaExpr(S: L);
293 // The body of a generic lambda is the pattern of its call operator,
294 // but it is reached from the LambdaExpr as a statement, so TraverseDecl
295 // never gets to skip it. Traverse the capture initializers, which are
296 // evaluated in the enclosing scope, and then the call operator itself,
297 // of which the pattern is skipped like any other and the instantiations
298 // are traversed. Going through TraverseDecl also makes an instantiation
299 // the decl with the issue, so that a guardian is looked up in it rather
300 // than in the pattern. The initializers are traversed as expressions
301 // because the variable of an init capture is declared in the pattern.
302 for (unsigned I = 0, N = L->capture_size(); I != N; ++I) {
303 if (!(L->capture_begin() + I)->isExplicit())
304 continue;
305 if (auto *Init = L->capture_init_begin()[I];
306 Init && !TraverseStmt(S: Init))
307 return false;
308 }
309 return TraverseDecl(D: FTD);
310 }
311
312 bool VisitTypedefDecl(TypedefDecl *TD) override {
313 if (auto *RTC = Checker->Model->retainTypeChecker())
314 RTC->visitTypedef(TD);
315 return true;
316 }
317
318 bool VisitVarDecl(VarDecl *V) override {
319 auto *Init = V->getInit();
320 if (V->isLocalVarDecl())
321 Checker->visitVarDecl(V, SinkType: V->getType(), Value: Init, DeclWithIssue);
322 return true;
323 }
324
325 bool VisitBinaryOperator(BinaryOperator *BO) override {
326 if (BO->isAssignmentOp()) {
327 if (Checker->Model->recognizesIndirectStores()) {
328 if (auto *V = findAssignedVar(DestExpr: BO->getLHS()))
329 Checker->visitVarDecl(V, SinkType: BO->getLHS()->getType(), Value: BO->getRHS(),
330 DeclWithIssue);
331 } else if (auto *VarRef = dyn_cast<DeclRefExpr>(Val: BO->getLHS())) {
332 if (auto *V = dyn_cast<VarDecl>(Val: VarRef->getDecl()))
333 Checker->visitVarDecl(V, SinkType: V->getType(), Value: BO->getRHS(),
334 DeclWithIssue);
335 }
336 }
337 return true;
338 }
339
340 bool TraverseIfStmt(IfStmt *IS) override {
341 if (IS->getConditionVariable()) {
342 // This code does not check the condition variable in the "else"
343 // statement since getConditionVariable returns nullptr when there
344 // is a condition defined after ";" as in "if (auto foo = ~; !foo)".
345 // If this semantics change, we should check it in "else" as well.
346 if (auto *Then = IS->getThen(); !Then || TFA.isTrivial(S: Then)) {
347 if (auto *Else = IS->getElse(); Else && !TFA.isTrivial(S: Else))
348 return TraverseStmt(S: Else);
349 return true;
350 }
351 }
352 if (!TFA.isTrivial(S: IS))
353 return DynamicRecursiveASTVisitor::TraverseIfStmt(S: IS);
354 return true;
355 }
356
357 bool TraverseForStmt(ForStmt *FS) override {
358 if (!TFA.isTrivial(S: FS))
359 return DynamicRecursiveASTVisitor::TraverseForStmt(S: FS);
360 return true;
361 }
362
363 bool TraverseCXXForRangeStmt(CXXForRangeStmt *FRS) override {
364 if (!TFA.isTrivial(S: FRS))
365 return DynamicRecursiveASTVisitor::TraverseCXXForRangeStmt(S: FRS);
366 return true;
367 }
368
369 bool TraverseWhileStmt(WhileStmt *WS) override {
370 if (!TFA.isTrivial(S: WS))
371 return DynamicRecursiveASTVisitor::TraverseWhileStmt(S: WS);
372 return true;
373 }
374
375 bool TraverseCompoundStmt(CompoundStmt *CS) override {
376 if (!TFA.isTrivial(S: CS))
377 return DynamicRecursiveASTVisitor::TraverseCompoundStmt(S: CS);
378 return true;
379 }
380
381 bool TraverseClassTemplateDecl(ClassTemplateDecl *Decl) override {
382 if (isSmartPtrClass(Name: safeGetName(ASTNode: Decl)))
383 return true;
384 return DynamicRecursiveASTVisitor::TraverseClassTemplateDecl(D: Decl);
385 }
386 };
387
388 LocalVisitor visitor(this);
389 if (auto *RTC = Model->retainTypeChecker())
390 RTC->visitTranslationUnitDecl(TUD);
391 visitor.TraverseDecl(D: const_cast<TranslationUnitDecl *>(TUD));
392 }
393
394 void visitVarDecl(const VarDecl *V, QualType SinkType, const Expr *Value,
395 const Decl *DeclWithIssue) const {
396 if (shouldSkipVarDecl(V))
397 return;
398
399 if (auto *DD = dyn_cast<DecompositionDecl>(Val: V)) {
400 const auto *InitList =
401 Value ? dyn_cast<InitListExpr>(Val: Value->IgnoreParenCasts()) : nullptr;
402 if (InitList && InitList->getNumInits() != DD->bindings().size())
403 InitList = nullptr;
404
405 unsigned BindingIndex = 0;
406 for (auto *BD : DD->bindings()) {
407 const unsigned Index = BindingIndex++;
408 auto *Binding = BD->getBinding();
409 if (!Binding)
410 continue;
411 std::optional<bool> IsUncountedPtr = isUnsafePtr(T: Binding->getType());
412 if (!IsUncountedPtr || !*IsUncountedPtr)
413 continue;
414
415 const Expr *Origin = nullptr;
416 if (Model->checksForInteriorDestruction()) {
417 const Expr *Source = InitList ? InitList->getInit(Init: Index) : Value;
418 if (isPtrOriginSafe(V, Value: Source, DeclWithIssue, Origin,
419 SinkType: Binding->getType()))
420 continue;
421 }
422 reportBug(V, SinkType: V->getType(), Value: nullptr, BindingDecl: BD, DeclWithIssue, Origin);
423 }
424 }
425
426 std::optional<bool> IsUncountedPtr = isUnsafePtr(T: SinkType);
427 if (IsUncountedPtr && *IsUncountedPtr) {
428 const Expr *Origin = nullptr;
429 if (Value) {
430 if (isPtrOriginSafe(V, Value, DeclWithIssue, Origin, SinkType))
431 return;
432 } else if (Model->checksForInteriorDestruction())
433 return;
434 reportBug(V, SinkType, Value, BindingDecl: nullptr, DeclWithIssue, Origin);
435 }
436 }
437
438 bool isPtrOriginSafe(const VarDecl *V, const Expr *Value,
439 const Decl *DeclWithIssue, const Expr *&Origin,
440 QualType SinkType = QualType()) const {
441 return tryToFindPtrOrigin(
442 E: Value, /*StopAtFirstRefCountedObj=*/false,
443 FollowLifetimeBound: Model->checksForInteriorDestruction(),
444 isSafePtr: [&](const clang::CXXRecordDecl *Record) {
445 return Model->isSafePtr(Record);
446 },
447 isSafePtrType: [&](const clang::QualType Type) { return Model->isSafePtrType(T: Type); },
448 isSafeGlobalDecl: [&](const clang::Decl *D) {
449 return Model->isSafeDecl(D, BR->getSourceManager());
450 },
451 callback: [&](const clang::Expr *InitArgOrigin, bool IsSafe,
452 bool OriginDependsOnFullExpressionTemporary,
453 bool PtrIsLifetimeBoundToOrigin) {
454 if (!InitArgOrigin)
455 return true;
456
457 if (IsSafe) {
458 if (!OriginDependsOnFullExpressionTemporary)
459 return true;
460 if (!Origin)
461 Origin = InitArgOrigin;
462 return false;
463 }
464
465 if (isa<CXXThisExpr>(Val: InitArgOrigin))
466 return true;
467
468 if (isNullPtr(E: InitArgOrigin))
469 return true;
470
471 if (isa<IntegerLiteral>(Val: InitArgOrigin))
472 return true;
473
474 if (isConstOwnerPtrMemberExpr(E: InitArgOrigin))
475 return true;
476
477 if (EFA.isACallToEnsureFn(E: InitArgOrigin))
478 return true;
479
480 if (Model->isSafeExpr(Origin: InitArgOrigin, PtrIsLifetimeBoundToOrigin,
481 SinkType, /*SinkMayEscape=*/false))
482 return true;
483
484 if (!Model->checksForInteriorDestruction() &&
485 hasGuardian(V, InitArgOrigin, DeclWithIssue))
486 return true;
487
488 if (!Origin)
489 Origin = InitArgOrigin;
490 return false;
491 });
492 }
493
494 bool hasGuardian(const VarDecl *V, const Expr *InitArgOrigin,
495 const Decl *DeclWithIssue) const {
496 auto *Ref = dyn_cast<DeclRefExpr>(Val: InitArgOrigin);
497 if (!Ref)
498 return false;
499
500 auto *MaybeGuardian = dyn_cast_or_null<VarDecl>(Val: Ref->getFoundDecl());
501 if (!MaybeGuardian)
502 return false;
503
504 QualType GuardianType = MaybeGuardian->getType();
505 if (!GuardianType.isNull()) {
506 if (auto *Record = GuardianType->getAsCXXRecordDecl()) {
507 if (MaybeGuardian->isLocalVarDecl() &&
508 (Model->isSafePtr(Record) ||
509 isRefcountedStringsHack(V: MaybeGuardian)) &&
510 isGuardedScopeEmbeddedInGuardianScope(Guarded: V, MaybeGuardian))
511 return true;
512 }
513 }
514
515 if (isa<ParmVarDecl>(Val: MaybeGuardian)) {
516 bool IsRawPtrOrRef = isUnsafePtr(T: GuardianType).value_or(u: false);
517 GuardianVisitor Visitor{MaybeGuardian, IsRawPtrOrRef};
518 if (auto *FD = dyn_cast<FunctionDecl>(Val: DeclWithIssue))
519 return Visitor.TraverseStmt(S: FD->getBody());
520 if (auto *MD = dyn_cast<ObjCMethodDecl>(Val: DeclWithIssue))
521 return Visitor.TraverseStmt(S: MD->getBody());
522 }
523
524 return false;
525 }
526
527 bool shouldSkipVarDecl(const VarDecl *V) const {
528 assert(V);
529 if (isa<ImplicitParamDecl>(Val: V))
530 return true;
531 if (V->isInitCapture())
532 return true;
533 return BR->getSourceManager().isInSystemHeader(Loc: V->getLocation());
534 }
535
536 void reportBug(const VarDecl *V, QualType SinkType, const Expr *Value,
537 const Decl *BindingDecl, const Decl *DeclWithIssue,
538 const Expr *Origin) const {
539 assert(V);
540 SmallString<100> Buf;
541 llvm::raw_svector_ostream Os(Buf);
542
543 if (isa<ParmVarDecl>(Val: V)) {
544 Os << "Parameter ";
545 printQuotedQualifiedName(Os, D: V);
546 Os << " is a ";
547 Model->describeHazard(Os, Origin, SinkType);
548
549 SourceLocation ExprLoc = (Value) ? Value->getExprLoc() : V->getLocation();
550 PathDiagnosticLocation BSLoc(ExprLoc, BR->getSourceManager());
551 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
552 if (Value)
553 Report->addRange(R: Value->getSourceRange());
554 Report->setDeclWithIssue(DeclWithIssue);
555 BR->emitReport(R: std::move(Report));
556 } else {
557 if (V->hasLocalStorage())
558 Os << "Local variable ";
559 else if (V->isStaticLocal())
560 Os << "Static local variable ";
561 else if (V->hasGlobalStorage())
562 Os << "Global variable ";
563 else
564 Os << "Variable ";
565 if (BindingDecl)
566 Os << "'" << safeGetName(ASTNode: BindingDecl) << "'";
567 else
568 printQuotedQualifiedName(Os, D: V);
569 Os << " is a ";
570 Model->describeHazard(Os, Origin, SinkType);
571
572 PathDiagnosticLocation BSLoc(V->getLocation(), BR->getSourceManager());
573 auto Report = std::make_unique<BasicBugReport>(args: Bug, args: Os.str(), args&: BSLoc);
574 Report->addRange(R: V->getSourceRange());
575 Report->setDeclWithIssue(DeclWithIssue);
576 BR->emitReport(R: std::move(Report));
577 }
578 }
579};
580
581class UncountedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
582public:
583 UncountedLocalVarsChecker()
584 : RawPtrRefLocalVarsChecker("Uncounted raw pointer or reference not "
585 "provably backed by ref-counted variable",
586 makeRefPtrSafetyModel()) {}
587};
588
589class UncheckedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
590public:
591 UncheckedLocalVarsChecker()
592 : RawPtrRefLocalVarsChecker("Unchecked raw pointer or reference not "
593 "provably backed by checked variable",
594 makeCheckedPtrSafetyModel()) {}
595};
596
597class UnretainedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
598public:
599 UnretainedLocalVarsChecker()
600 : RawPtrRefLocalVarsChecker("Unretained raw pointer or reference not "
601 "provably backed by a RetainPtr",
602 makeRetainPtrSafetyModel()) {}
603};
604
605class UnborrowedLocalVarsChecker final : public RawPtrRefLocalVarsChecker {
606public:
607 UnborrowedLocalVarsChecker()
608 : RawPtrRefLocalVarsChecker("Loan on a CanBorrow object not guarded by "
609 "const or a Borrow",
610 makeBorrowSafetyModel()) {}
611};
612
613} // namespace
614
615void ento::registerUncountedLocalVarsChecker(CheckerManager &Mgr) {
616 Mgr.registerChecker<UncountedLocalVarsChecker>();
617}
618
619bool ento::shouldRegisterUncountedLocalVarsChecker(const CheckerManager &) {
620 return true;
621}
622
623void ento::registerUncheckedLocalVarsChecker(CheckerManager &Mgr) {
624 Mgr.registerChecker<UncheckedLocalVarsChecker>();
625}
626
627bool ento::shouldRegisterUncheckedLocalVarsChecker(const CheckerManager &) {
628 return true;
629}
630
631void ento::registerUnretainedLocalVarsChecker(CheckerManager &Mgr) {
632 Mgr.registerChecker<UnretainedLocalVarsChecker>();
633}
634
635bool ento::shouldRegisterUnretainedLocalVarsChecker(const CheckerManager &) {
636 return true;
637}
638
639void ento::registerUnborrowedLocalVarsChecker(CheckerManager &Mgr) {
640 Mgr.registerChecker<UnborrowedLocalVarsChecker>();
641}
642
643bool ento::shouldRegisterUnborrowedLocalVarsChecker(const CheckerManager &) {
644 return true;
645}
646