[-Wunsafe-buffer-usage] FixableGadget for handling stand alone pointers under UPC.

[malavikasamak]

Summary

This patch introduces UPCStandalonePointerGadget, a FixableGadget that emits fixits to handle cases where a pointer identified as unsafe is simply referenced. An example of such a case is when the pointer is input as an argument to a method call, where we can not change the type of the argument. For cases where the strategy for the unsafe pointer is to use std::span, the idea is to extract the underlying pointer by invoking the "data()" method on the span instance.

For example, the gadget emits a fixit for S3, where S1, S2 are handled by other gadgets:

S1: int *ptr = new int[10]; 
S2: int val1 = ptr[k];  // Unsafe operation on ptr
S3: foo(ptr); // Some method that accepts raw pointer => FIXIT: foo(ptr.data());

[malavikasamak]

Updating diff to get rid of white-space changes.

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

166

I haven't thought it through carefully but I'm afraid that this could result in one match result with both LHS and RHS being matched and bound to the same tag. Only one Fixable will be created from this match result but we actually need two. Besides, reading the tag from the match result could return either LHS or RHS non-deterministically I guess.

clang/test/SemaCXX/warn-unsafe-buffer-usage-fixits-pointer-access.cpp

29

we could also test when both p and q are used somewhere unsafely.

[malavikasamak]

Added a new test case.

[malavikasamak]

clang/lib/Analysis/UnsafeBufferUsage.cpp

166

Do you mean that this can result in only one side of the equation will be fixed? Added a test case "condition_check_two_usafe_buffers" to check such cases.

[NoQ]

clang/lib/Analysis/UnsafeBufferUsage.cpp

166

This code produces two matches, one for LHS one for RHS, and never produces a match in which both are bound: https://godbolt.org/z/dadETKf8d

So there's no "either LHS or RHS non-deterministically", it's just two independent MatchResults.

So I think this looks correct, just like the callExpr() case.

[ziqingluo-90]

clang/lib/Analysis/UnsafeBufferUsage.cpp

166

Oh yes, you are right. I really didn't think it through.

[jkorous]

clang/lib/Analysis/UnsafeBufferUsage.cpp

457

I get confused by the word Access. I think here we are actually processing cases where the memory address pointed to is not accessed.

485

We can now remove the dyn_cast since Node has type DeclRefExpr*.

929

We should be able to remove this dyn_cast too.

[NoQ]

Other than my usual complaint about declRefExpr(to(varDecl())), LGTM!

clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def

35

🚲🏠 : "Reference" kinda reads like "int *&q = p" which is not what we mean. (Yes, in DeclRefExpr "Ref" stands for "Reference" but nobody likes it.) Folks also seem to be adding UPC/ULC when appropriate. Maybe UPCStandalonePointer???

[NoQ]

clang/lib/Analysis/UnsafeBufferUsage.cpp

929

Nitpick: This is one of the few recommended use cases for auto (https://www.llvm.org/docs/CodingStandards.html#use-auto-type-deduction-to-make-code-more-readable).

935–939

This code probably wants to check for empty optional before dereferencing(?)

[malavikasamak]

clang/lib/Analysis/UnsafeBufferUsage.cpp

935–939

The getEndCharLoc method does not return an optional at this point of time in our stack. So, I am going to change the type of endOfOperand to SourceLocation to reflect this.

[ziqingluo-90]

LGTM now!

[NoQ]

I think this is good to go!

clang/include/clang/Analysis/Analyses/UnsafeBufferUsageGadgets.def

 
 WARNING_GADGET(Increment)
 WARNING_GADGET(Decrement)
 WARNING_GADGET(ArraySubscript)
 WARNING_GADGET(PointerArithmetic)
 WARNING_GADGET(UnsafeBufferUsageAttr)
 FIXABLE_GADGET(ULCArraySubscript)          // `DRE[any]` in an Unspecified Lvalue Context
 FIXABLE_GADGET(UPCAddressofArraySubscript) // '&DRE[any]' in an Unspecified Pointer Context
+FIXABLE_GADGET(PointerCtxAccess)
 
 #undef FIXABLE_GADGET
 #undef WARNING_GADGET
 #undef GADGET

clang/lib/Analysis/UnsafeBufferUsage.cpp

 static internal::Matcher<Stmt>
 isInUnspecifiedPointerContext(internal::Matcher<Stmt> InnerMatcher) {
   // A UPC can be
   // 1. an argument of a function call (except the callee has [[unsafe_...]]
   // attribute), or
   // 2. the operand of a cast operation; or
   // ...
   auto CallArgMatcher =
-      callExpr(hasAnyArgument(allOf(
-                   hasPointerType() /* array also decays to pointer type*/,
-                   InnerMatcher)),
-               unless(callee(functionDecl(hasAttr(attr::UnsafeBufferUsage)))));
+      callExpr(forEachArgumentWithParam(InnerMatcher, 
+                  hasPointerType() /* array also decays to pointer type*/),
+
   auto CastOperandMatcher =
       explicitCastExpr(hasCastKind(CastKind::CK_PointerToIntegral),
                        castSubExpr(allOf(hasPointerType(), InnerMatcher)));
 
-  return stmt(anyOf(CallArgMatcher, CastOperandMatcher));
+  auto CompOperandMatcher =
+      binaryOperator(hasAnyOperatorName("!=", "==", "<", "<=", ">", ">="),
+                     eachOf(hasLHS(allOf(hasPointerType(), InnerMatcher)),
+                            hasRHS(allOf(hasPointerType(), InnerMatcher))));
+
+  return stmt(anyOf(CallArgMatcher, CastOperandMatcher, CompOperandMatcher));
   // FIXME: any more cases? (UPC excludes the RHS of an assignment.  For now we
   // don't have to check that.)
 }
 } // namespace clang::ast_matchers
 
 namespace {
 // Because the analysis revolves around variables and their types, we'll need to
 // track uses of variables (aka DeclRefExprs).
public:
   virtual DeclUseList getClaimedVarUseSites() const override {
     if (const auto *DRE = dyn_cast<DeclRefExpr>(Node->getBase()->IgnoreImpCasts())) {
       return {DRE};
     }
     return {};
   }
 };
 
+// Fixable gadget to handle the expressions DRE in the unspecified pointer
+// context.
+class PointerCtxAccessGadget : public FixableGadget {
+private:
+  static constexpr const char *const DeclRefExprTag = "PtrAccess";
+  const DeclRefExpr *Node;
+
+public:
+  PointerCtxAccessGadget(const MatchFinder::MatchResult &Result)
+      : FixableGadget(Kind::PointerCtxAccess),
+        Node(Result.Nodes.getNodeAs<DeclRefExpr>(DeclRefExprTag)) {
+    assert(Node != nullptr && "Expecting a non-null matching result");
+  }
+
+  static bool classof(const Gadget *G) {
+    return G->getKind() == Kind::PointerCtxAccess;
+  }
+
+  static Matcher matcher() {
+    auto ArrayOrPtr = anyOf(hasPointerType(), hasArrayType());
+    auto target = expr(
+        ignoringParenImpCasts(declRefExpr(ArrayOrPtr).bind(DeclRefExprTag)));
+    return stmt(isInUnspecifiedPointerContext(target));
+  }
+
+  virtual std::optional<FixItList> getFixits(const Strategy &S) const override;
+
+  virtual const Stmt *getBaseStmt() const override { return Node; }
+
+  virtual DeclUseList getClaimedVarUseSites() const override {
+    if (const auto *DRE = dyn_cast<DeclRefExpr>(Node)) {
+      return {DRE};
+    }
+    return {};
+  }
+};
 
 /// A call of a function or method that performs unchecked buffer operations
 /// over one of its pointer parameters.
 class UnsafeBufferUsageAttrGadget : public WarningGadget {
     constexpr static const char *const OpTag = "call_expr";
     const CallExpr *Op;
 
 public:
if (const auto *DRE =
           return {FixItHint::CreateReplacement(Node->getSourceRange(),
                                                StrBuffer.str())};
         }
       }
     }
   return {}; // something went wrong. no fix-it
 }
 
+
+// Generates fix-its replacing an expression of the form UPC(DRE) with
+// `DRE.data()`
+std::optional<FixItList> PointerCtxAccessGadget::getFixits(const Strategy &S)
+      const {
+  if (const auto *DRE = dyn_cast<DeclRefExpr>(Node))
+     if (const auto *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
+      switch (S.lookup(VD)) {
+      case Strategy::Kind::Span: {
+        ASTContext &Ctx = VD->getASTContext();
+        SourceManager &SM = Ctx.getSourceManager();
+        // Inserts the .data() after the DRE
+        std::optional<SourceLocation> endOfOperand =
+            getEndCharLoc(DRE, SM, Ctx.getLangOpts());
+
+        return FixItList{{FixItHint::CreateInsertion(
+            endOfOperand.value().getLocWithOffset(1), ".data()")}};
+      }
+      case Strategy::Kind::Wontfix:
+      case Strategy::Kind::Iterator:
+      case Strategy::Kind::Array:
+      case Strategy::Kind::Vector:
+        llvm_unreachable("unsupported strategies for FixableGadgets");
+      }
+    }
+    return std::nullopt;
+}
+
 // For a non-null initializer `Init` of `T *` type, this function returns
 // `FixItHint`s producing a list initializer `{Init,  S}` as a part of a fix-it
 // to output stream.
 // In many cases, this function cannot figure out the actual extent `S`.  It
 // then will use a place holder to replace `S` to ask users to fill `S` in.  The
 // initializer shall be used to initialize a variable of type `std::span<T>`.
 //
 // FIXME: Support multi-level pointers

clang/test/SemaCXX/warn-unsafe-buffer-usage-fixits-pointer-access.cpp

+// RUN: %clang_cc1 -std=c++20 -Wunsafe-buffer-usage -fdiagnostics-parseable-fixits %s 2>&1 | FileCheck %s
+
+void foo(int* v) {
+}
+
+void m1(int* v1, int* v2, int) {
+
+}
+
+void condition_check_nullptr() {
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  
+  int tmp = p[5];
+  if(p != nullptr) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+}
+
+void condition_check() {
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  
+  auto q = new int[10];
+
+  int tmp = p[5];
+  if(p == q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+
+  if(q != p){}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:12-[[@LINE-1]]:12}:".data()"
+
+  if(p < q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+
+  if(p <= q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+
+  if(p > q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+
+  if(p >= q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+
+  if( p == q && p != nullptr) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:8-[[@LINE-1]]:8}:".data()"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:18-[[@LINE-2]]:18}:".data()"
+}
+
+void condition_check_two_usafe_buffers() {
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+
+  auto q = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> q"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+
+  int tmp = p[5];
+  tmp = q[5];
+
+  if(p == q) {}
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:".data()"
+}
+
+void unsafe_method_invocation_single_param() {
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  
+  int tmp = p[5];
+  foo(p);
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:8-[[@LINE-1]]:8}:".data()"
+
+}
+
+void safe_method_invocation_single_param() {
+  auto p = new int[10];
+  foo(p);
+}
+
+void unsafe_method_invocation_double_param() {
+  auto p = new int[10];
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:3-[[@LINE-1]]:11}:"std::span<int> p"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:12-[[@LINE-2]]:12}:"{"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-3]]:23-[[@LINE-3]]:23}:", 10}"
+  
+  int tmp = p[5];
+  m1(p, p, 10);
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-2]]:10-[[@LINE-2]]:10}:".data()"
+ 
+  auto q = new int[10];
+
+  m1(p, q, 4);
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:7-[[@LINE-1]]:7}:".data()"
+  
+  m1(q, p, 9);
+  // CHECK-DAG: fix-it:"{{.*}}":{[[@LINE-1]]:10-[[@LINE-1]]:10}:".data()"
+  
+  m1(q, q, 8);
+}
+