534 lines · cpp
1//===----------------------------------------------------------------------===//2//3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.4// See https://llvm.org/LICENSE.txt for license information.5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception6//7//===----------------------------------------------------------------------===//8 9#include "UseNullptrCheck.h"10#include "../utils/Matchers.h"11#include "../utils/OptionsUtils.h"12#include "clang/AST/ASTContext.h"13#include "clang/AST/RecursiveASTVisitor.h"14#include "clang/ASTMatchers/ASTMatchFinder.h"15#include "clang/Lex/Lexer.h"16 17using namespace clang;18using namespace clang::ast_matchers;19using namespace llvm;20 21namespace clang::tidy::modernize {22namespace {23 24AST_MATCHER(Type, sugaredNullptrType) {25 const Type *DesugaredType = Node.getUnqualifiedDesugaredType();26 if (const auto *BT = dyn_cast<BuiltinType>(DesugaredType))27 return BT->getKind() == BuiltinType::NullPtr;28 return false;29}30 31} // namespace32 33static const char CastSequence[] = "sequence";34 35/// Create a matcher that finds implicit casts as well as the head of a36/// sequence of zero or more nested explicit casts that have an implicit cast37/// to null within.38/// Finding sequences of explicit casts is necessary so that an entire sequence39/// can be replaced instead of just the inner-most implicit cast.40///41/// TODO/NOTE: The second "anyOf" below discards matches on a substituted type,42/// since we don't know if that would _always_ be a pointer type for all other43/// specializations, unless the expression was "__null", in which case we assume44/// that all specializations are expected to be for pointer types. Ideally this45/// would check for the "NULL" macro instead, but that'd be harder to express.46/// In practice, "NULL" is often defined as "__null", and this is a useful47/// condition.48static StatementMatcher49makeCastSequenceMatcher(llvm::ArrayRef<StringRef> NameList) {50 auto ImplicitCastToNull = implicitCastExpr(51 anyOf(hasCastKind(CK_NullToPointer), hasCastKind(CK_NullToMemberPointer)),52 anyOf(hasSourceExpression(gnuNullExpr()),53 unless(hasImplicitDestinationType(54 qualType(substTemplateTypeParmType())))),55 unless(hasSourceExpression(hasType(sugaredNullptrType()))),56 unless(hasImplicitDestinationType(57 qualType(matchers::matchesAnyListedTypeName(NameList)))));58 59 auto IsOrHasDescendant = [](const auto &InnerMatcher) {60 return anyOf(InnerMatcher, hasDescendant(InnerMatcher));61 };62 63 return traverse(64 TK_AsIs,65 anyOf(castExpr(anyOf(ImplicitCastToNull,66 explicitCastExpr(hasDescendant(ImplicitCastToNull))),67 unless(hasAncestor(explicitCastExpr())),68 unless(hasAncestor(cxxRewrittenBinaryOperator())))69 .bind(CastSequence),70 cxxRewrittenBinaryOperator(71 // Match rewritten operators, but verify (in the check method)72 // that if an implicit cast is found, it is not from another73 // nested rewritten operator.74 expr().bind("matchBinopOperands"),75 hasEitherOperand(IsOrHasDescendant(76 implicitCastExpr(77 ImplicitCastToNull,78 hasAncestor(cxxRewrittenBinaryOperator().bind(79 "checkBinopOperands")))80 .bind(CastSequence))),81 // Skip defaulted comparison operators.82 unless(hasAncestor(functionDecl(isDefaulted()))))));83}84 85static bool isReplaceableRange(SourceLocation StartLoc, SourceLocation EndLoc,86 const SourceManager &SM) {87 return SM.isWrittenInSameFile(StartLoc, EndLoc);88}89 90/// Replaces the provided range with the text "nullptr", but only if91/// the start and end location are both in main file.92/// Returns true if and only if a replacement was made.93static void replaceWithNullptr(ClangTidyCheck &Check, SourceManager &SM,94 SourceLocation StartLoc, SourceLocation EndLoc) {95 const CharSourceRange Range(SourceRange(StartLoc, EndLoc), true);96 // Add a space if nullptr follows an alphanumeric character. This happens97 // whenever there is an c-style explicit cast to nullptr not surrounded by98 // parentheses and right beside a return statement.99 const SourceLocation PreviousLocation = StartLoc.getLocWithOffset(-1);100 const bool NeedsSpace =101 isAlphanumeric(*SM.getCharacterData(PreviousLocation));102 Check.diag(Range.getBegin(), "use nullptr") << FixItHint::CreateReplacement(103 Range, NeedsSpace ? " nullptr" : "nullptr");104}105 106/// Returns the name of the outermost macro.107///108/// Given109/// \code110/// #define MY_NULL NULL111/// \endcode112/// If \p Loc points to NULL, this function will return the name MY_NULL.113static StringRef getOutermostMacroName(SourceLocation Loc,114 const SourceManager &SM,115 const LangOptions &LO) {116 assert(Loc.isMacroID());117 SourceLocation OutermostMacroLoc;118 119 while (Loc.isMacroID()) {120 OutermostMacroLoc = Loc;121 Loc = SM.getImmediateMacroCallerLoc(Loc);122 }123 124 return Lexer::getImmediateMacroName(OutermostMacroLoc, SM, LO);125}126 127namespace {128 129/// RecursiveASTVisitor for ensuring all nodes rooted at a given AST130/// subtree that have file-level source locations corresponding to a macro131/// argument have implicit NullTo(Member)Pointer nodes as ancestors.132class MacroArgUsageVisitor : public RecursiveASTVisitor<MacroArgUsageVisitor> {133public:134 MacroArgUsageVisitor(SourceLocation CastLoc, const SourceManager &SM)135 : CastLoc(CastLoc), SM(SM) {136 assert(CastLoc.isFileID());137 }138 139 bool TraverseStmt(Stmt *S) {140 const bool VisitedPreviously = Visited;141 142 if (!RecursiveASTVisitor<MacroArgUsageVisitor>::TraverseStmt(S))143 return false;144 145 // The point at which VisitedPreviously is false and Visited is true is the146 // root of a subtree containing nodes whose locations match CastLoc. It's147 // at this point we test that the Implicit NullTo(Member)Pointer cast was148 // found or not.149 if (!VisitedPreviously) {150 if (Visited && !CastFound) {151 // Found nodes with matching SourceLocations but didn't come across a152 // cast. This is an invalid macro arg use. Can stop traversal153 // completely now.154 InvalidFound = true;155 return false;156 }157 // Reset state as we unwind back up the tree.158 CastFound = false;159 Visited = false;160 }161 return true;162 }163 164 bool VisitStmt(Stmt *S) {165 if (SM.getFileLoc(S->getBeginLoc()) != CastLoc)166 return true;167 Visited = true;168 169 const ImplicitCastExpr *Cast = dyn_cast<ImplicitCastExpr>(S);170 if (Cast && (Cast->getCastKind() == CK_NullToPointer ||171 Cast->getCastKind() == CK_NullToMemberPointer))172 CastFound = true;173 174 return true;175 }176 177 bool TraverseInitListExpr(InitListExpr *S) {178 // Only go through the semantic form of the InitListExpr, because179 // ImplicitCast might not appear in the syntactic form, and this results in180 // finding usages of the macro argument that don't have a ImplicitCast as an181 // ancestor (thus invalidating the replacement) when they actually have.182 return RecursiveASTVisitor<MacroArgUsageVisitor>::183 TraverseSynOrSemInitListExpr(184 S->isSemanticForm() ? S : S->getSemanticForm());185 }186 187 bool foundInvalid() const { return InvalidFound; }188 189private:190 SourceLocation CastLoc;191 const SourceManager &SM;192 193 bool Visited = false;194 bool CastFound = false;195 bool InvalidFound = false;196};197 198/// Looks for implicit casts as well as sequences of 0 or more explicit199/// casts with an implicit null-to-pointer cast within.200///201/// The matcher this visitor is used with will find a single implicit cast or a202/// top-most explicit cast (i.e. it has no explicit casts as an ancestor) where203/// an implicit cast is nested within. However, there is no guarantee that only204/// explicit casts exist between the found top-most explicit cast and the205/// possibly more than one nested implicit cast. This visitor finds all cast206/// sequences with an implicit cast to null within and creates a replacement207/// leaving the outermost explicit cast unchanged to avoid introducing208/// ambiguities.209class CastSequenceVisitor : public RecursiveASTVisitor<CastSequenceVisitor> {210public:211 CastSequenceVisitor(ASTContext &Context, ArrayRef<StringRef> NullMacros,212 ClangTidyCheck &Check)213 : SM(Context.getSourceManager()), Context(Context),214 NullMacros(NullMacros), Check(Check) {}215 216 bool TraverseStmt(Stmt *S) {217 // Stop traversing down the tree if requested.218 if (PruneSubtree) {219 PruneSubtree = false;220 return true;221 }222 return RecursiveASTVisitor<CastSequenceVisitor>::TraverseStmt(S);223 }224 225 // Only VisitStmt is overridden as we shouldn't find other base AST types226 // within a cast expression.227 bool VisitStmt(Stmt *S) {228 auto *C = dyn_cast<CastExpr>(S);229 // Catch the castExpr inside cxxDefaultArgExpr.230 if (auto *E = dyn_cast<CXXDefaultArgExpr>(S)) {231 C = dyn_cast<CastExpr>(E->getExpr());232 FirstSubExpr = nullptr;233 }234 if (!C) {235 FirstSubExpr = nullptr;236 return true;237 }238 239 auto *CastSubExpr = C->getSubExpr()->IgnoreParens();240 // Ignore cast expressions which cast nullptr literal.241 if (isa<CXXNullPtrLiteralExpr>(CastSubExpr)) {242 return true;243 }244 245 if (!FirstSubExpr)246 FirstSubExpr = CastSubExpr;247 248 if (C->getCastKind() != CK_NullToPointer &&249 C->getCastKind() != CK_NullToMemberPointer) {250 return true;251 }252 253 SourceLocation StartLoc = FirstSubExpr->getBeginLoc();254 SourceLocation EndLoc = FirstSubExpr->getEndLoc();255 256 // If the location comes from a macro arg expansion, *all* uses of that257 // arg must be checked to result in NullTo(Member)Pointer casts.258 //259 // If the location comes from a macro body expansion, check to see if its260 // coming from one of the allowed 'NULL' macros.261 if (SM.isMacroArgExpansion(StartLoc) && SM.isMacroArgExpansion(EndLoc)) {262 const SourceLocation FileLocStart = SM.getFileLoc(StartLoc),263 FileLocEnd = SM.getFileLoc(EndLoc);264 SourceLocation ImmediateMacroArgLoc, MacroLoc;265 // Skip NULL macros used in macro.266 if (!getMacroAndArgLocations(StartLoc, ImmediateMacroArgLoc, MacroLoc) ||267 ImmediateMacroArgLoc != FileLocStart)268 return skipSubTree();269 270 if (isReplaceableRange(FileLocStart, FileLocEnd, SM) &&271 allArgUsesValid(C)) {272 replaceWithNullptr(Check, SM, FileLocStart, FileLocEnd);273 }274 return true;275 }276 277 if (SM.isMacroBodyExpansion(StartLoc) && SM.isMacroBodyExpansion(EndLoc)) {278 const StringRef OutermostMacroName =279 getOutermostMacroName(StartLoc, SM, Context.getLangOpts());280 281 // Check to see if the user wants to replace the macro being expanded.282 if (!llvm::is_contained(NullMacros, OutermostMacroName))283 return skipSubTree();284 285 StartLoc = SM.getFileLoc(StartLoc);286 EndLoc = SM.getFileLoc(EndLoc);287 }288 289 if (!isReplaceableRange(StartLoc, EndLoc, SM)) {290 return skipSubTree();291 }292 replaceWithNullptr(Check, SM, StartLoc, EndLoc);293 294 return true;295 }296 297private:298 bool skipSubTree() {299 PruneSubtree = true;300 return true;301 }302 303 /// Tests that all expansions of a macro arg, one of which expands to304 /// result in \p CE, yield NullTo(Member)Pointer casts.305 bool allArgUsesValid(const CastExpr *CE) {306 const SourceLocation CastLoc = CE->getBeginLoc();307 308 // Step 1: Get location of macro arg and location of the macro the arg was309 // provided to.310 SourceLocation ArgLoc, MacroLoc;311 if (!getMacroAndArgLocations(CastLoc, ArgLoc, MacroLoc))312 return false;313 314 // Step 2: Find the first ancestor that doesn't expand from this macro.315 DynTypedNode ContainingAncestor;316 if (!findContainingAncestor(DynTypedNode::create<Stmt>(*CE), MacroLoc,317 ContainingAncestor))318 return false;319 320 // Step 3:321 // Visit children of this containing parent looking for the least-descended322 // nodes of the containing parent which are macro arg expansions that expand323 // from the given arg location.324 // Visitor needs: arg loc.325 MacroArgUsageVisitor ArgUsageVisitor(SM.getFileLoc(CastLoc), SM);326 if (const auto *D = ContainingAncestor.get<Decl>())327 ArgUsageVisitor.TraverseDecl(const_cast<Decl *>(D));328 else if (const auto *S = ContainingAncestor.get<Stmt>())329 ArgUsageVisitor.TraverseStmt(const_cast<Stmt *>(S));330 else331 llvm_unreachable("Unhandled ContainingAncestor node type");332 333 return !ArgUsageVisitor.foundInvalid();334 }335 336 /// Given the SourceLocation for a macro arg expansion, finds the337 /// non-macro SourceLocation of the macro the arg was passed to and the338 /// non-macro SourceLocation of the argument in the arg list to that macro.339 /// These results are returned via \c MacroLoc and \c ArgLoc respectively.340 /// These values are undefined if the return value is false.341 ///342 /// \returns false if one of the returned SourceLocations would be a343 /// SourceLocation pointing within the definition of another macro.344 bool getMacroAndArgLocations(SourceLocation Loc, SourceLocation &ArgLoc,345 SourceLocation &MacroLoc) {346 assert(Loc.isMacroID() && "Only reasonable to call this on macros");347 348 ArgLoc = Loc;349 350 // Find the location of the immediate macro expansion.351 while (true) {352 const std::pair<FileID, unsigned> LocInfo = SM.getDecomposedLoc(ArgLoc);353 const SrcMgr::SLocEntry *E = &SM.getSLocEntry(LocInfo.first);354 const SrcMgr::ExpansionInfo &Expansion = E->getExpansion();355 356 const SourceLocation OldArgLoc = ArgLoc;357 ArgLoc = Expansion.getExpansionLocStart();358 if (!Expansion.isMacroArgExpansion()) {359 if (!MacroLoc.isFileID())360 return false;361 362 const StringRef Name =363 Lexer::getImmediateMacroName(OldArgLoc, SM, Context.getLangOpts());364 return llvm::is_contained(NullMacros, Name);365 }366 367 MacroLoc = SM.getExpansionRange(ArgLoc).getBegin();368 369 ArgLoc = Expansion.getSpellingLoc().getLocWithOffset(LocInfo.second);370 if (ArgLoc.isFileID())371 return true;372 373 // If spelling location resides in the same FileID as macro expansion374 // location, it means there is no inner macro.375 const FileID MacroFID = SM.getFileID(MacroLoc);376 if (SM.isInFileID(ArgLoc, MacroFID)) {377 // Don't transform this case. If the characters that caused the378 // null-conversion come from within a macro, they can't be changed.379 return false;380 }381 }382 383 llvm_unreachable("getMacroAndArgLocations");384 }385 386 /// Tests if TestMacroLoc is found while recursively unravelling387 /// expansions starting at TestLoc. TestMacroLoc.isFileID() must be true.388 /// Implementation is very similar to getMacroAndArgLocations() except in this389 /// case, it's not assumed that TestLoc is expanded from a macro argument.390 /// While unravelling expansions macro arguments are handled as with391 /// getMacroAndArgLocations() but in this function macro body expansions are392 /// also handled.393 ///394 /// False means either:395 /// - TestLoc is not from a macro expansion.396 /// - TestLoc is from a different macro expansion.397 bool expandsFrom(SourceLocation TestLoc, SourceLocation TestMacroLoc) {398 if (TestLoc.isFileID()) {399 return false;400 }401 402 SourceLocation Loc = TestLoc, MacroLoc;403 404 while (true) {405 const std::pair<FileID, unsigned> LocInfo = SM.getDecomposedLoc(Loc);406 const SrcMgr::SLocEntry *E = &SM.getSLocEntry(LocInfo.first);407 const SrcMgr::ExpansionInfo &Expansion = E->getExpansion();408 409 Loc = Expansion.getExpansionLocStart();410 411 if (!Expansion.isMacroArgExpansion()) {412 if (Loc.isFileID()) {413 return Loc == TestMacroLoc;414 }415 // Since Loc is still a macro ID and it's not an argument expansion, we416 // don't need to do the work of handling an argument expansion. Simply417 // keep recursively expanding until we hit a FileID or a macro arg418 // expansion or a macro arg expansion.419 continue;420 }421 422 MacroLoc = SM.getImmediateExpansionRange(Loc).getBegin();423 if (MacroLoc.isFileID() && MacroLoc == TestMacroLoc) {424 // Match made.425 return true;426 }427 428 Loc = Expansion.getSpellingLoc().getLocWithOffset(LocInfo.second);429 if (Loc.isFileID()) {430 // If we made it this far without finding a match, there is no match to431 // be made.432 return false;433 }434 }435 436 llvm_unreachable("expandsFrom");437 }438 439 /// Given a starting point \c Start in the AST, find an ancestor that440 /// doesn't expand from the macro called at file location \c MacroLoc.441 ///442 /// \pre MacroLoc.isFileID()443 /// \returns true if such an ancestor was found, false otherwise.444 bool findContainingAncestor(DynTypedNode Start, SourceLocation MacroLoc,445 DynTypedNode &Result) {446 // Below we're only following the first parent back up the AST. This should447 // be fine since for the statements we care about there should only be one448 // parent, except for the case specified below.449 450 assert(MacroLoc.isFileID());451 452 while (true) {453 const auto &Parents = Context.getParents(Start);454 if (Parents.empty())455 return false;456 if (Parents.size() > 1) {457 // If there are more than one parents, don't do the replacement unless458 // they are InitListsExpr (semantic and syntactic form). In this case we459 // can choose any one here, and the ASTVisitor will take care of460 // traversing the right one.461 for (const auto &Parent : Parents) {462 if (!Parent.get<InitListExpr>())463 return false;464 }465 }466 467 const DynTypedNode &Parent = Parents[0];468 469 SourceLocation Loc;470 if (const auto *D = Parent.get<Decl>())471 Loc = D->getBeginLoc();472 else if (const auto *S = Parent.get<Stmt>())473 Loc = S->getBeginLoc();474 475 // TypeLoc and NestedNameSpecifierLoc are members of the parent map. Skip476 // them and keep going up.477 if (Loc.isValid()) {478 if (!expandsFrom(Loc, MacroLoc)) {479 Result = Parent;480 return true;481 }482 }483 Start = Parent;484 }485 486 llvm_unreachable("findContainingAncestor");487 }488 489 SourceManager &SM;490 ASTContext &Context;491 ArrayRef<StringRef> NullMacros;492 ClangTidyCheck &Check;493 Expr *FirstSubExpr = nullptr;494 bool PruneSubtree = false;495};496 497} // namespace498 499UseNullptrCheck::UseNullptrCheck(StringRef Name, ClangTidyContext *Context)500 : ClangTidyCheck(Name, Context),501 NullMacrosStr(Options.get("NullMacros", "NULL")),502 IgnoredTypes(utils::options::parseStringList(Options.get(503 "IgnoredTypes", "_CmpUnspecifiedParam;^std::__cmp_cat::__unspec"))) {504 NullMacrosStr.split(NullMacros, ",");505}506 507void UseNullptrCheck::storeOptions(ClangTidyOptions::OptionMap &Opts) {508 Options.store(Opts, "NullMacros", NullMacrosStr);509 Options.store(Opts, "IgnoredTypes",510 utils::options::serializeStringList(IgnoredTypes));511}512 513void UseNullptrCheck::registerMatchers(MatchFinder *Finder) {514 Finder->addMatcher(makeCastSequenceMatcher(IgnoredTypes), this);515}516 517void UseNullptrCheck::check(const MatchFinder::MatchResult &Result) {518 const auto *NullCast = Result.Nodes.getNodeAs<CastExpr>(CastSequence);519 assert(NullCast && "Bad Callback. No node provided");520 521 if (Result.Nodes.getNodeAs<CXXRewrittenBinaryOperator>(522 "matchBinopOperands") !=523 Result.Nodes.getNodeAs<CXXRewrittenBinaryOperator>("checkBinopOperands"))524 return;525 526 // Given an implicit null-ptr cast or an explicit cast with an implicit527 // null-to-pointer cast within use CastSequenceVisitor to identify sequences528 // of explicit casts that can be converted into 'nullptr'.529 CastSequenceVisitor(*Result.Context, NullMacros, *this)530 .TraverseStmt(const_cast<CastExpr *>(NullCast));531}532 533} // namespace clang::tidy::modernize534