1//===--- MultipleNewInOneExpressionCheck.cpp - clang-tidy------------------===//
2//
3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4// See https://llvm.org/LICENSE.txt for license information.
5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6//
7//===----------------------------------------------------------------------===//
8
9#include "MultipleNewInOneExpressionCheck.h"
10#include "clang/AST/ASTContext.h"
11#include "clang/ASTMatchers/ASTMatchFinder.h"
12#include "clang/Lex/Lexer.h"
13
14using namespace clang::ast_matchers;
15
16namespace clang::tidy::bugprone {
17
18namespace {
19
20// Determine if the result of an expression is "stored" in some way.
21// It is true if the value is stored into a variable or used as initialization
22// or passed to a function or constructor.
23// For this use case compound assignments are not counted as a "store" (the 'E'
24// expression should have pointer type).
25bool isExprValueStored(const Expr *E, ASTContext &C) {
26 E = E->IgnoreParenCasts();
27 // Get first non-paren, non-cast parent.
28 ParentMapContext &PMap = C.getParentMapContext();
29 DynTypedNodeList P = PMap.getParents(Node: *E);
30 if (P.size() != 1)
31 return false;
32 const Expr *ParentE = nullptr;
33 while ((ParentE = P[0].get<Expr>()) && ParentE->IgnoreParenCasts() == E) {
34 P = PMap.getParents(Node: P[0]);
35 if (P.size() != 1)
36 return false;
37 }
38
39 if (const auto *ParentVarD = P[0].get<VarDecl>())
40 return ParentVarD->getInit()->IgnoreParenCasts() == E;
41
42 if (!ParentE)
43 return false;
44
45 if (const auto *BinOp = dyn_cast<BinaryOperator>(Val: ParentE))
46 return BinOp->getOpcode() == BO_Assign &&
47 BinOp->getRHS()->IgnoreParenCasts() == E;
48
49 return isa<CallExpr, CXXConstructExpr>(Val: ParentE);
50}
51
52AST_MATCHER_P(CXXTryStmt, hasHandlerFor,
53 ast_matchers::internal::Matcher<QualType>, InnerMatcher) {
54 for (unsigned NH = Node.getNumHandlers(), I = 0; I < NH; ++I) {
55 const CXXCatchStmt *CatchS = Node.getHandler(i: I);
56 // Check for generic catch handler (match anything).
57 if (CatchS->getCaughtType().isNull())
58 return true;
59 ast_matchers::internal::BoundNodesTreeBuilder Result(*Builder);
60 if (InnerMatcher.matches(Node: CatchS->getCaughtType(), Finder, Builder: &Result)) {
61 *Builder = std::move(Result);
62 return true;
63 }
64 }
65 return false;
66}
67
68AST_MATCHER(CXXNewExpr, mayThrow) {
69 FunctionDecl *OperatorNew = Node.getOperatorNew();
70 if (!OperatorNew)
71 return false;
72 return !OperatorNew->getType()->castAs<FunctionProtoType>()->isNothrow();
73}
74
75} // namespace
76
77void MultipleNewInOneExpressionCheck::registerMatchers(MatchFinder *Finder) {
78 auto BadAllocType =
79 recordType(hasDeclaration(InnerMatcher: cxxRecordDecl(hasName(Name: "::std::bad_alloc"))));
80 auto ExceptionType =
81 recordType(hasDeclaration(InnerMatcher: cxxRecordDecl(hasName(Name: "::std::exception"))));
82 auto BadAllocReferenceType = referenceType(pointee(BadAllocType));
83 auto ExceptionReferenceType = referenceType(pointee(ExceptionType));
84
85 auto CatchBadAllocType =
86 qualType(hasCanonicalType(InnerMatcher: anyOf(BadAllocType, BadAllocReferenceType,
87 ExceptionType, ExceptionReferenceType)));
88 auto BadAllocCatchingTryBlock = cxxTryStmt(hasHandlerFor(InnerMatcher: CatchBadAllocType));
89
90 auto NewExprMayThrow = cxxNewExpr(mayThrow());
91 auto HasNewExpr1 = expr(anyOf(NewExprMayThrow.bind(ID: "new1"),
92 hasDescendant(NewExprMayThrow.bind(ID: "new1"))));
93 auto HasNewExpr2 = expr(anyOf(NewExprMayThrow.bind(ID: "new2"),
94 hasDescendant(NewExprMayThrow.bind(ID: "new2"))));
95
96 Finder->addMatcher(
97 NodeMatch: callExpr(
98 hasAnyArgument(InnerMatcher: expr(HasNewExpr1).bind(ID: "arg1")),
99 hasAnyArgument(
100 InnerMatcher: expr(HasNewExpr2, unless(equalsBoundNode(ID: "arg1"))).bind(ID: "arg2")),
101 hasAncestor(BadAllocCatchingTryBlock)),
102 Action: this);
103 Finder->addMatcher(
104 NodeMatch: cxxConstructExpr(
105 hasAnyArgument(InnerMatcher: expr(HasNewExpr1).bind(ID: "arg1")),
106 hasAnyArgument(
107 InnerMatcher: expr(HasNewExpr2, unless(equalsBoundNode(ID: "arg1"))).bind(ID: "arg2")),
108 unless(isListInitialization()),
109 hasAncestor(BadAllocCatchingTryBlock)),
110 Action: this);
111 Finder->addMatcher(NodeMatch: binaryOperator(hasLHS(InnerMatcher: HasNewExpr1), hasRHS(InnerMatcher: HasNewExpr2),
112 unless(hasAnyOperatorName("&&", "||", ",")),
113 hasAncestor(BadAllocCatchingTryBlock)),
114 Action: this);
115 Finder->addMatcher(
116 NodeMatch: cxxNewExpr(mayThrow(),
117 hasDescendant(NewExprMayThrow.bind(ID: "new2_in_new1")),
118 hasAncestor(BadAllocCatchingTryBlock))
119 .bind(ID: "new1"),
120 Action: this);
121}
122
123void MultipleNewInOneExpressionCheck::check(
124 const MatchFinder::MatchResult &Result) {
125 const auto *NewExpr1 = Result.Nodes.getNodeAs<CXXNewExpr>(ID: "new1");
126 const auto *NewExpr2 = Result.Nodes.getNodeAs<CXXNewExpr>(ID: "new2");
127 const auto *NewExpr2InNewExpr1 =
128 Result.Nodes.getNodeAs<CXXNewExpr>(ID: "new2_in_new1");
129 if (!NewExpr2)
130 NewExpr2 = NewExpr2InNewExpr1;
131 assert(NewExpr1 && NewExpr2 && "Bound nodes not found.");
132
133 // No warning if both allocations are not stored.
134 // The value may be intentionally not stored (no deallocations needed or
135 // self-destructing object).
136 if (!isExprValueStored(NewExpr1, *Result.Context) &&
137 !isExprValueStored(NewExpr2, *Result.Context))
138 return;
139
140 // In C++17 sequencing of a 'new' inside constructor arguments of another
141 // 'new' is fixed. Still a leak can happen if the returned value from the
142 // first 'new' is not saved (yet) and the second fails.
143 if (getLangOpts().CPlusPlus17 && NewExpr2InNewExpr1)
144 diag(Loc: NewExpr1->getBeginLoc(),
145 Description: "memory allocation may leak if an other allocation is sequenced after "
146 "it and throws an exception")
147 << NewExpr1->getSourceRange() << NewExpr2->getSourceRange();
148 else
149 diag(Loc: NewExpr1->getBeginLoc(),
150 Description: "memory allocation may leak if an other allocation is sequenced after "
151 "it and throws an exception; order of these allocations is undefined")
152 << NewExpr1->getSourceRange() << NewExpr2->getSourceRange();
153}
154
155} // namespace clang::tidy::bugprone
156

source code of clang-tools-extra/clang-tidy/bugprone/MultipleNewInOneExpressionCheck.cpp