1 //===--- TransUnbridgedCasts.cpp - Transformations to ARC mode ------------===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // rewriteUnbridgedCasts:
10 //
11 // A cast of non-objc pointer to an objc one is checked. If the non-objc pointer
12 // is from a file-level variable, __bridge cast is used to convert it.
13 // For the result of a function call that we know is +1/+0,
14 // __bridge/CFBridgingRelease is used.
15 //
16 //  NSString *str = (NSString *)kUTTypePlainText;
17 //  str = b ? kUTTypeRTF : kUTTypePlainText;
18 //  NSString *_uuidString = (NSString *)CFUUIDCreateString(kCFAllocatorDefault,
19 //                                                         _uuid);
20 // ---->
21 //  NSString *str = (__bridge NSString *)kUTTypePlainText;
22 //  str = (__bridge NSString *)(b ? kUTTypeRTF : kUTTypePlainText);
23 // NSString *_uuidString = (NSString *)
24 //            CFBridgingRelease(CFUUIDCreateString(kCFAllocatorDefault, _uuid));
25 //
26 // For a C pointer to ObjC, for casting 'self', __bridge is used.
27 //
28 //  CFStringRef str = (CFStringRef)self;
29 // ---->
30 //  CFStringRef str = (__bridge CFStringRef)self;
31 //
32 // Uses of Block_copy/Block_release macros are rewritten:
33 //
34 //  c = Block_copy(b);
35 //  Block_release(c);
36 // ---->
37 //  c = [b copy];
38 //  <removed>
39 //
40 //===----------------------------------------------------------------------===//
41 
42 #include "Transforms.h"
43 #include "Internals.h"
44 #include "clang/AST/ASTContext.h"
45 #include "clang/AST/Attr.h"
46 #include "clang/AST/ParentMap.h"
47 #include "clang/Analysis/DomainSpecific/CocoaConventions.h"
48 #include "clang/Basic/SourceManager.h"
49 #include "clang/Lex/Lexer.h"
50 #include "clang/Sema/SemaDiagnostic.h"
51 #include "llvm/ADT/SmallString.h"
52 
53 using namespace clang;
54 using namespace arcmt;
55 using namespace trans;
56 
57 namespace {
58 
59 class UnbridgedCastRewriter : public RecursiveASTVisitor<UnbridgedCastRewriter>{
60   MigrationPass &Pass;
61   IdentifierInfo *SelfII;
62   std::unique_ptr<ParentMap> StmtMap;
63   Decl *ParentD;
64   Stmt *Body;
65   mutable std::unique_ptr<ExprSet> Removables;
66 
67 public:
68   UnbridgedCastRewriter(MigrationPass &pass)
69     : Pass(pass), ParentD(nullptr), Body(nullptr) {
70     SelfII = &Pass.Ctx.Idents.get("self");
71   }
72 
73   void transformBody(Stmt *body, Decl *ParentD) {
74     this->ParentD = ParentD;
75     Body = body;
76     StmtMap.reset(new ParentMap(body));
77     TraverseStmt(body);
78   }
79 
80   bool TraverseBlockDecl(BlockDecl *D) {
81     // ParentMap does not enter into a BlockDecl to record its stmts, so use a
82     // new UnbridgedCastRewriter to handle the block.
83     UnbridgedCastRewriter(Pass).transformBody(D->getBody(), D);
84     return true;
85   }
86 
87   bool VisitCastExpr(CastExpr *E) {
88     if (E->getCastKind() != CK_CPointerToObjCPointerCast &&
89         E->getCastKind() != CK_BitCast &&
90         E->getCastKind() != CK_AnyPointerToBlockPointerCast)
91       return true;
92 
93     QualType castType = E->getType();
94     Expr *castExpr = E->getSubExpr();
95     QualType castExprType = castExpr->getType();
96 
97     if (castType->isObjCRetainableType() == castExprType->isObjCRetainableType())
98       return true;
99 
100     bool exprRetainable = castExprType->isObjCIndirectLifetimeType();
101     bool castRetainable = castType->isObjCIndirectLifetimeType();
102     if (exprRetainable == castRetainable) return true;
103 
104     if (castExpr->isNullPointerConstant(Pass.Ctx,
105                                         Expr::NPC_ValueDependentIsNull))
106       return true;
107 
108     SourceLocation loc = castExpr->getExprLoc();
109     if (loc.isValid() && Pass.Ctx.getSourceManager().isInSystemHeader(loc))
110       return true;
111 
112     if (castType->isObjCRetainableType())
113       transformNonObjCToObjCCast(E);
114     else
115       transformObjCToNonObjCCast(E);
116 
117     return true;
118   }
119 
120 private:
121   void transformNonObjCToObjCCast(CastExpr *E) {
122     if (!E) return;
123 
124     // Global vars are assumed that are cast as unretained.
125     if (isGlobalVar(E))
126       if (E->getSubExpr()->getType()->isPointerType()) {
127         castToObjCObject(E, /*retained=*/false);
128         return;
129       }
130 
131     // If the cast is directly over the result of a Core Foundation function
132     // try to figure out whether it should be cast as retained or unretained.
133     Expr *inner = E->IgnoreParenCasts();
134     if (CallExpr *callE = dyn_cast<CallExpr>(inner)) {
135       if (FunctionDecl *FD = callE->getDirectCallee()) {
136         if (FD->hasAttr<CFReturnsRetainedAttr>()) {
137           castToObjCObject(E, /*retained=*/true);
138           return;
139         }
140         if (FD->hasAttr<CFReturnsNotRetainedAttr>()) {
141           castToObjCObject(E, /*retained=*/false);
142           return;
143         }
144         if (FD->isGlobal() &&
145             FD->getIdentifier() &&
146             ento::cocoa::isRefType(E->getSubExpr()->getType(), "CF",
147                                    FD->getIdentifier()->getName())) {
148           StringRef fname = FD->getIdentifier()->getName();
149           if (fname.ends_with("Retain") || fname.contains("Create") ||
150               fname.contains("Copy")) {
151             // Do not migrate to couple of bridge transfer casts which
152             // cancel each other out. Leave it unchanged so error gets user
153             // attention instead.
154             if (FD->getName() == "CFRetain" &&
155                 FD->getNumParams() == 1 &&
156                 FD->getParent()->isTranslationUnit() &&
157                 FD->isExternallyVisible()) {
158               Expr *Arg = callE->getArg(0);
159               if (const ImplicitCastExpr *ICE = dyn_cast<ImplicitCastExpr>(Arg)) {
160                 const Expr *sub = ICE->getSubExpr();
161                 QualType T = sub->getType();
162                 if (T->isObjCObjectPointerType())
163                   return;
164               }
165             }
166             castToObjCObject(E, /*retained=*/true);
167             return;
168           }
169 
170           if (fname.contains("Get")) {
171             castToObjCObject(E, /*retained=*/false);
172             return;
173           }
174         }
175       }
176     }
177 
178     // If returning an ivar or a member of an ivar from a +0 method, use
179     // a __bridge cast.
180     Expr *base = inner->IgnoreParenImpCasts();
181     while (isa<MemberExpr>(base))
182       base = cast<MemberExpr>(base)->getBase()->IgnoreParenImpCasts();
183     if (isa<ObjCIvarRefExpr>(base) &&
184         isa<ReturnStmt>(StmtMap->getParentIgnoreParenCasts(E))) {
185       if (ObjCMethodDecl *method = dyn_cast_or_null<ObjCMethodDecl>(ParentD)) {
186         if (!method->hasAttr<NSReturnsRetainedAttr>()) {
187           castToObjCObject(E, /*retained=*/false);
188           return;
189         }
190       }
191     }
192   }
193 
194   void castToObjCObject(CastExpr *E, bool retained) {
195     rewriteToBridgedCast(E, retained ? OBC_BridgeTransfer : OBC_Bridge);
196   }
197 
198   void rewriteToBridgedCast(CastExpr *E, ObjCBridgeCastKind Kind) {
199     Transaction Trans(Pass.TA);
200     rewriteToBridgedCast(E, Kind, Trans);
201   }
202 
203   void rewriteToBridgedCast(CastExpr *E, ObjCBridgeCastKind Kind,
204                             Transaction &Trans) {
205     TransformActions &TA = Pass.TA;
206 
207     // We will remove the compiler diagnostic.
208     if (!TA.hasDiagnostic(diag::err_arc_mismatched_cast,
209                           diag::err_arc_cast_requires_bridge,
210                           E->getBeginLoc())) {
211       Trans.abort();
212       return;
213     }
214 
215     StringRef bridge;
216     switch(Kind) {
217     case OBC_Bridge:
218       bridge = "__bridge "; break;
219     case OBC_BridgeTransfer:
220       bridge = "__bridge_transfer "; break;
221     case OBC_BridgeRetained:
222       bridge = "__bridge_retained "; break;
223     }
224 
225     TA.clearDiagnostic(diag::err_arc_mismatched_cast,
226                        diag::err_arc_cast_requires_bridge, E->getBeginLoc());
227     if (Kind == OBC_Bridge || !Pass.CFBridgingFunctionsDefined()) {
228       if (CStyleCastExpr *CCE = dyn_cast<CStyleCastExpr>(E)) {
229         TA.insertAfterToken(CCE->getLParenLoc(), bridge);
230       } else {
231         SourceLocation insertLoc = E->getSubExpr()->getBeginLoc();
232         SmallString<128> newCast;
233         newCast += '(';
234         newCast += bridge;
235         newCast += E->getType().getAsString(Pass.Ctx.getPrintingPolicy());
236         newCast += ')';
237 
238         if (isa<ParenExpr>(E->getSubExpr())) {
239           TA.insert(insertLoc, newCast.str());
240         } else {
241           newCast += '(';
242           TA.insert(insertLoc, newCast.str());
243           TA.insertAfterToken(E->getEndLoc(), ")");
244         }
245       }
246     } else {
247       assert(Kind == OBC_BridgeTransfer || Kind == OBC_BridgeRetained);
248       SmallString<32> BridgeCall;
249 
250       Expr *WrapE = E->getSubExpr();
251       SourceLocation InsertLoc = WrapE->getBeginLoc();
252 
253       SourceManager &SM = Pass.Ctx.getSourceManager();
254       char PrevChar = *SM.getCharacterData(InsertLoc.getLocWithOffset(-1));
255       if (Lexer::isAsciiIdentifierContinueChar(PrevChar,
256                                                Pass.Ctx.getLangOpts()))
257         BridgeCall += ' ';
258 
259       if (Kind == OBC_BridgeTransfer)
260         BridgeCall += "CFBridgingRelease";
261       else
262         BridgeCall += "CFBridgingRetain";
263 
264       if (isa<ParenExpr>(WrapE)) {
265         TA.insert(InsertLoc, BridgeCall);
266       } else {
267         BridgeCall += '(';
268         TA.insert(InsertLoc, BridgeCall);
269         TA.insertAfterToken(WrapE->getEndLoc(), ")");
270       }
271     }
272   }
273 
274   void rewriteCastForCFRetain(CastExpr *castE, CallExpr *callE) {
275     Transaction Trans(Pass.TA);
276     Pass.TA.replace(callE->getSourceRange(), callE->getArg(0)->getSourceRange());
277     rewriteToBridgedCast(castE, OBC_BridgeRetained, Trans);
278   }
279 
280   void getBlockMacroRanges(CastExpr *E, SourceRange &Outer, SourceRange &Inner) {
281     SourceManager &SM = Pass.Ctx.getSourceManager();
282     SourceLocation Loc = E->getExprLoc();
283     assert(Loc.isMacroID());
284     CharSourceRange MacroRange = SM.getImmediateExpansionRange(Loc);
285     SourceRange SubRange = E->getSubExpr()->IgnoreParenImpCasts()->getSourceRange();
286     SourceLocation InnerBegin = SM.getImmediateMacroCallerLoc(SubRange.getBegin());
287     SourceLocation InnerEnd = SM.getImmediateMacroCallerLoc(SubRange.getEnd());
288 
289     Outer = MacroRange.getAsRange();
290     Inner = SourceRange(InnerBegin, InnerEnd);
291   }
292 
293   void rewriteBlockCopyMacro(CastExpr *E) {
294     SourceRange OuterRange, InnerRange;
295     getBlockMacroRanges(E, OuterRange, InnerRange);
296 
297     Transaction Trans(Pass.TA);
298     Pass.TA.replace(OuterRange, InnerRange);
299     Pass.TA.insert(InnerRange.getBegin(), "[");
300     Pass.TA.insertAfterToken(InnerRange.getEnd(), " copy]");
301     Pass.TA.clearDiagnostic(diag::err_arc_mismatched_cast,
302                             diag::err_arc_cast_requires_bridge,
303                             OuterRange);
304   }
305 
306   void removeBlockReleaseMacro(CastExpr *E) {
307     SourceRange OuterRange, InnerRange;
308     getBlockMacroRanges(E, OuterRange, InnerRange);
309 
310     Transaction Trans(Pass.TA);
311     Pass.TA.clearDiagnostic(diag::err_arc_mismatched_cast,
312                             diag::err_arc_cast_requires_bridge,
313                             OuterRange);
314     if (!hasSideEffects(E, Pass.Ctx)) {
315       if (tryRemoving(cast<Expr>(StmtMap->getParentIgnoreParenCasts(E))))
316         return;
317     }
318     Pass.TA.replace(OuterRange, InnerRange);
319   }
320 
321   bool tryRemoving(Expr *E) const {
322     if (!Removables) {
323       Removables.reset(new ExprSet);
324       collectRemovables(Body, *Removables);
325     }
326 
327     if (Removables->count(E)) {
328       Pass.TA.removeStmt(E);
329       return true;
330     }
331 
332     return false;
333   }
334 
335   void transformObjCToNonObjCCast(CastExpr *E) {
336     SourceLocation CastLoc = E->getExprLoc();
337     if (CastLoc.isMacroID()) {
338       StringRef MacroName = Lexer::getImmediateMacroName(CastLoc,
339                                                     Pass.Ctx.getSourceManager(),
340                                                     Pass.Ctx.getLangOpts());
341       if (MacroName == "Block_copy") {
342         rewriteBlockCopyMacro(E);
343         return;
344       }
345       if (MacroName == "Block_release") {
346         removeBlockReleaseMacro(E);
347         return;
348       }
349     }
350 
351     if (isSelf(E->getSubExpr()))
352       return rewriteToBridgedCast(E, OBC_Bridge);
353 
354     CallExpr *callE;
355     if (isPassedToCFRetain(E, callE))
356       return rewriteCastForCFRetain(E, callE);
357 
358     ObjCMethodFamily family = getFamilyOfMessage(E->getSubExpr());
359     if (family == OMF_retain)
360       return rewriteToBridgedCast(E, OBC_BridgeRetained);
361 
362     if (family == OMF_autorelease || family == OMF_release) {
363       std::string err = "it is not safe to cast to '";
364       err += E->getType().getAsString(Pass.Ctx.getPrintingPolicy());
365       err += "' the result of '";
366       err += family == OMF_autorelease ? "autorelease" : "release";
367       err += "' message; a __bridge cast may result in a pointer to a "
368           "destroyed object and a __bridge_retained may leak the object";
369       Pass.TA.reportError(err, E->getBeginLoc(),
370                           E->getSubExpr()->getSourceRange());
371       Stmt *parent = E;
372       do {
373         parent = StmtMap->getParentIgnoreParenImpCasts(parent);
374       } while (parent && isa<FullExpr>(parent));
375 
376       if (ReturnStmt *retS = dyn_cast_or_null<ReturnStmt>(parent)) {
377         std::string note = "remove the cast and change return type of function "
378             "to '";
379         note += E->getSubExpr()->getType().getAsString(Pass.Ctx.getPrintingPolicy());
380         note += "' to have the object automatically autoreleased";
381         Pass.TA.reportNote(note, retS->getBeginLoc());
382       }
383     }
384 
385     Expr *subExpr = E->getSubExpr();
386 
387     // Look through pseudo-object expressions.
388     if (PseudoObjectExpr *pseudo = dyn_cast<PseudoObjectExpr>(subExpr)) {
389       subExpr = pseudo->getResultExpr();
390       assert(subExpr && "no result for pseudo-object of non-void type?");
391     }
392 
393     if (ImplicitCastExpr *implCE = dyn_cast<ImplicitCastExpr>(subExpr)) {
394       if (implCE->getCastKind() == CK_ARCConsumeObject)
395         return rewriteToBridgedCast(E, OBC_BridgeRetained);
396       if (implCE->getCastKind() == CK_ARCReclaimReturnedObject)
397         return rewriteToBridgedCast(E, OBC_Bridge);
398     }
399 
400     bool isConsumed = false;
401     if (isPassedToCParamWithKnownOwnership(E, isConsumed))
402       return rewriteToBridgedCast(E, isConsumed ? OBC_BridgeRetained
403                                                 : OBC_Bridge);
404   }
405 
406   static ObjCMethodFamily getFamilyOfMessage(Expr *E) {
407     E = E->IgnoreParenCasts();
408     if (ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(E))
409       return ME->getMethodFamily();
410 
411     return OMF_None;
412   }
413 
414   bool isPassedToCFRetain(Expr *E, CallExpr *&callE) const {
415     if ((callE = dyn_cast_or_null<CallExpr>(
416                                      StmtMap->getParentIgnoreParenImpCasts(E))))
417       if (FunctionDecl *
418             FD = dyn_cast_or_null<FunctionDecl>(callE->getCalleeDecl()))
419         if (FD->getName() == "CFRetain" && FD->getNumParams() == 1 &&
420             FD->getParent()->isTranslationUnit() &&
421             FD->isExternallyVisible())
422           return true;
423 
424     return false;
425   }
426 
427   bool isPassedToCParamWithKnownOwnership(Expr *E, bool &isConsumed) const {
428     if (CallExpr *callE = dyn_cast_or_null<CallExpr>(
429                                      StmtMap->getParentIgnoreParenImpCasts(E)))
430       if (FunctionDecl *
431             FD = dyn_cast_or_null<FunctionDecl>(callE->getCalleeDecl())) {
432         unsigned i = 0;
433         for (unsigned e = callE->getNumArgs(); i != e; ++i) {
434           Expr *arg = callE->getArg(i);
435           if (arg == E || arg->IgnoreParenImpCasts() == E)
436             break;
437         }
438         if (i < callE->getNumArgs() && i < FD->getNumParams()) {
439           ParmVarDecl *PD = FD->getParamDecl(i);
440           if (PD->hasAttr<CFConsumedAttr>()) {
441             isConsumed = true;
442             return true;
443           }
444         }
445       }
446 
447     return false;
448   }
449 
450   bool isSelf(Expr *E) const {
451     E = E->IgnoreParenLValueCasts();
452     if (DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(E))
453       if (ImplicitParamDecl *IPD = dyn_cast<ImplicitParamDecl>(DRE->getDecl()))
454         if (IPD->getIdentifier() == SelfII)
455           return true;
456 
457     return false;
458   }
459 };
460 
461 } // end anonymous namespace
462 
463 void trans::rewriteUnbridgedCasts(MigrationPass &pass) {
464   BodyTransform<UnbridgedCastRewriter> trans(pass);
465   trans.TraverseDecl(pass.Ctx.getTranslationUnitDecl());
466 }
467