[SSAF] Let UnsafeBufferUsageExtractor & PointerFlowExtractor ignore templates (#198927)

Templates are ignored for two reasons:

- Template instantiations are still handled. Template facts can be
inferred from their instantiations.
- Templates are inherently difficult to reason about. Their ASTs can
contain dependent expression types (such as ParenListExpr) that
complicate analysis.

Author: ziqingluo-90

clang/lib/ScalableStaticAnalysisFramework/Analyses/PointerFlow/PointerFlowExtractor.cpp

@@ -336,6 +336,12 @@ class PointerFlowTUSummaryExtractor : public TUSummaryExtractor {
 
     findContributors(Ctx, Contributors);
     for (auto *CD : Contributors) {
+      // Templates are skipped, but their instantiations are handled. The idea
+      // is that we can conclude facts about a template through all of its
+      // instantiations.
+      if (CD->isTemplated())
+        continue;
+
       auto EntitySummary = extractEntitySummary(CD, Ctx, *this);
 
       assert(EntitySummary);

clang/lib/ScalableStaticAnalysisFramework/Analyses/SSAFAnalysesCommon.cpp

@@ -34,6 +34,11 @@ class ContributorFinder : public DynamicRecursiveASTVisitor {
 public:
   std::set<const NamedDecl *> Contributors;
 
+  ContributorFinder() {
+    ShouldVisitTemplateInstantiations = true;
+    ShouldVisitImplicitCode = false;
+  }
+
   bool VisitFunctionDecl(FunctionDecl *D) override {
     Contributors.insert(D);
     return true;

clang/lib/ScalableStaticAnalysisFramework/Analyses/UnsafeBufferUsage/UnsafeBufferUsageExtractor.cpp

@@ -74,6 +74,12 @@ void clang::ssaf::UnsafeBufferUsageTUSummaryExtractor::HandleTranslationUnit(
 
   findContributors(Ctx, Contributors);
   for (auto *CD : Contributors) {
+    // Templates are skipped, but their instantiations are handled. The idea
+    // is that we can conclude facts about a template through all of its
+    // instantiations.
+    if (CD->isTemplated())
+      continue;
+
     auto EntitySummary = extractEntitySummary(CD, Ctx);
 
     assert(EntitySummary);

clang/unittests/ScalableStaticAnalysisFramework/Analyses/PointerFlow/PointerFlowTest.cpp

@@ -104,9 +104,13 @@ const SomeDecl *findEntityByName(FindEntityByName Name, ASTContext &Ctx) {
     const SomeDecl *FoundDecl = nullptr;
 
     NamedDeclFinder(FindEntityByName SearchingName)
-        : SearchingName(SearchingName) {}
+        : SearchingName(SearchingName) {
+      ShouldVisitTemplateInstantiations = true;
+    }
 
     bool VisitDecl(Decl *D) override {
+      if (D->isTemplated())
+        return true;
       if (auto *ND = dyn_cast<NamedDecl>(D)) {
         FoundDecl = llvm::dyn_cast_or_null<SomeDecl>(
             matchNamedDeclByFindEntityByName(SearchingName, ND));
@@ -1265,6 +1269,72 @@ TEST_F(PointerFlowTest, CXXConstructExprArrayInit) {
   EXPECT_EQ(*Sum, makeEdges(__LINE__, {{{"q", 1U}, {"arr", 1U}}}));
 }
 
+//////////////////////////////////////////////////////////////
+// Template is ignored but instantiations are visited.      //
+//////////////////////////////////////////////////////////////
+TEST_F(PointerFlowTest, FunctionTemplate) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    T* f(T *p) {
+      int *q = p;
+      return q;
+    }
+  )cpp"));
+  ASSERT_FALSE(findEntityByName("f", AST->getASTContext()));
+}
+
+TEST_F(PointerFlowTest, MethodInClassTemplate) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    struct Wrapper {
+      T *ptr;
+      void set(T *p) { ptr = p; }
+    };
+  )cpp"));
+  ASSERT_FALSE(findEntityByName("set", AST->getASTContext()));
+}
+
+TEST_F(PointerFlowTest, FunctionTemplateInstantiation) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    T* f(T *p) {
+      int *q = p;
+      return q;
+    }
+
+    void test(int *p) {
+      f(p);
+    }
+  )cpp"));
+
+  auto *Sum = getEntitySummary<FunctionDecl>("f");
+
+  ASSERT_TRUE(Sum);
+  ASSERT_EQ(*Sum, makeEdges(__LINE__, {{{"q", 1U}, {"p", 1U}},
+                                       {{"f", 1U, 1}, {"q", 1U}}}));
+}
+
+TEST_F(PointerFlowTest, MethodInClassTemplateInstantiation) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    struct Wrapper {
+      T *ptr;
+      void set(T *p) { ptr = p; }
+    };
+
+    void test(int *p) {
+      Wrapper<int> W;
+
+      W.set(p);
+    }
+  )cpp"));
+
+  auto *Sum = getEntitySummary<FunctionDecl>("set");
+
+  ASSERT_TRUE(Sum);
+  ASSERT_EQ(*Sum, makeEdges(__LINE__, {{{"ptr", 1U}, {"p", 1U}}}));
+}
+
 //////////////////////////////////////////////////////////////
 //          Robustness Tests (No Crash Tests)               //
 //////////////////////////////////////////////////////////////

clang/unittests/ScalableStaticAnalysisFramework/Analyses/UnsafeBufferUsage/UnsafeBufferUsageTest.cpp

@@ -688,6 +688,71 @@ TEST_F(UnsafeBufferUsageTest, CXXScalarValueInitExpr) {
   EXPECT_EQ(*Sum, makeSet(__LINE__, {{"q", 1U}}));
 }
 
+//////////////////////////////////////////////////////////////
+// Template is ignored but instantiations are visited.      //
+//////////////////////////////////////////////////////////////
+
+TEST_F(UnsafeBufferUsageTest, FunctionTemplate) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    T* f(T *p) {
+      return &p[5];
+    }
+  )cpp"));
+  ASSERT_FALSE(findDeclByName("f", AST->getASTContext()));
+}
+
+TEST_F(UnsafeBufferUsageTest, MethodInClassTemplate) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+    template <typename T>
+    struct Wrapper {
+      T *ptr;
+      void set(T *p) { ptr = p[5]; }
+    };
+  )cpp"));
+  ASSERT_FALSE(findDeclByName("set", AST->getASTContext()));
+}
+
+TEST_F(UnsafeBufferUsageTest, FunctionTemplateInstantiation) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+  template<typename T>
+  void unsafe(T p) {
+    p[1] = p[2] + p[3];
+  }
+  
+  void f(int *p) {
+    unsafe(p);
+  }
+  )cpp"));
+
+  auto *Sum = getEntitySummary("unsafe");
+
+  ASSERT_TRUE(Sum);
+  ASSERT_EQ(*Sum, makeSet(__LINE__, {{"p", 1U}}));
+}
+
+TEST_F(UnsafeBufferUsageTest, MethodInClassTemplateInstantiation) {
+  ASSERT_TRUE(setUpTest(R"cpp(
+  template<typename T>
+  struct UnsafeClass {
+    T p;
+    void unsafe_method() {
+       p[1] = p[2] + p[3];
+    }
+  };
+  
+  void f(int *p) {
+    UnsafeClass<int *> UC;
+
+    UC.unsafe_method();
+  }
+  )cpp"));
+
+  auto *Sum = getEntitySummary("unsafe_method");
+
+  ASSERT_TRUE(Sum);
+  EXPECT_EQ(*Sum, makeSet(__LINE__, {{"p", 1U}}));
+}
 // Robustness test: unsupported constructs will not cause crash
 #ifndef NDEBUG
 TEST_F(UnsafeBufferUsageTest, StmtExprArrayAccess) {

clang/unittests/ScalableStaticAnalysisFramework/FindDecl.h

@@ -21,9 +21,13 @@ const SomeDecl *findDeclByName(StringRef Name, ASTContext &Ctx) {
     StringRef SearchingName;
     const NamedDecl *FoundDecl = nullptr;
 
-    NamedDeclFinder(StringRef SearchingName) : SearchingName(SearchingName) {}
+    NamedDeclFinder(StringRef SearchingName) : SearchingName(SearchingName) {
+      ShouldVisitTemplateInstantiations = true;
+    }
 
     bool VisitDecl(Decl *D) override {
+      if (D->isTemplated())
+        return true;
       if (const auto *ND = dyn_cast<SomeDecl>(D)) {
         if (ND->getNameAsString() == SearchingName) {
           FoundDecl = ND;