/**
* @name no cleanup
* @description raw pointer fields that does not have any cleanup or managed objects that backs them.
* @kind problem
* @problem.severity warning
*/
import cpp
import common
import pointers.raw_ptr
import pointers.managed_ptr
import object_lifetime.lifetime_management
import object_lifetime.obj_lifetime
from GeneralPointerField f
where
//The type of the pointer field contains a managed field that is the declaring type of the pointer field, e.g.
//``` class A {
// F* f;
// }
// class F {
// unique_ptr a;
// }
//```
// often, `F` is the owner of `A`.
not exists(GeneralManagedField mf | f.getPointerType() = mf.getDeclaringType().getABaseClass*()
and mf.getManagedType() = f.getDeclaringType() and
mf.isOwner()
)
and
//Cases like:
//```
// class A {
// F* f;
// }
// class B {
// std::unique_ptr a;
// std::unique_ptr f;
// }
//```
// Class B should be managing both `A` and `F`, this can have interesting consequences if `a` gets reset and `f` doesn't.
// Leave it out for now.
//
not exists(GeneralManagedField ptr_mf, GeneralManagedField mf | f.getDeclaringType() = mf.getManagedType() and
f.getPointerType() = ptr_mf.getManagedType() and
mf.getDeclaringType() = ptr_mf.getDeclaringType()
)
and
//Restrict to files of interests.
(f.getFile().getAbsolutePath().matches("%/browser/%") or f.getFile().getAbsolutePath().matches("%/components/%")) and
//exclude protobuf
not f.getFile().getBaseName().matches("%.pb.%") and
//raw pointer has a clean up
not exists(Expr p | p = f.getACleanup()) and
//exclude field that is probably safe (See `ManagedKeyValueField`)
not f instanceof ManagedKeyValueField
and
//FrameServiceBase and raw pointer is `render_frame_host_`, most likely ok as FrameServiceBase observes lifetime of rfh.
not exists(FrameServiceBase fsb |
(fsb.getService() = f.getDeclaringType() or fsb = f.getDeclaringType())and
f.getName() = "render_frame_host_"
) and
//Unlikely to be able to delete.
not f.getPointerType() instanceof OwnedByBrowserMainLoop and
//Unlikely to be able to delete.
not f.getPointerType() instanceof Singleton and
//Generated
not f.getFile().getAbsolutePath().matches("%/out/%") and
//BrowserContext only destroyed during shutdown
not f.getPointerType().hasName("BrowserContext") and
not f.getPointerType() instanceof OwnedByBrowserContext
select f, f.getDeclaringType()