Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1 | //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--// |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 10 | // This file defines the methods for RetainCountChecker, which implements |
| 11 | // a reference count checker for Core Foundation and Cocoa on (Mac OS X). |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 16 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | b277159 | 2011-03-30 17:41:19 +0000 | [diff] [blame] | 17 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 18 | #include "clang/Basic/LangOptions.h" |
| 19 | #include "clang/Basic/SourceManager.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/DomainSpecific/CocoaConventions.h" |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 21 | #include "clang/AST/ParentMap.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 23 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
| 25 | #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 26 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 27 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 28 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Jordy Rose | d1e5a89 | 2011-09-02 08:02:59 +0000 | [diff] [blame] | 29 | #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 30 | #include "llvm/ADT/DenseMap.h" |
| 31 | #include "llvm/ADT/FoldingSet.h" |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 32 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 33 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 34 | #include "llvm/ADT/SmallString.h" |
Ted Kremenek | 6ed9afc | 2008-05-16 18:33:44 +0000 | [diff] [blame] | 35 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 36 | #include "llvm/ADT/StringExtras.h" |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 37 | #include <cstdarg> |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 38 | |
| 39 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 40 | using namespace ento; |
Ted Kremenek | a64e89b | 2010-01-27 06:13:48 +0000 | [diff] [blame] | 41 | using llvm::StrInStrNoCase; |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | d775c66 | 2010-05-21 21:57:00 +0000 | [diff] [blame] | 43 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 44 | /// Wrapper around different kinds of node builder, so that helper functions |
| 45 | /// can have a common interface. |
Francois Pichet | ea09785 | 2011-01-11 10:41:37 +0000 | [diff] [blame] | 46 | class GenericNodeBuilderRefCount { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 47 | CheckerContext *C; |
Ted Kremenek | ca80453 | 2011-08-12 23:04:46 +0000 | [diff] [blame] | 48 | const ProgramPointTag *tag; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 49 | public: |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 50 | GenericNodeBuilderRefCount(CheckerContext &c, |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 51 | const ProgramPointTag *t = 0) |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 52 | : C(&c), tag(t){} |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 53 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 54 | ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred, |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 55 | bool MarkAsSink = false) { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 56 | return C->addTransition(state, Pred, tag, MarkAsSink); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 57 | } |
| 58 | }; |
| 59 | } // end anonymous namespace |
| 60 | |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 61 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 62 | // Primitives used for constructing summaries for function/method calls. |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 63 | //===----------------------------------------------------------------------===// |
| 64 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 65 | /// ArgEffect is used to summarize a function/method call's effect on a |
| 66 | /// particular argument. |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 67 | enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 68 | DecRefBridgedTransfered, |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 69 | IncRefMsg, IncRef, MakeCollectable, MayEscape, |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 70 | NewAutoreleasePool, SelfOwn, StopTracking }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 71 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 72 | namespace llvm { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 73 | template <> struct FoldingSetTrait<ArgEffect> { |
| 74 | static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) { |
| 75 | ID.AddInteger((unsigned) X); |
| 76 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 77 | }; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 78 | } // end llvm namespace |
| 79 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 80 | /// ArgEffects summarizes the effects of a function/method call on all of |
| 81 | /// its arguments. |
| 82 | typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects; |
| 83 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 84 | namespace { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 85 | |
| 86 | /// RetEffect is used to summarize a function/method call's behavior with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 87 | /// respect to its return value. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 88 | class RetEffect { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 89 | public: |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 90 | enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 91 | NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol, |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 92 | OwnedWhenTrackedReceiver }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 93 | |
| 94 | enum ObjKind { CF, ObjC, AnyObj }; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 96 | private: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 97 | Kind K; |
| 98 | ObjKind O; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 99 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 100 | RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 101 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 102 | public: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 103 | Kind getKind() const { return K; } |
| 104 | |
| 105 | ObjKind getObjKind() const { return O; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 106 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 107 | bool isOwned() const { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 108 | return K == OwnedSymbol || K == OwnedAllocatedSymbol || |
| 109 | K == OwnedWhenTrackedReceiver; |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 110 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 111 | |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 112 | bool operator==(const RetEffect &Other) const { |
| 113 | return K == Other.K && O == Other.O; |
| 114 | } |
| 115 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 116 | static RetEffect MakeOwnedWhenTrackedReceiver() { |
| 117 | return RetEffect(OwnedWhenTrackedReceiver, ObjC); |
| 118 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 120 | static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) { |
| 121 | return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 122 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 123 | static RetEffect MakeNotOwned(ObjKind o) { |
| 124 | return RetEffect(NotOwnedSymbol, o); |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 125 | } |
| 126 | static RetEffect MakeGCNotOwned() { |
| 127 | return RetEffect(GCNotOwnedSymbol, ObjC); |
| 128 | } |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 129 | static RetEffect MakeARCNotOwned() { |
| 130 | return RetEffect(ARCNotOwnedSymbol, ObjC); |
| 131 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 132 | static RetEffect MakeNoRet() { |
| 133 | return RetEffect(NoRet); |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 134 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 135 | |
| 136 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 137 | ID.AddInteger((unsigned) K); |
| 138 | ID.AddInteger((unsigned) O); |
| 139 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 140 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 141 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 142 | //===----------------------------------------------------------------------===// |
| 143 | // Reference-counting logic (typestate + counts). |
| 144 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 145 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 146 | class RefVal { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 147 | public: |
| 148 | enum Kind { |
| 149 | Owned = 0, // Owning reference. |
| 150 | NotOwned, // Reference is not owned by still valid (not freed). |
| 151 | Released, // Object has been released. |
| 152 | ReturnedOwned, // Returned object passes ownership to caller. |
| 153 | ReturnedNotOwned, // Return object does not pass ownership to caller. |
| 154 | ERROR_START, |
| 155 | ErrorDeallocNotOwned, // -dealloc called on non-owned object. |
| 156 | ErrorDeallocGC, // Calling -dealloc with GC enabled. |
| 157 | ErrorUseAfterRelease, // Object used after released. |
| 158 | ErrorReleaseNotOwned, // Release of an object that was not owned. |
| 159 | ERROR_LEAK_START, |
| 160 | ErrorLeak, // A memory leak due to excessive reference counts. |
| 161 | ErrorLeakReturned, // A memory leak due to the returning method not having |
| 162 | // the correct naming conventions. |
| 163 | ErrorGCLeakReturned, |
| 164 | ErrorOverAutorelease, |
| 165 | ErrorReturnedNotOwned |
| 166 | }; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 167 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 168 | private: |
| 169 | Kind kind; |
| 170 | RetEffect::ObjKind okind; |
| 171 | unsigned Cnt; |
| 172 | unsigned ACnt; |
| 173 | QualType T; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 174 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 175 | RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t) |
| 176 | : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {} |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 177 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 178 | public: |
| 179 | Kind getKind() const { return kind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 180 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 181 | RetEffect::ObjKind getObjKind() const { return okind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 182 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 183 | unsigned getCount() const { return Cnt; } |
| 184 | unsigned getAutoreleaseCount() const { return ACnt; } |
| 185 | unsigned getCombinedCounts() const { return Cnt + ACnt; } |
| 186 | void clearCounts() { Cnt = 0; ACnt = 0; } |
| 187 | void setCount(unsigned i) { Cnt = i; } |
| 188 | void setAutoreleaseCount(unsigned i) { ACnt = i; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 190 | QualType getType() const { return T; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 191 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 192 | bool isOwned() const { |
| 193 | return getKind() == Owned; |
| 194 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 195 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 196 | bool isNotOwned() const { |
| 197 | return getKind() == NotOwned; |
| 198 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 199 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 200 | bool isReturnedOwned() const { |
| 201 | return getKind() == ReturnedOwned; |
| 202 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 203 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 204 | bool isReturnedNotOwned() const { |
| 205 | return getKind() == ReturnedNotOwned; |
| 206 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 207 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 208 | static RefVal makeOwned(RetEffect::ObjKind o, QualType t, |
| 209 | unsigned Count = 1) { |
| 210 | return RefVal(Owned, o, Count, 0, t); |
| 211 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 213 | static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t, |
| 214 | unsigned Count = 0) { |
| 215 | return RefVal(NotOwned, o, Count, 0, t); |
| 216 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 217 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 218 | // Comparison, profiling, and pretty-printing. |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 219 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 220 | bool operator==(const RefVal& X) const { |
| 221 | return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt; |
| 222 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 223 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 224 | RefVal operator-(size_t i) const { |
| 225 | return RefVal(getKind(), getObjKind(), getCount() - i, |
| 226 | getAutoreleaseCount(), getType()); |
| 227 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 228 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 229 | RefVal operator+(size_t i) const { |
| 230 | return RefVal(getKind(), getObjKind(), getCount() + i, |
| 231 | getAutoreleaseCount(), getType()); |
| 232 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 234 | RefVal operator^(Kind k) const { |
| 235 | return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(), |
| 236 | getType()); |
| 237 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 238 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 239 | RefVal autorelease() const { |
| 240 | return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1, |
| 241 | getType()); |
| 242 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 243 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 244 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 245 | ID.AddInteger((unsigned) kind); |
| 246 | ID.AddInteger(Cnt); |
| 247 | ID.AddInteger(ACnt); |
| 248 | ID.Add(T); |
| 249 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 250 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 251 | void print(raw_ostream &Out) const; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 252 | }; |
| 253 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 254 | void RefVal::print(raw_ostream &Out) const { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 255 | if (!T.isNull()) |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 256 | Out << "Tracked " << T.getAsString() << '/'; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 257 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 258 | switch (getKind()) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 259 | default: llvm_unreachable("Invalid RefVal kind"); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 260 | case Owned: { |
| 261 | Out << "Owned"; |
| 262 | unsigned cnt = getCount(); |
| 263 | if (cnt) Out << " (+ " << cnt << ")"; |
| 264 | break; |
| 265 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 266 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 267 | case NotOwned: { |
| 268 | Out << "NotOwned"; |
| 269 | unsigned cnt = getCount(); |
| 270 | if (cnt) Out << " (+ " << cnt << ")"; |
| 271 | break; |
| 272 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 273 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 274 | case ReturnedOwned: { |
| 275 | Out << "ReturnedOwned"; |
| 276 | unsigned cnt = getCount(); |
| 277 | if (cnt) Out << " (+ " << cnt << ")"; |
| 278 | break; |
| 279 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 280 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 281 | case ReturnedNotOwned: { |
| 282 | Out << "ReturnedNotOwned"; |
| 283 | unsigned cnt = getCount(); |
| 284 | if (cnt) Out << " (+ " << cnt << ")"; |
| 285 | break; |
| 286 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 287 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 288 | case Released: |
| 289 | Out << "Released"; |
| 290 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 291 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 292 | case ErrorDeallocGC: |
| 293 | Out << "-dealloc (GC)"; |
| 294 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 295 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 296 | case ErrorDeallocNotOwned: |
| 297 | Out << "-dealloc (not-owned)"; |
| 298 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 299 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 300 | case ErrorLeak: |
| 301 | Out << "Leaked"; |
| 302 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 303 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 304 | case ErrorLeakReturned: |
| 305 | Out << "Leaked (Bad naming)"; |
| 306 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 307 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 308 | case ErrorGCLeakReturned: |
| 309 | Out << "Leaked (GC-ed at return)"; |
| 310 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 311 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 312 | case ErrorUseAfterRelease: |
| 313 | Out << "Use-After-Release [ERROR]"; |
| 314 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 315 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 316 | case ErrorReleaseNotOwned: |
| 317 | Out << "Release of Not-Owned [ERROR]"; |
| 318 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 319 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 320 | case RefVal::ErrorOverAutorelease: |
| 321 | Out << "Over autoreleased"; |
| 322 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 323 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 324 | case RefVal::ErrorReturnedNotOwned: |
| 325 | Out << "Non-owned object returned instead of owned"; |
| 326 | break; |
| 327 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 328 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 329 | if (ACnt) { |
| 330 | Out << " [ARC +" << ACnt << ']'; |
| 331 | } |
| 332 | } |
| 333 | } //end anonymous namespace |
| 334 | |
| 335 | //===----------------------------------------------------------------------===// |
| 336 | // RefBindings - State used to track object reference counts. |
| 337 | //===----------------------------------------------------------------------===// |
| 338 | |
| 339 | typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 340 | |
| 341 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 342 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 343 | template<> |
| 344 | struct ProgramStateTrait<RefBindings> |
| 345 | : public ProgramStatePartialTrait<RefBindings> { |
| 346 | static void *GDMIndex() { |
| 347 | static int RefBIndex = 0; |
| 348 | return &RefBIndex; |
| 349 | } |
| 350 | }; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 351 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 352 | } |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 353 | |
| 354 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 355 | // Function/Method behavior summaries. |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 356 | //===----------------------------------------------------------------------===// |
| 357 | |
| 358 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 359 | class RetainSummary { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 360 | /// Args - a map of (index, ArgEffect) pairs, where index |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 361 | /// specifies the argument (starting from 0). This can be sparsely |
| 362 | /// populated; arguments with no entry in Args use 'DefaultArgEffect'. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 363 | ArgEffects Args; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 364 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 365 | /// DefaultArgEffect - The default ArgEffect to apply to arguments that |
| 366 | /// do not have an entry in Args. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 367 | ArgEffect DefaultArgEffect; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 368 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 369 | /// Receiver - If this summary applies to an Objective-C message expression, |
| 370 | /// this is the effect applied to the state of the receiver. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 371 | ArgEffect Receiver; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 372 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 373 | /// Ret - The effect on the return value. Used to indicate if the |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 374 | /// function/method call returns a new tracked symbol. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 375 | RetEffect Ret; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 376 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 377 | public: |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 378 | RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff, |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 379 | ArgEffect ReceiverEff) |
| 380 | : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 381 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 382 | /// getArg - Return the argument effect on the argument specified by |
| 383 | /// idx (starting from 0). |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 384 | ArgEffect getArg(unsigned idx) const { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 385 | if (const ArgEffect *AE = Args.lookup(idx)) |
| 386 | return *AE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 387 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 388 | return DefaultArgEffect; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 389 | } |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 390 | |
| 391 | void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) { |
| 392 | Args = af.add(Args, idx, e); |
| 393 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 394 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 395 | /// setDefaultArgEffect - Set the default argument effect. |
| 396 | void setDefaultArgEffect(ArgEffect E) { |
| 397 | DefaultArgEffect = E; |
| 398 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 399 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 400 | /// getRetEffect - Returns the effect on the return value of the call. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 401 | RetEffect getRetEffect() const { return Ret; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 402 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 403 | /// setRetEffect - Set the effect of the return value of the call. |
| 404 | void setRetEffect(RetEffect E) { Ret = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 405 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 406 | |
| 407 | /// Sets the effect on the receiver of the message. |
| 408 | void setReceiverEffect(ArgEffect e) { Receiver = e; } |
| 409 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 410 | /// getReceiverEffect - Returns the effect on the receiver of the call. |
| 411 | /// This is only meaningful if the summary applies to an ObjCMessageExpr*. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 412 | ArgEffect getReceiverEffect() const { return Receiver; } |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 413 | |
| 414 | /// Test if two retain summaries are identical. Note that merely equivalent |
| 415 | /// summaries are not necessarily identical (for example, if an explicit |
| 416 | /// argument effect matches the default effect). |
| 417 | bool operator==(const RetainSummary &Other) const { |
| 418 | return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect && |
| 419 | Receiver == Other.Receiver && Ret == Other.Ret; |
| 420 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 421 | |
| 422 | /// Profile this summary for inclusion in a FoldingSet. |
| 423 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 424 | ID.Add(Args); |
| 425 | ID.Add(DefaultArgEffect); |
| 426 | ID.Add(Receiver); |
| 427 | ID.Add(Ret); |
| 428 | } |
| 429 | |
| 430 | /// A retain summary is simple if it has no ArgEffects other than the default. |
| 431 | bool isSimple() const { |
| 432 | return Args.isEmpty(); |
| 433 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 434 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 435 | } // end anonymous namespace |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 436 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 437 | //===----------------------------------------------------------------------===// |
| 438 | // Data structures for constructing summaries. |
| 439 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 53301ba | 2008-06-24 03:49:48 +0000 | [diff] [blame] | 440 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 441 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 442 | class ObjCSummaryKey { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 443 | IdentifierInfo* II; |
| 444 | Selector S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 445 | public: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 446 | ObjCSummaryKey(IdentifierInfo* ii, Selector s) |
| 447 | : II(ii), S(s) {} |
| 448 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 449 | ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 450 | : II(d ? d->getIdentifier() : 0), S(s) {} |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 451 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 452 | ObjCSummaryKey(const ObjCInterfaceDecl *d, IdentifierInfo *ii, Selector s) |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 453 | : II(d ? d->getIdentifier() : ii), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 454 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 455 | ObjCSummaryKey(Selector s) |
| 456 | : II(0), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 457 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 458 | IdentifierInfo *getIdentifier() const { return II; } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 459 | Selector getSelector() const { return S; } |
| 460 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 461 | } |
| 462 | |
| 463 | namespace llvm { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 464 | template <> struct DenseMapInfo<ObjCSummaryKey> { |
| 465 | static inline ObjCSummaryKey getEmptyKey() { |
| 466 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(), |
| 467 | DenseMapInfo<Selector>::getEmptyKey()); |
| 468 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 469 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 470 | static inline ObjCSummaryKey getTombstoneKey() { |
| 471 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 472 | DenseMapInfo<Selector>::getTombstoneKey()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 473 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 474 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 475 | static unsigned getHashValue(const ObjCSummaryKey &V) { |
| 476 | return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier()) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 477 | & 0x88888888) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 478 | | (DenseMapInfo<Selector>::getHashValue(V.getSelector()) |
| 479 | & 0x55555555); |
| 480 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 481 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 482 | static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) { |
| 483 | return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(), |
| 484 | RHS.getIdentifier()) && |
| 485 | DenseMapInfo<Selector>::isEqual(LHS.getSelector(), |
| 486 | RHS.getSelector()); |
| 487 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 488 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 489 | }; |
Chris Lattner | 06159e8 | 2009-12-15 07:26:51 +0000 | [diff] [blame] | 490 | template <> |
| 491 | struct isPodLike<ObjCSummaryKey> { static const bool value = true; }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 492 | } // end llvm namespace |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 493 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 494 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 495 | class ObjCSummaryCache { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 496 | typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 497 | MapTy M; |
| 498 | public: |
| 499 | ObjCSummaryCache() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 500 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 501 | const RetainSummary * find(const ObjCInterfaceDecl *D, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 502 | Selector S) { |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 503 | // Lookup the method using the decl for the class @interface. If we |
| 504 | // have no decl, lookup using the class name. |
| 505 | return D ? find(D, S) : find(ClsName, S); |
| 506 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 507 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 508 | const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 509 | // Do a lookup with the (D,S) pair. If we find a match return |
| 510 | // the iterator. |
| 511 | ObjCSummaryKey K(D, S); |
| 512 | MapTy::iterator I = M.find(K); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 513 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 514 | if (I != M.end() || !D) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 515 | return I->second; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 516 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 517 | // Walk the super chain. If we find a hit with a parent, we'll end |
| 518 | // up returning that summary. We actually allow that key (null,S), as |
| 519 | // we cache summaries for the null ObjCInterfaceDecl* to allow us to |
| 520 | // generate initial summaries without having to worry about NSObject |
| 521 | // being declared. |
| 522 | // FIXME: We may change this at some point. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 523 | for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 524 | if ((I = M.find(ObjCSummaryKey(C, S))) != M.end()) |
| 525 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 526 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 527 | if (!C) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 528 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 529 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 530 | |
| 531 | // Cache the summary with original key to make the next lookup faster |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 532 | // and return the iterator. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 533 | const RetainSummary *Summ = I->second; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 534 | M[K] = Summ; |
| 535 | return Summ; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 536 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 537 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 538 | const RetainSummary *find(IdentifierInfo* II, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 539 | // FIXME: Class method lookup. Right now we dont' have a good way |
| 540 | // of going between IdentifierInfo* and the class hierarchy. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 541 | MapTy::iterator I = M.find(ObjCSummaryKey(II, S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 542 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 543 | if (I == M.end()) |
| 544 | I = M.find(ObjCSummaryKey(S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 545 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 546 | return I == M.end() ? NULL : I->second; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 547 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 548 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 549 | const RetainSummary *& operator[](ObjCSummaryKey K) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 550 | return M[K]; |
| 551 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 552 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 553 | const RetainSummary *& operator[](Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 554 | return M[ ObjCSummaryKey(S) ]; |
| 555 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 556 | }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 557 | } // end anonymous namespace |
| 558 | |
| 559 | //===----------------------------------------------------------------------===// |
| 560 | // Data structures for managing collections of summaries. |
| 561 | //===----------------------------------------------------------------------===// |
| 562 | |
| 563 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 564 | class RetainSummaryManager { |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 565 | |
| 566 | //==-----------------------------------------------------------------==// |
| 567 | // Typedefs. |
| 568 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 569 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 570 | typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *> |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 571 | FuncSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 572 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 573 | typedef ObjCSummaryCache ObjCMethodSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 574 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 575 | typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode; |
| 576 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 577 | //==-----------------------------------------------------------------==// |
| 578 | // Data. |
| 579 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 580 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 581 | /// Ctx - The ASTContext object for the analyzed ASTs. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 582 | ASTContext &Ctx; |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 583 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 584 | /// GCEnabled - Records whether or not the analyzed code runs in GC mode. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 585 | const bool GCEnabled; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 586 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 587 | /// Records whether or not the analyzed code runs in ARC mode. |
| 588 | const bool ARCEnabled; |
| 589 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 590 | /// FuncSummaries - A map from FunctionDecls to summaries. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 591 | FuncSummariesTy FuncSummaries; |
| 592 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 593 | /// ObjCClassMethodSummaries - A map from selectors (for instance methods) |
| 594 | /// to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 595 | ObjCMethodSummariesTy ObjCClassMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 596 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 597 | /// ObjCMethodSummaries - A map from selectors to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 598 | ObjCMethodSummariesTy ObjCMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 599 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 600 | /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects, |
| 601 | /// and all other data used by the checker. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 602 | llvm::BumpPtrAllocator BPAlloc; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 603 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 604 | /// AF - A factory for ArgEffects objects. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 605 | ArgEffects::Factory AF; |
| 606 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 607 | /// ScratchArgs - A holding buffer for construct ArgEffects. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 608 | ArgEffects ScratchArgs; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 609 | |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 610 | /// ObjCAllocRetE - Default return effect for methods returning Objective-C |
| 611 | /// objects. |
| 612 | RetEffect ObjCAllocRetE; |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 613 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 614 | /// ObjCInitRetE - Default return effect for init methods returning |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 615 | /// Objective-C objects. |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 616 | RetEffect ObjCInitRetE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 617 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 618 | /// SimpleSummaries - Used for uniquing summaries that don't have special |
| 619 | /// effects. |
| 620 | llvm::FoldingSet<CachedSummaryNode> SimpleSummaries; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 621 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 622 | //==-----------------------------------------------------------------==// |
| 623 | // Methods. |
| 624 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 625 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 626 | /// getArgEffects - Returns a persistent ArgEffects object based on the |
| 627 | /// data in ScratchArgs. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 628 | ArgEffects getArgEffects(); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 629 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 630 | enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable }; |
| 631 | |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 632 | public: |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 633 | RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; } |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 634 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 635 | const RetainSummary *getUnarySummary(const FunctionType* FT, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 636 | UnaryFuncKind func); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 637 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 638 | const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD); |
| 639 | const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD); |
| 640 | const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 641 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 642 | const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 643 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 644 | const RetainSummary *getPersistentSummary(RetEffect RetEff, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 645 | ArgEffect ReceiverEff = DoNothing, |
| 646 | ArgEffect DefaultEff = MayEscape) { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 647 | RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff); |
| 648 | return getPersistentSummary(Summ); |
| 649 | } |
| 650 | |
| 651 | const RetainSummary *getDefaultSummary() { |
| 652 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 653 | DoNothing, MayEscape); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 654 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 655 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 656 | const RetainSummary *getPersistentStopSummary() { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 657 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 658 | StopTracking, StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 659 | } |
Ted Kremenek | b309525 | 2008-05-06 04:20:12 +0000 | [diff] [blame] | 660 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 661 | void InitializeClassMethodSummaries(); |
| 662 | void InitializeMethodSummaries(); |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 663 | private: |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 664 | void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 665 | ObjCClassMethodSummaries[S] = Summ; |
| 666 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 667 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 668 | void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 669 | ObjCMethodSummaries[S] = Summ; |
| 670 | } |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 671 | |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 672 | void addClassMethSummary(const char* Cls, const char* name, |
| 673 | const RetainSummary *Summ, bool isNullary = true) { |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 674 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 675 | Selector S = isNullary ? GetNullarySelector(name, Ctx) |
| 676 | : GetUnarySelector(name, Ctx); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 677 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 678 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 679 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 680 | void addInstMethSummary(const char* Cls, const char* nullaryName, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 681 | const RetainSummary *Summ) { |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 682 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 683 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 684 | ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 685 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 686 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 687 | Selector generateSelector(va_list argp) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 688 | SmallVector<IdentifierInfo*, 10> II; |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 689 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 690 | while (const char* s = va_arg(argp, const char*)) |
| 691 | II.push_back(&Ctx.Idents.get(s)); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 692 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 693 | return Ctx.Selectors.getSelector(II.size(), &II[0]); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 694 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 695 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 696 | void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 697 | const RetainSummary * Summ, va_list argp) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 698 | Selector S = generateSelector(argp); |
| 699 | Summaries[ObjCSummaryKey(ClsII, S)] = Summ; |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 700 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 701 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 702 | void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 703 | va_list argp; |
| 704 | va_start(argp, Summ); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 705 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 706 | va_end(argp); |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 707 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 708 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 709 | void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 710 | va_list argp; |
| 711 | va_start(argp, Summ); |
| 712 | addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp); |
| 713 | va_end(argp); |
| 714 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 715 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 716 | void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 717 | va_list argp; |
| 718 | va_start(argp, Summ); |
| 719 | addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp); |
| 720 | va_end(argp); |
| 721 | } |
| 722 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 723 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 724 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 725 | RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC) |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 726 | : Ctx(ctx), |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 727 | GCEnabled(gcenabled), |
| 728 | ARCEnabled(usesARC), |
| 729 | AF(BPAlloc), ScratchArgs(AF.getEmptyMap()), |
| 730 | ObjCAllocRetE(gcenabled |
| 731 | ? RetEffect::MakeGCNotOwned() |
| 732 | : (usesARC ? RetEffect::MakeARCNotOwned() |
| 733 | : RetEffect::MakeOwned(RetEffect::ObjC, true))), |
| 734 | ObjCInitRetE(gcenabled |
| 735 | ? RetEffect::MakeGCNotOwned() |
| 736 | : (usesARC ? RetEffect::MakeARCNotOwned() |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 737 | : RetEffect::MakeOwnedWhenTrackedReceiver())) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 738 | InitializeClassMethodSummaries(); |
| 739 | InitializeMethodSummaries(); |
| 740 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 741 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 742 | const RetainSummary *getSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 743 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 744 | const RetainSummary *getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 745 | const ObjCInterfaceDecl *ID, |
| 746 | const ObjCMethodDecl *MD, |
| 747 | QualType RetTy, |
| 748 | ObjCMethodSummariesTy &CachedSummaries); |
| 749 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 750 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 751 | ProgramStateRef state, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 752 | const LocationContext *LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 753 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 754 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 755 | const ObjCInterfaceDecl *ID) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 756 | return getMethodSummary(msg.getSelector(), 0, ID, msg.getMethodDecl(), |
| 757 | msg.getType(Ctx), ObjCMethodSummaries); |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 758 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 759 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 760 | const RetainSummary *getClassMethodSummary(const ObjCMessage &msg) { |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 761 | const ObjCInterfaceDecl *Class = 0; |
| 762 | if (!msg.isInstanceMessage()) |
| 763 | Class = msg.getReceiverInterface(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 764 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 765 | return getMethodSummary(msg.getSelector(), Class->getIdentifier(), |
| 766 | Class, msg.getMethodDecl(), msg.getType(Ctx), |
| 767 | ObjCClassMethodSummaries); |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 768 | } |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 769 | |
| 770 | /// getMethodSummary - This version of getMethodSummary is used to query |
| 771 | /// the summary for the current method being analyzed. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 772 | const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) { |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 773 | // FIXME: Eventually this should be unneeded. |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 774 | const ObjCInterfaceDecl *ID = MD->getClassInterface(); |
Ted Kremenek | 70a6576 | 2009-04-30 05:41:14 +0000 | [diff] [blame] | 775 | Selector S = MD->getSelector(); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 776 | IdentifierInfo *ClsName = ID->getIdentifier(); |
| 777 | QualType ResultTy = MD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 778 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 779 | ObjCMethodSummariesTy *CachedSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 780 | if (MD->isInstanceMethod()) |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 781 | CachedSummaries = &ObjCMethodSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 782 | else |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 783 | CachedSummaries = &ObjCClassMethodSummaries; |
| 784 | |
| 785 | return getMethodSummary(S, ClsName, ID, MD, ResultTy, *CachedSummaries); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 786 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 787 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 788 | const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 789 | Selector S, QualType RetTy); |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 790 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 791 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 792 | const ObjCMethodDecl *MD); |
| 793 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 794 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 795 | const FunctionDecl *FD); |
| 796 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 797 | bool isGCEnabled() const { return GCEnabled; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 798 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 799 | bool isARCEnabled() const { return ARCEnabled; } |
| 800 | |
| 801 | bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 802 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 803 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 804 | // Used to avoid allocating long-term (BPAlloc'd) memory for default retain |
| 805 | // summaries. If a function or method looks like it has a default summary, but |
| 806 | // it has annotations, the annotations are added to the stack-based template |
| 807 | // and then copied into managed memory. |
| 808 | class RetainSummaryTemplate { |
| 809 | RetainSummaryManager &Manager; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 810 | const RetainSummary *&RealSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 811 | RetainSummary ScratchSummary; |
| 812 | bool Accessed; |
| 813 | public: |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 814 | RetainSummaryTemplate(const RetainSummary *&real, const RetainSummary &base, |
| 815 | RetainSummaryManager &mgr) |
| 816 | : Manager(mgr), RealSummary(real), ScratchSummary(real ? *real : base), |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 817 | Accessed(false) {} |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 818 | |
| 819 | ~RetainSummaryTemplate() { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 820 | if (Accessed) |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 821 | RealSummary = Manager.getPersistentSummary(ScratchSummary); |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 822 | } |
| 823 | |
| 824 | RetainSummary &operator*() { |
| 825 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 826 | return ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 827 | } |
| 828 | |
| 829 | RetainSummary *operator->() { |
| 830 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 831 | return &ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 832 | } |
| 833 | }; |
| 834 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 835 | } // end anonymous namespace |
| 836 | |
| 837 | //===----------------------------------------------------------------------===// |
| 838 | // Implementation of checker data structures. |
| 839 | //===----------------------------------------------------------------------===// |
| 840 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 841 | ArgEffects RetainSummaryManager::getArgEffects() { |
| 842 | ArgEffects AE = ScratchArgs; |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 843 | ScratchArgs = AF.getEmptyMap(); |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 844 | return AE; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 845 | } |
| 846 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 847 | const RetainSummary * |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 848 | RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) { |
| 849 | // Unique "simple" summaries -- those without ArgEffects. |
| 850 | if (OldSumm.isSimple()) { |
| 851 | llvm::FoldingSetNodeID ID; |
| 852 | OldSumm.Profile(ID); |
| 853 | |
| 854 | void *Pos; |
| 855 | CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos); |
| 856 | |
| 857 | if (!N) { |
| 858 | N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>(); |
| 859 | new (N) CachedSummaryNode(OldSumm); |
| 860 | SimpleSummaries.InsertNode(N, Pos); |
| 861 | } |
| 862 | |
| 863 | return &N->getValue(); |
| 864 | } |
| 865 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 866 | RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>(); |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 867 | new (Summ) RetainSummary(OldSumm); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 868 | return Summ; |
| 869 | } |
| 870 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 871 | //===----------------------------------------------------------------------===// |
| 872 | // Summary creation for functions (largely uses of Core Foundation). |
| 873 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 875 | static bool isRetain(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 876 | return FName.endswith("Retain"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 877 | } |
| 878 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 879 | static bool isRelease(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 880 | return FName.endswith("Release"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 881 | } |
| 882 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 883 | static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) { |
| 884 | // FIXME: Remove FunctionDecl parameter. |
| 885 | // FIXME: Is it really okay if MakeCollectable isn't a suffix? |
| 886 | return FName.find("MakeCollectable") != StringRef::npos; |
| 887 | } |
| 888 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 889 | const RetainSummary * RetainSummaryManager::getSummary(const FunctionDecl *FD) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 890 | // Look up a summary in our cache of FunctionDecls -> Summaries. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 891 | FuncSummariesTy::iterator I = FuncSummaries.find(FD); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 892 | if (I != FuncSummaries.end()) |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 893 | return I->second; |
| 894 | |
Ted Kremenek | e401a0c | 2009-05-04 15:34:07 +0000 | [diff] [blame] | 895 | // No summary? Generate one. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 896 | const RetainSummary *S = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 897 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 898 | do { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 899 | // We generate "stop" summaries for implicitly defined functions. |
| 900 | if (FD->isImplicit()) { |
| 901 | S = getPersistentStopSummary(); |
| 902 | break; |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 903 | } |
Ted Kremenek | 9ca2851 | 2011-05-02 21:21:42 +0000 | [diff] [blame] | 904 | // For C++ methods, generate an implicit "stop" summary as well. We |
| 905 | // can relax this once we have a clear policy for C++ methods and |
| 906 | // ownership attributes. |
| 907 | if (isa<CXXMethodDecl>(FD)) { |
| 908 | S = getPersistentStopSummary(); |
| 909 | break; |
| 910 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 911 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 912 | // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the |
Ted Kremenek | 9989065 | 2009-01-16 18:40:33 +0000 | [diff] [blame] | 913 | // function's type. |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 914 | const FunctionType* FT = FD->getType()->getAs<FunctionType>(); |
Ted Kremenek | 48c6d18 | 2009-12-16 06:06:43 +0000 | [diff] [blame] | 915 | const IdentifierInfo *II = FD->getIdentifier(); |
| 916 | if (!II) |
| 917 | break; |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 918 | |
| 919 | StringRef FName = II->getName(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 920 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 921 | // Strip away preceding '_'. Doing this here will effect all the checks |
| 922 | // down below. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 923 | FName = FName.substr(FName.find_first_not_of('_')); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 924 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 925 | // Inspect the result type. |
| 926 | QualType RetTy = FT->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 927 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 928 | // FIXME: This should all be refactored into a chain of "summary lookup" |
| 929 | // filters. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 930 | assert(ScratchArgs.isEmpty()); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 931 | |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 932 | if (FName == "pthread_create") { |
| 933 | // Part of: <rdar://problem/7299394>. This will be addressed |
| 934 | // better with IPA. |
| 935 | S = getPersistentStopSummary(); |
| 936 | } else if (FName == "NSMakeCollectable") { |
| 937 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 938 | S = (RetTy->isObjCIdType()) |
| 939 | ? getUnarySummary(FT, cfmakecollectable) |
| 940 | : getPersistentStopSummary(); |
| 941 | } else if (FName == "IOBSDNameMatching" || |
| 942 | FName == "IOServiceMatching" || |
| 943 | FName == "IOServiceNameMatching" || |
| 944 | FName == "IORegistryEntryIDMatching" || |
| 945 | FName == "IOOpenFirmwarePathMatching") { |
| 946 | // Part of <rdar://problem/6961230>. (IOKit) |
| 947 | // This should be addressed using a API table. |
| 948 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 949 | DoNothing, DoNothing); |
| 950 | } else if (FName == "IOServiceGetMatchingService" || |
| 951 | FName == "IOServiceGetMatchingServices") { |
| 952 | // FIXES: <rdar://problem/6326900> |
| 953 | // This should be addressed using a API table. This strcmp is also |
| 954 | // a little gross, but there is no need to super optimize here. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 955 | ScratchArgs = AF.add(ScratchArgs, 1, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 956 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 957 | } else if (FName == "IOServiceAddNotification" || |
| 958 | FName == "IOServiceAddMatchingNotification") { |
| 959 | // Part of <rdar://problem/6961230>. (IOKit) |
| 960 | // This should be addressed using a API table. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 961 | ScratchArgs = AF.add(ScratchArgs, 2, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 962 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 963 | } else if (FName == "CVPixelBufferCreateWithBytes") { |
| 964 | // FIXES: <rdar://problem/7283567> |
| 965 | // Eventually this can be improved by recognizing that the pixel |
| 966 | // buffer passed to CVPixelBufferCreateWithBytes is released via |
| 967 | // a callback and doing full IPA to make sure this is done correctly. |
| 968 | // FIXME: This function has an out parameter that returns an |
| 969 | // allocated object. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 970 | ScratchArgs = AF.add(ScratchArgs, 7, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 971 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 972 | } else if (FName == "CGBitmapContextCreateWithData") { |
| 973 | // FIXES: <rdar://problem/7358899> |
| 974 | // Eventually this can be improved by recognizing that 'releaseInfo' |
| 975 | // passed to CGBitmapContextCreateWithData is released via |
| 976 | // a callback and doing full IPA to make sure this is done correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 977 | ScratchArgs = AF.add(ScratchArgs, 8, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 978 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 979 | DoNothing, DoNothing); |
| 980 | } else if (FName == "CVPixelBufferCreateWithPlanarBytes") { |
| 981 | // FIXES: <rdar://problem/7283567> |
| 982 | // Eventually this can be improved by recognizing that the pixel |
| 983 | // buffer passed to CVPixelBufferCreateWithPlanarBytes is released |
| 984 | // via a callback and doing full IPA to make sure this is done |
| 985 | // correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 986 | ScratchArgs = AF.add(ScratchArgs, 12, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 987 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 988 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 989 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 990 | // Did we get a summary? |
| 991 | if (S) |
| 992 | break; |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 993 | |
| 994 | // Enable this code once the semantics of NSDeallocateObject are resolved |
| 995 | // for GC. <rdar://problem/6619988> |
| 996 | #if 0 |
| 997 | // Handle: NSDeallocateObject(id anObject); |
| 998 | // This method does allow 'nil' (although we don't check it now). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 999 | if (strcmp(FName, "NSDeallocateObject") == 0) { |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1000 | return RetTy == Ctx.VoidTy |
| 1001 | ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc) |
| 1002 | : getPersistentStopSummary(); |
| 1003 | } |
| 1004 | #endif |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1005 | |
| 1006 | if (RetTy->isPointerType()) { |
| 1007 | // For CoreFoundation ('CF') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1008 | if (cocoa::isRefType(RetTy, "CF", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1009 | if (isRetain(FD, FName)) |
| 1010 | S = getUnarySummary(FT, cfretain); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1011 | else if (isMakeCollectable(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1012 | S = getUnarySummary(FT, cfmakecollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1013 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1014 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1015 | |
| 1016 | break; |
| 1017 | } |
| 1018 | |
| 1019 | // For CoreGraphics ('CG') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1020 | if (cocoa::isRefType(RetTy, "CG", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1021 | if (isRetain(FD, FName)) |
| 1022 | S = getUnarySummary(FT, cfretain); |
| 1023 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1024 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1025 | |
| 1026 | break; |
| 1027 | } |
| 1028 | |
| 1029 | // For the Disk Arbitration API (DiskArbitration/DADisk.h) |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1030 | if (cocoa::isRefType(RetTy, "DADisk") || |
| 1031 | cocoa::isRefType(RetTy, "DADissenter") || |
| 1032 | cocoa::isRefType(RetTy, "DASessionRef")) { |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1033 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1034 | break; |
| 1035 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1036 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1037 | break; |
| 1038 | } |
| 1039 | |
| 1040 | // Check for release functions, the only kind of functions that we care |
| 1041 | // about that don't return a pointer type. |
| 1042 | if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) { |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1043 | // Test for 'CGCF'. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1044 | FName = FName.substr(FName.startswith("CGCF") ? 4 : 2); |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1045 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1046 | if (isRelease(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1047 | S = getUnarySummary(FT, cfrelease); |
| 1048 | else { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1049 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1050 | // Remaining CoreFoundation and CoreGraphics functions. |
| 1051 | // We use to assume that they all strictly followed the ownership idiom |
| 1052 | // and that ownership cannot be transferred. While this is technically |
| 1053 | // correct, many methods allow a tracked object to escape. For example: |
| 1054 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1055 | // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1056 | // CFDictionaryAddValue(y, key, x); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1057 | // CFRelease(x); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1058 | // ... it is okay to use 'x' since 'y' has a reference to it |
| 1059 | // |
| 1060 | // We handle this and similar cases with the follow heuristic. If the |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1061 | // function name contains "InsertValue", "SetValue", "AddValue", |
| 1062 | // "AppendValue", or "SetAttribute", then we assume that arguments may |
| 1063 | // "escape." This means that something else holds on to the object, |
| 1064 | // allowing it be used even after its local retain count drops to 0. |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1065 | ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos|| |
| 1066 | StrInStrNoCase(FName, "AddValue") != StringRef::npos || |
| 1067 | StrInStrNoCase(FName, "SetValue") != StringRef::npos || |
| 1068 | StrInStrNoCase(FName, "AppendValue") != StringRef::npos|| |
Benjamin Kramer | c027e54 | 2010-01-11 20:15:06 +0000 | [diff] [blame] | 1069 | StrInStrNoCase(FName, "SetAttribute") != StringRef::npos) |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1070 | ? MayEscape : DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1071 | |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1072 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1073 | } |
| 1074 | } |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1075 | } |
| 1076 | while (0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1077 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1078 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1079 | updateSummaryFromAnnotations(S, FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1080 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1081 | FuncSummaries[FD] = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1082 | return S; |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 1083 | } |
| 1084 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1085 | const RetainSummary * |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1086 | RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) { |
| 1087 | if (coreFoundation::followsCreateRule(FD)) |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1088 | return getCFSummaryCreateRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1089 | |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 1090 | return getCFSummaryGetRule(FD); |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1091 | } |
| 1092 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1093 | const RetainSummary * |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 1094 | RetainSummaryManager::getUnarySummary(const FunctionType* FT, |
| 1095 | UnaryFuncKind func) { |
| 1096 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1097 | // Sanity check that this is *really* a unary function. This can |
| 1098 | // happen if people do weird things. |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1099 | const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1100 | if (!FTP || FTP->getNumArgs() != 1) |
| 1101 | return getPersistentStopSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1102 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1103 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1104 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1105 | ArgEffect Effect; |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1106 | switch (func) { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1107 | case cfretain: Effect = IncRef; break; |
| 1108 | case cfrelease: Effect = DecRef; break; |
| 1109 | case cfmakecollectable: Effect = MakeCollectable; break; |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 1110 | } |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1111 | |
| 1112 | ScratchArgs = AF.add(ScratchArgs, 0, Effect); |
| 1113 | return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1114 | } |
| 1115 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1116 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1117 | RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1118 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1119 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1120 | return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1121 | } |
| 1122 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1123 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1124 | RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1125 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1126 | return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF), |
| 1127 | DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1128 | } |
| 1129 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1130 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1131 | // Summary creation for Selectors. |
| 1132 | //===----------------------------------------------------------------------===// |
| 1133 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1134 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1135 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1136 | const FunctionDecl *FD) { |
| 1137 | if (!FD) |
| 1138 | return; |
| 1139 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 1140 | RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1141 | |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1142 | // Effects on the parameters. |
| 1143 | unsigned parm_idx = 0; |
| 1144 | for (FunctionDecl::param_const_iterator pi = FD->param_begin(), |
John McCall | 98b8f16 | 2011-04-06 09:02:12 +0000 | [diff] [blame] | 1145 | pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1146 | const ParmVarDecl *pd = *pi; |
| 1147 | if (pd->getAttr<NSConsumedAttr>()) { |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1148 | if (!GCEnabled) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1149 | Template->addArg(AF, parm_idx, DecRef); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1150 | } |
| 1151 | } else if (pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1152 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1153 | } |
| 1154 | } |
| 1155 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1156 | QualType RetTy = FD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1157 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1158 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1159 | if (cocoa::isCocoaObjectRef(RetTy)) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1160 | if (FD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1161 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1162 | } |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1163 | else if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1164 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1165 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1166 | else if (FD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1167 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1168 | } |
| 1169 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1170 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1171 | } |
| 1172 | } else if (RetTy->getAs<PointerType>()) { |
| 1173 | if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1174 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1175 | } |
| 1176 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1177 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1178 | } |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1179 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1180 | } |
| 1181 | |
| 1182 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1183 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
| 1184 | const ObjCMethodDecl *MD) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1185 | if (!MD) |
| 1186 | return; |
| 1187 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 1188 | RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1189 | bool isTrackedLoc = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1190 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1191 | // Effects on the receiver. |
| 1192 | if (MD->getAttr<NSConsumesSelfAttr>()) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1193 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1194 | Template->setReceiverEffect(DecRefMsg); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1195 | } |
| 1196 | |
| 1197 | // Effects on the parameters. |
| 1198 | unsigned parm_idx = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1199 | for (ObjCMethodDecl::param_const_iterator |
| 1200 | pi=MD->param_begin(), pe=MD->param_end(); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1201 | pi != pe; ++pi, ++parm_idx) { |
| 1202 | const ParmVarDecl *pd = *pi; |
| 1203 | if (pd->getAttr<NSConsumedAttr>()) { |
| 1204 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1205 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1206 | } |
| 1207 | else if(pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1208 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1209 | } |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1210 | } |
| 1211 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1212 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1213 | if (cocoa::isCocoaObjectRef(MD->getResultType())) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1214 | if (MD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1215 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1216 | return; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1217 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1218 | if (MD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1219 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1220 | return; |
| 1221 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1222 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1223 | isTrackedLoc = true; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1224 | } else { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1225 | isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1226 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1227 | |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1228 | if (isTrackedLoc) { |
| 1229 | if (MD->getAttr<CFReturnsRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1230 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1231 | else if (MD->getAttr<CFReturnsNotRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1232 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1233 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1234 | } |
| 1235 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1236 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1237 | RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD, |
| 1238 | Selector S, QualType RetTy) { |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1239 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1240 | if (MD) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1241 | // Scan the method decl for 'void*' arguments. These should be treated |
| 1242 | // as 'StopTracking' because they are often used with delegates. |
| 1243 | // Delegates are a frequent form of false positives with the retain |
| 1244 | // count checker. |
| 1245 | unsigned i = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1246 | for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(), |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1247 | E = MD->param_end(); I != E; ++I, ++i) |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1248 | if (const ParmVarDecl *PD = *I) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1249 | QualType Ty = Ctx.getCanonicalType(PD->getType()); |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 1250 | if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy) |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1251 | ScratchArgs = AF.add(ScratchArgs, i, StopTracking); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1252 | } |
| 1253 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1254 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1255 | // Any special effects? |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1256 | ArgEffect ReceiverEff = DoNothing; |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1257 | RetEffect ResultEff = RetEffect::MakeNoRet(); |
| 1258 | |
| 1259 | // Check the method family, and apply any default annotations. |
| 1260 | switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) { |
| 1261 | case OMF_None: |
| 1262 | case OMF_performSelector: |
| 1263 | // Assume all Objective-C methods follow Cocoa Memory Management rules. |
| 1264 | // FIXME: Does the non-threaded performSelector family really belong here? |
| 1265 | // The selector could be, say, @selector(copy). |
| 1266 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1267 | ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 1268 | else if (coreFoundation::isCFObjectRef(RetTy)) { |
| 1269 | // ObjCMethodDecl currently doesn't consider CF objects as valid return |
| 1270 | // values for alloc, new, copy, or mutableCopy, so we have to |
| 1271 | // double-check with the selector. This is ugly, but there aren't that |
| 1272 | // many Objective-C methods that return CF objects, right? |
| 1273 | if (MD) { |
| 1274 | switch (S.getMethodFamily()) { |
| 1275 | case OMF_alloc: |
| 1276 | case OMF_new: |
| 1277 | case OMF_copy: |
| 1278 | case OMF_mutableCopy: |
| 1279 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1280 | break; |
| 1281 | default: |
| 1282 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1283 | break; |
| 1284 | } |
| 1285 | } else { |
| 1286 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1287 | } |
| 1288 | } |
| 1289 | break; |
| 1290 | case OMF_init: |
| 1291 | ResultEff = ObjCInitRetE; |
| 1292 | ReceiverEff = DecRefMsg; |
| 1293 | break; |
| 1294 | case OMF_alloc: |
| 1295 | case OMF_new: |
| 1296 | case OMF_copy: |
| 1297 | case OMF_mutableCopy: |
| 1298 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1299 | ResultEff = ObjCAllocRetE; |
| 1300 | else if (coreFoundation::isCFObjectRef(RetTy)) |
| 1301 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1302 | break; |
| 1303 | case OMF_autorelease: |
| 1304 | ReceiverEff = Autorelease; |
| 1305 | break; |
| 1306 | case OMF_retain: |
| 1307 | ReceiverEff = IncRefMsg; |
| 1308 | break; |
| 1309 | case OMF_release: |
| 1310 | ReceiverEff = DecRefMsg; |
| 1311 | break; |
| 1312 | case OMF_dealloc: |
| 1313 | ReceiverEff = Dealloc; |
| 1314 | break; |
| 1315 | case OMF_self: |
| 1316 | // -self is handled specially by the ExprEngine to propagate the receiver. |
| 1317 | break; |
| 1318 | case OMF_retainCount: |
| 1319 | case OMF_finalize: |
| 1320 | // These methods don't return objects. |
| 1321 | break; |
| 1322 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1323 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1324 | // If one of the arguments in the selector has the keyword 'delegate' we |
| 1325 | // should stop tracking the reference count for the receiver. This is |
| 1326 | // because the reference count is quite possibly handled by a delegate |
| 1327 | // method. |
| 1328 | if (S.isKeywordSelector()) { |
| 1329 | const std::string &str = S.getAsString(); |
| 1330 | assert(!str.empty()); |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1331 | if (StrInStrNoCase(str, "delegate:") != StringRef::npos) |
| 1332 | ReceiverEff = StopTracking; |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1333 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1334 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1335 | if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing && |
| 1336 | ResultEff.getKind() == RetEffect::NoRet) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1337 | return getDefaultSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1338 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1339 | return getPersistentSummary(ResultEff, ReceiverEff, MayEscape); |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1340 | } |
| 1341 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1342 | const RetainSummary * |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1343 | RetainSummaryManager::getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1344 | ProgramStateRef state, |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1345 | const LocationContext *LC) { |
| 1346 | |
| 1347 | // We need the type-information of the tracked receiver object |
| 1348 | // Retrieve it from the state. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1349 | const Expr *Receiver = msg.getInstanceReceiver(); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1350 | const ObjCInterfaceDecl *ID = 0; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1351 | |
| 1352 | // FIXME: Is this really working as expected? There are cases where |
| 1353 | // we just use the 'ID' from the message expression. |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1354 | SVal receiverV; |
| 1355 | |
Ted Kremenek | 8f32675 | 2010-05-21 21:56:53 +0000 | [diff] [blame] | 1356 | if (Receiver) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1357 | receiverV = state->getSValAsScalarOrLoc(Receiver, LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1358 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1359 | // FIXME: Eventually replace the use of state->get<RefBindings> with |
| 1360 | // a generic API for reasoning about the Objective-C types of symbolic |
| 1361 | // objects. |
| 1362 | if (SymbolRef Sym = receiverV.getAsLocSymbol()) |
| 1363 | if (const RefVal *T = state->get<RefBindings>(Sym)) |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1364 | if (const ObjCObjectPointerType* PT = |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1365 | T->getType()->getAs<ObjCObjectPointerType>()) |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1366 | ID = PT->getInterfaceDecl(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1367 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1368 | // FIXME: this is a hack. This may or may not be the actual method |
| 1369 | // that is called. |
| 1370 | if (!ID) { |
| 1371 | if (const ObjCObjectPointerType *PT = |
| 1372 | Receiver->getType()->getAs<ObjCObjectPointerType>()) |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1373 | ID = PT->getInterfaceDecl(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1374 | } |
| 1375 | } else { |
| 1376 | // FIXME: Hack for 'super'. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1377 | ID = msg.getReceiverInterface(); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1378 | } |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1379 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1380 | // FIXME: The receiver could be a reference to a class, meaning that |
| 1381 | // we should use the class method. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1382 | return getInstanceMethodSummary(msg, ID); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1383 | } |
| 1384 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1385 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1386 | RetainSummaryManager::getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 1387 | const ObjCInterfaceDecl *ID, |
| 1388 | const ObjCMethodDecl *MD, QualType RetTy, |
| 1389 | ObjCMethodSummariesTy &CachedSummaries) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1390 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1391 | // Look up a summary in our summary cache. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1392 | const RetainSummary *Summ = CachedSummaries.find(ID, ClsName, S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1393 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1394 | if (!Summ) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1395 | Summ = getStandardMethodSummary(MD, S, RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1396 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1397 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1398 | updateSummaryFromAnnotations(Summ, MD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1399 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1400 | // Memoize the summary. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1401 | CachedSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1402 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1403 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1404 | return Summ; |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1405 | } |
| 1406 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1407 | void RetainSummaryManager::InitializeClassMethodSummaries() { |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1408 | assert(ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1409 | // Create the [NSAssertionHandler currentHander] summary. |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1410 | addClassMethSummary("NSAssertionHandler", "currentHandler", |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1411 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1412 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1413 | // Create the [NSAutoreleasePool addObject:] summary. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1414 | ScratchArgs = AF.add(ScratchArgs, 0, Autorelease); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1415 | addClassMethSummary("NSAutoreleasePool", "addObject", |
| 1416 | getPersistentSummary(RetEffect::MakeNoRet(), |
| 1417 | DoNothing, Autorelease)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1418 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1419 | // Create the summaries for [NSObject performSelector...]. We treat |
| 1420 | // these as 'stop tracking' for the arguments because they are often |
| 1421 | // used for delegates that can release the object. When we have better |
| 1422 | // inter-procedural analysis we can potentially do something better. This |
| 1423 | // workaround is to remove false positives. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1424 | const RetainSummary *Summ = |
Ted Kremenek | 012614e | 2011-08-17 21:04:19 +0000 | [diff] [blame] | 1425 | getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1426 | IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject"); |
| 1427 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1428 | "afterDelay", NULL); |
| 1429 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1430 | "afterDelay", "inModes", NULL); |
| 1431 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1432 | "withObject", "waitUntilDone", NULL); |
| 1433 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1434 | "withObject", "waitUntilDone", "modes", NULL); |
| 1435 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1436 | "withObject", "waitUntilDone", NULL); |
| 1437 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1438 | "withObject", "waitUntilDone", "modes", NULL); |
| 1439 | addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground", |
| 1440 | "withObject", NULL); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 1441 | } |
| 1442 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 1443 | void RetainSummaryManager::InitializeMethodSummaries() { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1444 | |
| 1445 | assert (ScratchArgs.isEmpty()); |
| 1446 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1447 | // Create the "init" selector. It just acts as a pass-through for the |
| 1448 | // receiver. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1449 | const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 1450 | addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm); |
| 1451 | |
| 1452 | // awakeAfterUsingCoder: behaves basically like an 'init' method. It |
| 1453 | // claims the receiver and returns a retained object. |
| 1454 | addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx), |
| 1455 | InitSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1456 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1457 | // The next methods are allocators. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1458 | const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE); |
| 1459 | const RetainSummary *CFAllocSumm = |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1460 | getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1461 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1462 | // Create the "retain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1463 | RetEffect NoRet = RetEffect::MakeNoRet(); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1464 | const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1465 | addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1466 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1467 | // Create the "release" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1468 | Summ = getPersistentSummary(NoRet, DecRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1469 | addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1470 | |
Ted Kremenek | 299e815 | 2008-05-07 21:17:39 +0000 | [diff] [blame] | 1471 | // Create the "drain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1472 | Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1473 | addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1474 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1475 | // Create the -dealloc summary. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1476 | Summ = getPersistentSummary(NoRet, Dealloc); |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1477 | addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1478 | |
| 1479 | // Create the "autorelease" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1480 | Summ = getPersistentSummary(NoRet, Autorelease); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1481 | addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1482 | |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1483 | // Specially handle NSAutoreleasePool. |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1484 | addInstMethSummary("NSAutoreleasePool", "init", |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1485 | getPersistentSummary(NoRet, NewAutoreleasePool)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1486 | |
| 1487 | // For NSWindow, allocated objects are (initially) self-owned. |
Ted Kremenek | 89e202d | 2009-02-23 02:51:29 +0000 | [diff] [blame] | 1488 | // FIXME: For now we opt for false negatives with NSWindow, as these objects |
| 1489 | // self-own themselves. However, they only do this once they are displayed. |
| 1490 | // Thus, we need to track an NSWindow's display status. |
| 1491 | // This is tracked in <rdar://problem/6062711>. |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1492 | // See also http://llvm.org/bugs/show_bug.cgi?id=3714. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1493 | const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(), |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1494 | StopTracking, |
| 1495 | StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1496 | |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1497 | addClassMethSummary("NSWindow", "alloc", NoTrackYet); |
| 1498 | |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1499 | #if 0 |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1500 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1501 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1502 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1503 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1504 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1505 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1506 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1507 | // For NSPanel (which subclasses NSWindow), allocated objects are not |
| 1508 | // self-owned. |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1509 | // FIXME: For now we don't track NSPanels. object for the same reason |
| 1510 | // as for NSWindow objects. |
| 1511 | addClassMethSummary("NSPanel", "alloc", NoTrackYet); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1512 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1513 | #if 0 |
| 1514 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1515 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1516 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1517 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1518 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1519 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1520 | |
Ted Kremenek | ba67f6a | 2009-05-18 23:14:34 +0000 | [diff] [blame] | 1521 | // Don't track allocated autorelease pools yet, as it is okay to prematurely |
| 1522 | // exit a method. |
| 1523 | addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 1524 | addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1525 | |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1526 | // Create summaries QCRenderer/QCView -createSnapShotImageOfType: |
| 1527 | addInstMethSummary("QCRenderer", AllocSumm, |
| 1528 | "createSnapshotImageOfType", NULL); |
| 1529 | addInstMethSummary("QCView", AllocSumm, |
| 1530 | "createSnapshotImageOfType", NULL); |
| 1531 | |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1532 | // Create summaries for CIContext, 'createCGImage' and |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1533 | // 'createCGLayerWithSize'. These objects are CF objects, and are not |
| 1534 | // automatically garbage collected. |
| 1535 | addInstMethSummary("CIContext", CFAllocSumm, |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1536 | "createCGImage", "fromRect", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1537 | addInstMethSummary("CIContext", CFAllocSumm, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1538 | "createCGImage", "fromRect", "format", "colorSpace", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1539 | addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1540 | "info", NULL); |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1541 | } |
| 1542 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1543 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1544 | // AutoreleaseBindings - State used to track objects in autorelease pools. |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1545 | //===----------------------------------------------------------------------===// |
| 1546 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1547 | typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts; |
| 1548 | typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents; |
| 1549 | typedef llvm::ImmutableList<SymbolRef> ARStack; |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1550 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1551 | static int AutoRCIndex = 0; |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1552 | static int AutoRBIndex = 0; |
| 1553 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1554 | namespace { class AutoreleasePoolContents {}; } |
| 1555 | namespace { class AutoreleaseStack {}; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1556 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1557 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 1558 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1559 | template<> struct ProgramStateTrait<AutoreleaseStack> |
| 1560 | : public ProgramStatePartialTrait<ARStack> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1561 | static inline void *GDMIndex() { return &AutoRBIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1562 | }; |
| 1563 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1564 | template<> struct ProgramStateTrait<AutoreleasePoolContents> |
| 1565 | : public ProgramStatePartialTrait<ARPoolContents> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1566 | static inline void *GDMIndex() { return &AutoRCIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1567 | }; |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 1568 | } // end GR namespace |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1569 | } // end clang namespace |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1570 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1571 | static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1572 | ARStack stack = state->get<AutoreleaseStack>(); |
| 1573 | return stack.isEmpty() ? SymbolRef() : stack.getHead(); |
| 1574 | } |
| 1575 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1576 | static ProgramStateRef |
| 1577 | SendAutorelease(ProgramStateRef state, |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1578 | ARCounts::Factory &F, |
| 1579 | SymbolRef sym) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1580 | SymbolRef pool = GetCurrentAutoreleasePool(state); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1581 | const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1582 | ARCounts newCnts(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1583 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1584 | if (cnts) { |
| 1585 | const unsigned *cnt = (*cnts).lookup(sym); |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1586 | newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1587 | } |
| 1588 | else |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1589 | newCnts = F.add(F.getEmptyMap(), sym, 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1590 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1591 | return state->set<AutoreleasePoolContents>(pool, newCnts); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1592 | } |
| 1593 | |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 1594 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1595 | // Error reporting. |
| 1596 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1597 | namespace { |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1598 | typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *> |
| 1599 | SummaryLogTy; |
| 1600 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1601 | //===-------------===// |
| 1602 | // Bug Descriptions. // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1603 | //===-------------===// |
| 1604 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1605 | class CFRefBug : public BugType { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1606 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1607 | CFRefBug(StringRef name) |
| 1608 | : BugType(name, "Memory (Core Foundation/Objective-C)") {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1609 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1610 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1611 | // FIXME: Eventually remove. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1612 | virtual const char *getDescription() const = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1613 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1614 | virtual bool isLeak() const { return false; } |
| 1615 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1616 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1617 | class UseAfterRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1618 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1619 | UseAfterRelease() : CFRefBug("Use-after-release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1620 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1621 | const char *getDescription() const { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1622 | return "Reference-counted object is used after it is released"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1623 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1624 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1625 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1626 | class BadRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1627 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1628 | BadRelease() : CFRefBug("Bad release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1629 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1630 | const char *getDescription() const { |
Ted Kremenek | bb206fd | 2009-10-01 17:31:50 +0000 | [diff] [blame] | 1631 | return "Incorrect decrement of the reference count of an object that is " |
| 1632 | "not owned at this point by the caller"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1633 | } |
| 1634 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1635 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1636 | class DeallocGC : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1637 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1638 | DeallocGC() |
| 1639 | : CFRefBug("-dealloc called while using garbage collection") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1640 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1641 | const char *getDescription() const { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1642 | return "-dealloc called while using garbage collection"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1643 | } |
| 1644 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1645 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1646 | class DeallocNotOwned : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1647 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1648 | DeallocNotOwned() |
| 1649 | : CFRefBug("-dealloc sent to non-exclusively owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1650 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1651 | const char *getDescription() const { |
| 1652 | return "-dealloc sent to object that may be referenced elsewhere"; |
| 1653 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1654 | }; |
| 1655 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1656 | class OverAutorelease : public CFRefBug { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1657 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1658 | OverAutorelease() |
| 1659 | : CFRefBug("Object sent -autorelease too many times") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1660 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1661 | const char *getDescription() const { |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1662 | return "Object sent -autorelease too many times"; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1663 | } |
| 1664 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1665 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1666 | class ReturnedNotOwnedForOwned : public CFRefBug { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1667 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1668 | ReturnedNotOwnedForOwned() |
| 1669 | : CFRefBug("Method should return an owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1670 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1671 | const char *getDescription() const { |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 1672 | return "Object with a +0 retain count returned to caller where a +1 " |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1673 | "(owning) retain count is expected"; |
| 1674 | } |
| 1675 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1676 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1677 | class Leak : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1678 | const bool isReturn; |
| 1679 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1680 | Leak(StringRef name, bool isRet) |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 1681 | : CFRefBug(name), isReturn(isRet) { |
| 1682 | // Leaks should not be reported if they are post-dominated by a sink. |
| 1683 | setSuppressOnSink(true); |
| 1684 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1685 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1686 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1687 | const char *getDescription() const { return ""; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1688 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1689 | bool isLeak() const { return true; } |
| 1690 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1691 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1692 | class LeakAtReturn : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1693 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1694 | LeakAtReturn(StringRef name) |
| 1695 | : Leak(name, true) {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1696 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1697 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1698 | class LeakWithinFunction : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1699 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1700 | LeakWithinFunction(StringRef name) |
| 1701 | : Leak(name, false) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1702 | }; |
| 1703 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1704 | //===---------===// |
| 1705 | // Bug Reports. // |
| 1706 | //===---------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1707 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1708 | class CFRefReportVisitor : public BugReporterVisitor { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1709 | protected: |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1710 | SymbolRef Sym; |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1711 | const SummaryLogTy &SummaryLog; |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1712 | bool GCEnabled; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1713 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1714 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1715 | CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log) |
| 1716 | : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {} |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1717 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1718 | virtual void Profile(llvm::FoldingSetNodeID &ID) const { |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1719 | static int x = 0; |
| 1720 | ID.AddPointer(&x); |
| 1721 | ID.AddPointer(Sym); |
| 1722 | } |
| 1723 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1724 | virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 1725 | const ExplodedNode *PrevN, |
| 1726 | BugReporterContext &BRC, |
| 1727 | BugReport &BR); |
| 1728 | |
| 1729 | virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1730 | const ExplodedNode *N, |
| 1731 | BugReport &BR); |
| 1732 | }; |
| 1733 | |
| 1734 | class CFRefLeakReportVisitor : public CFRefReportVisitor { |
| 1735 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1736 | CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled, |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1737 | const SummaryLogTy &log) |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1738 | : CFRefReportVisitor(sym, GCEnabled, log) {} |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1739 | |
| 1740 | PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1741 | const ExplodedNode *N, |
| 1742 | BugReport &BR); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1743 | }; |
| 1744 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1745 | class CFRefReport : public BugReport { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1746 | void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1747 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1748 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1749 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1750 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1751 | bool registerVisitor = true) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1752 | : BugReport(D, D.getDescription(), n) { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1753 | if (registerVisitor) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1754 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1755 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1756 | } |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1757 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1758 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1759 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1760 | StringRef endText) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1761 | : BugReport(D, D.getDescription(), endText, n) { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1762 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1763 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1764 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1765 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1766 | virtual std::pair<ranges_iterator, ranges_iterator> getRanges() { |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1767 | const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType()); |
| 1768 | if (!BugTy.isLeak()) |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1769 | return BugReport::getRanges(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1770 | else |
Argyrios Kyrtzidis | 640ccf0 | 2010-12-04 01:12:15 +0000 | [diff] [blame] | 1771 | return std::make_pair(ranges_iterator(), ranges_iterator()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1772 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1773 | }; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1774 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1775 | class CFRefLeakReport : public CFRefReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1776 | const MemRegion* AllocBinding; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1777 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1778 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1779 | CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1780 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 1781 | CheckerContext &Ctx); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1782 | |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 1783 | PathDiagnosticLocation getLocation(const SourceManager &SM) const { |
| 1784 | assert(Location.isValid()); |
| 1785 | return Location; |
| 1786 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1787 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1788 | } // end anonymous namespace |
| 1789 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1790 | void CFRefReport::addGCModeDescription(const LangOptions &LOpts, |
| 1791 | bool GCEnabled) { |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1792 | const char *GCModeDescription = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1793 | |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 1794 | switch (LOpts.getGC()) { |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1795 | case LangOptions::GCOnly: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1796 | assert(GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1797 | GCModeDescription = "Code is compiled to only use garbage collection"; |
| 1798 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1799 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1800 | case LangOptions::NonGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1801 | assert(!GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1802 | GCModeDescription = "Code is compiled to use reference counts"; |
| 1803 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1804 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1805 | case LangOptions::HybridGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1806 | if (GCEnabled) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1807 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1808 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1809 | "with GC enabled"; |
| 1810 | break; |
| 1811 | } else { |
| 1812 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1813 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1814 | "in non-GC mode"; |
| 1815 | break; |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1816 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1817 | } |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1818 | |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1819 | assert(GCModeDescription && "invalid/unknown GC mode"); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1820 | addExtraText(GCModeDescription); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1821 | } |
| 1822 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1823 | // FIXME: This should be a method on SmallVector. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1824 | static inline bool contains(const SmallVectorImpl<ArgEffect>& V, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1825 | ArgEffect X) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1826 | for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1827 | I!=E; ++I) |
| 1828 | if (*I == X) return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1829 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1830 | return false; |
| 1831 | } |
| 1832 | |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 1833 | static bool isPropertyAccess(const Stmt *S, ParentMap &PM) { |
| 1834 | unsigned maxDepth = 4; |
| 1835 | while (S && maxDepth) { |
| 1836 | if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) { |
| 1837 | if (!isa<ObjCMessageExpr>(PO->getSyntacticForm())) |
| 1838 | return true; |
| 1839 | return false; |
| 1840 | } |
| 1841 | S = PM.getParent(S); |
| 1842 | --maxDepth; |
| 1843 | } |
| 1844 | return false; |
| 1845 | } |
| 1846 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1847 | PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N, |
| 1848 | const ExplodedNode *PrevN, |
| 1849 | BugReporterContext &BRC, |
| 1850 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1851 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1852 | if (!isa<StmtPoint>(N->getLocation())) |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 1853 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1854 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 1855 | // Check if the type state has changed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1856 | ProgramStateRef PrevSt = PrevN->getState(); |
| 1857 | ProgramStateRef CurrSt = N->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1858 | const LocationContext *LCtx = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1859 | |
| 1860 | const RefVal* CurrT = CurrSt->get<RefBindings>(Sym); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1861 | if (!CurrT) return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1862 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1863 | const RefVal &CurrV = *CurrT; |
| 1864 | const RefVal *PrevT = PrevSt->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1865 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1866 | // Create a string buffer to constain all the useful things we want |
| 1867 | // to tell the user. |
| 1868 | std::string sbuf; |
| 1869 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1870 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1871 | // This is the allocation site since the previous node had no bindings |
| 1872 | // for this symbol. |
| 1873 | if (!PrevT) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1874 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1875 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1876 | if (isa<ObjCArrayLiteral>(S)) { |
| 1877 | os << "NSArray literal is an object with a +0 retain count"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1878 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1879 | else if (isa<ObjCDictionaryLiteral>(S)) { |
| 1880 | os << "NSDictionary literal is an object with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1881 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1882 | else { |
| 1883 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
| 1884 | // Get the name of the callee (if it is available). |
| 1885 | SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx); |
| 1886 | if (const FunctionDecl *FD = X.getAsFunctionDecl()) |
| 1887 | os << "Call to function '" << *FD << '\''; |
| 1888 | else |
| 1889 | os << "function call"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1890 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1891 | else { |
| 1892 | assert(isa<ObjCMessageExpr>(S)); |
| 1893 | // The message expression may have between written directly or as |
| 1894 | // a property access. Lazily determine which case we are looking at. |
| 1895 | os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method"); |
| 1896 | } |
| 1897 | |
| 1898 | if (CurrV.getObjKind() == RetEffect::CF) { |
| 1899 | os << " returns a Core Foundation object with a "; |
| 1900 | } |
| 1901 | else { |
| 1902 | assert (CurrV.getObjKind() == RetEffect::ObjC); |
| 1903 | os << " returns an Objective-C object with a "; |
| 1904 | } |
| 1905 | |
| 1906 | if (CurrV.isOwned()) { |
| 1907 | os << "+1 retain count"; |
| 1908 | |
| 1909 | if (GCEnabled) { |
| 1910 | assert(CurrV.getObjKind() == RetEffect::CF); |
| 1911 | os << ". " |
| 1912 | "Core Foundation objects are not automatically garbage collected."; |
| 1913 | } |
| 1914 | } |
| 1915 | else { |
| 1916 | assert (CurrV.isNotOwned()); |
| 1917 | os << "+0 retain count"; |
| 1918 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1919 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1920 | |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 1921 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 1922 | N->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1923 | return new PathDiagnosticEventPiece(Pos, os.str()); |
| 1924 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1925 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1926 | // Gather up the effects that were performed on the object at this |
| 1927 | // program point |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1928 | SmallVector<ArgEffect, 2> AEffects; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1929 | |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1930 | const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N); |
| 1931 | if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1932 | // We only have summaries attached to nodes after evaluating CallExpr and |
| 1933 | // ObjCMessageExprs. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1934 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1935 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1936 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1937 | // Iterate through the parameter expressions and see if the symbol |
| 1938 | // was ever passed as an argument. |
| 1939 | unsigned i = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1940 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1941 | for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1942 | AI!=AE; ++AI, ++i) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1943 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1944 | // Retrieve the value of the argument. Is it the symbol |
| 1945 | // we are interested in? |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1946 | if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1947 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1949 | // We have an argument. Get the effect! |
| 1950 | AEffects.push_back(Summ->getArg(i)); |
| 1951 | } |
| 1952 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1953 | else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1954 | if (const Expr *receiver = ME->getInstanceReceiver()) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1955 | if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx) |
| 1956 | .getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1957 | // The symbol we are tracking is the receiver. |
| 1958 | AEffects.push_back(Summ->getReceiverEffect()); |
| 1959 | } |
| 1960 | } |
| 1961 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1962 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1963 | do { |
| 1964 | // Get the previous type state. |
| 1965 | RefVal PrevV = *PrevT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1966 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1967 | // Specially handle -dealloc. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1968 | if (!GCEnabled && contains(AEffects, Dealloc)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1969 | // Determine if the object's reference count was pushed to zero. |
| 1970 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
| 1971 | // We may not have transitioned to 'release' if we hit an error. |
| 1972 | // This case is handled elsewhere. |
| 1973 | if (CurrV.getKind() == RefVal::Released) { |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 1974 | assert(CurrV.getCombinedCounts() == 0); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1975 | os << "Object released by directly sending the '-dealloc' message"; |
| 1976 | break; |
| 1977 | } |
| 1978 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1979 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1980 | // Specially handle CFMakeCollectable and friends. |
| 1981 | if (contains(AEffects, MakeCollectable)) { |
| 1982 | // Get the name of the function. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1983 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1984 | SVal X = |
| 1985 | CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1986 | const FunctionDecl *FD = X.getAsFunctionDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1987 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1988 | if (GCEnabled) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1989 | // Determine if the object's reference count was pushed to zero. |
| 1990 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1991 | |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 1992 | os << "In GC mode a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1993 | << "' decrements an object's retain count and registers the " |
| 1994 | "object with the garbage collector. "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1995 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1996 | if (CurrV.getKind() == RefVal::Released) { |
| 1997 | assert(CurrV.getCount() == 0); |
| 1998 | os << "Since it now has a 0 retain count the object can be " |
| 1999 | "automatically collected by the garbage collector."; |
| 2000 | } |
| 2001 | else |
| 2002 | os << "An object must have a 0 retain count to be garbage collected. " |
| 2003 | "After this call its retain count is +" << CurrV.getCount() |
| 2004 | << '.'; |
| 2005 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2006 | else |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 2007 | os << "When GC is not enabled a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2008 | << "' has no effect on its argument."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2009 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2010 | // Nothing more to say. |
| 2011 | break; |
| 2012 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2013 | |
| 2014 | // Determine if the typestate has changed. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2015 | if (!(PrevV == CurrV)) |
| 2016 | switch (CurrV.getKind()) { |
| 2017 | case RefVal::Owned: |
| 2018 | case RefVal::NotOwned: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2019 | |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2020 | if (PrevV.getCount() == CurrV.getCount()) { |
| 2021 | // Did an autorelease message get sent? |
| 2022 | if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount()) |
| 2023 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2024 | |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2025 | assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount()); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2026 | os << "Object sent -autorelease message"; |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2027 | break; |
| 2028 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2029 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2030 | if (PrevV.getCount() > CurrV.getCount()) |
| 2031 | os << "Reference count decremented."; |
| 2032 | else |
| 2033 | os << "Reference count incremented."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2034 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2035 | if (unsigned Count = CurrV.getCount()) |
| 2036 | os << " The object now has a +" << Count << " retain count."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2037 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2038 | if (PrevV.getKind() == RefVal::Released) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2039 | assert(GCEnabled && CurrV.getCount() > 0); |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2040 | os << " The object is not eligible for garbage collection until " |
| 2041 | "the retain count reaches 0 again."; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2042 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2043 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2044 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2045 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2046 | case RefVal::Released: |
| 2047 | os << "Object released."; |
| 2048 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2049 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2050 | case RefVal::ReturnedOwned: |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2051 | // Autoreleases can be applied after marking a node ReturnedOwned. |
| 2052 | if (CurrV.getAutoreleaseCount()) |
| 2053 | return NULL; |
| 2054 | |
| 2055 | os << "Object returned to caller as an owning reference (single " |
| 2056 | "retain count transferred to caller)"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2057 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2058 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2059 | case RefVal::ReturnedNotOwned: |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2060 | os << "Object returned to caller with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2061 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2062 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2063 | default: |
| 2064 | return NULL; |
| 2065 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2066 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2067 | // Emit any remaining diagnostics for the argument effects (if any). |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2068 | for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(), |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2069 | E=AEffects.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2070 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2071 | // A bunch of things have alternate behavior under GC. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2072 | if (GCEnabled) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2073 | switch (*I) { |
| 2074 | default: break; |
| 2075 | case Autorelease: |
| 2076 | os << "In GC mode an 'autorelease' has no effect."; |
| 2077 | continue; |
| 2078 | case IncRefMsg: |
| 2079 | os << "In GC mode the 'retain' message has no effect."; |
| 2080 | continue; |
| 2081 | case DecRefMsg: |
| 2082 | os << "In GC mode the 'release' message has no effect."; |
| 2083 | continue; |
| 2084 | } |
| 2085 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2086 | } while (0); |
| 2087 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2088 | if (os.str().empty()) |
| 2089 | return 0; // We have nothing to say! |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2090 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2091 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 2092 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 2093 | N->getLocationContext()); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2094 | PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2095 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2096 | // Add the range by scanning the children of the statement for any bindings |
| 2097 | // to Sym. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2098 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2099 | I!=E; ++I) |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2100 | if (const Expr *Exp = dyn_cast_or_null<Expr>(*I)) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2101 | if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2102 | P->addRange(Exp->getSourceRange()); |
| 2103 | break; |
| 2104 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2105 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2106 | return P; |
| 2107 | } |
| 2108 | |
| 2109 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2110 | class FindUniqueBinding : |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2111 | public StoreManager::BindingsHandler { |
| 2112 | SymbolRef Sym; |
| 2113 | const MemRegion* Binding; |
| 2114 | bool First; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2115 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2116 | public: |
| 2117 | FindUniqueBinding(SymbolRef sym) : Sym(sym), Binding(0), First(true) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2118 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2119 | bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R, |
| 2120 | SVal val) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2121 | |
| 2122 | SymbolRef SymV = val.getAsSymbol(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2123 | if (!SymV || SymV != Sym) |
| 2124 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2125 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2126 | if (Binding) { |
| 2127 | First = false; |
| 2128 | return false; |
| 2129 | } |
| 2130 | else |
| 2131 | Binding = R; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2132 | |
| 2133 | return true; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2134 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2135 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2136 | operator bool() { return First && Binding; } |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 2137 | const MemRegion *getRegion() { return Binding; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2138 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2139 | } |
| 2140 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2141 | // Find the first node in the current function context that referred to the |
| 2142 | // tracked symbol and the memory location that value was stored to. Note, the |
| 2143 | // value is only reported if the allocation occurred in the same function as |
| 2144 | // the leak. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2145 | static std::pair<const ExplodedNode*,const MemRegion*> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 2146 | GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2147 | SymbolRef Sym) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2148 | const ExplodedNode *Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2149 | const MemRegion* FirstBinding = 0; |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2150 | const LocationContext *LeakContext = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2151 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2152 | while (N) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2153 | ProgramStateRef St = N->getState(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2154 | RefBindings B = St->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2155 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2156 | if (!B.lookup(Sym)) |
| 2157 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2158 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2159 | FindUniqueBinding FB(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2160 | StateMgr.iterBindings(St, FB); |
| 2161 | if (FB) FirstBinding = FB.getRegion(); |
| 2162 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2163 | // Allocation node, is the last node in the current context in which the |
| 2164 | // symbol was tracked. |
| 2165 | if (N->getLocationContext() == LeakContext) |
| 2166 | Last = N; |
| 2167 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2168 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2169 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2170 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2171 | // If allocation happened in a function different from the leak node context, |
| 2172 | // do not report the binding. |
| 2173 | if (N->getLocationContext() != LeakContext) { |
| 2174 | FirstBinding = 0; |
| 2175 | } |
| 2176 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2177 | return std::make_pair(Last, FirstBinding); |
| 2178 | } |
| 2179 | |
| 2180 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2181 | CFRefReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2182 | const ExplodedNode *EndN, |
| 2183 | BugReport &BR) { |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2184 | BR.markInteresting(Sym); |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2185 | return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2186 | } |
| 2187 | |
| 2188 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2189 | CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2190 | const ExplodedNode *EndN, |
| 2191 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2192 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2193 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2194 | // assigned to different variables, etc. |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2195 | BR.markInteresting(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2196 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2197 | // We are reporting a leak. Walk up the graph to get to the first node where |
| 2198 | // the symbol appeared, and also get the first VarDecl that tracked object |
| 2199 | // is stored to. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2200 | const ExplodedNode *AllocNode = 0; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2201 | const MemRegion* FirstBinding = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2202 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2203 | llvm::tie(AllocNode, FirstBinding) = |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2204 | GetAllocationSite(BRC.getStateManager(), EndN, Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2205 | |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2206 | SourceManager& SM = BRC.getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2207 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2208 | // Compute an actual location for the leak. Sometimes a leak doesn't |
| 2209 | // occur at an actual statement (e.g., transition between blocks; end |
| 2210 | // of function) so we need to walk the graph and compute a real location. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2211 | const ExplodedNode *LeakN = EndN; |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2212 | PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2213 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2214 | std::string sbuf; |
| 2215 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2216 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2217 | os << "Object leaked: "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2218 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2219 | if (FirstBinding) { |
| 2220 | os << "object allocated and stored into '" |
| 2221 | << FirstBinding->getString() << '\''; |
| 2222 | } |
| 2223 | else |
| 2224 | os << "allocated object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2225 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2226 | // Get the retain count. |
| 2227 | const RefVal* RV = EndN->getState()->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2228 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2229 | if (RV->getKind() == RefVal::ErrorLeakReturned) { |
| 2230 | // FIXME: Per comments in rdar://6320065, "create" only applies to CF |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2231 | // objects. Only "copy", "alloc", "retain" and "new" transfer ownership |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2232 | // to the caller for NS objects. |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2233 | const Decl *D = &EndN->getCodeDecl(); |
| 2234 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
| 2235 | os << " is returned from a method whose name ('" |
| 2236 | << MD->getSelector().getAsString() |
| 2237 | << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'." |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2238 | " This violates the naming convention rules" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2239 | " given in the Memory Management Guide for Cocoa"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2240 | } |
| 2241 | else { |
| 2242 | const FunctionDecl *FD = cast<FunctionDecl>(D); |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2243 | os << " is returned from a function whose name ('" |
Benjamin Kramer | a59d20b | 2012-02-07 11:57:57 +0000 | [diff] [blame] | 2244 | << *FD |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2245 | << "') does not contain 'Copy' or 'Create'. This violates the naming" |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2246 | " convention rules given in the Memory Management Guide for Core" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2247 | " Foundation"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2248 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2249 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2250 | else if (RV->getKind() == RefVal::ErrorGCLeakReturned) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2251 | ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2252 | os << " and returned from method '" << MD.getSelector().getAsString() |
Ted Kremenek | 82f2be5 | 2009-05-10 16:52:15 +0000 | [diff] [blame] | 2253 | << "' is potentially leaked when using garbage collection. Callers " |
| 2254 | "of this method do not expect a returned object with a +1 retain " |
| 2255 | "count since they expect the object to be managed by the garbage " |
| 2256 | "collector"; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2257 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2258 | else |
Ted Kremenek | abf517c | 2010-10-15 22:50:23 +0000 | [diff] [blame] | 2259 | os << " is not referenced later in this execution path and has a retain " |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2260 | "count of +" << RV->getCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2261 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2262 | return new PathDiagnosticEventPiece(L, os.str()); |
| 2263 | } |
| 2264 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2265 | CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, |
| 2266 | bool GCEnabled, const SummaryLogTy &Log, |
| 2267 | ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2268 | CheckerContext &Ctx) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2269 | : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2270 | |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 2271 | // Most bug reports are cached at the location where they occurred. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2272 | // With leaks, we want to unique them by the location where they were |
| 2273 | // allocated, and only report a single path. To do this, we need to find |
| 2274 | // the allocation site of a piece of tracked memory, which we do via a |
| 2275 | // call to GetAllocationSite. This will walk the ExplodedGraph backwards. |
| 2276 | // Note that this is *not* the trimmed graph; we are guaranteed, however, |
| 2277 | // that all ancestor nodes that represent the allocation site have the |
| 2278 | // same SourceLocation. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2279 | const ExplodedNode *AllocNode = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2280 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2281 | const SourceManager& SMgr = Ctx.getSourceManager(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2282 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2283 | llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding. |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2284 | GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2285 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2286 | // Get the SourceLocation for the allocation site. |
| 2287 | ProgramPoint P = AllocNode->getLocation(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2288 | const Stmt *AllocStmt = cast<PostStmt>(P).getStmt(); |
| 2289 | Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr, |
| 2290 | n->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2291 | // Fill in the description of the bug. |
| 2292 | Description.clear(); |
| 2293 | llvm::raw_string_ostream os(Description); |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2294 | os << "Potential leak "; |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2295 | if (GCEnabled) |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2296 | os << "(when using garbage collection) "; |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2297 | os << "of an object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2298 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2299 | // FIXME: AllocBinding doesn't get populated for RegionStore yet. |
| 2300 | if (AllocBinding) |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2301 | os << " stored into '" << AllocBinding->getString() << '\''; |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 2302 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2303 | addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log)); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2304 | } |
| 2305 | |
| 2306 | //===----------------------------------------------------------------------===// |
| 2307 | // Main checker logic. |
| 2308 | //===----------------------------------------------------------------------===// |
| 2309 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2310 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2311 | class RetainCountChecker |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2312 | : public Checker< check::Bind, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2313 | check::DeadSymbols, |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2314 | check::EndAnalysis, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2315 | check::EndPath, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2316 | check::PostStmt<BlockExpr>, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2317 | check::PostStmt<CastExpr>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2318 | check::PostStmt<CallExpr>, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2319 | check::PostStmt<CXXConstructExpr>, |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2320 | check::PostStmt<ObjCArrayLiteral>, |
| 2321 | check::PostStmt<ObjCDictionaryLiteral>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2322 | check::PostObjCMessage, |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2323 | check::PreStmt<ReturnStmt>, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2324 | check::RegionChanges, |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2325 | eval::Assume, |
| 2326 | eval::Call > { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2327 | mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned; |
| 2328 | mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned; |
| 2329 | mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned; |
| 2330 | mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn; |
| 2331 | mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2332 | |
| 2333 | typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap; |
| 2334 | |
| 2335 | // This map is only used to ensure proper deletion of any allocated tags. |
| 2336 | mutable SymbolTagMap DeadSymbolTags; |
| 2337 | |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2338 | mutable OwningPtr<RetainSummaryManager> Summaries; |
| 2339 | mutable OwningPtr<RetainSummaryManager> SummariesGC; |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2340 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2341 | mutable ARCounts::Factory ARCountFactory; |
| 2342 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2343 | mutable SummaryLogTy SummaryLog; |
| 2344 | mutable bool ShouldResetSummaryLog; |
| 2345 | |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2346 | public: |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2347 | RetainCountChecker() : ShouldResetSummaryLog(false) {} |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2348 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2349 | virtual ~RetainCountChecker() { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2350 | DeleteContainerSeconds(DeadSymbolTags); |
| 2351 | } |
| 2352 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2353 | void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR, |
| 2354 | ExprEngine &Eng) const { |
| 2355 | // FIXME: This is a hack to make sure the summary log gets cleared between |
| 2356 | // analyses of different code bodies. |
| 2357 | // |
| 2358 | // Why is this necessary? Because a checker's lifetime is tied to a |
| 2359 | // translation unit, but an ExplodedGraph's lifetime is just a code body. |
| 2360 | // Once in a blue moon, a new ExplodedNode will have the same address as an |
| 2361 | // old one with an associated summary, and the bug report visitor gets very |
| 2362 | // confused. (To make things worse, the summary lifetime is currently also |
| 2363 | // tied to a code body, so we get a crash instead of incorrect results.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2364 | // |
| 2365 | // Why is this a bad solution? Because if the lifetime of the ExplodedGraph |
| 2366 | // changes, things will start going wrong again. Really the lifetime of this |
| 2367 | // log needs to be tied to either the specific nodes in it or the entire |
| 2368 | // ExplodedGraph, not to a specific part of the code being analyzed. |
| 2369 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2370 | // (Also, having stateful local data means that the same checker can't be |
| 2371 | // used from multiple threads, but a lot of checkers have incorrect |
| 2372 | // assumptions about that anyway. So that wasn't a priority at the time of |
| 2373 | // this fix.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2374 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2375 | // This happens at the end of analysis, but bug reports are emitted /after/ |
| 2376 | // this point. So we can't just clear the summary log now. Instead, we mark |
| 2377 | // that the next time we access the summary log, it should be cleared. |
| 2378 | |
| 2379 | // If we never reset the summary log during /this/ code body analysis, |
| 2380 | // there were no new summaries. There might still have been summaries from |
| 2381 | // the /last/ analysis, so clear them out to make sure the bug report |
| 2382 | // visitors don't get confused. |
| 2383 | if (ShouldResetSummaryLog) |
| 2384 | SummaryLog.clear(); |
| 2385 | |
| 2386 | ShouldResetSummaryLog = !SummaryLog.empty(); |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2387 | } |
| 2388 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2389 | CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts, |
| 2390 | bool GCEnabled) const { |
| 2391 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2392 | if (!leakWithinFunctionGC) |
| 2393 | leakWithinFunctionGC.reset(new LeakWithinFunction("Leak of object when " |
| 2394 | "using garbage " |
| 2395 | "collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2396 | return leakWithinFunctionGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2397 | } else { |
| 2398 | if (!leakWithinFunction) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2399 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2400 | leakWithinFunction.reset(new LeakWithinFunction("Leak of object when " |
| 2401 | "not using garbage " |
| 2402 | "collection (GC) in " |
| 2403 | "dual GC/non-GC " |
| 2404 | "code")); |
| 2405 | } else { |
| 2406 | leakWithinFunction.reset(new LeakWithinFunction("Leak")); |
| 2407 | } |
| 2408 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2409 | return leakWithinFunction.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2410 | } |
| 2411 | } |
| 2412 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2413 | CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const { |
| 2414 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2415 | if (!leakAtReturnGC) |
| 2416 | leakAtReturnGC.reset(new LeakAtReturn("Leak of returned object when " |
| 2417 | "using garbage collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2418 | return leakAtReturnGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2419 | } else { |
| 2420 | if (!leakAtReturn) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2421 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2422 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object when " |
| 2423 | "not using garbage collection " |
| 2424 | "(GC) in dual GC/non-GC code")); |
| 2425 | } else { |
| 2426 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object")); |
| 2427 | } |
| 2428 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2429 | return leakAtReturn.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2430 | } |
| 2431 | } |
| 2432 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2433 | RetainSummaryManager &getSummaryManager(ASTContext &Ctx, |
| 2434 | bool GCEnabled) const { |
| 2435 | // FIXME: We don't support ARC being turned on and off during one analysis. |
| 2436 | // (nor, for that matter, do we support changing ASTContexts) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2437 | bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2438 | if (GCEnabled) { |
| 2439 | if (!SummariesGC) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2440 | SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2441 | else |
| 2442 | assert(SummariesGC->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2443 | return *SummariesGC; |
| 2444 | } else { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2445 | if (!Summaries) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2446 | Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2447 | else |
| 2448 | assert(Summaries->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2449 | return *Summaries; |
| 2450 | } |
| 2451 | } |
| 2452 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2453 | RetainSummaryManager &getSummaryManager(CheckerContext &C) const { |
| 2454 | return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled()); |
| 2455 | } |
| 2456 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2457 | void printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 2458 | const char *NL, const char *Sep) const; |
| 2459 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 2460 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2461 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
| 2462 | void checkPostStmt(const CastExpr *CE, CheckerContext &C) const; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2463 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2464 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2465 | void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2466 | void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const; |
| 2467 | void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2468 | void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2469 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2470 | void checkSummary(const RetainSummary &Summ, const CallOrObjCMessage &Call, |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2471 | CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2472 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2473 | bool evalCall(const CallExpr *CE, CheckerContext &C) const; |
| 2474 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2475 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2476 | bool Assumption) const; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2477 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2478 | ProgramStateRef |
| 2479 | checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2480 | const StoreManager::InvalidatedSymbols *invalidated, |
| 2481 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 2482 | ArrayRef<const MemRegion *> Regions, |
| 2483 | const CallOrObjCMessage *Call) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2484 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2485 | bool wantsRegionChangeUpdate(ProgramStateRef state) const { |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2486 | return true; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2487 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2488 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2489 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
| 2490 | void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, |
| 2491 | ExplodedNode *Pred, RetEffect RE, RefVal X, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2492 | SymbolRef Sym, ProgramStateRef state) const; |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2493 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2494 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 2495 | void checkEndPath(CheckerContext &C) const; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2496 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2497 | ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2498 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2499 | CheckerContext &C) const; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2500 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2501 | void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2502 | RefVal::Kind ErrorKind, SymbolRef Sym, |
| 2503 | CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2504 | |
| 2505 | void processObjCLiterals(CheckerContext &C, const Expr *Ex) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2506 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2507 | const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const; |
| 2508 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2509 | ProgramStateRef handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2510 | SymbolRef sid, RefVal V, |
| 2511 | SmallVectorImpl<SymbolRef> &Leaked) const; |
| 2512 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2513 | std::pair<ExplodedNode *, ProgramStateRef > |
| 2514 | handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2515 | GenericNodeBuilderRefCount Bd, ExplodedNode *Pred, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2516 | CheckerContext &Ctx, SymbolRef Sym, RefVal V) const; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2517 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2518 | ExplodedNode *processLeaks(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2519 | SmallVectorImpl<SymbolRef> &Leaked, |
| 2520 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2521 | CheckerContext &Ctx, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2522 | ExplodedNode *Pred = 0) const; |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2523 | }; |
| 2524 | } // end anonymous namespace |
| 2525 | |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2526 | namespace { |
| 2527 | class StopTrackingCallback : public SymbolVisitor { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2528 | ProgramStateRef state; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2529 | public: |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2530 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 2531 | ProgramStateRef getState() const { return state; } |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2532 | |
| 2533 | bool VisitSymbol(SymbolRef sym) { |
| 2534 | state = state->remove<RefBindings>(sym); |
| 2535 | return true; |
| 2536 | } |
| 2537 | }; |
| 2538 | } // end anonymous namespace |
| 2539 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2540 | //===----------------------------------------------------------------------===// |
| 2541 | // Handle statements that may have an effect on refcounts. |
| 2542 | //===----------------------------------------------------------------------===// |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2543 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2544 | void RetainCountChecker::checkPostStmt(const BlockExpr *BE, |
| 2545 | CheckerContext &C) const { |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2546 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2547 | // Scan the BlockDecRefExprs for any object the retain count checker |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2548 | // may be tracking. |
John McCall | 469a1eb | 2011-02-02 13:00:07 +0000 | [diff] [blame] | 2549 | if (!BE->getBlockDecl()->hasCaptures()) |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2550 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2551 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2552 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2553 | const BlockDataRegion *R = |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2554 | cast<BlockDataRegion>(state->getSVal(BE, |
| 2555 | C.getLocationContext()).getAsRegion()); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2556 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2557 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 2558 | E = R->referenced_vars_end(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2559 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2560 | if (I == E) |
| 2561 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2562 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2563 | // FIXME: For now we invalidate the tracking of all symbols passed to blocks |
| 2564 | // via captured variables, even though captured variables result in a copy |
| 2565 | // and in implicit increment/decrement of a retain count. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2566 | SmallVector<const MemRegion*, 10> Regions; |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2567 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2568 | MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2569 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2570 | for ( ; I != E; ++I) { |
| 2571 | const VarRegion *VR = *I; |
| 2572 | if (VR->getSuperRegion() == R) { |
| 2573 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 2574 | } |
| 2575 | Regions.push_back(VR); |
| 2576 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2577 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2578 | state = |
| 2579 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 2580 | Regions.data() + Regions.size()).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2581 | C.addTransition(state); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2582 | } |
| 2583 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2584 | void RetainCountChecker::checkPostStmt(const CastExpr *CE, |
| 2585 | CheckerContext &C) const { |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2586 | const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE); |
| 2587 | if (!BE) |
| 2588 | return; |
| 2589 | |
John McCall | 71c482c | 2011-06-17 06:50:50 +0000 | [diff] [blame] | 2590 | ArgEffect AE = IncRef; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2591 | |
| 2592 | switch (BE->getBridgeKind()) { |
| 2593 | case clang::OBC_Bridge: |
| 2594 | // Do nothing. |
| 2595 | return; |
| 2596 | case clang::OBC_BridgeRetained: |
| 2597 | AE = IncRef; |
| 2598 | break; |
| 2599 | case clang::OBC_BridgeTransfer: |
| 2600 | AE = DecRefBridgedTransfered; |
| 2601 | break; |
| 2602 | } |
| 2603 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2604 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2605 | SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol(); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2606 | if (!Sym) |
| 2607 | return; |
| 2608 | const RefVal* T = state->get<RefBindings>(Sym); |
| 2609 | if (!T) |
| 2610 | return; |
| 2611 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2612 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2613 | state = updateSymbol(state, Sym, *T, AE, hasErr, C); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2614 | |
| 2615 | if (hasErr) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2616 | // FIXME: If we get an error during a bridge cast, should we report it? |
| 2617 | // Should we assert that there is no error? |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2618 | return; |
| 2619 | } |
| 2620 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2621 | C.addTransition(state); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2622 | } |
| 2623 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2624 | void RetainCountChecker::checkPostStmt(const CallExpr *CE, |
| 2625 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2626 | // Get the callee. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2627 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2628 | const Expr *Callee = CE->getCallee(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2629 | SVal L = state->getSVal(Callee, C.getLocationContext()); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2630 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2631 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2632 | const RetainSummary *Summ = 0; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2633 | |
| 2634 | // FIXME: Better support for blocks. For now we stop tracking anything |
| 2635 | // that is passed to blocks. |
| 2636 | // FIXME: Need to handle variables that are "captured" by the block. |
| 2637 | if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) { |
| 2638 | Summ = Summaries.getPersistentStopSummary(); |
| 2639 | } else if (const FunctionDecl *FD = L.getAsFunctionDecl()) { |
| 2640 | Summ = Summaries.getSummary(FD); |
| 2641 | } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) { |
| 2642 | if (const CXXMethodDecl *MD = me->getMethodDecl()) |
| 2643 | Summ = Summaries.getSummary(MD); |
| 2644 | } |
| 2645 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2646 | if (!Summ) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2647 | Summ = Summaries.getDefaultSummary(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2648 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2649 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2650 | } |
| 2651 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2652 | void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE, |
| 2653 | CheckerContext &C) const { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2654 | const CXXConstructorDecl *Ctor = CE->getConstructor(); |
| 2655 | if (!Ctor) |
| 2656 | return; |
| 2657 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2658 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2659 | const RetainSummary *Summ = Summaries.getSummary(Ctor); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2660 | |
| 2661 | // If we didn't get a summary, this constructor doesn't affect retain counts. |
| 2662 | if (!Summ) |
| 2663 | return; |
| 2664 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2665 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2666 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2667 | } |
| 2668 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2669 | void RetainCountChecker::processObjCLiterals(CheckerContext &C, |
| 2670 | const Expr *Ex) const { |
| 2671 | ProgramStateRef state = C.getState(); |
| 2672 | const ExplodedNode *pred = C.getPredecessor(); |
| 2673 | for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ; |
| 2674 | it != et ; ++it) { |
| 2675 | const Stmt *child = *it; |
| 2676 | SVal V = state->getSVal(child, pred->getLocationContext()); |
| 2677 | if (SymbolRef sym = V.getAsSymbol()) |
| 2678 | if (const RefVal* T = state->get<RefBindings>(sym)) { |
| 2679 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2680 | state = updateSymbol(state, sym, *T, MayEscape, hasErr, C); |
| 2681 | if (hasErr) { |
| 2682 | processNonLeakError(state, child->getSourceRange(), hasErr, sym, C); |
| 2683 | return; |
| 2684 | } |
| 2685 | } |
| 2686 | } |
| 2687 | |
| 2688 | // Return the object as autoreleased. |
| 2689 | // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 2690 | if (SymbolRef sym = |
| 2691 | state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { |
| 2692 | QualType ResultTy = Ex->getType(); |
| 2693 | state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC, |
| 2694 | ResultTy)); |
| 2695 | } |
| 2696 | |
| 2697 | C.addTransition(state); |
| 2698 | } |
| 2699 | |
| 2700 | void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL, |
| 2701 | CheckerContext &C) const { |
| 2702 | // Apply the 'MayEscape' to all values. |
| 2703 | processObjCLiterals(C, AL); |
| 2704 | } |
| 2705 | |
| 2706 | void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL, |
| 2707 | CheckerContext &C) const { |
| 2708 | // Apply the 'MayEscape' to all keys and values. |
| 2709 | processObjCLiterals(C, DL); |
| 2710 | } |
| 2711 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2712 | void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg, |
| 2713 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2714 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2715 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2716 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2717 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2718 | const RetainSummary *Summ; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2719 | if (Msg.isInstanceMessage()) { |
Anna Zaks | a2a8603 | 2011-11-01 22:41:01 +0000 | [diff] [blame] | 2720 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2721 | Summ = Summaries.getInstanceMethodSummary(Msg, state, LC); |
| 2722 | } else { |
| 2723 | Summ = Summaries.getClassMethodSummary(Msg); |
| 2724 | } |
| 2725 | |
| 2726 | // If we didn't get a summary, this message doesn't affect retain counts. |
| 2727 | if (!Summ) |
| 2728 | return; |
| 2729 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2730 | checkSummary(*Summ, CallOrObjCMessage(Msg, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2731 | } |
| 2732 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2733 | /// GetReturnType - Used to get the return type of a message expression or |
| 2734 | /// function call with the intention of affixing that type to a tracked symbol. |
| 2735 | /// While the the return type can be queried directly from RetEx, when |
| 2736 | /// invoking class methods we augment to the return type to be that of |
| 2737 | /// a pointer to the class (as opposed it just being id). |
| 2738 | // FIXME: We may be able to do this with related result types instead. |
| 2739 | // This function is probably overestimating. |
| 2740 | static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) { |
| 2741 | QualType RetTy = RetE->getType(); |
| 2742 | // If RetE is not a message expression just return its type. |
| 2743 | // If RetE is a message expression, return its types if it is something |
| 2744 | /// more specific than id. |
| 2745 | if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE)) |
| 2746 | if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>()) |
| 2747 | if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() || |
| 2748 | PT->isObjCClassType()) { |
| 2749 | // At this point we know the return type of the message expression is |
| 2750 | // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this |
| 2751 | // is a call to a class method whose type we can resolve. In such |
| 2752 | // cases, promote the return type to XXX* (where XXX is the class). |
| 2753 | const ObjCInterfaceDecl *D = ME->getReceiverInterface(); |
| 2754 | return !D ? RetTy : |
| 2755 | Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D)); |
| 2756 | } |
| 2757 | |
| 2758 | return RetTy; |
| 2759 | } |
| 2760 | |
| 2761 | void RetainCountChecker::checkSummary(const RetainSummary &Summ, |
| 2762 | const CallOrObjCMessage &CallOrMsg, |
| 2763 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2764 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2765 | |
| 2766 | // Evaluate the effect of the arguments. |
| 2767 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2768 | SourceRange ErrorRange; |
| 2769 | SymbolRef ErrorSym = 0; |
| 2770 | |
| 2771 | for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2772 | SVal V = CallOrMsg.getArgSVal(idx); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2773 | |
| 2774 | if (SymbolRef Sym = V.getAsLocSymbol()) { |
| 2775 | if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2776 | state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2777 | if (hasErr) { |
| 2778 | ErrorRange = CallOrMsg.getArgSourceRange(idx); |
| 2779 | ErrorSym = Sym; |
| 2780 | break; |
| 2781 | } |
| 2782 | } |
| 2783 | } |
| 2784 | } |
| 2785 | |
| 2786 | // Evaluate the effect on the message receiver. |
| 2787 | bool ReceiverIsTracked = false; |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2788 | if (!hasErr && CallOrMsg.isObjCMessage()) { |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2789 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2790 | SVal Receiver = CallOrMsg.getInstanceMessageReceiver(LC); |
| 2791 | if (SymbolRef Sym = Receiver.getAsLocSymbol()) { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2792 | if (const RefVal *T = state->get<RefBindings>(Sym)) { |
| 2793 | ReceiverIsTracked = true; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2794 | state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(), |
| 2795 | hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2796 | if (hasErr) { |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2797 | ErrorRange = CallOrMsg.getReceiverSourceRange(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2798 | ErrorSym = Sym; |
| 2799 | } |
| 2800 | } |
| 2801 | } |
| 2802 | } |
| 2803 | |
| 2804 | // Process any errors. |
| 2805 | if (hasErr) { |
| 2806 | processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C); |
| 2807 | return; |
| 2808 | } |
| 2809 | |
| 2810 | // Consult the summary for the return value. |
| 2811 | RetEffect RE = Summ.getRetEffect(); |
| 2812 | |
| 2813 | if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2814 | if (ReceiverIsTracked) |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2815 | RE = getSummaryManager(C).getObjAllocRetEffect(); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2816 | else |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2817 | RE = RetEffect::MakeNoRet(); |
| 2818 | } |
| 2819 | |
| 2820 | switch (RE.getKind()) { |
| 2821 | default: |
David Blaikie | 7530c03 | 2012-01-17 06:56:22 +0000 | [diff] [blame] | 2822 | llvm_unreachable("Unhandled RetEffect."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2823 | |
| 2824 | case RetEffect::NoRet: |
| 2825 | // No work necessary. |
| 2826 | break; |
| 2827 | |
| 2828 | case RetEffect::OwnedAllocatedSymbol: |
| 2829 | case RetEffect::OwnedSymbol: { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2830 | SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(), |
| 2831 | C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2832 | if (!Sym) |
| 2833 | break; |
| 2834 | |
| 2835 | // Use the result type from callOrMsg as it automatically adjusts |
| 2836 | // for methods/functions that return references. |
| 2837 | QualType ResultTy = CallOrMsg.getResultType(C.getASTContext()); |
| 2838 | state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(), |
| 2839 | ResultTy)); |
| 2840 | |
| 2841 | // FIXME: Add a flag to the checker where allocations are assumed to |
| 2842 | // *not* fail. (The code below is out-of-date, though.) |
| 2843 | #if 0 |
| 2844 | if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) { |
| 2845 | bool isFeasible; |
| 2846 | state = state.assume(loc::SymbolVal(Sym), true, isFeasible); |
| 2847 | assert(isFeasible && "Cannot assume fresh symbol is non-null."); |
| 2848 | } |
| 2849 | #endif |
| 2850 | |
| 2851 | break; |
| 2852 | } |
| 2853 | |
| 2854 | case RetEffect::GCNotOwnedSymbol: |
| 2855 | case RetEffect::ARCNotOwnedSymbol: |
| 2856 | case RetEffect::NotOwnedSymbol: { |
| 2857 | const Expr *Ex = CallOrMsg.getOriginExpr(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2858 | SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2859 | if (!Sym) |
| 2860 | break; |
| 2861 | |
| 2862 | // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *. |
| 2863 | QualType ResultTy = GetReturnType(Ex, C.getASTContext()); |
| 2864 | state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(), |
| 2865 | ResultTy)); |
| 2866 | break; |
| 2867 | } |
| 2868 | } |
| 2869 | |
| 2870 | // This check is actually necessary; otherwise the statement builder thinks |
| 2871 | // we've hit a previously-found path. |
| 2872 | // Normally addTransition takes care of this, but we want the node pointer. |
| 2873 | ExplodedNode *NewNode; |
| 2874 | if (state == C.getState()) { |
| 2875 | NewNode = C.getPredecessor(); |
| 2876 | } else { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2877 | NewNode = C.addTransition(state); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2878 | } |
| 2879 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2880 | // Annotate the node with summary we used. |
| 2881 | if (NewNode) { |
| 2882 | // FIXME: This is ugly. See checkEndAnalysis for why it's necessary. |
| 2883 | if (ShouldResetSummaryLog) { |
| 2884 | SummaryLog.clear(); |
| 2885 | ShouldResetSummaryLog = false; |
| 2886 | } |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 2887 | SummaryLog[NewNode] = &Summ; |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2888 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2889 | } |
| 2890 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2891 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2892 | ProgramStateRef |
| 2893 | RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2894 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2895 | CheckerContext &C) const { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2896 | // In GC mode [... release] and [... retain] do nothing. |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2897 | // In ARC mode they shouldn't exist at all, but we just ignore them. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2898 | bool IgnoreRetainMsg = C.isObjCGCEnabled(); |
| 2899 | if (!IgnoreRetainMsg) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2900 | IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2901 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2902 | switch (E) { |
| 2903 | default: break; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2904 | case IncRefMsg: E = IgnoreRetainMsg ? DoNothing : IncRef; break; |
| 2905 | case DecRefMsg: E = IgnoreRetainMsg ? DoNothing : DecRef; break; |
| 2906 | case MakeCollectable: E = C.isObjCGCEnabled() ? DecRef : DoNothing; break; |
| 2907 | case NewAutoreleasePool: E = C.isObjCGCEnabled() ? DoNothing : |
| 2908 | NewAutoreleasePool; break; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2909 | } |
| 2910 | |
| 2911 | // Handle all use-after-releases. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2912 | if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2913 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 2914 | hasErr = V.getKind(); |
| 2915 | return state->set<RefBindings>(sym, V); |
| 2916 | } |
| 2917 | |
| 2918 | switch (E) { |
| 2919 | case DecRefMsg: |
| 2920 | case IncRefMsg: |
| 2921 | case MakeCollectable: |
| 2922 | llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted"); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2923 | |
| 2924 | case Dealloc: |
| 2925 | // Any use of -dealloc in GC is *bad*. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2926 | if (C.isObjCGCEnabled()) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2927 | V = V ^ RefVal::ErrorDeallocGC; |
| 2928 | hasErr = V.getKind(); |
| 2929 | break; |
| 2930 | } |
| 2931 | |
| 2932 | switch (V.getKind()) { |
| 2933 | default: |
| 2934 | llvm_unreachable("Invalid RefVal state for an explicit dealloc."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2935 | case RefVal::Owned: |
| 2936 | // The object immediately transitions to the released state. |
| 2937 | V = V ^ RefVal::Released; |
| 2938 | V.clearCounts(); |
| 2939 | return state->set<RefBindings>(sym, V); |
| 2940 | case RefVal::NotOwned: |
| 2941 | V = V ^ RefVal::ErrorDeallocNotOwned; |
| 2942 | hasErr = V.getKind(); |
| 2943 | break; |
| 2944 | } |
| 2945 | break; |
| 2946 | |
| 2947 | case NewAutoreleasePool: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2948 | assert(!C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2949 | return state->add<AutoreleaseStack>(sym); |
| 2950 | |
| 2951 | case MayEscape: |
| 2952 | if (V.getKind() == RefVal::Owned) { |
| 2953 | V = V ^ RefVal::NotOwned; |
| 2954 | break; |
| 2955 | } |
| 2956 | |
| 2957 | // Fall-through. |
| 2958 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2959 | case DoNothing: |
| 2960 | return state; |
| 2961 | |
| 2962 | case Autorelease: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2963 | if (C.isObjCGCEnabled()) |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2964 | return state; |
| 2965 | |
| 2966 | // Update the autorelease counts. |
| 2967 | state = SendAutorelease(state, ARCountFactory, sym); |
| 2968 | V = V.autorelease(); |
| 2969 | break; |
| 2970 | |
| 2971 | case StopTracking: |
| 2972 | return state->remove<RefBindings>(sym); |
| 2973 | |
| 2974 | case IncRef: |
| 2975 | switch (V.getKind()) { |
| 2976 | default: |
| 2977 | llvm_unreachable("Invalid RefVal state for a retain."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2978 | case RefVal::Owned: |
| 2979 | case RefVal::NotOwned: |
| 2980 | V = V + 1; |
| 2981 | break; |
| 2982 | case RefVal::Released: |
| 2983 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2984 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2985 | V = (V ^ RefVal::Owned) + 1; |
| 2986 | break; |
| 2987 | } |
| 2988 | break; |
| 2989 | |
| 2990 | case SelfOwn: |
| 2991 | V = V ^ RefVal::NotOwned; |
| 2992 | // Fall-through. |
| 2993 | case DecRef: |
| 2994 | case DecRefBridgedTransfered: |
| 2995 | switch (V.getKind()) { |
| 2996 | default: |
| 2997 | // case 'RefVal::Released' handled above. |
| 2998 | llvm_unreachable("Invalid RefVal state for a release."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2999 | |
| 3000 | case RefVal::Owned: |
| 3001 | assert(V.getCount() > 0); |
| 3002 | if (V.getCount() == 1) |
| 3003 | V = V ^ (E == DecRefBridgedTransfered ? |
| 3004 | RefVal::NotOwned : RefVal::Released); |
| 3005 | V = V - 1; |
| 3006 | break; |
| 3007 | |
| 3008 | case RefVal::NotOwned: |
| 3009 | if (V.getCount() > 0) |
| 3010 | V = V - 1; |
| 3011 | else { |
| 3012 | V = V ^ RefVal::ErrorReleaseNotOwned; |
| 3013 | hasErr = V.getKind(); |
| 3014 | } |
| 3015 | break; |
| 3016 | |
| 3017 | case RefVal::Released: |
| 3018 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3019 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3020 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3021 | hasErr = V.getKind(); |
| 3022 | break; |
| 3023 | } |
| 3024 | break; |
| 3025 | } |
| 3026 | return state->set<RefBindings>(sym, V); |
| 3027 | } |
| 3028 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3029 | void RetainCountChecker::processNonLeakError(ProgramStateRef St, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3030 | SourceRange ErrorRange, |
| 3031 | RefVal::Kind ErrorKind, |
| 3032 | SymbolRef Sym, |
| 3033 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3034 | ExplodedNode *N = C.generateSink(St); |
| 3035 | if (!N) |
| 3036 | return; |
| 3037 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3038 | CFRefBug *BT; |
| 3039 | switch (ErrorKind) { |
| 3040 | default: |
| 3041 | llvm_unreachable("Unhandled error."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3042 | case RefVal::ErrorUseAfterRelease: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3043 | if (!useAfterRelease) |
| 3044 | useAfterRelease.reset(new UseAfterRelease()); |
| 3045 | BT = &*useAfterRelease; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3046 | break; |
| 3047 | case RefVal::ErrorReleaseNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3048 | if (!releaseNotOwned) |
| 3049 | releaseNotOwned.reset(new BadRelease()); |
| 3050 | BT = &*releaseNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3051 | break; |
| 3052 | case RefVal::ErrorDeallocGC: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3053 | if (!deallocGC) |
| 3054 | deallocGC.reset(new DeallocGC()); |
| 3055 | BT = &*deallocGC; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3056 | break; |
| 3057 | case RefVal::ErrorDeallocNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3058 | if (!deallocNotOwned) |
| 3059 | deallocNotOwned.reset(new DeallocNotOwned()); |
| 3060 | BT = &*deallocNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3061 | break; |
| 3062 | } |
| 3063 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3064 | assert(BT); |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3065 | CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3066 | C.isObjCGCEnabled(), SummaryLog, |
| 3067 | N, Sym); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3068 | report->addRange(ErrorRange); |
| 3069 | C.EmitReport(report); |
| 3070 | } |
| 3071 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3072 | //===----------------------------------------------------------------------===// |
| 3073 | // Handle the return values of retain-count-related functions. |
| 3074 | //===----------------------------------------------------------------------===// |
| 3075 | |
| 3076 | bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3077 | // Get the callee. We're only interested in simple C functions. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3078 | ProgramStateRef state = C.getState(); |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3079 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3080 | if (!FD) |
| 3081 | return false; |
| 3082 | |
| 3083 | IdentifierInfo *II = FD->getIdentifier(); |
| 3084 | if (!II) |
| 3085 | return false; |
| 3086 | |
| 3087 | // For now, we're only handling the functions that return aliases of their |
| 3088 | // arguments: CFRetain and CFMakeCollectable (and their families). |
| 3089 | // Eventually we should add other functions we can model entirely, |
| 3090 | // such as CFRelease, which don't invalidate their arguments or globals. |
| 3091 | if (CE->getNumArgs() != 1) |
| 3092 | return false; |
| 3093 | |
| 3094 | // Get the name of the function. |
| 3095 | StringRef FName = II->getName(); |
| 3096 | FName = FName.substr(FName.find_first_not_of('_')); |
| 3097 | |
| 3098 | // See if it's one of the specific functions we know how to eval. |
| 3099 | bool canEval = false; |
| 3100 | |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3101 | QualType ResultTy = CE->getCallReturnType(); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3102 | if (ResultTy->isObjCIdType()) { |
| 3103 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 3104 | canEval = II->isStr("NSMakeCollectable"); |
| 3105 | } else if (ResultTy->isPointerType()) { |
| 3106 | // Handle: (CF|CG)Retain |
| 3107 | // CFMakeCollectable |
| 3108 | // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist). |
| 3109 | if (cocoa::isRefType(ResultTy, "CF", FName) || |
| 3110 | cocoa::isRefType(ResultTy, "CG", FName)) { |
| 3111 | canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName); |
| 3112 | } |
| 3113 | } |
| 3114 | |
| 3115 | if (!canEval) |
| 3116 | return false; |
| 3117 | |
| 3118 | // Bind the return value. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3119 | const LocationContext *LCtx = C.getLocationContext(); |
| 3120 | SVal RetVal = state->getSVal(CE->getArg(0), LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3121 | if (RetVal.isUnknown()) { |
| 3122 | // If the receiver is unknown, conjure a return value. |
| 3123 | SValBuilder &SVB = C.getSValBuilder(); |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3124 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3125 | SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3126 | } |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3127 | state = state->BindExpr(CE, LCtx, RetVal, false); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3128 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3129 | // FIXME: This should not be necessary, but otherwise the argument seems to be |
| 3130 | // considered alive during the next statement. |
| 3131 | if (const MemRegion *ArgRegion = RetVal.getAsRegion()) { |
| 3132 | // Save the refcount status of the argument. |
| 3133 | SymbolRef Sym = RetVal.getAsLocSymbol(); |
| 3134 | RefBindings::data_type *Binding = 0; |
| 3135 | if (Sym) |
| 3136 | Binding = state->get<RefBindings>(Sym); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3137 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3138 | // Invalidate the argument region. |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3139 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3140 | state = state->invalidateRegions(ArgRegion, CE, Count, LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3141 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3142 | // Restore the refcount status of the argument. |
| 3143 | if (Binding) |
| 3144 | state = state->set<RefBindings>(Sym, *Binding); |
| 3145 | } |
| 3146 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3147 | C.addTransition(state); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3148 | return true; |
| 3149 | } |
| 3150 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3151 | //===----------------------------------------------------------------------===// |
| 3152 | // Handle return statements. |
| 3153 | //===----------------------------------------------------------------------===// |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3154 | |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3155 | // Return true if the current LocationContext has no caller context. |
| 3156 | static bool inTopFrame(CheckerContext &C) { |
| 3157 | const LocationContext *LC = C.getLocationContext(); |
| 3158 | return LC->getParent() == 0; |
| 3159 | } |
| 3160 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3161 | void RetainCountChecker::checkPreStmt(const ReturnStmt *S, |
| 3162 | CheckerContext &C) const { |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3163 | |
| 3164 | // Only adjust the reference count if this is the top-level call frame, |
| 3165 | // and not the result of inlining. In the future, we should do |
| 3166 | // better checking even for inlined calls, and see if they match |
| 3167 | // with their expected semantics (e.g., the method should return a retained |
| 3168 | // object, etc.). |
| 3169 | if (!inTopFrame(C)) |
| 3170 | return; |
| 3171 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3172 | const Expr *RetE = S->getRetValue(); |
| 3173 | if (!RetE) |
| 3174 | return; |
| 3175 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3176 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3177 | SymbolRef Sym = |
| 3178 | state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3179 | if (!Sym) |
| 3180 | return; |
| 3181 | |
| 3182 | // Get the reference count binding (if any). |
| 3183 | const RefVal *T = state->get<RefBindings>(Sym); |
| 3184 | if (!T) |
| 3185 | return; |
| 3186 | |
| 3187 | // Change the reference count. |
| 3188 | RefVal X = *T; |
| 3189 | |
| 3190 | switch (X.getKind()) { |
| 3191 | case RefVal::Owned: { |
| 3192 | unsigned cnt = X.getCount(); |
| 3193 | assert(cnt > 0); |
| 3194 | X.setCount(cnt - 1); |
| 3195 | X = X ^ RefVal::ReturnedOwned; |
| 3196 | break; |
| 3197 | } |
| 3198 | |
| 3199 | case RefVal::NotOwned: { |
| 3200 | unsigned cnt = X.getCount(); |
| 3201 | if (cnt) { |
| 3202 | X.setCount(cnt - 1); |
| 3203 | X = X ^ RefVal::ReturnedOwned; |
| 3204 | } |
| 3205 | else { |
| 3206 | X = X ^ RefVal::ReturnedNotOwned; |
| 3207 | } |
| 3208 | break; |
| 3209 | } |
| 3210 | |
| 3211 | default: |
| 3212 | return; |
| 3213 | } |
| 3214 | |
| 3215 | // Update the binding. |
| 3216 | state = state->set<RefBindings>(Sym, X); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3217 | ExplodedNode *Pred = C.addTransition(state); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3218 | |
| 3219 | // At this point we have updated the state properly. |
| 3220 | // Everything after this is merely checking to see if the return value has |
| 3221 | // been over- or under-retained. |
| 3222 | |
| 3223 | // Did we cache out? |
| 3224 | if (!Pred) |
| 3225 | return; |
| 3226 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3227 | // Update the autorelease counts. |
| 3228 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3229 | AutoreleaseTag("RetainCountChecker : Autorelease"); |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3230 | GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3231 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3232 | |
| 3233 | // Did we cache out? |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3234 | if (!Pred) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3235 | return; |
| 3236 | |
| 3237 | // Get the updated binding. |
| 3238 | T = state->get<RefBindings>(Sym); |
| 3239 | assert(T); |
| 3240 | X = *T; |
| 3241 | |
| 3242 | // Consult the summary of the enclosing method. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3243 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3244 | const Decl *CD = &Pred->getCodeDecl(); |
| 3245 | |
| 3246 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) { |
| 3247 | // Unlike regular functions, /all/ ObjC methods are assumed to always |
| 3248 | // follow Cocoa retain-count conventions, not just those with special |
| 3249 | // names or attributes. |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3250 | const RetainSummary *Summ = Summaries.getMethodSummary(MD); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3251 | RetEffect RE = Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet(); |
| 3252 | checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state); |
| 3253 | } |
| 3254 | |
| 3255 | if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) { |
| 3256 | if (!isa<CXXMethodDecl>(FD)) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3257 | if (const RetainSummary *Summ = Summaries.getSummary(FD)) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3258 | checkReturnWithRetEffect(S, C, Pred, Summ->getRetEffect(), X, |
| 3259 | Sym, state); |
| 3260 | } |
| 3261 | } |
| 3262 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3263 | void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S, |
| 3264 | CheckerContext &C, |
| 3265 | ExplodedNode *Pred, |
| 3266 | RetEffect RE, RefVal X, |
| 3267 | SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3268 | ProgramStateRef state) const { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3269 | // Any leaks or other errors? |
| 3270 | if (X.isReturnedOwned() && X.getCount() == 0) { |
| 3271 | if (RE.getKind() != RetEffect::NoRet) { |
| 3272 | bool hasError = false; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3273 | if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3274 | // Things are more complicated with garbage collection. If the |
| 3275 | // returned object is suppose to be an Objective-C object, we have |
| 3276 | // a leak (as the caller expects a GC'ed object) because no |
| 3277 | // method should return ownership unless it returns a CF object. |
| 3278 | hasError = true; |
| 3279 | X = X ^ RefVal::ErrorGCLeakReturned; |
| 3280 | } |
| 3281 | else if (!RE.isOwned()) { |
| 3282 | // Either we are using GC and the returned object is a CF type |
| 3283 | // or we aren't using GC. In either case, we expect that the |
| 3284 | // enclosing method is expected to return ownership. |
| 3285 | hasError = true; |
| 3286 | X = X ^ RefVal::ErrorLeakReturned; |
| 3287 | } |
| 3288 | |
| 3289 | if (hasError) { |
| 3290 | // Generate an error node. |
| 3291 | state = state->set<RefBindings>(Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3292 | |
| 3293 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3294 | ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3295 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3296 | if (N) { |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3297 | const LangOptions &LOpts = C.getASTContext().getLangOpts(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3298 | bool GCEnabled = C.isObjCGCEnabled(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3299 | CFRefReport *report = |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3300 | new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled), |
| 3301 | LOpts, GCEnabled, SummaryLog, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3302 | N, Sym, C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3303 | C.EmitReport(report); |
| 3304 | } |
| 3305 | } |
| 3306 | } |
| 3307 | } else if (X.isReturnedNotOwned()) { |
| 3308 | if (RE.isOwned()) { |
| 3309 | // Trying to return a not owned object to a caller expecting an |
| 3310 | // owned object. |
| 3311 | state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3312 | |
| 3313 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3314 | ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3315 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3316 | if (N) { |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3317 | if (!returnNotOwnedForOwned) |
| 3318 | returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned()); |
| 3319 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3320 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3321 | new CFRefReport(*returnNotOwnedForOwned, |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3322 | C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3323 | C.isObjCGCEnabled(), SummaryLog, N, Sym); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3324 | C.EmitReport(report); |
| 3325 | } |
| 3326 | } |
| 3327 | } |
| 3328 | } |
| 3329 | |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3330 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3331 | // Check various ways a symbol can be invalidated. |
| 3332 | //===----------------------------------------------------------------------===// |
| 3333 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 3334 | void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3335 | CheckerContext &C) const { |
| 3336 | // Are we storing to something that causes the value to "escape"? |
| 3337 | bool escapes = true; |
| 3338 | |
| 3339 | // A value escapes in three possible cases (this may change): |
| 3340 | // |
| 3341 | // (1) we are binding to something that is not a memory region. |
| 3342 | // (2) we are binding to a memregion that does not have stack storage |
| 3343 | // (3) we are binding to a memregion with stack storage that the store |
| 3344 | // does not understand. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3345 | ProgramStateRef state = C.getState(); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3346 | |
| 3347 | if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { |
| 3348 | escapes = !regionLoc->getRegion()->hasStackStorage(); |
| 3349 | |
| 3350 | if (!escapes) { |
| 3351 | // To test (3), generate a new state with the binding added. If it is |
| 3352 | // the same state, then it escapes (since the store cannot represent |
| 3353 | // the binding). |
| 3354 | escapes = (state == (state->bindLoc(*regionLoc, val))); |
| 3355 | } |
| 3356 | } |
| 3357 | |
| 3358 | // If our store can represent the binding and we aren't storing to something |
| 3359 | // that doesn't have local storage then just return and have the simulation |
| 3360 | // state continue as is. |
| 3361 | if (!escapes) |
| 3362 | return; |
| 3363 | |
| 3364 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 3365 | // and stop tracking them. |
| 3366 | state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3367 | C.addTransition(state); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3368 | } |
| 3369 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3370 | ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3371 | SVal Cond, |
| 3372 | bool Assumption) const { |
| 3373 | |
| 3374 | // FIXME: We may add to the interface of evalAssume the list of symbols |
| 3375 | // whose assumptions have changed. For now we just iterate through the |
| 3376 | // bindings and check if any of the tracked symbols are NULL. This isn't |
| 3377 | // too bad since the number of symbols we will track in practice are |
| 3378 | // probably small and evalAssume is only called at branches and a few |
| 3379 | // other places. |
| 3380 | RefBindings B = state->get<RefBindings>(); |
| 3381 | |
| 3382 | if (B.isEmpty()) |
| 3383 | return state; |
| 3384 | |
| 3385 | bool changed = false; |
| 3386 | RefBindings::Factory &RefBFactory = state->get_context<RefBindings>(); |
| 3387 | |
| 3388 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3389 | // Check if the symbol is null (or equal to any constant). |
| 3390 | // If this is the case, stop tracking the symbol. |
| 3391 | if (state->getSymVal(I.getKey())) { |
| 3392 | changed = true; |
| 3393 | B = RefBFactory.remove(B, I.getKey()); |
| 3394 | } |
| 3395 | } |
| 3396 | |
| 3397 | if (changed) |
| 3398 | state = state->set<RefBindings>(B); |
| 3399 | |
| 3400 | return state; |
| 3401 | } |
| 3402 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3403 | ProgramStateRef |
| 3404 | RetainCountChecker::checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3405 | const StoreManager::InvalidatedSymbols *invalidated, |
| 3406 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 3407 | ArrayRef<const MemRegion *> Regions, |
| 3408 | const CallOrObjCMessage *Call) const { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3409 | if (!invalidated) |
| 3410 | return state; |
| 3411 | |
| 3412 | llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; |
| 3413 | for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), |
| 3414 | E = ExplicitRegions.end(); I != E; ++I) { |
| 3415 | if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>()) |
| 3416 | WhitelistedSymbols.insert(SR->getSymbol()); |
| 3417 | } |
| 3418 | |
| 3419 | for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), |
| 3420 | E = invalidated->end(); I!=E; ++I) { |
| 3421 | SymbolRef sym = *I; |
| 3422 | if (WhitelistedSymbols.count(sym)) |
| 3423 | continue; |
| 3424 | // Remove any existing reference-count binding. |
| 3425 | state = state->remove<RefBindings>(sym); |
| 3426 | } |
| 3427 | return state; |
| 3428 | } |
| 3429 | |
| 3430 | //===----------------------------------------------------------------------===// |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3431 | // Handle dead symbols and end-of-path. |
| 3432 | //===----------------------------------------------------------------------===// |
| 3433 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3434 | std::pair<ExplodedNode *, ProgramStateRef > |
| 3435 | RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3436 | GenericNodeBuilderRefCount Bd, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3437 | ExplodedNode *Pred, |
| 3438 | CheckerContext &Ctx, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3439 | SymbolRef Sym, RefVal V) const { |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3440 | unsigned ACnt = V.getAutoreleaseCount(); |
| 3441 | |
| 3442 | // No autorelease counts? Nothing to be done. |
| 3443 | if (!ACnt) |
| 3444 | return std::make_pair(Pred, state); |
| 3445 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3446 | assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?"); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3447 | unsigned Cnt = V.getCount(); |
| 3448 | |
| 3449 | // FIXME: Handle sending 'autorelease' to already released object. |
| 3450 | |
| 3451 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3452 | ++Cnt; |
| 3453 | |
| 3454 | if (ACnt <= Cnt) { |
| 3455 | if (ACnt == Cnt) { |
| 3456 | V.clearCounts(); |
| 3457 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3458 | V = V ^ RefVal::ReturnedNotOwned; |
| 3459 | else |
| 3460 | V = V ^ RefVal::NotOwned; |
| 3461 | } else { |
| 3462 | V.setCount(Cnt - ACnt); |
| 3463 | V.setAutoreleaseCount(0); |
| 3464 | } |
| 3465 | state = state->set<RefBindings>(Sym, V); |
| 3466 | ExplodedNode *N = Bd.MakeNode(state, Pred); |
| 3467 | if (N == 0) |
| 3468 | state = 0; |
| 3469 | return std::make_pair(N, state); |
| 3470 | } |
| 3471 | |
| 3472 | // Woah! More autorelease counts then retain counts left. |
| 3473 | // Emit hard error. |
| 3474 | V = V ^ RefVal::ErrorOverAutorelease; |
| 3475 | state = state->set<RefBindings>(Sym, V); |
| 3476 | |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 3477 | if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3478 | SmallString<128> sbuf; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3479 | llvm::raw_svector_ostream os(sbuf); |
| 3480 | os << "Object over-autoreleased: object was sent -autorelease "; |
| 3481 | if (V.getAutoreleaseCount() > 1) |
| 3482 | os << V.getAutoreleaseCount() << " times "; |
| 3483 | os << "but the object has a +" << V.getCount() << " retain count"; |
| 3484 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3485 | if (!overAutorelease) |
| 3486 | overAutorelease.reset(new OverAutorelease()); |
| 3487 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3488 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3489 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3490 | new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false, |
| 3491 | SummaryLog, N, Sym, os.str()); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3492 | Ctx.EmitReport(report); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3493 | } |
| 3494 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3495 | return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3496 | } |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3497 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3498 | ProgramStateRef |
| 3499 | RetainCountChecker::handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3500 | SymbolRef sid, RefVal V, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3501 | SmallVectorImpl<SymbolRef> &Leaked) const { |
Jordy Rose | 5337612 | 2011-08-24 04:48:19 +0000 | [diff] [blame] | 3502 | bool hasLeak = false; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3503 | if (V.isOwned()) |
| 3504 | hasLeak = true; |
| 3505 | else if (V.isNotOwned() || V.isReturnedOwned()) |
| 3506 | hasLeak = (V.getCount() > 0); |
| 3507 | |
| 3508 | if (!hasLeak) |
| 3509 | return state->remove<RefBindings>(sid); |
| 3510 | |
| 3511 | Leaked.push_back(sid); |
| 3512 | return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak); |
| 3513 | } |
| 3514 | |
| 3515 | ExplodedNode * |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3516 | RetainCountChecker::processLeaks(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3517 | SmallVectorImpl<SymbolRef> &Leaked, |
| 3518 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3519 | CheckerContext &Ctx, |
| 3520 | ExplodedNode *Pred) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3521 | if (Leaked.empty()) |
| 3522 | return Pred; |
| 3523 | |
| 3524 | // Generate an intermediate node representing the leak point. |
| 3525 | ExplodedNode *N = Builder.MakeNode(state, Pred); |
| 3526 | |
| 3527 | if (N) { |
| 3528 | for (SmallVectorImpl<SymbolRef>::iterator |
| 3529 | I = Leaked.begin(), E = Leaked.end(); I != E; ++I) { |
| 3530 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3531 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3532 | bool GCEnabled = Ctx.isObjCGCEnabled(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3533 | CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled) |
| 3534 | : getLeakAtReturnBug(LOpts, GCEnabled); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3535 | assert(BT && "BugType not initialized."); |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 3536 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3537 | CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3538 | SummaryLog, N, *I, Ctx); |
| 3539 | Ctx.EmitReport(report); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3540 | } |
| 3541 | } |
| 3542 | |
| 3543 | return N; |
| 3544 | } |
| 3545 | |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3546 | void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3547 | ProgramStateRef state = Ctx.getState(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3548 | GenericNodeBuilderRefCount Bd(Ctx); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3549 | RefBindings B = state->get<RefBindings>(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3550 | ExplodedNode *Pred = Ctx.getPredecessor(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3551 | |
| 3552 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3553 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3554 | I->first, I->second); |
| 3555 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3556 | return; |
| 3557 | } |
| 3558 | |
Ted Kremenek | 0cf3d47 | 2012-02-07 00:24:33 +0000 | [diff] [blame] | 3559 | // If the current LocationContext has a parent, don't check for leaks. |
| 3560 | // We will do that later. |
| 3561 | // FIXME: we should instead check for imblances of the retain/releases, |
| 3562 | // and suggest annotations. |
| 3563 | if (Ctx.getLocationContext()->getParent()) |
| 3564 | return; |
| 3565 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3566 | B = state->get<RefBindings>(); |
| 3567 | SmallVector<SymbolRef, 10> Leaked; |
| 3568 | |
| 3569 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3570 | state = handleSymbolDeath(state, I->first, I->second, Leaked); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3571 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3572 | processLeaks(state, Leaked, Bd, Ctx, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3573 | } |
| 3574 | |
| 3575 | const ProgramPointTag * |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3576 | RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3577 | const SimpleProgramPointTag *&tag = DeadSymbolTags[sym]; |
| 3578 | if (!tag) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3579 | SmallString<64> buf; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3580 | llvm::raw_svector_ostream out(buf); |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3581 | out << "RetainCountChecker : Dead Symbol : "; |
| 3582 | sym->dumpToStream(out); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3583 | tag = new SimpleProgramPointTag(out.str()); |
| 3584 | } |
| 3585 | return tag; |
| 3586 | } |
| 3587 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3588 | void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 3589 | CheckerContext &C) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3590 | ExplodedNode *Pred = C.getPredecessor(); |
| 3591 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3592 | ProgramStateRef state = C.getState(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3593 | RefBindings B = state->get<RefBindings>(); |
| 3594 | |
| 3595 | // Update counts from autorelease pools |
| 3596 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3597 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3598 | SymbolRef Sym = *I; |
| 3599 | if (const RefVal *T = B.lookup(Sym)){ |
| 3600 | // Use the symbol as the tag. |
| 3601 | // FIXME: This might not be as unique as we would like. |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3602 | GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym)); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3603 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3604 | Sym, *T); |
| 3605 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3606 | return; |
| 3607 | } |
| 3608 | } |
| 3609 | |
| 3610 | B = state->get<RefBindings>(); |
| 3611 | SmallVector<SymbolRef, 10> Leaked; |
| 3612 | |
| 3613 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3614 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3615 | if (const RefVal *T = B.lookup(*I)) |
| 3616 | state = handleSymbolDeath(state, *I, *T, Leaked); |
| 3617 | } |
| 3618 | |
| 3619 | { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3620 | GenericNodeBuilderRefCount Bd(C, this); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3621 | Pred = processLeaks(state, Leaked, Bd, C, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3622 | } |
| 3623 | |
| 3624 | // Did we cache out? |
| 3625 | if (!Pred) |
| 3626 | return; |
| 3627 | |
| 3628 | // Now generate a new node that nukes the old bindings. |
| 3629 | RefBindings::Factory &F = state->get_context<RefBindings>(); |
| 3630 | |
| 3631 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3632 | E = SymReaper.dead_end(); I != E; ++I) |
| 3633 | B = F.remove(B, *I); |
| 3634 | |
| 3635 | state = state->set<RefBindings>(B); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3636 | C.addTransition(state, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3637 | } |
| 3638 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3639 | //===----------------------------------------------------------------------===// |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3640 | // Debug printing of refcount bindings and autorelease pools. |
| 3641 | //===----------------------------------------------------------------------===// |
| 3642 | |
| 3643 | static void PrintPool(raw_ostream &Out, SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3644 | ProgramStateRef State) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3645 | Out << ' '; |
| 3646 | if (Sym) |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3647 | Sym->dumpToStream(Out); |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3648 | else |
| 3649 | Out << "<pool>"; |
| 3650 | Out << ":{"; |
| 3651 | |
| 3652 | // Get the contents of the pool. |
| 3653 | if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym)) |
| 3654 | for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I) |
| 3655 | Out << '(' << I.getKey() << ',' << I.getData() << ')'; |
| 3656 | |
| 3657 | Out << '}'; |
| 3658 | } |
| 3659 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3660 | static bool UsesAutorelease(ProgramStateRef state) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3661 | // A state uses autorelease if it allocated an autorelease pool or if it has |
| 3662 | // objects in the caller's autorelease pool. |
| 3663 | return !state->get<AutoreleaseStack>().isEmpty() || |
| 3664 | state->get<AutoreleasePoolContents>(SymbolRef()); |
| 3665 | } |
| 3666 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3667 | void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3668 | const char *NL, const char *Sep) const { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3669 | |
| 3670 | RefBindings B = State->get<RefBindings>(); |
| 3671 | |
| 3672 | if (!B.isEmpty()) |
| 3673 | Out << Sep << NL; |
| 3674 | |
| 3675 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3676 | Out << I->first << " : "; |
| 3677 | I->second.print(Out); |
| 3678 | Out << NL; |
| 3679 | } |
| 3680 | |
| 3681 | // Print the autorelease stack. |
| 3682 | if (UsesAutorelease(State)) { |
| 3683 | Out << Sep << NL << "AR pool stack:"; |
| 3684 | ARStack Stack = State->get<AutoreleaseStack>(); |
| 3685 | |
| 3686 | PrintPool(Out, SymbolRef(), State); // Print the caller's pool. |
| 3687 | for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I) |
| 3688 | PrintPool(Out, *I, State); |
| 3689 | |
| 3690 | Out << NL; |
| 3691 | } |
| 3692 | } |
| 3693 | |
| 3694 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3695 | // Checker registration. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3696 | //===----------------------------------------------------------------------===// |
| 3697 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3698 | void ento::registerRetainCountChecker(CheckerManager &Mgr) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3699 | Mgr.registerChecker<RetainCountChecker>(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3700 | } |
| 3701 | |