blob: b06a50d856b8cf8fad9d87b69ab2bf38532cbadc [file] [log] [blame]
Jordy Rose910c4052011-09-02 06:44:22 +00001//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
Ted Kremenek2fff37e2008-03-06 00:08:09 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Jordy Rose910c4052011-09-02 06:44:22 +000010// This file defines the methods for RetainCountChecker, which implements
11// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
Ted Kremenek2fff37e2008-03-06 00:08:09 +000012//
13//===----------------------------------------------------------------------===//
14
Jordy Rose910c4052011-09-02 06:44:22 +000015#include "ClangSACheckers.h"
Mike Stump1eb44332009-09-09 15:08:12 +000016#include "clang/AST/DeclObjC.h"
Ted Kremenekb2771592011-03-30 17:41:19 +000017#include "clang/AST/DeclCXX.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000018#include "clang/Basic/LangOptions.h"
19#include "clang/Basic/SourceManager.h"
Jordy Rose910c4052011-09-02 06:44:22 +000020#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
Ted Kremenek4c42bb72011-11-14 21:59:21 +000021#include "clang/AST/ParentMap.h"
Jordy Rose910c4052011-09-02 06:44:22 +000022#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000024#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
Jordy Rose910c4052011-09-02 06:44:22 +000026#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000027#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000028#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Jordy Rosed1e5a892011-09-02 08:02:59 +000029#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h"
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000030#include "llvm/ADT/DenseMap.h"
31#include "llvm/ADT/FoldingSet.h"
Ted Kremenek6d348932008-10-21 15:53:15 +000032#include "llvm/ADT/ImmutableList.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000033#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000034#include "llvm/ADT/SmallString.h"
Ted Kremenek6ed9afc2008-05-16 18:33:44 +000035#include "llvm/ADT/STLExtras.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000036#include "llvm/ADT/StringExtras.h"
Chris Lattner5f9e2722011-07-23 10:55:15 +000037#include <cstdarg>
Ted Kremenek2fff37e2008-03-06 00:08:09 +000038
39using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000040using namespace ento;
Ted Kremeneka64e89b2010-01-27 06:13:48 +000041using llvm::StrInStrNoCase;
Ted Kremenek4c79e552008-11-05 16:54:44 +000042
Ted Kremenekd775c662010-05-21 21:57:00 +000043namespace {
Jordy Rose910c4052011-09-02 06:44:22 +000044/// Wrapper around different kinds of node builder, so that helper functions
45/// can have a common interface.
Francois Pichetea097852011-01-11 10:41:37 +000046class GenericNodeBuilderRefCount {
Anna Zaks4eff8232011-10-05 23:44:11 +000047 CheckerContext *C;
Ted Kremenekca804532011-08-12 23:04:46 +000048 const ProgramPointTag *tag;
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000049public:
Anna Zaks4eff8232011-10-05 23:44:11 +000050 GenericNodeBuilderRefCount(CheckerContext &c,
Anna Zaksaf498a22011-10-25 19:56:48 +000051 const ProgramPointTag *t = 0)
Anna Zaks6a93bd52011-10-25 19:57:11 +000052 : C(&c), tag(t){}
Zhongxing Xu031ccc02009-08-06 12:48:26 +000053
Ted Kremenek8bef8232012-01-26 21:29:00 +000054 ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred,
Anna Zaksf05aac82011-10-18 23:05:58 +000055 bool MarkAsSink = false) {
Anna Zaks0bd6b112011-10-26 21:06:34 +000056 return C->addTransition(state, Pred, tag, MarkAsSink);
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000057 }
58};
59} // end anonymous namespace
60
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000061//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +000062// Primitives used for constructing summaries for function/method calls.
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000063//===----------------------------------------------------------------------===//
64
Ted Kremenek553cf182008-06-25 21:21:56 +000065/// ArgEffect is used to summarize a function/method call's effect on a
66/// particular argument.
Jordy Rosebd85b132011-08-24 19:10:50 +000067enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg,
John McCallf85e1932011-06-15 23:02:42 +000068 DecRefBridgedTransfered,
Jordy Rosebd85b132011-08-24 19:10:50 +000069 IncRefMsg, IncRef, MakeCollectable, MayEscape,
Ted Kremenekf95e9fc2009-03-17 19:42:23 +000070 NewAutoreleasePool, SelfOwn, StopTracking };
Ted Kremenek553cf182008-06-25 21:21:56 +000071
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000072namespace llvm {
Ted Kremenekb77449c2009-05-03 05:20:50 +000073template <> struct FoldingSetTrait<ArgEffect> {
74static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) {
75 ID.AddInteger((unsigned) X);
76}
Ted Kremenek553cf182008-06-25 21:21:56 +000077};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000078} // end llvm namespace
79
Ted Kremenekb77449c2009-05-03 05:20:50 +000080/// ArgEffects summarizes the effects of a function/method call on all of
81/// its arguments.
82typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects;
83
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000084namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +000085
86/// RetEffect is used to summarize a function/method call's behavior with
Mike Stump1eb44332009-09-09 15:08:12 +000087/// respect to its return value.
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000088class RetEffect {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000089public:
Jordy Rose76c506f2011-08-21 21:58:18 +000090 enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol,
John McCallf85e1932011-06-15 23:02:42 +000091 NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol,
Ted Kremenek78a35a32009-05-12 20:06:54 +000092 OwnedWhenTrackedReceiver };
Mike Stump1eb44332009-09-09 15:08:12 +000093
94 enum ObjKind { CF, ObjC, AnyObj };
Ted Kremenek2d1652e2009-01-28 05:56:51 +000095
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000096private:
Ted Kremenek2d1652e2009-01-28 05:56:51 +000097 Kind K;
98 ObjKind O;
Ted Kremenek2d1652e2009-01-28 05:56:51 +000099
Jordy Rose76c506f2011-08-21 21:58:18 +0000100 RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000101
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000102public:
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000103 Kind getKind() const { return K; }
104
105 ObjKind getObjKind() const { return O; }
Mike Stump1eb44332009-09-09 15:08:12 +0000106
Ted Kremeneka8833552009-04-29 23:03:22 +0000107 bool isOwned() const {
Ted Kremenek78a35a32009-05-12 20:06:54 +0000108 return K == OwnedSymbol || K == OwnedAllocatedSymbol ||
109 K == OwnedWhenTrackedReceiver;
Ted Kremeneka8833552009-04-29 23:03:22 +0000110 }
Mike Stump1eb44332009-09-09 15:08:12 +0000111
Jordy Rose4df54fe2011-08-23 04:27:15 +0000112 bool operator==(const RetEffect &Other) const {
113 return K == Other.K && O == Other.O;
114 }
115
Ted Kremenek78a35a32009-05-12 20:06:54 +0000116 static RetEffect MakeOwnedWhenTrackedReceiver() {
117 return RetEffect(OwnedWhenTrackedReceiver, ObjC);
118 }
Mike Stump1eb44332009-09-09 15:08:12 +0000119
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000120 static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) {
121 return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o);
Mike Stump1eb44332009-09-09 15:08:12 +0000122 }
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000123 static RetEffect MakeNotOwned(ObjKind o) {
124 return RetEffect(NotOwnedSymbol, o);
Ted Kremeneke798e7c2009-04-27 19:14:45 +0000125 }
126 static RetEffect MakeGCNotOwned() {
127 return RetEffect(GCNotOwnedSymbol, ObjC);
128 }
John McCallf85e1932011-06-15 23:02:42 +0000129 static RetEffect MakeARCNotOwned() {
130 return RetEffect(ARCNotOwnedSymbol, ObjC);
131 }
Ted Kremenek553cf182008-06-25 21:21:56 +0000132 static RetEffect MakeNoRet() {
133 return RetEffect(NoRet);
Ted Kremeneka7344702008-06-23 18:02:52 +0000134 }
Jordy Roseef945882012-03-18 01:26:10 +0000135
136 void Profile(llvm::FoldingSetNodeID& ID) const {
137 ID.AddInteger((unsigned) K);
138 ID.AddInteger((unsigned) O);
139 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000140};
Mike Stump1eb44332009-09-09 15:08:12 +0000141
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000142//===----------------------------------------------------------------------===//
143// Reference-counting logic (typestate + counts).
144//===----------------------------------------------------------------------===//
Mike Stump1eb44332009-09-09 15:08:12 +0000145
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000146class RefVal {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000147public:
148 enum Kind {
149 Owned = 0, // Owning reference.
150 NotOwned, // Reference is not owned by still valid (not freed).
151 Released, // Object has been released.
152 ReturnedOwned, // Returned object passes ownership to caller.
153 ReturnedNotOwned, // Return object does not pass ownership to caller.
154 ERROR_START,
155 ErrorDeallocNotOwned, // -dealloc called on non-owned object.
156 ErrorDeallocGC, // Calling -dealloc with GC enabled.
157 ErrorUseAfterRelease, // Object used after released.
158 ErrorReleaseNotOwned, // Release of an object that was not owned.
159 ERROR_LEAK_START,
160 ErrorLeak, // A memory leak due to excessive reference counts.
161 ErrorLeakReturned, // A memory leak due to the returning method not having
162 // the correct naming conventions.
163 ErrorGCLeakReturned,
164 ErrorOverAutorelease,
165 ErrorReturnedNotOwned
166 };
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000167
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000168private:
169 Kind kind;
170 RetEffect::ObjKind okind;
171 unsigned Cnt;
172 unsigned ACnt;
173 QualType T;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000174
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000175 RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t)
176 : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {}
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000177
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000178public:
179 Kind getKind() const { return kind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000180
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000181 RetEffect::ObjKind getObjKind() const { return okind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000182
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000183 unsigned getCount() const { return Cnt; }
184 unsigned getAutoreleaseCount() const { return ACnt; }
185 unsigned getCombinedCounts() const { return Cnt + ACnt; }
186 void clearCounts() { Cnt = 0; ACnt = 0; }
187 void setCount(unsigned i) { Cnt = i; }
188 void setAutoreleaseCount(unsigned i) { ACnt = i; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000189
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000190 QualType getType() const { return T; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000191
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000192 bool isOwned() const {
193 return getKind() == Owned;
194 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000195
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000196 bool isNotOwned() const {
197 return getKind() == NotOwned;
198 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000199
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000200 bool isReturnedOwned() const {
201 return getKind() == ReturnedOwned;
202 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000203
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000204 bool isReturnedNotOwned() const {
205 return getKind() == ReturnedNotOwned;
206 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000207
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000208 static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
209 unsigned Count = 1) {
210 return RefVal(Owned, o, Count, 0, t);
211 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000212
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000213 static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
214 unsigned Count = 0) {
215 return RefVal(NotOwned, o, Count, 0, t);
216 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000217
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000218 // Comparison, profiling, and pretty-printing.
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000219
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000220 bool operator==(const RefVal& X) const {
221 return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt;
222 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000223
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000224 RefVal operator-(size_t i) const {
225 return RefVal(getKind(), getObjKind(), getCount() - i,
226 getAutoreleaseCount(), getType());
227 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000228
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000229 RefVal operator+(size_t i) const {
230 return RefVal(getKind(), getObjKind(), getCount() + i,
231 getAutoreleaseCount(), getType());
232 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000233
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000234 RefVal operator^(Kind k) const {
235 return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
236 getType());
237 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000238
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000239 RefVal autorelease() const {
240 return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
241 getType());
242 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000243
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000244 void Profile(llvm::FoldingSetNodeID& ID) const {
245 ID.AddInteger((unsigned) kind);
246 ID.AddInteger(Cnt);
247 ID.AddInteger(ACnt);
248 ID.Add(T);
249 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000250
Ted Kremenek9c378f72011-08-12 23:37:29 +0000251 void print(raw_ostream &Out) const;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000252};
253
Ted Kremenek9c378f72011-08-12 23:37:29 +0000254void RefVal::print(raw_ostream &Out) const {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000255 if (!T.isNull())
Jordy Rosedbd658e2011-08-28 19:11:56 +0000256 Out << "Tracked " << T.getAsString() << '/';
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000257
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000258 switch (getKind()) {
Jordy Rose910c4052011-09-02 06:44:22 +0000259 default: llvm_unreachable("Invalid RefVal kind");
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000260 case Owned: {
261 Out << "Owned";
262 unsigned cnt = getCount();
263 if (cnt) Out << " (+ " << cnt << ")";
264 break;
265 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000266
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000267 case NotOwned: {
268 Out << "NotOwned";
269 unsigned cnt = getCount();
270 if (cnt) Out << " (+ " << cnt << ")";
271 break;
272 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000273
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000274 case ReturnedOwned: {
275 Out << "ReturnedOwned";
276 unsigned cnt = getCount();
277 if (cnt) Out << " (+ " << cnt << ")";
278 break;
279 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000280
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000281 case ReturnedNotOwned: {
282 Out << "ReturnedNotOwned";
283 unsigned cnt = getCount();
284 if (cnt) Out << " (+ " << cnt << ")";
285 break;
286 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000287
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000288 case Released:
289 Out << "Released";
290 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000291
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000292 case ErrorDeallocGC:
293 Out << "-dealloc (GC)";
294 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000295
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000296 case ErrorDeallocNotOwned:
297 Out << "-dealloc (not-owned)";
298 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000299
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000300 case ErrorLeak:
301 Out << "Leaked";
302 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000303
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000304 case ErrorLeakReturned:
305 Out << "Leaked (Bad naming)";
306 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000307
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000308 case ErrorGCLeakReturned:
309 Out << "Leaked (GC-ed at return)";
310 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000311
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000312 case ErrorUseAfterRelease:
313 Out << "Use-After-Release [ERROR]";
314 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000315
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000316 case ErrorReleaseNotOwned:
317 Out << "Release of Not-Owned [ERROR]";
318 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000319
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000320 case RefVal::ErrorOverAutorelease:
321 Out << "Over autoreleased";
322 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000323
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000324 case RefVal::ErrorReturnedNotOwned:
325 Out << "Non-owned object returned instead of owned";
326 break;
327 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000328
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000329 if (ACnt) {
330 Out << " [ARC +" << ACnt << ']';
331 }
332}
333} //end anonymous namespace
334
335//===----------------------------------------------------------------------===//
336// RefBindings - State used to track object reference counts.
337//===----------------------------------------------------------------------===//
338
339typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000340
341namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000342namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000343template<>
344struct ProgramStateTrait<RefBindings>
345 : public ProgramStatePartialTrait<RefBindings> {
346 static void *GDMIndex() {
347 static int RefBIndex = 0;
348 return &RefBIndex;
349 }
350};
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000351}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000352}
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000353
354//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +0000355// Function/Method behavior summaries.
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000356//===----------------------------------------------------------------------===//
357
358namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000359class RetainSummary {
Jordy Roseef945882012-03-18 01:26:10 +0000360 /// Args - a map of (index, ArgEffect) pairs, where index
Ted Kremenek1bffd742008-05-06 15:44:25 +0000361 /// specifies the argument (starting from 0). This can be sparsely
362 /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000363 ArgEffects Args;
Mike Stump1eb44332009-09-09 15:08:12 +0000364
Ted Kremenek1bffd742008-05-06 15:44:25 +0000365 /// DefaultArgEffect - The default ArgEffect to apply to arguments that
366 /// do not have an entry in Args.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000367 ArgEffect DefaultArgEffect;
Mike Stump1eb44332009-09-09 15:08:12 +0000368
Ted Kremenek553cf182008-06-25 21:21:56 +0000369 /// Receiver - If this summary applies to an Objective-C message expression,
370 /// this is the effect applied to the state of the receiver.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000371 ArgEffect Receiver;
Mike Stump1eb44332009-09-09 15:08:12 +0000372
Ted Kremenek553cf182008-06-25 21:21:56 +0000373 /// Ret - The effect on the return value. Used to indicate if the
Jordy Rose76c506f2011-08-21 21:58:18 +0000374 /// function/method call returns a new tracked symbol.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000375 RetEffect Ret;
Mike Stump1eb44332009-09-09 15:08:12 +0000376
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000377public:
Ted Kremenekb77449c2009-05-03 05:20:50 +0000378 RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
Jordy Rosee62e87b2011-08-20 20:55:40 +0000379 ArgEffect ReceiverEff)
380 : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000381
Ted Kremenek553cf182008-06-25 21:21:56 +0000382 /// getArg - Return the argument effect on the argument specified by
383 /// idx (starting from 0).
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000384 ArgEffect getArg(unsigned idx) const {
Ted Kremenekb77449c2009-05-03 05:20:50 +0000385 if (const ArgEffect *AE = Args.lookup(idx))
386 return *AE;
Mike Stump1eb44332009-09-09 15:08:12 +0000387
Ted Kremenek1bffd742008-05-06 15:44:25 +0000388 return DefaultArgEffect;
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000389 }
Ted Kremenek11fe1752011-01-27 18:43:03 +0000390
391 void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
392 Args = af.add(Args, idx, e);
393 }
Mike Stump1eb44332009-09-09 15:08:12 +0000394
Ted Kremenek885c27b2009-05-04 05:31:22 +0000395 /// setDefaultArgEffect - Set the default argument effect.
396 void setDefaultArgEffect(ArgEffect E) {
397 DefaultArgEffect = E;
398 }
Mike Stump1eb44332009-09-09 15:08:12 +0000399
Ted Kremenek553cf182008-06-25 21:21:56 +0000400 /// getRetEffect - Returns the effect on the return value of the call.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000401 RetEffect getRetEffect() const { return Ret; }
Mike Stump1eb44332009-09-09 15:08:12 +0000402
Ted Kremenek885c27b2009-05-04 05:31:22 +0000403 /// setRetEffect - Set the effect of the return value of the call.
404 void setRetEffect(RetEffect E) { Ret = E; }
Mike Stump1eb44332009-09-09 15:08:12 +0000405
Ted Kremenek12b94342011-01-27 06:54:14 +0000406
407 /// Sets the effect on the receiver of the message.
408 void setReceiverEffect(ArgEffect e) { Receiver = e; }
409
Ted Kremenek553cf182008-06-25 21:21:56 +0000410 /// getReceiverEffect - Returns the effect on the receiver of the call.
411 /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000412 ArgEffect getReceiverEffect() const { return Receiver; }
Jordy Rose4df54fe2011-08-23 04:27:15 +0000413
414 /// Test if two retain summaries are identical. Note that merely equivalent
415 /// summaries are not necessarily identical (for example, if an explicit
416 /// argument effect matches the default effect).
417 bool operator==(const RetainSummary &Other) const {
418 return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
419 Receiver == Other.Receiver && Ret == Other.Ret;
420 }
Jordy Roseef945882012-03-18 01:26:10 +0000421
422 /// Profile this summary for inclusion in a FoldingSet.
423 void Profile(llvm::FoldingSetNodeID& ID) const {
424 ID.Add(Args);
425 ID.Add(DefaultArgEffect);
426 ID.Add(Receiver);
427 ID.Add(Ret);
428 }
429
430 /// A retain summary is simple if it has no ArgEffects other than the default.
431 bool isSimple() const {
432 return Args.isEmpty();
433 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000434};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000435} // end anonymous namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000436
Ted Kremenek553cf182008-06-25 21:21:56 +0000437//===----------------------------------------------------------------------===//
438// Data structures for constructing summaries.
439//===----------------------------------------------------------------------===//
Ted Kremenek53301ba2008-06-24 03:49:48 +0000440
Ted Kremenek553cf182008-06-25 21:21:56 +0000441namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000442class ObjCSummaryKey {
Ted Kremenek553cf182008-06-25 21:21:56 +0000443 IdentifierInfo* II;
444 Selector S;
Mike Stump1eb44332009-09-09 15:08:12 +0000445public:
Ted Kremenek553cf182008-06-25 21:21:56 +0000446 ObjCSummaryKey(IdentifierInfo* ii, Selector s)
447 : II(ii), S(s) {}
448
Ted Kremenek9c378f72011-08-12 23:37:29 +0000449 ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
Ted Kremenek553cf182008-06-25 21:21:56 +0000450 : II(d ? d->getIdentifier() : 0), S(s) {}
Ted Kremenek70b6a832009-05-13 18:16:01 +0000451
Ted Kremenek9c378f72011-08-12 23:37:29 +0000452 ObjCSummaryKey(const ObjCInterfaceDecl *d, IdentifierInfo *ii, Selector s)
Ted Kremenek70b6a832009-05-13 18:16:01 +0000453 : II(d ? d->getIdentifier() : ii), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000454
Ted Kremenek553cf182008-06-25 21:21:56 +0000455 ObjCSummaryKey(Selector s)
456 : II(0), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000457
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000458 IdentifierInfo *getIdentifier() const { return II; }
Ted Kremenek553cf182008-06-25 21:21:56 +0000459 Selector getSelector() const { return S; }
460};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000461}
462
463namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000464template <> struct DenseMapInfo<ObjCSummaryKey> {
465 static inline ObjCSummaryKey getEmptyKey() {
466 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
467 DenseMapInfo<Selector>::getEmptyKey());
468 }
Mike Stump1eb44332009-09-09 15:08:12 +0000469
Ted Kremenek553cf182008-06-25 21:21:56 +0000470 static inline ObjCSummaryKey getTombstoneKey() {
471 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
Mike Stump1eb44332009-09-09 15:08:12 +0000472 DenseMapInfo<Selector>::getTombstoneKey());
Ted Kremenek553cf182008-06-25 21:21:56 +0000473 }
Mike Stump1eb44332009-09-09 15:08:12 +0000474
Ted Kremenek553cf182008-06-25 21:21:56 +0000475 static unsigned getHashValue(const ObjCSummaryKey &V) {
476 return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier())
Mike Stump1eb44332009-09-09 15:08:12 +0000477 & 0x88888888)
Ted Kremenek553cf182008-06-25 21:21:56 +0000478 | (DenseMapInfo<Selector>::getHashValue(V.getSelector())
479 & 0x55555555);
480 }
Mike Stump1eb44332009-09-09 15:08:12 +0000481
Ted Kremenek553cf182008-06-25 21:21:56 +0000482 static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
483 return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(),
484 RHS.getIdentifier()) &&
485 DenseMapInfo<Selector>::isEqual(LHS.getSelector(),
486 RHS.getSelector());
487 }
Mike Stump1eb44332009-09-09 15:08:12 +0000488
Ted Kremenek553cf182008-06-25 21:21:56 +0000489};
Chris Lattner06159e82009-12-15 07:26:51 +0000490template <>
491struct isPodLike<ObjCSummaryKey> { static const bool value = true; };
Ted Kremenek4f22a782008-06-23 23:30:29 +0000492} // end llvm namespace
Mike Stump1eb44332009-09-09 15:08:12 +0000493
Ted Kremenek4f22a782008-06-23 23:30:29 +0000494namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000495class ObjCSummaryCache {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000496 typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
Ted Kremenek553cf182008-06-25 21:21:56 +0000497 MapTy M;
498public:
499 ObjCSummaryCache() {}
Mike Stump1eb44332009-09-09 15:08:12 +0000500
Ted Kremenek93edbc52011-10-05 23:54:29 +0000501 const RetainSummary * find(const ObjCInterfaceDecl *D, IdentifierInfo *ClsName,
Ted Kremeneka8833552009-04-29 23:03:22 +0000502 Selector S) {
Ted Kremenek8711c032009-04-29 05:04:30 +0000503 // Lookup the method using the decl for the class @interface. If we
504 // have no decl, lookup using the class name.
505 return D ? find(D, S) : find(ClsName, S);
506 }
Mike Stump1eb44332009-09-09 15:08:12 +0000507
Ted Kremenek93edbc52011-10-05 23:54:29 +0000508 const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000509 // Do a lookup with the (D,S) pair. If we find a match return
510 // the iterator.
511 ObjCSummaryKey K(D, S);
512 MapTy::iterator I = M.find(K);
Mike Stump1eb44332009-09-09 15:08:12 +0000513
Ted Kremenek553cf182008-06-25 21:21:56 +0000514 if (I != M.end() || !D)
Ted Kremenek614cc542009-07-21 23:27:57 +0000515 return I->second;
Mike Stump1eb44332009-09-09 15:08:12 +0000516
Ted Kremenek553cf182008-06-25 21:21:56 +0000517 // Walk the super chain. If we find a hit with a parent, we'll end
518 // up returning that summary. We actually allow that key (null,S), as
519 // we cache summaries for the null ObjCInterfaceDecl* to allow us to
520 // generate initial summaries without having to worry about NSObject
521 // being declared.
522 // FIXME: We may change this at some point.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000523 for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000524 if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
525 break;
Mike Stump1eb44332009-09-09 15:08:12 +0000526
Ted Kremenek553cf182008-06-25 21:21:56 +0000527 if (!C)
Ted Kremenek614cc542009-07-21 23:27:57 +0000528 return NULL;
Ted Kremenek553cf182008-06-25 21:21:56 +0000529 }
Mike Stump1eb44332009-09-09 15:08:12 +0000530
531 // Cache the summary with original key to make the next lookup faster
Ted Kremenek553cf182008-06-25 21:21:56 +0000532 // and return the iterator.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000533 const RetainSummary *Summ = I->second;
Ted Kremenek614cc542009-07-21 23:27:57 +0000534 M[K] = Summ;
535 return Summ;
Ted Kremenek553cf182008-06-25 21:21:56 +0000536 }
Mike Stump1eb44332009-09-09 15:08:12 +0000537
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000538 const RetainSummary *find(IdentifierInfo* II, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000539 // FIXME: Class method lookup. Right now we dont' have a good way
540 // of going between IdentifierInfo* and the class hierarchy.
Ted Kremenek614cc542009-07-21 23:27:57 +0000541 MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
Mike Stump1eb44332009-09-09 15:08:12 +0000542
Ted Kremenek614cc542009-07-21 23:27:57 +0000543 if (I == M.end())
544 I = M.find(ObjCSummaryKey(S));
Mike Stump1eb44332009-09-09 15:08:12 +0000545
Ted Kremenek614cc542009-07-21 23:27:57 +0000546 return I == M.end() ? NULL : I->second;
Ted Kremenek553cf182008-06-25 21:21:56 +0000547 }
Mike Stump1eb44332009-09-09 15:08:12 +0000548
Ted Kremenek93edbc52011-10-05 23:54:29 +0000549 const RetainSummary *& operator[](ObjCSummaryKey K) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000550 return M[K];
551 }
Mike Stump1eb44332009-09-09 15:08:12 +0000552
Ted Kremenek93edbc52011-10-05 23:54:29 +0000553 const RetainSummary *& operator[](Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000554 return M[ ObjCSummaryKey(S) ];
555 }
Mike Stump1eb44332009-09-09 15:08:12 +0000556};
Ted Kremenek553cf182008-06-25 21:21:56 +0000557} // end anonymous namespace
558
559//===----------------------------------------------------------------------===//
560// Data structures for managing collections of summaries.
561//===----------------------------------------------------------------------===//
562
563namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000564class RetainSummaryManager {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000565
566 //==-----------------------------------------------------------------==//
567 // Typedefs.
568 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000569
Ted Kremenek93edbc52011-10-05 23:54:29 +0000570 typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000571 FuncSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000572
Ted Kremenek4f22a782008-06-23 23:30:29 +0000573 typedef ObjCSummaryCache ObjCMethodSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000574
Jordy Roseef945882012-03-18 01:26:10 +0000575 typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
576
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000577 //==-----------------------------------------------------------------==//
578 // Data.
579 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000580
Ted Kremenek553cf182008-06-25 21:21:56 +0000581 /// Ctx - The ASTContext object for the analyzed ASTs.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000582 ASTContext &Ctx;
Ted Kremenek179064e2008-07-01 17:21:27 +0000583
Ted Kremenek553cf182008-06-25 21:21:56 +0000584 /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
Ted Kremenek377e2302008-04-29 05:33:51 +0000585 const bool GCEnabled;
Mike Stump1eb44332009-09-09 15:08:12 +0000586
John McCallf85e1932011-06-15 23:02:42 +0000587 /// Records whether or not the analyzed code runs in ARC mode.
588 const bool ARCEnabled;
589
Ted Kremenek553cf182008-06-25 21:21:56 +0000590 /// FuncSummaries - A map from FunctionDecls to summaries.
Mike Stump1eb44332009-09-09 15:08:12 +0000591 FuncSummariesTy FuncSummaries;
592
Ted Kremenek553cf182008-06-25 21:21:56 +0000593 /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
594 /// to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000595 ObjCMethodSummariesTy ObjCClassMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000596
Ted Kremenek553cf182008-06-25 21:21:56 +0000597 /// ObjCMethodSummaries - A map from selectors to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000598 ObjCMethodSummariesTy ObjCMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000599
Ted Kremenek553cf182008-06-25 21:21:56 +0000600 /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
601 /// and all other data used by the checker.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000602 llvm::BumpPtrAllocator BPAlloc;
Mike Stump1eb44332009-09-09 15:08:12 +0000603
Ted Kremenekb77449c2009-05-03 05:20:50 +0000604 /// AF - A factory for ArgEffects objects.
Mike Stump1eb44332009-09-09 15:08:12 +0000605 ArgEffects::Factory AF;
606
Ted Kremenek553cf182008-06-25 21:21:56 +0000607 /// ScratchArgs - A holding buffer for construct ArgEffects.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000608 ArgEffects ScratchArgs;
Mike Stump1eb44332009-09-09 15:08:12 +0000609
Ted Kremenekec315332009-05-07 23:40:42 +0000610 /// ObjCAllocRetE - Default return effect for methods returning Objective-C
611 /// objects.
612 RetEffect ObjCAllocRetE;
Ted Kremenek547d4952009-06-05 23:18:01 +0000613
Mike Stump1eb44332009-09-09 15:08:12 +0000614 /// ObjCInitRetE - Default return effect for init methods returning
Ted Kremenekac02f202009-08-20 05:13:36 +0000615 /// Objective-C objects.
Ted Kremenek547d4952009-06-05 23:18:01 +0000616 RetEffect ObjCInitRetE;
Mike Stump1eb44332009-09-09 15:08:12 +0000617
Jordy Roseef945882012-03-18 01:26:10 +0000618 /// SimpleSummaries - Used for uniquing summaries that don't have special
619 /// effects.
620 llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
Mike Stump1eb44332009-09-09 15:08:12 +0000621
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000622 //==-----------------------------------------------------------------==//
623 // Methods.
624 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000625
Ted Kremenek553cf182008-06-25 21:21:56 +0000626 /// getArgEffects - Returns a persistent ArgEffects object based on the
627 /// data in ScratchArgs.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000628 ArgEffects getArgEffects();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000629
Mike Stump1eb44332009-09-09 15:08:12 +0000630 enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
631
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000632public:
Ted Kremenek78a35a32009-05-12 20:06:54 +0000633 RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
Ted Kremenek93edbc52011-10-05 23:54:29 +0000634
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000635 const RetainSummary *getUnarySummary(const FunctionType* FT,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000636 UnaryFuncKind func);
Mike Stump1eb44332009-09-09 15:08:12 +0000637
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000638 const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
639 const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
640 const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000641
Jordy Roseef945882012-03-18 01:26:10 +0000642 const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
Ted Kremenek706522f2008-10-29 04:07:07 +0000643
Jordy Roseef945882012-03-18 01:26:10 +0000644 const RetainSummary *getPersistentSummary(RetEffect RetEff,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000645 ArgEffect ReceiverEff = DoNothing,
646 ArgEffect DefaultEff = MayEscape) {
Jordy Roseef945882012-03-18 01:26:10 +0000647 RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
648 return getPersistentSummary(Summ);
649 }
650
651 const RetainSummary *getDefaultSummary() {
652 return getPersistentSummary(RetEffect::MakeNoRet(),
653 DoNothing, MayEscape);
Ted Kremenek9c32d082008-05-06 00:30:21 +0000654 }
Mike Stump1eb44332009-09-09 15:08:12 +0000655
Ted Kremenek93edbc52011-10-05 23:54:29 +0000656 const RetainSummary *getPersistentStopSummary() {
Jordy Roseef945882012-03-18 01:26:10 +0000657 return getPersistentSummary(RetEffect::MakeNoRet(),
658 StopTracking, StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +0000659 }
Ted Kremenekb3095252008-05-06 04:20:12 +0000660
Ted Kremenek1f180c32008-06-23 22:21:20 +0000661 void InitializeClassMethodSummaries();
662 void InitializeMethodSummaries();
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000663private:
Ted Kremenek93edbc52011-10-05 23:54:29 +0000664 void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000665 ObjCClassMethodSummaries[S] = Summ;
666 }
Mike Stump1eb44332009-09-09 15:08:12 +0000667
Ted Kremenek93edbc52011-10-05 23:54:29 +0000668 void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000669 ObjCMethodSummaries[S] = Summ;
670 }
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000671
Ted Kremeneka9797122012-02-18 21:37:48 +0000672 void addClassMethSummary(const char* Cls, const char* name,
673 const RetainSummary *Summ, bool isNullary = true) {
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000674 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
Ted Kremeneka9797122012-02-18 21:37:48 +0000675 Selector S = isNullary ? GetNullarySelector(name, Ctx)
676 : GetUnarySelector(name, Ctx);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000677 ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
678 }
Mike Stump1eb44332009-09-09 15:08:12 +0000679
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000680 void addInstMethSummary(const char* Cls, const char* nullaryName,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000681 const RetainSummary *Summ) {
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000682 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
683 Selector S = GetNullarySelector(nullaryName, Ctx);
684 ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
685 }
Mike Stump1eb44332009-09-09 15:08:12 +0000686
Ted Kremenekde4d5332009-04-24 17:50:11 +0000687 Selector generateSelector(va_list argp) {
Chris Lattner5f9e2722011-07-23 10:55:15 +0000688 SmallVector<IdentifierInfo*, 10> II;
Ted Kremenekde4d5332009-04-24 17:50:11 +0000689
Ted Kremenek9e476de2008-08-12 18:30:56 +0000690 while (const char* s = va_arg(argp, const char*))
691 II.push_back(&Ctx.Idents.get(s));
Ted Kremenekde4d5332009-04-24 17:50:11 +0000692
Mike Stump1eb44332009-09-09 15:08:12 +0000693 return Ctx.Selectors.getSelector(II.size(), &II[0]);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000694 }
Mike Stump1eb44332009-09-09 15:08:12 +0000695
Ted Kremenekde4d5332009-04-24 17:50:11 +0000696 void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000697 const RetainSummary * Summ, va_list argp) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000698 Selector S = generateSelector(argp);
699 Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
Ted Kremenek70a733e2008-07-18 17:24:20 +0000700 }
Mike Stump1eb44332009-09-09 15:08:12 +0000701
Ted Kremenek93edbc52011-10-05 23:54:29 +0000702 void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000703 va_list argp;
704 va_start(argp, Summ);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000705 addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp);
Mike Stump1eb44332009-09-09 15:08:12 +0000706 va_end(argp);
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000707 }
Mike Stump1eb44332009-09-09 15:08:12 +0000708
Ted Kremenek93edbc52011-10-05 23:54:29 +0000709 void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000710 va_list argp;
711 va_start(argp, Summ);
712 addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp);
713 va_end(argp);
714 }
Mike Stump1eb44332009-09-09 15:08:12 +0000715
Ted Kremenek93edbc52011-10-05 23:54:29 +0000716 void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000717 va_list argp;
718 va_start(argp, Summ);
719 addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp);
720 va_end(argp);
721 }
722
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000723public:
Mike Stump1eb44332009-09-09 15:08:12 +0000724
Ted Kremenek9c378f72011-08-12 23:37:29 +0000725 RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
Ted Kremenek179064e2008-07-01 17:21:27 +0000726 : Ctx(ctx),
John McCallf85e1932011-06-15 23:02:42 +0000727 GCEnabled(gcenabled),
728 ARCEnabled(usesARC),
729 AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
730 ObjCAllocRetE(gcenabled
731 ? RetEffect::MakeGCNotOwned()
732 : (usesARC ? RetEffect::MakeARCNotOwned()
733 : RetEffect::MakeOwned(RetEffect::ObjC, true))),
734 ObjCInitRetE(gcenabled
735 ? RetEffect::MakeGCNotOwned()
736 : (usesARC ? RetEffect::MakeARCNotOwned()
Jordy Roseef945882012-03-18 01:26:10 +0000737 : RetEffect::MakeOwnedWhenTrackedReceiver())) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000738 InitializeClassMethodSummaries();
739 InitializeMethodSummaries();
740 }
Mike Stump1eb44332009-09-09 15:08:12 +0000741
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000742 const RetainSummary *getSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000743
Jordy Rosef3aae582012-03-17 21:13:07 +0000744 const RetainSummary *getMethodSummary(Selector S, IdentifierInfo *ClsName,
745 const ObjCInterfaceDecl *ID,
746 const ObjCMethodDecl *MD,
747 QualType RetTy,
748 ObjCMethodSummariesTy &CachedSummaries);
749
Ted Kremenek93edbc52011-10-05 23:54:29 +0000750 const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000751 ProgramStateRef state,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000752 const LocationContext *LC);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000753
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000754 const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000755 const ObjCInterfaceDecl *ID) {
Jordy Rosef3aae582012-03-17 21:13:07 +0000756 return getMethodSummary(msg.getSelector(), 0, ID, msg.getMethodDecl(),
757 msg.getType(Ctx), ObjCMethodSummaries);
Ted Kremenek8711c032009-04-29 05:04:30 +0000758 }
Mike Stump1eb44332009-09-09 15:08:12 +0000759
Ted Kremenek93edbc52011-10-05 23:54:29 +0000760 const RetainSummary *getClassMethodSummary(const ObjCMessage &msg) {
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +0000761 const ObjCInterfaceDecl *Class = 0;
762 if (!msg.isInstanceMessage())
763 Class = msg.getReceiverInterface();
Douglas Gregor04badcf2010-04-21 00:45:42 +0000764
Jordy Rosef3aae582012-03-17 21:13:07 +0000765 return getMethodSummary(msg.getSelector(), Class->getIdentifier(),
766 Class, msg.getMethodDecl(), msg.getType(Ctx),
767 ObjCClassMethodSummaries);
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +0000768 }
Ted Kremenek552333c2009-04-29 17:17:48 +0000769
770 /// getMethodSummary - This version of getMethodSummary is used to query
771 /// the summary for the current method being analyzed.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000772 const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
Ted Kremeneka8833552009-04-29 23:03:22 +0000773 // FIXME: Eventually this should be unneeded.
Ted Kremeneka8833552009-04-29 23:03:22 +0000774 const ObjCInterfaceDecl *ID = MD->getClassInterface();
Ted Kremenek70a65762009-04-30 05:41:14 +0000775 Selector S = MD->getSelector();
Ted Kremenek552333c2009-04-29 17:17:48 +0000776 IdentifierInfo *ClsName = ID->getIdentifier();
777 QualType ResultTy = MD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000778
Jordy Rosef3aae582012-03-17 21:13:07 +0000779 ObjCMethodSummariesTy *CachedSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000780 if (MD->isInstanceMethod())
Jordy Rosef3aae582012-03-17 21:13:07 +0000781 CachedSummaries = &ObjCMethodSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000782 else
Jordy Rosef3aae582012-03-17 21:13:07 +0000783 CachedSummaries = &ObjCClassMethodSummaries;
784
785 return getMethodSummary(S, ClsName, ID, MD, ResultTy, *CachedSummaries);
Ted Kremenek552333c2009-04-29 17:17:48 +0000786 }
Mike Stump1eb44332009-09-09 15:08:12 +0000787
Jordy Rosef3aae582012-03-17 21:13:07 +0000788 const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000789 Selector S, QualType RetTy);
Ted Kremeneka8833552009-04-29 23:03:22 +0000790
Ted Kremenek93edbc52011-10-05 23:54:29 +0000791 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000792 const ObjCMethodDecl *MD);
793
Ted Kremenek93edbc52011-10-05 23:54:29 +0000794 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000795 const FunctionDecl *FD);
796
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000797 bool isGCEnabled() const { return GCEnabled; }
Mike Stump1eb44332009-09-09 15:08:12 +0000798
John McCallf85e1932011-06-15 23:02:42 +0000799 bool isARCEnabled() const { return ARCEnabled; }
800
801 bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000802};
Mike Stump1eb44332009-09-09 15:08:12 +0000803
Jordy Rose0fe62f82011-08-24 09:02:37 +0000804// Used to avoid allocating long-term (BPAlloc'd) memory for default retain
805// summaries. If a function or method looks like it has a default summary, but
806// it has annotations, the annotations are added to the stack-based template
807// and then copied into managed memory.
808class RetainSummaryTemplate {
809 RetainSummaryManager &Manager;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000810 const RetainSummary *&RealSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000811 RetainSummary ScratchSummary;
812 bool Accessed;
813public:
Jordy Rosee921b1a2012-03-17 19:53:04 +0000814 RetainSummaryTemplate(const RetainSummary *&real, const RetainSummary &base,
815 RetainSummaryManager &mgr)
816 : Manager(mgr), RealSummary(real), ScratchSummary(real ? *real : base),
Ted Kremenek93edbc52011-10-05 23:54:29 +0000817 Accessed(false) {}
Jordy Rose0fe62f82011-08-24 09:02:37 +0000818
819 ~RetainSummaryTemplate() {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000820 if (Accessed)
Jordy Roseef945882012-03-18 01:26:10 +0000821 RealSummary = Manager.getPersistentSummary(ScratchSummary);
Jordy Rose0fe62f82011-08-24 09:02:37 +0000822 }
823
824 RetainSummary &operator*() {
825 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000826 return ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000827 }
828
829 RetainSummary *operator->() {
830 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000831 return &ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000832 }
833};
834
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000835} // end anonymous namespace
836
837//===----------------------------------------------------------------------===//
838// Implementation of checker data structures.
839//===----------------------------------------------------------------------===//
840
Ted Kremenekb77449c2009-05-03 05:20:50 +0000841ArgEffects RetainSummaryManager::getArgEffects() {
842 ArgEffects AE = ScratchArgs;
Ted Kremenek3baf6722010-11-24 00:54:37 +0000843 ScratchArgs = AF.getEmptyMap();
Ted Kremenekb77449c2009-05-03 05:20:50 +0000844 return AE;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000845}
846
Ted Kremenek93edbc52011-10-05 23:54:29 +0000847const RetainSummary *
Jordy Roseef945882012-03-18 01:26:10 +0000848RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
849 // Unique "simple" summaries -- those without ArgEffects.
850 if (OldSumm.isSimple()) {
851 llvm::FoldingSetNodeID ID;
852 OldSumm.Profile(ID);
853
854 void *Pos;
855 CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
856
857 if (!N) {
858 N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
859 new (N) CachedSummaryNode(OldSumm);
860 SimpleSummaries.InsertNode(N, Pos);
861 }
862
863 return &N->getValue();
864 }
865
Ted Kremenek93edbc52011-10-05 23:54:29 +0000866 RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
Jordy Roseef945882012-03-18 01:26:10 +0000867 new (Summ) RetainSummary(OldSumm);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000868 return Summ;
869}
870
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000871//===----------------------------------------------------------------------===//
872// Summary creation for functions (largely uses of Core Foundation).
873//===----------------------------------------------------------------------===//
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000874
Ted Kremenek9c378f72011-08-12 23:37:29 +0000875static bool isRetain(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000876 return FName.endswith("Retain");
Ted Kremenek12619382009-01-12 21:45:02 +0000877}
878
Ted Kremenek9c378f72011-08-12 23:37:29 +0000879static bool isRelease(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000880 return FName.endswith("Release");
Ted Kremenek12619382009-01-12 21:45:02 +0000881}
882
Jordy Rose76c506f2011-08-21 21:58:18 +0000883static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
884 // FIXME: Remove FunctionDecl parameter.
885 // FIXME: Is it really okay if MakeCollectable isn't a suffix?
886 return FName.find("MakeCollectable") != StringRef::npos;
887}
888
Ted Kremenek93edbc52011-10-05 23:54:29 +0000889const RetainSummary * RetainSummaryManager::getSummary(const FunctionDecl *FD) {
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000890 // Look up a summary in our cache of FunctionDecls -> Summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000891 FuncSummariesTy::iterator I = FuncSummaries.find(FD);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000892 if (I != FuncSummaries.end())
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000893 return I->second;
894
Ted Kremeneke401a0c2009-05-04 15:34:07 +0000895 // No summary? Generate one.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000896 const RetainSummary *S = 0;
Mike Stump1eb44332009-09-09 15:08:12 +0000897
Ted Kremenek37d785b2008-07-15 16:50:12 +0000898 do {
Ted Kremenek12619382009-01-12 21:45:02 +0000899 // We generate "stop" summaries for implicitly defined functions.
900 if (FD->isImplicit()) {
901 S = getPersistentStopSummary();
902 break;
Ted Kremenek37d785b2008-07-15 16:50:12 +0000903 }
Ted Kremenek9ca28512011-05-02 21:21:42 +0000904 // For C++ methods, generate an implicit "stop" summary as well. We
905 // can relax this once we have a clear policy for C++ methods and
906 // ownership attributes.
907 if (isa<CXXMethodDecl>(FD)) {
908 S = getPersistentStopSummary();
909 break;
910 }
Mike Stump1eb44332009-09-09 15:08:12 +0000911
John McCall183700f2009-09-21 23:43:11 +0000912 // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
Ted Kremenek99890652009-01-16 18:40:33 +0000913 // function's type.
John McCall183700f2009-09-21 23:43:11 +0000914 const FunctionType* FT = FD->getType()->getAs<FunctionType>();
Ted Kremenek48c6d182009-12-16 06:06:43 +0000915 const IdentifierInfo *II = FD->getIdentifier();
916 if (!II)
917 break;
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000918
919 StringRef FName = II->getName();
Mike Stump1eb44332009-09-09 15:08:12 +0000920
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +0000921 // Strip away preceding '_'. Doing this here will effect all the checks
922 // down below.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000923 FName = FName.substr(FName.find_first_not_of('_'));
Mike Stump1eb44332009-09-09 15:08:12 +0000924
Ted Kremenek12619382009-01-12 21:45:02 +0000925 // Inspect the result type.
926 QualType RetTy = FT->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000927
Ted Kremenek12619382009-01-12 21:45:02 +0000928 // FIXME: This should all be refactored into a chain of "summary lookup"
929 // filters.
Ted Kremenek008636a2009-10-14 00:27:24 +0000930 assert(ScratchArgs.isEmpty());
Ted Kremenek39d88b02009-06-15 20:36:07 +0000931
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000932 if (FName == "pthread_create") {
933 // Part of: <rdar://problem/7299394>. This will be addressed
934 // better with IPA.
935 S = getPersistentStopSummary();
936 } else if (FName == "NSMakeCollectable") {
937 // Handle: id NSMakeCollectable(CFTypeRef)
938 S = (RetTy->isObjCIdType())
939 ? getUnarySummary(FT, cfmakecollectable)
940 : getPersistentStopSummary();
941 } else if (FName == "IOBSDNameMatching" ||
942 FName == "IOServiceMatching" ||
943 FName == "IOServiceNameMatching" ||
944 FName == "IORegistryEntryIDMatching" ||
945 FName == "IOOpenFirmwarePathMatching") {
946 // Part of <rdar://problem/6961230>. (IOKit)
947 // This should be addressed using a API table.
948 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
949 DoNothing, DoNothing);
950 } else if (FName == "IOServiceGetMatchingService" ||
951 FName == "IOServiceGetMatchingServices") {
952 // FIXES: <rdar://problem/6326900>
953 // This should be addressed using a API table. This strcmp is also
954 // a little gross, but there is no need to super optimize here.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000955 ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000956 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
957 } else if (FName == "IOServiceAddNotification" ||
958 FName == "IOServiceAddMatchingNotification") {
959 // Part of <rdar://problem/6961230>. (IOKit)
960 // This should be addressed using a API table.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000961 ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000962 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
963 } else if (FName == "CVPixelBufferCreateWithBytes") {
964 // FIXES: <rdar://problem/7283567>
965 // Eventually this can be improved by recognizing that the pixel
966 // buffer passed to CVPixelBufferCreateWithBytes is released via
967 // a callback and doing full IPA to make sure this is done correctly.
968 // FIXME: This function has an out parameter that returns an
969 // allocated object.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000970 ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000971 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
972 } else if (FName == "CGBitmapContextCreateWithData") {
973 // FIXES: <rdar://problem/7358899>
974 // Eventually this can be improved by recognizing that 'releaseInfo'
975 // passed to CGBitmapContextCreateWithData is released via
976 // a callback and doing full IPA to make sure this is done correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000977 ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000978 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
979 DoNothing, DoNothing);
980 } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
981 // FIXES: <rdar://problem/7283567>
982 // Eventually this can be improved by recognizing that the pixel
983 // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
984 // via a callback and doing full IPA to make sure this is done
985 // correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000986 ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000987 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekb04cb592009-06-11 18:17:24 +0000988 }
Mike Stump1eb44332009-09-09 15:08:12 +0000989
Ted Kremenekb04cb592009-06-11 18:17:24 +0000990 // Did we get a summary?
991 if (S)
992 break;
Ted Kremenek61991902009-03-17 22:43:44 +0000993
994 // Enable this code once the semantics of NSDeallocateObject are resolved
995 // for GC. <rdar://problem/6619988>
996#if 0
997 // Handle: NSDeallocateObject(id anObject);
998 // This method does allow 'nil' (although we don't check it now).
Mike Stump1eb44332009-09-09 15:08:12 +0000999 if (strcmp(FName, "NSDeallocateObject") == 0) {
Ted Kremenek61991902009-03-17 22:43:44 +00001000 return RetTy == Ctx.VoidTy
1001 ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc)
1002 : getPersistentStopSummary();
1003 }
1004#endif
Ted Kremenek12619382009-01-12 21:45:02 +00001005
1006 if (RetTy->isPointerType()) {
1007 // For CoreFoundation ('CF') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001008 if (cocoa::isRefType(RetTy, "CF", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001009 if (isRetain(FD, FName))
1010 S = getUnarySummary(FT, cfretain);
Jordy Rose76c506f2011-08-21 21:58:18 +00001011 else if (isMakeCollectable(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001012 S = getUnarySummary(FT, cfmakecollectable);
Mike Stump1eb44332009-09-09 15:08:12 +00001013 else
John McCall7df2ff42011-10-01 00:48:56 +00001014 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001015
1016 break;
1017 }
1018
1019 // For CoreGraphics ('CG') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001020 if (cocoa::isRefType(RetTy, "CG", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001021 if (isRetain(FD, FName))
1022 S = getUnarySummary(FT, cfretain);
1023 else
John McCall7df2ff42011-10-01 00:48:56 +00001024 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001025
1026 break;
1027 }
1028
1029 // For the Disk Arbitration API (DiskArbitration/DADisk.h)
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001030 if (cocoa::isRefType(RetTy, "DADisk") ||
1031 cocoa::isRefType(RetTy, "DADissenter") ||
1032 cocoa::isRefType(RetTy, "DASessionRef")) {
John McCall7df2ff42011-10-01 00:48:56 +00001033 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001034 break;
1035 }
Mike Stump1eb44332009-09-09 15:08:12 +00001036
Ted Kremenek12619382009-01-12 21:45:02 +00001037 break;
1038 }
1039
1040 // Check for release functions, the only kind of functions that we care
1041 // about that don't return a pointer type.
1042 if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
Ted Kremeneke7d03122010-02-08 16:45:01 +00001043 // Test for 'CGCF'.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001044 FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
Ted Kremeneke7d03122010-02-08 16:45:01 +00001045
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +00001046 if (isRelease(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001047 S = getUnarySummary(FT, cfrelease);
1048 else {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001049 assert (ScratchArgs.isEmpty());
Ted Kremenek68189282009-01-29 22:45:13 +00001050 // Remaining CoreFoundation and CoreGraphics functions.
1051 // We use to assume that they all strictly followed the ownership idiom
1052 // and that ownership cannot be transferred. While this is technically
1053 // correct, many methods allow a tracked object to escape. For example:
1054 //
Mike Stump1eb44332009-09-09 15:08:12 +00001055 // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
Ted Kremenek68189282009-01-29 22:45:13 +00001056 // CFDictionaryAddValue(y, key, x);
Mike Stump1eb44332009-09-09 15:08:12 +00001057 // CFRelease(x);
Ted Kremenek68189282009-01-29 22:45:13 +00001058 // ... it is okay to use 'x' since 'y' has a reference to it
1059 //
1060 // We handle this and similar cases with the follow heuristic. If the
Ted Kremenekc4843812009-08-20 00:57:22 +00001061 // function name contains "InsertValue", "SetValue", "AddValue",
1062 // "AppendValue", or "SetAttribute", then we assume that arguments may
1063 // "escape." This means that something else holds on to the object,
1064 // allowing it be used even after its local retain count drops to 0.
Benjamin Kramere45c1492010-01-11 19:46:28 +00001065 ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1066 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1067 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1068 StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
Benjamin Kramerc027e542010-01-11 20:15:06 +00001069 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
Ted Kremenek68189282009-01-29 22:45:13 +00001070 ? MayEscape : DoNothing;
Mike Stump1eb44332009-09-09 15:08:12 +00001071
Ted Kremenek68189282009-01-29 22:45:13 +00001072 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
Ted Kremenek12619382009-01-12 21:45:02 +00001073 }
1074 }
Ted Kremenek37d785b2008-07-15 16:50:12 +00001075 }
1076 while (0);
Mike Stump1eb44332009-09-09 15:08:12 +00001077
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001078 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001079 updateSummaryFromAnnotations(S, FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001080
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001081 FuncSummaries[FD] = S;
Mike Stump1eb44332009-09-09 15:08:12 +00001082 return S;
Ted Kremenek2fff37e2008-03-06 00:08:09 +00001083}
1084
Ted Kremenek93edbc52011-10-05 23:54:29 +00001085const RetainSummary *
John McCall7df2ff42011-10-01 00:48:56 +00001086RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1087 if (coreFoundation::followsCreateRule(FD))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001088 return getCFSummaryCreateRule(FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001089
Ted Kremenekd368d712011-05-25 06:19:45 +00001090 return getCFSummaryGetRule(FD);
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001091}
1092
Ted Kremenek93edbc52011-10-05 23:54:29 +00001093const RetainSummary *
Ted Kremenek6ad315a2009-02-23 16:51:39 +00001094RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1095 UnaryFuncKind func) {
1096
Ted Kremenek12619382009-01-12 21:45:02 +00001097 // Sanity check that this is *really* a unary function. This can
1098 // happen if people do weird things.
Douglas Gregor72564e72009-02-26 23:50:07 +00001099 const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
Ted Kremenek12619382009-01-12 21:45:02 +00001100 if (!FTP || FTP->getNumArgs() != 1)
1101 return getPersistentStopSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001102
Ted Kremenekb77449c2009-05-03 05:20:50 +00001103 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001104
Jordy Rose76c506f2011-08-21 21:58:18 +00001105 ArgEffect Effect;
Ted Kremenek377e2302008-04-29 05:33:51 +00001106 switch (func) {
Jordy Rose76c506f2011-08-21 21:58:18 +00001107 case cfretain: Effect = IncRef; break;
1108 case cfrelease: Effect = DecRef; break;
1109 case cfmakecollectable: Effect = MakeCollectable; break;
Ted Kremenek940b1d82008-04-10 23:44:06 +00001110 }
Jordy Rose76c506f2011-08-21 21:58:18 +00001111
1112 ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1113 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001114}
1115
Ted Kremenek93edbc52011-10-05 23:54:29 +00001116const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001117RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001118 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001119
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001120 return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001121}
1122
Ted Kremenek93edbc52011-10-05 23:54:29 +00001123const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001124RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
Mike Stump1eb44332009-09-09 15:08:12 +00001125 assert (ScratchArgs.isEmpty());
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001126 return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1127 DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001128}
1129
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001130//===----------------------------------------------------------------------===//
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001131// Summary creation for Selectors.
1132//===----------------------------------------------------------------------===//
1133
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001134void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001135RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001136 const FunctionDecl *FD) {
1137 if (!FD)
1138 return;
1139
Jordy Roseef945882012-03-18 01:26:10 +00001140 RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001141
Ted Kremenek11fe1752011-01-27 18:43:03 +00001142 // Effects on the parameters.
1143 unsigned parm_idx = 0;
1144 for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
John McCall98b8f162011-04-06 09:02:12 +00001145 pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001146 const ParmVarDecl *pd = *pi;
1147 if (pd->getAttr<NSConsumedAttr>()) {
Jordy Rose4df54fe2011-08-23 04:27:15 +00001148 if (!GCEnabled) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001149 Template->addArg(AF, parm_idx, DecRef);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001150 }
1151 } else if (pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001152 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001153 }
1154 }
1155
Ted Kremenekb04cb592009-06-11 18:17:24 +00001156 QualType RetTy = FD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001157
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001158 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001159 if (cocoa::isCocoaObjectRef(RetTy)) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001160 if (FD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001161 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001162 }
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001163 else if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001164 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenekb04cb592009-06-11 18:17:24 +00001165 }
Ted Kremenek60411112010-02-18 00:06:12 +00001166 else if (FD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001167 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001168 }
1169 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001170 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001171 }
1172 } else if (RetTy->getAs<PointerType>()) {
1173 if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001174 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001175 }
1176 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001177 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001178 }
Ted Kremenekb04cb592009-06-11 18:17:24 +00001179 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001180}
1181
1182void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001183RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1184 const ObjCMethodDecl *MD) {
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001185 if (!MD)
1186 return;
1187
Jordy Roseef945882012-03-18 01:26:10 +00001188 RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001189 bool isTrackedLoc = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001190
Ted Kremenek12b94342011-01-27 06:54:14 +00001191 // Effects on the receiver.
1192 if (MD->getAttr<NSConsumesSelfAttr>()) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001193 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001194 Template->setReceiverEffect(DecRefMsg);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001195 }
1196
1197 // Effects on the parameters.
1198 unsigned parm_idx = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001199 for (ObjCMethodDecl::param_const_iterator
1200 pi=MD->param_begin(), pe=MD->param_end();
Ted Kremenek11fe1752011-01-27 18:43:03 +00001201 pi != pe; ++pi, ++parm_idx) {
1202 const ParmVarDecl *pd = *pi;
1203 if (pd->getAttr<NSConsumedAttr>()) {
1204 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001205 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001206 }
1207 else if(pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001208 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001209 }
Ted Kremenek12b94342011-01-27 06:54:14 +00001210 }
1211
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001212 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001213 if (cocoa::isCocoaObjectRef(MD->getResultType())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001214 if (MD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001215 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001216 return;
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001217 }
Ted Kremenek60411112010-02-18 00:06:12 +00001218 if (MD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001219 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001220 return;
1221 }
Mike Stump1eb44332009-09-09 15:08:12 +00001222
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001223 isTrackedLoc = true;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001224 } else {
Ted Kremenek6217b802009-07-29 21:53:49 +00001225 isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001226 }
Mike Stump1eb44332009-09-09 15:08:12 +00001227
Ted Kremenek60411112010-02-18 00:06:12 +00001228 if (isTrackedLoc) {
1229 if (MD->getAttr<CFReturnsRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001230 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek60411112010-02-18 00:06:12 +00001231 else if (MD->getAttr<CFReturnsNotRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001232 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001233 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001234}
1235
Ted Kremenek93edbc52011-10-05 23:54:29 +00001236const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001237RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1238 Selector S, QualType RetTy) {
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001239
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +00001240 if (MD) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001241 // Scan the method decl for 'void*' arguments. These should be treated
1242 // as 'StopTracking' because they are often used with delegates.
1243 // Delegates are a frequent form of false positives with the retain
1244 // count checker.
1245 unsigned i = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001246 for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(),
Ted Kremenek376d1e72009-04-24 18:00:17 +00001247 E = MD->param_end(); I != E; ++I, ++i)
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001248 if (const ParmVarDecl *PD = *I) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001249 QualType Ty = Ctx.getCanonicalType(PD->getType());
Douglas Gregora4923eb2009-11-16 21:35:15 +00001250 if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy)
Ted Kremenek3baf6722010-11-24 00:54:37 +00001251 ScratchArgs = AF.add(ScratchArgs, i, StopTracking);
Ted Kremenek376d1e72009-04-24 18:00:17 +00001252 }
1253 }
Mike Stump1eb44332009-09-09 15:08:12 +00001254
Jordy Rosee921b1a2012-03-17 19:53:04 +00001255 // Any special effects?
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001256 ArgEffect ReceiverEff = DoNothing;
Jordy Rosee921b1a2012-03-17 19:53:04 +00001257 RetEffect ResultEff = RetEffect::MakeNoRet();
1258
1259 // Check the method family, and apply any default annotations.
1260 switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1261 case OMF_None:
1262 case OMF_performSelector:
1263 // Assume all Objective-C methods follow Cocoa Memory Management rules.
1264 // FIXME: Does the non-threaded performSelector family really belong here?
1265 // The selector could be, say, @selector(copy).
1266 if (cocoa::isCocoaObjectRef(RetTy))
1267 ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
1268 else if (coreFoundation::isCFObjectRef(RetTy)) {
1269 // ObjCMethodDecl currently doesn't consider CF objects as valid return
1270 // values for alloc, new, copy, or mutableCopy, so we have to
1271 // double-check with the selector. This is ugly, but there aren't that
1272 // many Objective-C methods that return CF objects, right?
1273 if (MD) {
1274 switch (S.getMethodFamily()) {
1275 case OMF_alloc:
1276 case OMF_new:
1277 case OMF_copy:
1278 case OMF_mutableCopy:
1279 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1280 break;
1281 default:
1282 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1283 break;
1284 }
1285 } else {
1286 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1287 }
1288 }
1289 break;
1290 case OMF_init:
1291 ResultEff = ObjCInitRetE;
1292 ReceiverEff = DecRefMsg;
1293 break;
1294 case OMF_alloc:
1295 case OMF_new:
1296 case OMF_copy:
1297 case OMF_mutableCopy:
1298 if (cocoa::isCocoaObjectRef(RetTy))
1299 ResultEff = ObjCAllocRetE;
1300 else if (coreFoundation::isCFObjectRef(RetTy))
1301 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1302 break;
1303 case OMF_autorelease:
1304 ReceiverEff = Autorelease;
1305 break;
1306 case OMF_retain:
1307 ReceiverEff = IncRefMsg;
1308 break;
1309 case OMF_release:
1310 ReceiverEff = DecRefMsg;
1311 break;
1312 case OMF_dealloc:
1313 ReceiverEff = Dealloc;
1314 break;
1315 case OMF_self:
1316 // -self is handled specially by the ExprEngine to propagate the receiver.
1317 break;
1318 case OMF_retainCount:
1319 case OMF_finalize:
1320 // These methods don't return objects.
1321 break;
1322 }
Mike Stump1eb44332009-09-09 15:08:12 +00001323
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001324 // If one of the arguments in the selector has the keyword 'delegate' we
1325 // should stop tracking the reference count for the receiver. This is
1326 // because the reference count is quite possibly handled by a delegate
1327 // method.
1328 if (S.isKeywordSelector()) {
1329 const std::string &str = S.getAsString();
1330 assert(!str.empty());
Benjamin Kramere45c1492010-01-11 19:46:28 +00001331 if (StrInStrNoCase(str, "delegate:") != StringRef::npos)
1332 ReceiverEff = StopTracking;
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001333 }
Mike Stump1eb44332009-09-09 15:08:12 +00001334
Jordy Rosee921b1a2012-03-17 19:53:04 +00001335 if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1336 ResultEff.getKind() == RetEffect::NoRet)
Ted Kremenek93edbc52011-10-05 23:54:29 +00001337 return getDefaultSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001338
Jordy Rosee921b1a2012-03-17 19:53:04 +00001339 return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
Ted Kremenek250b1fa2009-04-23 23:08:22 +00001340}
1341
Ted Kremenek93edbc52011-10-05 23:54:29 +00001342const RetainSummary *
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001343RetainSummaryManager::getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek8bef8232012-01-26 21:29:00 +00001344 ProgramStateRef state,
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001345 const LocationContext *LC) {
1346
1347 // We need the type-information of the tracked receiver object
1348 // Retrieve it from the state.
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001349 const Expr *Receiver = msg.getInstanceReceiver();
Ted Kremenek9c378f72011-08-12 23:37:29 +00001350 const ObjCInterfaceDecl *ID = 0;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001351
1352 // FIXME: Is this really working as expected? There are cases where
1353 // we just use the 'ID' from the message expression.
Douglas Gregor04badcf2010-04-21 00:45:42 +00001354 SVal receiverV;
1355
Ted Kremenek8f326752010-05-21 21:56:53 +00001356 if (Receiver) {
Ted Kremenek5eca4822012-01-06 22:09:28 +00001357 receiverV = state->getSValAsScalarOrLoc(Receiver, LC);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001358
Douglas Gregor04badcf2010-04-21 00:45:42 +00001359 // FIXME: Eventually replace the use of state->get<RefBindings> with
1360 // a generic API for reasoning about the Objective-C types of symbolic
1361 // objects.
1362 if (SymbolRef Sym = receiverV.getAsLocSymbol())
1363 if (const RefVal *T = state->get<RefBindings>(Sym))
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001364 if (const ObjCObjectPointerType* PT =
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001365 T->getType()->getAs<ObjCObjectPointerType>())
Douglas Gregor04badcf2010-04-21 00:45:42 +00001366 ID = PT->getInterfaceDecl();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001367
Douglas Gregor04badcf2010-04-21 00:45:42 +00001368 // FIXME: this is a hack. This may or may not be the actual method
1369 // that is called.
1370 if (!ID) {
1371 if (const ObjCObjectPointerType *PT =
1372 Receiver->getType()->getAs<ObjCObjectPointerType>())
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001373 ID = PT->getInterfaceDecl();
Douglas Gregor04badcf2010-04-21 00:45:42 +00001374 }
1375 } else {
1376 // FIXME: Hack for 'super'.
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001377 ID = msg.getReceiverInterface();
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001378 }
Douglas Gregor04badcf2010-04-21 00:45:42 +00001379
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001380 // FIXME: The receiver could be a reference to a class, meaning that
1381 // we should use the class method.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001382 return getInstanceMethodSummary(msg, ID);
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001383}
1384
Ted Kremenek93edbc52011-10-05 23:54:29 +00001385const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001386RetainSummaryManager::getMethodSummary(Selector S, IdentifierInfo *ClsName,
1387 const ObjCInterfaceDecl *ID,
1388 const ObjCMethodDecl *MD, QualType RetTy,
1389 ObjCMethodSummariesTy &CachedSummaries) {
Ted Kremenek1bffd742008-05-06 15:44:25 +00001390
Ted Kremenek8711c032009-04-29 05:04:30 +00001391 // Look up a summary in our summary cache.
Jordy Rosef3aae582012-03-17 21:13:07 +00001392 const RetainSummary *Summ = CachedSummaries.find(ID, ClsName, S);
Mike Stump1eb44332009-09-09 15:08:12 +00001393
Ted Kremenek614cc542009-07-21 23:27:57 +00001394 if (!Summ) {
Jordy Rosef3aae582012-03-17 21:13:07 +00001395 Summ = getStandardMethodSummary(MD, S, RetTy);
Mike Stump1eb44332009-09-09 15:08:12 +00001396
Ted Kremenek614cc542009-07-21 23:27:57 +00001397 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001398 updateSummaryFromAnnotations(Summ, MD);
Mike Stump1eb44332009-09-09 15:08:12 +00001399
Ted Kremenek614cc542009-07-21 23:27:57 +00001400 // Memoize the summary.
Jordy Rosef3aae582012-03-17 21:13:07 +00001401 CachedSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ;
Ted Kremenek614cc542009-07-21 23:27:57 +00001402 }
Mike Stump1eb44332009-09-09 15:08:12 +00001403
Ted Kremeneke87450e2009-04-23 19:11:35 +00001404 return Summ;
Ted Kremenekc8395602008-05-06 21:26:51 +00001405}
1406
Mike Stump1eb44332009-09-09 15:08:12 +00001407void RetainSummaryManager::InitializeClassMethodSummaries() {
Ted Kremenekec315332009-05-07 23:40:42 +00001408 assert(ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001409 // Create the [NSAssertionHandler currentHander] summary.
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001410 addClassMethSummary("NSAssertionHandler", "currentHandler",
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001411 getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
Mike Stump1eb44332009-09-09 15:08:12 +00001412
Ted Kremenek6d348932008-10-21 15:53:15 +00001413 // Create the [NSAutoreleasePool addObject:] summary.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001414 ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001415 addClassMethSummary("NSAutoreleasePool", "addObject",
1416 getPersistentSummary(RetEffect::MakeNoRet(),
1417 DoNothing, Autorelease));
Mike Stump1eb44332009-09-09 15:08:12 +00001418
Ted Kremenekde4d5332009-04-24 17:50:11 +00001419 // Create the summaries for [NSObject performSelector...]. We treat
1420 // these as 'stop tracking' for the arguments because they are often
1421 // used for delegates that can release the object. When we have better
1422 // inter-procedural analysis we can potentially do something better. This
1423 // workaround is to remove false positives.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001424 const RetainSummary *Summ =
Ted Kremenek012614e2011-08-17 21:04:19 +00001425 getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking);
Ted Kremenekde4d5332009-04-24 17:50:11 +00001426 IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject");
1427 addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject",
1428 "afterDelay", NULL);
1429 addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject",
1430 "afterDelay", "inModes", NULL);
1431 addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread",
1432 "withObject", "waitUntilDone", NULL);
1433 addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread",
1434 "withObject", "waitUntilDone", "modes", NULL);
1435 addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread",
1436 "withObject", "waitUntilDone", NULL);
1437 addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread",
1438 "withObject", "waitUntilDone", "modes", NULL);
1439 addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground",
1440 "withObject", NULL);
Ted Kremenek9c32d082008-05-06 00:30:21 +00001441}
1442
Ted Kremenek1f180c32008-06-23 22:21:20 +00001443void RetainSummaryManager::InitializeMethodSummaries() {
Mike Stump1eb44332009-09-09 15:08:12 +00001444
1445 assert (ScratchArgs.isEmpty());
1446
Ted Kremenekc8395602008-05-06 21:26:51 +00001447 // Create the "init" selector. It just acts as a pass-through for the
1448 // receiver.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001449 const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
Ted Kremenekac02f202009-08-20 05:13:36 +00001450 addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1451
1452 // awakeAfterUsingCoder: behaves basically like an 'init' method. It
1453 // claims the receiver and returns a retained object.
1454 addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1455 InitSumm);
Mike Stump1eb44332009-09-09 15:08:12 +00001456
Ted Kremenekc8395602008-05-06 21:26:51 +00001457 // The next methods are allocators.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001458 const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1459 const RetainSummary *CFAllocSumm =
Ted Kremeneka834fb42009-08-28 19:52:12 +00001460 getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Mike Stump1eb44332009-09-09 15:08:12 +00001461
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001462 // Create the "retain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001463 RetEffect NoRet = RetEffect::MakeNoRet();
Ted Kremenek93edbc52011-10-05 23:54:29 +00001464 const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001465 addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001466
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001467 // Create the "release" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001468 Summ = getPersistentSummary(NoRet, DecRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001469 addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001470
Ted Kremenek299e8152008-05-07 21:17:39 +00001471 // Create the "drain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001472 Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001473 addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001474
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001475 // Create the -dealloc summary.
Jordy Rose500abad2011-08-21 19:41:36 +00001476 Summ = getPersistentSummary(NoRet, Dealloc);
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001477 addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001478
1479 // Create the "autorelease" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001480 Summ = getPersistentSummary(NoRet, Autorelease);
Ted Kremenek553cf182008-06-25 21:21:56 +00001481 addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001482
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001483 // Specially handle NSAutoreleasePool.
Ted Kremenek6c4becb2009-02-25 02:54:57 +00001484 addInstMethSummary("NSAutoreleasePool", "init",
Jordy Rose500abad2011-08-21 19:41:36 +00001485 getPersistentSummary(NoRet, NewAutoreleasePool));
Mike Stump1eb44332009-09-09 15:08:12 +00001486
1487 // For NSWindow, allocated objects are (initially) self-owned.
Ted Kremenek89e202d2009-02-23 02:51:29 +00001488 // FIXME: For now we opt for false negatives with NSWindow, as these objects
1489 // self-own themselves. However, they only do this once they are displayed.
1490 // Thus, we need to track an NSWindow's display status.
1491 // This is tracked in <rdar://problem/6062711>.
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001492 // See also http://llvm.org/bugs/show_bug.cgi?id=3714.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001493 const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
Ted Kremenek78a35a32009-05-12 20:06:54 +00001494 StopTracking,
1495 StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +00001496
Ted Kremenek99d02692009-04-03 19:02:51 +00001497 addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1498
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001499#if 0
Ted Kremenek78a35a32009-05-12 20:06:54 +00001500 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001501 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001502
Ted Kremenek78a35a32009-05-12 20:06:54 +00001503 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001504 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001505#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001506
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001507 // For NSPanel (which subclasses NSWindow), allocated objects are not
1508 // self-owned.
Ted Kremenek99d02692009-04-03 19:02:51 +00001509 // FIXME: For now we don't track NSPanels. object for the same reason
1510 // as for NSWindow objects.
1511 addClassMethSummary("NSPanel", "alloc", NoTrackYet);
Mike Stump1eb44332009-09-09 15:08:12 +00001512
Ted Kremenek78a35a32009-05-12 20:06:54 +00001513#if 0
1514 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001515 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001516
Ted Kremenek78a35a32009-05-12 20:06:54 +00001517 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001518 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek78a35a32009-05-12 20:06:54 +00001519#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001520
Ted Kremenekba67f6a2009-05-18 23:14:34 +00001521 // Don't track allocated autorelease pools yet, as it is okay to prematurely
1522 // exit a method.
1523 addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
Ted Kremeneka9797122012-02-18 21:37:48 +00001524 addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
Ted Kremenek553cf182008-06-25 21:21:56 +00001525
Ted Kremenek767d6492009-05-20 22:39:57 +00001526 // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1527 addInstMethSummary("QCRenderer", AllocSumm,
1528 "createSnapshotImageOfType", NULL);
1529 addInstMethSummary("QCView", AllocSumm,
1530 "createSnapshotImageOfType", NULL);
1531
Ted Kremenek211a9c62009-06-15 20:58:58 +00001532 // Create summaries for CIContext, 'createCGImage' and
Ted Kremeneka834fb42009-08-28 19:52:12 +00001533 // 'createCGLayerWithSize'. These objects are CF objects, and are not
1534 // automatically garbage collected.
1535 addInstMethSummary("CIContext", CFAllocSumm,
Ted Kremenek767d6492009-05-20 22:39:57 +00001536 "createCGImage", "fromRect", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001537 addInstMethSummary("CIContext", CFAllocSumm,
Mike Stump1eb44332009-09-09 15:08:12 +00001538 "createCGImage", "fromRect", "format", "colorSpace", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001539 addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize",
Ted Kremenek211a9c62009-06-15 20:58:58 +00001540 "info", NULL);
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001541}
1542
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001543//===----------------------------------------------------------------------===//
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001544// AutoreleaseBindings - State used to track objects in autorelease pools.
Ted Kremenek6d348932008-10-21 15:53:15 +00001545//===----------------------------------------------------------------------===//
1546
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001547typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts;
1548typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents;
1549typedef llvm::ImmutableList<SymbolRef> ARStack;
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001550
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001551static int AutoRCIndex = 0;
Ted Kremenek6d348932008-10-21 15:53:15 +00001552static int AutoRBIndex = 0;
1553
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001554namespace { class AutoreleasePoolContents {}; }
1555namespace { class AutoreleaseStack {}; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001556
Ted Kremenek6d348932008-10-21 15:53:15 +00001557namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +00001558namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001559template<> struct ProgramStateTrait<AutoreleaseStack>
1560 : public ProgramStatePartialTrait<ARStack> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001561 static inline void *GDMIndex() { return &AutoRBIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001562};
1563
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001564template<> struct ProgramStateTrait<AutoreleasePoolContents>
1565 : public ProgramStatePartialTrait<ARPoolContents> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001566 static inline void *GDMIndex() { return &AutoRCIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001567};
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +00001568} // end GR namespace
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001569} // end clang namespace
Ted Kremenek6d348932008-10-21 15:53:15 +00001570
Ted Kremenek8bef8232012-01-26 21:29:00 +00001571static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001572 ARStack stack = state->get<AutoreleaseStack>();
1573 return stack.isEmpty() ? SymbolRef() : stack.getHead();
1574}
1575
Ted Kremenek8bef8232012-01-26 21:29:00 +00001576static ProgramStateRef
1577SendAutorelease(ProgramStateRef state,
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001578 ARCounts::Factory &F,
1579 SymbolRef sym) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001580 SymbolRef pool = GetCurrentAutoreleasePool(state);
Ted Kremenekb65be702009-06-18 01:23:53 +00001581 const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001582 ARCounts newCnts(0);
Mike Stump1eb44332009-09-09 15:08:12 +00001583
Ted Kremenek7037ab82009-03-20 17:34:15 +00001584 if (cnts) {
1585 const unsigned *cnt = (*cnts).lookup(sym);
Ted Kremenek3baf6722010-11-24 00:54:37 +00001586 newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001587 }
1588 else
Ted Kremenek3baf6722010-11-24 00:54:37 +00001589 newCnts = F.add(F.getEmptyMap(), sym, 1);
Mike Stump1eb44332009-09-09 15:08:12 +00001590
Ted Kremenekb65be702009-06-18 01:23:53 +00001591 return state->set<AutoreleasePoolContents>(pool, newCnts);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001592}
1593
Ted Kremenek13922612008-04-16 20:40:59 +00001594//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001595// Error reporting.
1596//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001597namespace {
Jordy Roseec9ef852011-08-23 20:55:48 +00001598 typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1599 SummaryLogTy;
1600
Ted Kremenekc887d132009-04-29 18:50:19 +00001601 //===-------------===//
1602 // Bug Descriptions. //
Mike Stump1eb44332009-09-09 15:08:12 +00001603 //===-------------===//
1604
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001605 class CFRefBug : public BugType {
Ted Kremenekc887d132009-04-29 18:50:19 +00001606 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001607 CFRefBug(StringRef name)
1608 : BugType(name, "Memory (Core Foundation/Objective-C)") {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001609 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001610
Ted Kremenekc887d132009-04-29 18:50:19 +00001611 // FIXME: Eventually remove.
Jordy Rose35c86952011-08-24 05:47:39 +00001612 virtual const char *getDescription() const = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001613
Ted Kremenekc887d132009-04-29 18:50:19 +00001614 virtual bool isLeak() const { return false; }
1615 };
Mike Stump1eb44332009-09-09 15:08:12 +00001616
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001617 class UseAfterRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001618 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001619 UseAfterRelease() : CFRefBug("Use-after-release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001620
Jordy Rose35c86952011-08-24 05:47:39 +00001621 const char *getDescription() const {
Ted Kremenekc887d132009-04-29 18:50:19 +00001622 return "Reference-counted object is used after it is released";
Mike Stump1eb44332009-09-09 15:08:12 +00001623 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001624 };
Mike Stump1eb44332009-09-09 15:08:12 +00001625
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001626 class BadRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001627 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001628 BadRelease() : CFRefBug("Bad release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001629
Jordy Rose35c86952011-08-24 05:47:39 +00001630 const char *getDescription() const {
Ted Kremenekbb206fd2009-10-01 17:31:50 +00001631 return "Incorrect decrement of the reference count of an object that is "
1632 "not owned at this point by the caller";
Ted Kremenekc887d132009-04-29 18:50:19 +00001633 }
1634 };
Mike Stump1eb44332009-09-09 15:08:12 +00001635
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001636 class DeallocGC : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001637 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001638 DeallocGC()
1639 : CFRefBug("-dealloc called while using garbage collection") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001640
Ted Kremenekc887d132009-04-29 18:50:19 +00001641 const char *getDescription() const {
Ted Kremenek369de562009-05-09 00:10:05 +00001642 return "-dealloc called while using garbage collection";
Ted Kremenekc887d132009-04-29 18:50:19 +00001643 }
1644 };
Mike Stump1eb44332009-09-09 15:08:12 +00001645
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001646 class DeallocNotOwned : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001647 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001648 DeallocNotOwned()
1649 : CFRefBug("-dealloc sent to non-exclusively owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001650
Ted Kremenekc887d132009-04-29 18:50:19 +00001651 const char *getDescription() const {
1652 return "-dealloc sent to object that may be referenced elsewhere";
1653 }
Mike Stump1eb44332009-09-09 15:08:12 +00001654 };
1655
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001656 class OverAutorelease : public CFRefBug {
Ted Kremenek369de562009-05-09 00:10:05 +00001657 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001658 OverAutorelease()
1659 : CFRefBug("Object sent -autorelease too many times") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001660
Ted Kremenek369de562009-05-09 00:10:05 +00001661 const char *getDescription() const {
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001662 return "Object sent -autorelease too many times";
Ted Kremenek369de562009-05-09 00:10:05 +00001663 }
1664 };
Mike Stump1eb44332009-09-09 15:08:12 +00001665
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001666 class ReturnedNotOwnedForOwned : public CFRefBug {
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001667 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001668 ReturnedNotOwnedForOwned()
1669 : CFRefBug("Method should return an owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001670
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001671 const char *getDescription() const {
Jordy Rose5b5402b2011-07-15 22:17:54 +00001672 return "Object with a +0 retain count returned to caller where a +1 "
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001673 "(owning) retain count is expected";
1674 }
1675 };
Mike Stump1eb44332009-09-09 15:08:12 +00001676
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001677 class Leak : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001678 const bool isReturn;
1679 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001680 Leak(StringRef name, bool isRet)
Jordy Rosedb92bb62011-08-25 01:14:38 +00001681 : CFRefBug(name), isReturn(isRet) {
1682 // Leaks should not be reported if they are post-dominated by a sink.
1683 setSuppressOnSink(true);
1684 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001685 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001686
Jordy Rose35c86952011-08-24 05:47:39 +00001687 const char *getDescription() const { return ""; }
Mike Stump1eb44332009-09-09 15:08:12 +00001688
Ted Kremenekc887d132009-04-29 18:50:19 +00001689 bool isLeak() const { return true; }
1690 };
Mike Stump1eb44332009-09-09 15:08:12 +00001691
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001692 class LeakAtReturn : public Leak {
Ted Kremenekc887d132009-04-29 18:50:19 +00001693 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001694 LeakAtReturn(StringRef name)
1695 : Leak(name, true) {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001696 };
Mike Stump1eb44332009-09-09 15:08:12 +00001697
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001698 class LeakWithinFunction : public Leak {
Ted Kremenekc887d132009-04-29 18:50:19 +00001699 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001700 LeakWithinFunction(StringRef name)
1701 : Leak(name, false) {}
Mike Stump1eb44332009-09-09 15:08:12 +00001702 };
1703
Ted Kremenekc887d132009-04-29 18:50:19 +00001704 //===---------===//
1705 // Bug Reports. //
1706 //===---------===//
Mike Stump1eb44332009-09-09 15:08:12 +00001707
Anna Zaksdc757b02011-08-19 23:21:56 +00001708 class CFRefReportVisitor : public BugReporterVisitor {
Anna Zaks23f395e2011-08-20 01:27:22 +00001709 protected:
Anna Zaksdc757b02011-08-19 23:21:56 +00001710 SymbolRef Sym;
Jordy Roseec9ef852011-08-23 20:55:48 +00001711 const SummaryLogTy &SummaryLog;
Jordy Rose35c86952011-08-24 05:47:39 +00001712 bool GCEnabled;
Anna Zaks23f395e2011-08-20 01:27:22 +00001713
Anna Zaksdc757b02011-08-19 23:21:56 +00001714 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001715 CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1716 : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
Anna Zaksdc757b02011-08-19 23:21:56 +00001717
Anna Zaks23f395e2011-08-20 01:27:22 +00001718 virtual void Profile(llvm::FoldingSetNodeID &ID) const {
Anna Zaksdc757b02011-08-19 23:21:56 +00001719 static int x = 0;
1720 ID.AddPointer(&x);
1721 ID.AddPointer(Sym);
1722 }
1723
Anna Zaks23f395e2011-08-20 01:27:22 +00001724 virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
1725 const ExplodedNode *PrevN,
1726 BugReporterContext &BRC,
1727 BugReport &BR);
1728
1729 virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1730 const ExplodedNode *N,
1731 BugReport &BR);
1732 };
1733
1734 class CFRefLeakReportVisitor : public CFRefReportVisitor {
1735 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001736 CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
Jordy Roseec9ef852011-08-23 20:55:48 +00001737 const SummaryLogTy &log)
Jordy Rose35c86952011-08-24 05:47:39 +00001738 : CFRefReportVisitor(sym, GCEnabled, log) {}
Anna Zaks23f395e2011-08-20 01:27:22 +00001739
1740 PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1741 const ExplodedNode *N,
1742 BugReport &BR);
Anna Zaksdc757b02011-08-19 23:21:56 +00001743 };
1744
Anna Zakse172e8b2011-08-17 23:00:25 +00001745 class CFRefReport : public BugReport {
Jordy Rose20589562011-08-24 22:39:09 +00001746 void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001747
Ted Kremenekc887d132009-04-29 18:50:19 +00001748 public:
Jordy Rose20589562011-08-24 22:39:09 +00001749 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1750 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1751 bool registerVisitor = true)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001752 : BugReport(D, D.getDescription(), n) {
Anna Zaks23f395e2011-08-20 01:27:22 +00001753 if (registerVisitor)
Jordy Rose20589562011-08-24 22:39:09 +00001754 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1755 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001756 }
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001757
Jordy Rose20589562011-08-24 22:39:09 +00001758 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1759 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1760 StringRef endText)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001761 : BugReport(D, D.getDescription(), endText, n) {
Jordy Rose20589562011-08-24 22:39:09 +00001762 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1763 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001764 }
Mike Stump1eb44332009-09-09 15:08:12 +00001765
Anna Zakse172e8b2011-08-17 23:00:25 +00001766 virtual std::pair<ranges_iterator, ranges_iterator> getRanges() {
Anna Zaksedf4dae2011-08-22 18:54:07 +00001767 const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1768 if (!BugTy.isLeak())
Anna Zakse172e8b2011-08-17 23:00:25 +00001769 return BugReport::getRanges();
Ted Kremenekc887d132009-04-29 18:50:19 +00001770 else
Argyrios Kyrtzidis640ccf02010-12-04 01:12:15 +00001771 return std::make_pair(ranges_iterator(), ranges_iterator());
Ted Kremenekc887d132009-04-29 18:50:19 +00001772 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001773 };
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001774
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001775 class CFRefLeakReport : public CFRefReport {
Ted Kremenekc887d132009-04-29 18:50:19 +00001776 const MemRegion* AllocBinding;
Anna Zaks23f395e2011-08-20 01:27:22 +00001777
Ted Kremenekc887d132009-04-29 18:50:19 +00001778 public:
Jordy Rose20589562011-08-24 22:39:09 +00001779 CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1780 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00001781 CheckerContext &Ctx);
Mike Stump1eb44332009-09-09 15:08:12 +00001782
Anna Zaks590dd8e2011-09-20 21:38:35 +00001783 PathDiagnosticLocation getLocation(const SourceManager &SM) const {
1784 assert(Location.isValid());
1785 return Location;
1786 }
Mike Stump1eb44332009-09-09 15:08:12 +00001787 };
Ted Kremenekc887d132009-04-29 18:50:19 +00001788} // end anonymous namespace
1789
Jordy Rose20589562011-08-24 22:39:09 +00001790void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1791 bool GCEnabled) {
Jordy Rosef95b19d2011-08-24 20:38:42 +00001792 const char *GCModeDescription = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001793
Douglas Gregore289d812011-09-13 17:21:33 +00001794 switch (LOpts.getGC()) {
Anna Zaks7f2531c2011-08-22 20:31:28 +00001795 case LangOptions::GCOnly:
Jordy Rose20589562011-08-24 22:39:09 +00001796 assert(GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001797 GCModeDescription = "Code is compiled to only use garbage collection";
1798 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001799
Anna Zaks7f2531c2011-08-22 20:31:28 +00001800 case LangOptions::NonGC:
Jordy Rose20589562011-08-24 22:39:09 +00001801 assert(!GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001802 GCModeDescription = "Code is compiled to use reference counts";
1803 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001804
Anna Zaks7f2531c2011-08-22 20:31:28 +00001805 case LangOptions::HybridGC:
Jordy Rose20589562011-08-24 22:39:09 +00001806 if (GCEnabled) {
Jordy Rose35c86952011-08-24 05:47:39 +00001807 GCModeDescription = "Code is compiled to use either garbage collection "
1808 "(GC) or reference counts (non-GC). The bug occurs "
1809 "with GC enabled";
1810 break;
1811 } else {
1812 GCModeDescription = "Code is compiled to use either garbage collection "
1813 "(GC) or reference counts (non-GC). The bug occurs "
1814 "in non-GC mode";
1815 break;
Anna Zaks7f2531c2011-08-22 20:31:28 +00001816 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001817 }
Jordy Rose35c86952011-08-24 05:47:39 +00001818
Jordy Rosef95b19d2011-08-24 20:38:42 +00001819 assert(GCModeDescription && "invalid/unknown GC mode");
Jordy Rose35c86952011-08-24 05:47:39 +00001820 addExtraText(GCModeDescription);
Ted Kremenekc887d132009-04-29 18:50:19 +00001821}
1822
Jordy Rose910c4052011-09-02 06:44:22 +00001823// FIXME: This should be a method on SmallVector.
Chris Lattner5f9e2722011-07-23 10:55:15 +00001824static inline bool contains(const SmallVectorImpl<ArgEffect>& V,
Ted Kremenekc887d132009-04-29 18:50:19 +00001825 ArgEffect X) {
Chris Lattner5f9e2722011-07-23 10:55:15 +00001826 for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001827 I!=E; ++I)
1828 if (*I == X) return true;
Mike Stump1eb44332009-09-09 15:08:12 +00001829
Ted Kremenekc887d132009-04-29 18:50:19 +00001830 return false;
1831}
1832
Ted Kremenek4c42bb72011-11-14 21:59:21 +00001833static bool isPropertyAccess(const Stmt *S, ParentMap &PM) {
1834 unsigned maxDepth = 4;
1835 while (S && maxDepth) {
1836 if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) {
1837 if (!isa<ObjCMessageExpr>(PO->getSyntacticForm()))
1838 return true;
1839 return false;
1840 }
1841 S = PM.getParent(S);
1842 --maxDepth;
1843 }
1844 return false;
1845}
1846
Anna Zaksdc757b02011-08-19 23:21:56 +00001847PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N,
1848 const ExplodedNode *PrevN,
1849 BugReporterContext &BRC,
1850 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00001851
Jordy Rosef53e8c72011-08-23 19:43:16 +00001852 if (!isa<StmtPoint>(N->getLocation()))
Ted Kremenek2033a952009-05-13 07:12:33 +00001853 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001854
Ted Kremenek8966bc12009-05-06 21:39:49 +00001855 // Check if the type state has changed.
Ted Kremenek8bef8232012-01-26 21:29:00 +00001856 ProgramStateRef PrevSt = PrevN->getState();
1857 ProgramStateRef CurrSt = N->getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001858 const LocationContext *LCtx = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00001859
1860 const RefVal* CurrT = CurrSt->get<RefBindings>(Sym);
Ted Kremenekc887d132009-04-29 18:50:19 +00001861 if (!CurrT) return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001862
Ted Kremenekb65be702009-06-18 01:23:53 +00001863 const RefVal &CurrV = *CurrT;
1864 const RefVal *PrevT = PrevSt->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00001865
Ted Kremenekc887d132009-04-29 18:50:19 +00001866 // Create a string buffer to constain all the useful things we want
1867 // to tell the user.
1868 std::string sbuf;
1869 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00001870
Ted Kremenekc887d132009-04-29 18:50:19 +00001871 // This is the allocation site since the previous node had no bindings
1872 // for this symbol.
1873 if (!PrevT) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00001874 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001875
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001876 if (isa<ObjCArrayLiteral>(S)) {
1877 os << "NSArray literal is an object with a +0 retain count";
Mike Stump1eb44332009-09-09 15:08:12 +00001878 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001879 else if (isa<ObjCDictionaryLiteral>(S)) {
1880 os << "NSDictionary literal is an object with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00001881 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001882 else {
1883 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1884 // Get the name of the callee (if it is available).
1885 SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
1886 if (const FunctionDecl *FD = X.getAsFunctionDecl())
1887 os << "Call to function '" << *FD << '\'';
1888 else
1889 os << "function call";
Ted Kremenekc887d132009-04-29 18:50:19 +00001890 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001891 else {
1892 assert(isa<ObjCMessageExpr>(S));
1893 // The message expression may have between written directly or as
1894 // a property access. Lazily determine which case we are looking at.
1895 os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method");
1896 }
1897
1898 if (CurrV.getObjKind() == RetEffect::CF) {
1899 os << " returns a Core Foundation object with a ";
1900 }
1901 else {
1902 assert (CurrV.getObjKind() == RetEffect::ObjC);
1903 os << " returns an Objective-C object with a ";
1904 }
1905
1906 if (CurrV.isOwned()) {
1907 os << "+1 retain count";
1908
1909 if (GCEnabled) {
1910 assert(CurrV.getObjKind() == RetEffect::CF);
1911 os << ". "
1912 "Core Foundation objects are not automatically garbage collected.";
1913 }
1914 }
1915 else {
1916 assert (CurrV.isNotOwned());
1917 os << "+0 retain count";
1918 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001919 }
Mike Stump1eb44332009-09-09 15:08:12 +00001920
Anna Zaks220ac8c2011-09-15 01:08:34 +00001921 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
1922 N->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00001923 return new PathDiagnosticEventPiece(Pos, os.str());
1924 }
Mike Stump1eb44332009-09-09 15:08:12 +00001925
Ted Kremenekc887d132009-04-29 18:50:19 +00001926 // Gather up the effects that were performed on the object at this
1927 // program point
Chris Lattner5f9e2722011-07-23 10:55:15 +00001928 SmallVector<ArgEffect, 2> AEffects;
Mike Stump1eb44332009-09-09 15:08:12 +00001929
Jordy Roseec9ef852011-08-23 20:55:48 +00001930 const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
1931 if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001932 // We only have summaries attached to nodes after evaluating CallExpr and
1933 // ObjCMessageExprs.
Jordy Rosef53e8c72011-08-23 19:43:16 +00001934 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001935
Ted Kremenek5f85e172009-07-22 22:35:28 +00001936 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001937 // Iterate through the parameter expressions and see if the symbol
1938 // was ever passed as an argument.
1939 unsigned i = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001940
Ted Kremenek5f85e172009-07-22 22:35:28 +00001941 for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001942 AI!=AE; ++AI, ++i) {
Mike Stump1eb44332009-09-09 15:08:12 +00001943
Ted Kremenekc887d132009-04-29 18:50:19 +00001944 // Retrieve the value of the argument. Is it the symbol
1945 // we are interested in?
Ted Kremenek5eca4822012-01-06 22:09:28 +00001946 if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
Ted Kremenekc887d132009-04-29 18:50:19 +00001947 continue;
Mike Stump1eb44332009-09-09 15:08:12 +00001948
Ted Kremenekc887d132009-04-29 18:50:19 +00001949 // We have an argument. Get the effect!
1950 AEffects.push_back(Summ->getArg(i));
1951 }
1952 }
Mike Stump1eb44332009-09-09 15:08:12 +00001953 else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
Douglas Gregor04badcf2010-04-21 00:45:42 +00001954 if (const Expr *receiver = ME->getInstanceReceiver())
Ted Kremenek5eca4822012-01-06 22:09:28 +00001955 if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
1956 .getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001957 // The symbol we are tracking is the receiver.
1958 AEffects.push_back(Summ->getReceiverEffect());
1959 }
1960 }
1961 }
Mike Stump1eb44332009-09-09 15:08:12 +00001962
Ted Kremenekc887d132009-04-29 18:50:19 +00001963 do {
1964 // Get the previous type state.
1965 RefVal PrevV = *PrevT;
Mike Stump1eb44332009-09-09 15:08:12 +00001966
Ted Kremenekc887d132009-04-29 18:50:19 +00001967 // Specially handle -dealloc.
Jordy Rose35c86952011-08-24 05:47:39 +00001968 if (!GCEnabled && contains(AEffects, Dealloc)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001969 // Determine if the object's reference count was pushed to zero.
1970 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
1971 // We may not have transitioned to 'release' if we hit an error.
1972 // This case is handled elsewhere.
1973 if (CurrV.getKind() == RefVal::Released) {
Ted Kremenekf21332e2009-05-08 20:01:42 +00001974 assert(CurrV.getCombinedCounts() == 0);
Ted Kremenekc887d132009-04-29 18:50:19 +00001975 os << "Object released by directly sending the '-dealloc' message";
1976 break;
1977 }
1978 }
Mike Stump1eb44332009-09-09 15:08:12 +00001979
Ted Kremenekc887d132009-04-29 18:50:19 +00001980 // Specially handle CFMakeCollectable and friends.
1981 if (contains(AEffects, MakeCollectable)) {
1982 // Get the name of the function.
Jordy Rosef53e8c72011-08-23 19:43:16 +00001983 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001984 SVal X =
1985 CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
Ted Kremenek9c378f72011-08-12 23:37:29 +00001986 const FunctionDecl *FD = X.getAsFunctionDecl();
Mike Stump1eb44332009-09-09 15:08:12 +00001987
Jordy Rose35c86952011-08-24 05:47:39 +00001988 if (GCEnabled) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001989 // Determine if the object's reference count was pushed to zero.
1990 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
Mike Stump1eb44332009-09-09 15:08:12 +00001991
Benjamin Kramerb8989f22011-10-14 18:45:37 +00001992 os << "In GC mode a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00001993 << "' decrements an object's retain count and registers the "
1994 "object with the garbage collector. ";
Mike Stump1eb44332009-09-09 15:08:12 +00001995
Ted Kremenekc887d132009-04-29 18:50:19 +00001996 if (CurrV.getKind() == RefVal::Released) {
1997 assert(CurrV.getCount() == 0);
1998 os << "Since it now has a 0 retain count the object can be "
1999 "automatically collected by the garbage collector.";
2000 }
2001 else
2002 os << "An object must have a 0 retain count to be garbage collected. "
2003 "After this call its retain count is +" << CurrV.getCount()
2004 << '.';
2005 }
Mike Stump1eb44332009-09-09 15:08:12 +00002006 else
Benjamin Kramerb8989f22011-10-14 18:45:37 +00002007 os << "When GC is not enabled a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00002008 << "' has no effect on its argument.";
Mike Stump1eb44332009-09-09 15:08:12 +00002009
Ted Kremenekc887d132009-04-29 18:50:19 +00002010 // Nothing more to say.
2011 break;
2012 }
Mike Stump1eb44332009-09-09 15:08:12 +00002013
2014 // Determine if the typestate has changed.
Ted Kremenekc887d132009-04-29 18:50:19 +00002015 if (!(PrevV == CurrV))
2016 switch (CurrV.getKind()) {
2017 case RefVal::Owned:
2018 case RefVal::NotOwned:
Mike Stump1eb44332009-09-09 15:08:12 +00002019
Ted Kremenekf21332e2009-05-08 20:01:42 +00002020 if (PrevV.getCount() == CurrV.getCount()) {
2021 // Did an autorelease message get sent?
2022 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
2023 return 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002024
Zhongxing Xu264e9372009-05-12 10:10:00 +00002025 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
Ted Kremenekeaedfea2009-05-10 05:11:21 +00002026 os << "Object sent -autorelease message";
Ted Kremenekf21332e2009-05-08 20:01:42 +00002027 break;
2028 }
Mike Stump1eb44332009-09-09 15:08:12 +00002029
Ted Kremenekc887d132009-04-29 18:50:19 +00002030 if (PrevV.getCount() > CurrV.getCount())
2031 os << "Reference count decremented.";
2032 else
2033 os << "Reference count incremented.";
Mike Stump1eb44332009-09-09 15:08:12 +00002034
Ted Kremenekc887d132009-04-29 18:50:19 +00002035 if (unsigned Count = CurrV.getCount())
2036 os << " The object now has a +" << Count << " retain count.";
Mike Stump1eb44332009-09-09 15:08:12 +00002037
Ted Kremenekc887d132009-04-29 18:50:19 +00002038 if (PrevV.getKind() == RefVal::Released) {
Jordy Rose35c86952011-08-24 05:47:39 +00002039 assert(GCEnabled && CurrV.getCount() > 0);
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002040 os << " The object is not eligible for garbage collection until "
2041 "the retain count reaches 0 again.";
Ted Kremenekc887d132009-04-29 18:50:19 +00002042 }
Mike Stump1eb44332009-09-09 15:08:12 +00002043
Ted Kremenekc887d132009-04-29 18:50:19 +00002044 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002045
Ted Kremenekc887d132009-04-29 18:50:19 +00002046 case RefVal::Released:
2047 os << "Object released.";
2048 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002049
Ted Kremenekc887d132009-04-29 18:50:19 +00002050 case RefVal::ReturnedOwned:
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002051 // Autoreleases can be applied after marking a node ReturnedOwned.
2052 if (CurrV.getAutoreleaseCount())
2053 return NULL;
2054
2055 os << "Object returned to caller as an owning reference (single "
2056 "retain count transferred to caller)";
Ted Kremenekc887d132009-04-29 18:50:19 +00002057 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002058
Ted Kremenekc887d132009-04-29 18:50:19 +00002059 case RefVal::ReturnedNotOwned:
Ted Kremenekf1365462011-05-26 18:45:44 +00002060 os << "Object returned to caller with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00002061 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002062
Ted Kremenekc887d132009-04-29 18:50:19 +00002063 default:
2064 return NULL;
2065 }
Mike Stump1eb44332009-09-09 15:08:12 +00002066
Ted Kremenekc887d132009-04-29 18:50:19 +00002067 // Emit any remaining diagnostics for the argument effects (if any).
Chris Lattner5f9e2722011-07-23 10:55:15 +00002068 for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
Ted Kremenekc887d132009-04-29 18:50:19 +00002069 E=AEffects.end(); I != E; ++I) {
Mike Stump1eb44332009-09-09 15:08:12 +00002070
Ted Kremenekc887d132009-04-29 18:50:19 +00002071 // A bunch of things have alternate behavior under GC.
Jordy Rose35c86952011-08-24 05:47:39 +00002072 if (GCEnabled)
Ted Kremenekc887d132009-04-29 18:50:19 +00002073 switch (*I) {
2074 default: break;
2075 case Autorelease:
2076 os << "In GC mode an 'autorelease' has no effect.";
2077 continue;
2078 case IncRefMsg:
2079 os << "In GC mode the 'retain' message has no effect.";
2080 continue;
2081 case DecRefMsg:
2082 os << "In GC mode the 'release' message has no effect.";
2083 continue;
2084 }
2085 }
Mike Stump1eb44332009-09-09 15:08:12 +00002086 } while (0);
2087
Ted Kremenekc887d132009-04-29 18:50:19 +00002088 if (os.str().empty())
2089 return 0; // We have nothing to say!
Ted Kremenek2033a952009-05-13 07:12:33 +00002090
Jordy Rosef53e8c72011-08-23 19:43:16 +00002091 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Anna Zaks220ac8c2011-09-15 01:08:34 +00002092 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2093 N->getLocationContext());
Ted Kremenek9c378f72011-08-12 23:37:29 +00002094 PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str());
Mike Stump1eb44332009-09-09 15:08:12 +00002095
Ted Kremenekc887d132009-04-29 18:50:19 +00002096 // Add the range by scanning the children of the statement for any bindings
2097 // to Sym.
Mike Stump1eb44332009-09-09 15:08:12 +00002098 for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
Ted Kremenek5f85e172009-07-22 22:35:28 +00002099 I!=E; ++I)
Ted Kremenek9c378f72011-08-12 23:37:29 +00002100 if (const Expr *Exp = dyn_cast_or_null<Expr>(*I))
Ted Kremenek5eca4822012-01-06 22:09:28 +00002101 if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002102 P->addRange(Exp->getSourceRange());
2103 break;
2104 }
Mike Stump1eb44332009-09-09 15:08:12 +00002105
Ted Kremenekc887d132009-04-29 18:50:19 +00002106 return P;
2107}
2108
2109namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00002110 class FindUniqueBinding :
Ted Kremenekc887d132009-04-29 18:50:19 +00002111 public StoreManager::BindingsHandler {
2112 SymbolRef Sym;
2113 const MemRegion* Binding;
2114 bool First;
Mike Stump1eb44332009-09-09 15:08:12 +00002115
Ted Kremenekc887d132009-04-29 18:50:19 +00002116 public:
2117 FindUniqueBinding(SymbolRef sym) : Sym(sym), Binding(0), First(true) {}
Mike Stump1eb44332009-09-09 15:08:12 +00002118
Ted Kremenekc887d132009-04-29 18:50:19 +00002119 bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R,
2120 SVal val) {
Mike Stump1eb44332009-09-09 15:08:12 +00002121
2122 SymbolRef SymV = val.getAsSymbol();
Ted Kremenekc887d132009-04-29 18:50:19 +00002123 if (!SymV || SymV != Sym)
2124 return true;
Mike Stump1eb44332009-09-09 15:08:12 +00002125
Ted Kremenekc887d132009-04-29 18:50:19 +00002126 if (Binding) {
2127 First = false;
2128 return false;
2129 }
2130 else
2131 Binding = R;
Mike Stump1eb44332009-09-09 15:08:12 +00002132
2133 return true;
Ted Kremenekc887d132009-04-29 18:50:19 +00002134 }
Mike Stump1eb44332009-09-09 15:08:12 +00002135
Ted Kremenekc887d132009-04-29 18:50:19 +00002136 operator bool() { return First && Binding; }
Ted Kremenek0507f7e2012-01-04 00:35:45 +00002137 const MemRegion *getRegion() { return Binding; }
Mike Stump1eb44332009-09-09 15:08:12 +00002138 };
Ted Kremenekc887d132009-04-29 18:50:19 +00002139}
2140
Anna Zakse7e01682012-02-28 22:39:22 +00002141// Find the first node in the current function context that referred to the
2142// tracked symbol and the memory location that value was stored to. Note, the
2143// value is only reported if the allocation occurred in the same function as
2144// the leak.
Zhongxing Xuc5619d92009-08-06 01:32:16 +00002145static std::pair<const ExplodedNode*,const MemRegion*>
Ted Kremenek18c66fd2011-08-15 22:09:50 +00002146GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N,
Ted Kremenekc887d132009-04-29 18:50:19 +00002147 SymbolRef Sym) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002148 const ExplodedNode *Last = N;
Mike Stump1eb44332009-09-09 15:08:12 +00002149 const MemRegion* FirstBinding = 0;
Anna Zakse7e01682012-02-28 22:39:22 +00002150 const LocationContext *LeakContext = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00002151
Ted Kremenekc887d132009-04-29 18:50:19 +00002152 while (N) {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002153 ProgramStateRef St = N->getState();
Ted Kremenekc887d132009-04-29 18:50:19 +00002154 RefBindings B = St->get<RefBindings>();
Mike Stump1eb44332009-09-09 15:08:12 +00002155
Ted Kremenekc887d132009-04-29 18:50:19 +00002156 if (!B.lookup(Sym))
2157 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002158
Ted Kremenekc887d132009-04-29 18:50:19 +00002159 FindUniqueBinding FB(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002160 StateMgr.iterBindings(St, FB);
2161 if (FB) FirstBinding = FB.getRegion();
2162
Anna Zakse7e01682012-02-28 22:39:22 +00002163 // Allocation node, is the last node in the current context in which the
2164 // symbol was tracked.
2165 if (N->getLocationContext() == LeakContext)
2166 Last = N;
2167
Mike Stump1eb44332009-09-09 15:08:12 +00002168 N = N->pred_empty() ? NULL : *(N->pred_begin());
Ted Kremenekc887d132009-04-29 18:50:19 +00002169 }
Mike Stump1eb44332009-09-09 15:08:12 +00002170
Anna Zakse7e01682012-02-28 22:39:22 +00002171 // If allocation happened in a function different from the leak node context,
2172 // do not report the binding.
2173 if (N->getLocationContext() != LeakContext) {
2174 FirstBinding = 0;
2175 }
2176
Ted Kremenekc887d132009-04-29 18:50:19 +00002177 return std::make_pair(Last, FirstBinding);
2178}
2179
2180PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002181CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2182 const ExplodedNode *EndN,
2183 BugReport &BR) {
Ted Kremenek76aadc32012-03-09 01:13:14 +00002184 BR.markInteresting(Sym);
Anna Zaks23f395e2011-08-20 01:27:22 +00002185 return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
Ted Kremenekc887d132009-04-29 18:50:19 +00002186}
2187
2188PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002189CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2190 const ExplodedNode *EndN,
2191 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00002192
Ted Kremenek8966bc12009-05-06 21:39:49 +00002193 // Tell the BugReporterContext to report cases when the tracked symbol is
Ted Kremenekc887d132009-04-29 18:50:19 +00002194 // assigned to different variables, etc.
Ted Kremenek76aadc32012-03-09 01:13:14 +00002195 BR.markInteresting(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002196
Ted Kremenekc887d132009-04-29 18:50:19 +00002197 // We are reporting a leak. Walk up the graph to get to the first node where
2198 // the symbol appeared, and also get the first VarDecl that tracked object
2199 // is stored to.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002200 const ExplodedNode *AllocNode = 0;
Ted Kremenekc887d132009-04-29 18:50:19 +00002201 const MemRegion* FirstBinding = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002202
Ted Kremenekc887d132009-04-29 18:50:19 +00002203 llvm::tie(AllocNode, FirstBinding) =
Ted Kremenekf04dced2009-05-08 23:32:51 +00002204 GetAllocationSite(BRC.getStateManager(), EndN, Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002205
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002206 SourceManager& SM = BRC.getSourceManager();
Mike Stump1eb44332009-09-09 15:08:12 +00002207
Ted Kremenekc887d132009-04-29 18:50:19 +00002208 // Compute an actual location for the leak. Sometimes a leak doesn't
2209 // occur at an actual statement (e.g., transition between blocks; end
2210 // of function) so we need to walk the graph and compute a real location.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002211 const ExplodedNode *LeakN = EndN;
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002212 PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
Mike Stump1eb44332009-09-09 15:08:12 +00002213
Ted Kremenekc887d132009-04-29 18:50:19 +00002214 std::string sbuf;
2215 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00002216
Ted Kremenekf1365462011-05-26 18:45:44 +00002217 os << "Object leaked: ";
Mike Stump1eb44332009-09-09 15:08:12 +00002218
Ted Kremenekf1365462011-05-26 18:45:44 +00002219 if (FirstBinding) {
2220 os << "object allocated and stored into '"
2221 << FirstBinding->getString() << '\'';
2222 }
2223 else
2224 os << "allocated object";
Mike Stump1eb44332009-09-09 15:08:12 +00002225
Ted Kremenekc887d132009-04-29 18:50:19 +00002226 // Get the retain count.
2227 const RefVal* RV = EndN->getState()->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002228
Ted Kremenekc887d132009-04-29 18:50:19 +00002229 if (RV->getKind() == RefVal::ErrorLeakReturned) {
2230 // FIXME: Per comments in rdar://6320065, "create" only applies to CF
Jordy Rose5b5402b2011-07-15 22:17:54 +00002231 // objects. Only "copy", "alloc", "retain" and "new" transfer ownership
Ted Kremenekc887d132009-04-29 18:50:19 +00002232 // to the caller for NS objects.
Ted Kremenekd368d712011-05-25 06:19:45 +00002233 const Decl *D = &EndN->getCodeDecl();
2234 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2235 os << " is returned from a method whose name ('"
2236 << MD->getSelector().getAsString()
2237 << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
Jordy Rose5b5402b2011-07-15 22:17:54 +00002238 " This violates the naming convention rules"
Ted Kremenekf1365462011-05-26 18:45:44 +00002239 " given in the Memory Management Guide for Cocoa";
Ted Kremenekd368d712011-05-25 06:19:45 +00002240 }
2241 else {
2242 const FunctionDecl *FD = cast<FunctionDecl>(D);
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002243 os << " is returned from a function whose name ('"
Benjamin Kramera59d20b2012-02-07 11:57:57 +00002244 << *FD
Ted Kremenekd368d712011-05-25 06:19:45 +00002245 << "') does not contain 'Copy' or 'Create'. This violates the naming"
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002246 " convention rules given in the Memory Management Guide for Core"
Ted Kremenekf1365462011-05-26 18:45:44 +00002247 " Foundation";
Ted Kremenekd368d712011-05-25 06:19:45 +00002248 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002249 }
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002250 else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002251 ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002252 os << " and returned from method '" << MD.getSelector().getAsString()
Ted Kremenek82f2be52009-05-10 16:52:15 +00002253 << "' is potentially leaked when using garbage collection. Callers "
2254 "of this method do not expect a returned object with a +1 retain "
2255 "count since they expect the object to be managed by the garbage "
2256 "collector";
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002257 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002258 else
Ted Kremenekabf517c2010-10-15 22:50:23 +00002259 os << " is not referenced later in this execution path and has a retain "
Ted Kremenekf1365462011-05-26 18:45:44 +00002260 "count of +" << RV->getCount();
Mike Stump1eb44332009-09-09 15:08:12 +00002261
Ted Kremenekc887d132009-04-29 18:50:19 +00002262 return new PathDiagnosticEventPiece(L, os.str());
2263}
2264
Jordy Rose20589562011-08-24 22:39:09 +00002265CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2266 bool GCEnabled, const SummaryLogTy &Log,
2267 ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002268 CheckerContext &Ctx)
Jordy Rose20589562011-08-24 22:39:09 +00002269: CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
Mike Stump1eb44332009-09-09 15:08:12 +00002270
Chris Lattnerfc8f0e12011-04-15 05:22:18 +00002271 // Most bug reports are cached at the location where they occurred.
Ted Kremenekc887d132009-04-29 18:50:19 +00002272 // With leaks, we want to unique them by the location where they were
2273 // allocated, and only report a single path. To do this, we need to find
2274 // the allocation site of a piece of tracked memory, which we do via a
2275 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
2276 // Note that this is *not* the trimmed graph; we are guaranteed, however,
2277 // that all ancestor nodes that represent the allocation site have the
2278 // same SourceLocation.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002279 const ExplodedNode *AllocNode = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002280
Anna Zaks6a93bd52011-10-25 19:57:11 +00002281 const SourceManager& SMgr = Ctx.getSourceManager();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002282
Ted Kremenekc887d132009-04-29 18:50:19 +00002283 llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding.
Anna Zaks6a93bd52011-10-25 19:57:11 +00002284 GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002285
Ted Kremenekc887d132009-04-29 18:50:19 +00002286 // Get the SourceLocation for the allocation site.
2287 ProgramPoint P = AllocNode->getLocation();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002288 const Stmt *AllocStmt = cast<PostStmt>(P).getStmt();
2289 Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2290 n->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00002291 // Fill in the description of the bug.
2292 Description.clear();
2293 llvm::raw_string_ostream os(Description);
Ted Kremenekdd924e22009-05-02 19:05:19 +00002294 os << "Potential leak ";
Jordy Rose20589562011-08-24 22:39:09 +00002295 if (GCEnabled)
Ted Kremenekdd924e22009-05-02 19:05:19 +00002296 os << "(when using garbage collection) ";
Anna Zaks212000e2012-02-28 21:49:08 +00002297 os << "of an object";
Mike Stump1eb44332009-09-09 15:08:12 +00002298
Ted Kremenekc887d132009-04-29 18:50:19 +00002299 // FIXME: AllocBinding doesn't get populated for RegionStore yet.
2300 if (AllocBinding)
Anna Zaks212000e2012-02-28 21:49:08 +00002301 os << " stored into '" << AllocBinding->getString() << '\'';
Anna Zaksdc757b02011-08-19 23:21:56 +00002302
Jordy Rose20589562011-08-24 22:39:09 +00002303 addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log));
Ted Kremenekc887d132009-04-29 18:50:19 +00002304}
2305
2306//===----------------------------------------------------------------------===//
2307// Main checker logic.
2308//===----------------------------------------------------------------------===//
2309
Ted Kremenekd593eb92009-11-25 22:17:44 +00002310namespace {
Jordy Rose910c4052011-09-02 06:44:22 +00002311class RetainCountChecker
Jordy Rose9c083b72011-08-24 18:56:32 +00002312 : public Checker< check::Bind,
Jordy Rose38f17d62011-08-23 19:01:07 +00002313 check::DeadSymbols,
Jordy Rose9c083b72011-08-24 18:56:32 +00002314 check::EndAnalysis,
Jordy Rose38f17d62011-08-23 19:01:07 +00002315 check::EndPath,
Jordy Rose67044292011-08-17 21:27:39 +00002316 check::PostStmt<BlockExpr>,
John McCallf85e1932011-06-15 23:02:42 +00002317 check::PostStmt<CastExpr>,
Jordy Rose294396b2011-08-22 23:48:23 +00002318 check::PostStmt<CallExpr>,
Jordy Rose537716a2011-08-27 22:51:26 +00002319 check::PostStmt<CXXConstructExpr>,
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002320 check::PostStmt<ObjCArrayLiteral>,
2321 check::PostStmt<ObjCDictionaryLiteral>,
Jordy Rose294396b2011-08-22 23:48:23 +00002322 check::PostObjCMessage,
Jordy Rosef53e8c72011-08-23 19:43:16 +00002323 check::PreStmt<ReturnStmt>,
Jordy Rose67044292011-08-17 21:27:39 +00002324 check::RegionChanges,
Jordy Rose76c506f2011-08-21 21:58:18 +00002325 eval::Assume,
2326 eval::Call > {
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002327 mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned;
2328 mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned;
2329 mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2330 mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn;
2331 mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
Jordy Rose38f17d62011-08-23 19:01:07 +00002332
2333 typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap;
2334
2335 // This map is only used to ensure proper deletion of any allocated tags.
2336 mutable SymbolTagMap DeadSymbolTags;
2337
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002338 mutable OwningPtr<RetainSummaryManager> Summaries;
2339 mutable OwningPtr<RetainSummaryManager> SummariesGC;
Jordy Roseb6cfc092011-08-25 00:10:37 +00002340
Jordy Rosee0a5d322011-08-23 20:27:16 +00002341 mutable ARCounts::Factory ARCountFactory;
2342
Jordy Rose9c083b72011-08-24 18:56:32 +00002343 mutable SummaryLogTy SummaryLog;
2344 mutable bool ShouldResetSummaryLog;
2345
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002346public:
Jordy Rose910c4052011-09-02 06:44:22 +00002347 RetainCountChecker() : ShouldResetSummaryLog(false) {}
Jordy Rose38f17d62011-08-23 19:01:07 +00002348
Jordy Rose910c4052011-09-02 06:44:22 +00002349 virtual ~RetainCountChecker() {
Jordy Rose38f17d62011-08-23 19:01:07 +00002350 DeleteContainerSeconds(DeadSymbolTags);
2351 }
2352
Jordy Rose9c083b72011-08-24 18:56:32 +00002353 void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2354 ExprEngine &Eng) const {
2355 // FIXME: This is a hack to make sure the summary log gets cleared between
2356 // analyses of different code bodies.
2357 //
2358 // Why is this necessary? Because a checker's lifetime is tied to a
2359 // translation unit, but an ExplodedGraph's lifetime is just a code body.
2360 // Once in a blue moon, a new ExplodedNode will have the same address as an
2361 // old one with an associated summary, and the bug report visitor gets very
2362 // confused. (To make things worse, the summary lifetime is currently also
2363 // tied to a code body, so we get a crash instead of incorrect results.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002364 //
2365 // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2366 // changes, things will start going wrong again. Really the lifetime of this
2367 // log needs to be tied to either the specific nodes in it or the entire
2368 // ExplodedGraph, not to a specific part of the code being analyzed.
2369 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002370 // (Also, having stateful local data means that the same checker can't be
2371 // used from multiple threads, but a lot of checkers have incorrect
2372 // assumptions about that anyway. So that wasn't a priority at the time of
2373 // this fix.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002374 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002375 // This happens at the end of analysis, but bug reports are emitted /after/
2376 // this point. So we can't just clear the summary log now. Instead, we mark
2377 // that the next time we access the summary log, it should be cleared.
2378
2379 // If we never reset the summary log during /this/ code body analysis,
2380 // there were no new summaries. There might still have been summaries from
2381 // the /last/ analysis, so clear them out to make sure the bug report
2382 // visitors don't get confused.
2383 if (ShouldResetSummaryLog)
2384 SummaryLog.clear();
2385
2386 ShouldResetSummaryLog = !SummaryLog.empty();
Jordy Rose1ab51c72011-08-24 09:27:24 +00002387 }
2388
Jordy Rose17a38e22011-09-02 05:55:19 +00002389 CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2390 bool GCEnabled) const {
2391 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002392 if (!leakWithinFunctionGC)
2393 leakWithinFunctionGC.reset(new LeakWithinFunction("Leak of object when "
2394 "using garbage "
2395 "collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002396 return leakWithinFunctionGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002397 } else {
2398 if (!leakWithinFunction) {
Douglas Gregore289d812011-09-13 17:21:33 +00002399 if (LOpts.getGC() == LangOptions::HybridGC) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002400 leakWithinFunction.reset(new LeakWithinFunction("Leak of object when "
2401 "not using garbage "
2402 "collection (GC) in "
2403 "dual GC/non-GC "
2404 "code"));
2405 } else {
2406 leakWithinFunction.reset(new LeakWithinFunction("Leak"));
2407 }
2408 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002409 return leakWithinFunction.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002410 }
2411 }
2412
Jordy Rose17a38e22011-09-02 05:55:19 +00002413 CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2414 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002415 if (!leakAtReturnGC)
2416 leakAtReturnGC.reset(new LeakAtReturn("Leak of returned object when "
2417 "using garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002418 return leakAtReturnGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002419 } else {
2420 if (!leakAtReturn) {
Douglas Gregore289d812011-09-13 17:21:33 +00002421 if (LOpts.getGC() == LangOptions::HybridGC) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002422 leakAtReturn.reset(new LeakAtReturn("Leak of returned object when "
2423 "not using garbage collection "
2424 "(GC) in dual GC/non-GC code"));
2425 } else {
2426 leakAtReturn.reset(new LeakAtReturn("Leak of returned object"));
2427 }
2428 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002429 return leakAtReturn.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002430 }
2431 }
2432
Jordy Rose17a38e22011-09-02 05:55:19 +00002433 RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2434 bool GCEnabled) const {
2435 // FIXME: We don't support ARC being turned on and off during one analysis.
2436 // (nor, for that matter, do we support changing ASTContexts)
David Blaikie4e4d0842012-03-11 07:00:24 +00002437 bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002438 if (GCEnabled) {
2439 if (!SummariesGC)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002440 SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002441 else
2442 assert(SummariesGC->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002443 return *SummariesGC;
2444 } else {
Jordy Rose17a38e22011-09-02 05:55:19 +00002445 if (!Summaries)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002446 Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002447 else
2448 assert(Summaries->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002449 return *Summaries;
2450 }
2451 }
2452
Jordy Rose17a38e22011-09-02 05:55:19 +00002453 RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2454 return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2455 }
2456
Ted Kremenek8bef8232012-01-26 21:29:00 +00002457 void printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rosedbd658e2011-08-28 19:11:56 +00002458 const char *NL, const char *Sep) const;
2459
Anna Zaks390909c2011-10-06 00:43:15 +00002460 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002461 void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2462 void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
John McCallf85e1932011-06-15 23:02:42 +00002463
Jordy Rose294396b2011-08-22 23:48:23 +00002464 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
Jordy Rose537716a2011-08-27 22:51:26 +00002465 void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002466 void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2467 void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002468 void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002469
Jordy Rose294396b2011-08-22 23:48:23 +00002470 void checkSummary(const RetainSummary &Summ, const CallOrObjCMessage &Call,
Jordy Rosee38dd952011-08-28 05:16:28 +00002471 CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002472
Jordy Rose76c506f2011-08-21 21:58:18 +00002473 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2474
Ted Kremenek8bef8232012-01-26 21:29:00 +00002475 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
Jordy Roseab027fd2011-08-20 21:16:58 +00002476 bool Assumption) const;
Jordy Rose67044292011-08-17 21:27:39 +00002477
Ted Kremenek8bef8232012-01-26 21:29:00 +00002478 ProgramStateRef
2479 checkRegionChanges(ProgramStateRef state,
Jordy Rose537716a2011-08-27 22:51:26 +00002480 const StoreManager::InvalidatedSymbols *invalidated,
2481 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00002482 ArrayRef<const MemRegion *> Regions,
2483 const CallOrObjCMessage *Call) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002484
Ted Kremenek8bef8232012-01-26 21:29:00 +00002485 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002486 return true;
Jordy Roseab027fd2011-08-20 21:16:58 +00002487 }
Jordy Rose294396b2011-08-22 23:48:23 +00002488
Jordy Rosef53e8c72011-08-23 19:43:16 +00002489 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2490 void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2491 ExplodedNode *Pred, RetEffect RE, RefVal X,
Ted Kremenek8bef8232012-01-26 21:29:00 +00002492 SymbolRef Sym, ProgramStateRef state) const;
Jordy Rosef53e8c72011-08-23 19:43:16 +00002493
Jordy Rose38f17d62011-08-23 19:01:07 +00002494 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +00002495 void checkEndPath(CheckerContext &C) const;
Jordy Rose38f17d62011-08-23 19:01:07 +00002496
Ted Kremenek8bef8232012-01-26 21:29:00 +00002497 ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose17a38e22011-09-02 05:55:19 +00002498 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2499 CheckerContext &C) const;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002500
Ted Kremenek8bef8232012-01-26 21:29:00 +00002501 void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
Jordy Rose294396b2011-08-22 23:48:23 +00002502 RefVal::Kind ErrorKind, SymbolRef Sym,
2503 CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002504
2505 void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002506
Jordy Rose38f17d62011-08-23 19:01:07 +00002507 const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2508
Ted Kremenek8bef8232012-01-26 21:29:00 +00002509 ProgramStateRef handleSymbolDeath(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002510 SymbolRef sid, RefVal V,
2511 SmallVectorImpl<SymbolRef> &Leaked) const;
2512
Ted Kremenek8bef8232012-01-26 21:29:00 +00002513 std::pair<ExplodedNode *, ProgramStateRef >
2514 handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose8d228632011-08-23 20:07:14 +00002515 GenericNodeBuilderRefCount Bd, ExplodedNode *Pred,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002516 CheckerContext &Ctx, SymbolRef Sym, RefVal V) const;
Jordy Rose8d228632011-08-23 20:07:14 +00002517
Ted Kremenek8bef8232012-01-26 21:29:00 +00002518 ExplodedNode *processLeaks(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002519 SmallVectorImpl<SymbolRef> &Leaked,
2520 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002521 CheckerContext &Ctx,
Jordy Rose38f17d62011-08-23 19:01:07 +00002522 ExplodedNode *Pred = 0) const;
Ted Kremenekd593eb92009-11-25 22:17:44 +00002523};
2524} // end anonymous namespace
2525
Jordy Rose67044292011-08-17 21:27:39 +00002526namespace {
2527class StopTrackingCallback : public SymbolVisitor {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002528 ProgramStateRef state;
Jordy Rose67044292011-08-17 21:27:39 +00002529public:
Ted Kremenek8bef8232012-01-26 21:29:00 +00002530 StopTrackingCallback(ProgramStateRef st) : state(st) {}
2531 ProgramStateRef getState() const { return state; }
Jordy Rose67044292011-08-17 21:27:39 +00002532
2533 bool VisitSymbol(SymbolRef sym) {
2534 state = state->remove<RefBindings>(sym);
2535 return true;
2536 }
2537};
2538} // end anonymous namespace
2539
Jordy Rose910c4052011-09-02 06:44:22 +00002540//===----------------------------------------------------------------------===//
2541// Handle statements that may have an effect on refcounts.
2542//===----------------------------------------------------------------------===//
Jordy Rose67044292011-08-17 21:27:39 +00002543
Jordy Rose910c4052011-09-02 06:44:22 +00002544void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2545 CheckerContext &C) const {
Jordy Rose67044292011-08-17 21:27:39 +00002546
Jordy Rose910c4052011-09-02 06:44:22 +00002547 // Scan the BlockDecRefExprs for any object the retain count checker
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002548 // may be tracking.
John McCall469a1eb2011-02-02 13:00:07 +00002549 if (!BE->getBlockDecl()->hasCaptures())
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002550 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002551
Ted Kremenek8bef8232012-01-26 21:29:00 +00002552 ProgramStateRef state = C.getState();
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002553 const BlockDataRegion *R =
Ted Kremenek5eca4822012-01-06 22:09:28 +00002554 cast<BlockDataRegion>(state->getSVal(BE,
2555 C.getLocationContext()).getAsRegion());
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002556
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002557 BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
2558 E = R->referenced_vars_end();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002559
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002560 if (I == E)
2561 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002562
Ted Kremenek67d12872009-12-07 22:05:27 +00002563 // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2564 // via captured variables, even though captured variables result in a copy
2565 // and in implicit increment/decrement of a retain count.
Chris Lattner5f9e2722011-07-23 10:55:15 +00002566 SmallVector<const MemRegion*, 10> Regions;
Anna Zaks39ac1872011-10-26 21:06:44 +00002567 const LocationContext *LC = C.getLocationContext();
Ted Kremenekc8413fd2010-12-02 07:49:45 +00002568 MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002569
Ted Kremenek67d12872009-12-07 22:05:27 +00002570 for ( ; I != E; ++I) {
2571 const VarRegion *VR = *I;
2572 if (VR->getSuperRegion() == R) {
2573 VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2574 }
2575 Regions.push_back(VR);
2576 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002577
Ted Kremenek67d12872009-12-07 22:05:27 +00002578 state =
2579 state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2580 Regions.data() + Regions.size()).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00002581 C.addTransition(state);
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002582}
2583
Jordy Rose910c4052011-09-02 06:44:22 +00002584void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2585 CheckerContext &C) const {
John McCallf85e1932011-06-15 23:02:42 +00002586 const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2587 if (!BE)
2588 return;
2589
John McCall71c482c2011-06-17 06:50:50 +00002590 ArgEffect AE = IncRef;
John McCallf85e1932011-06-15 23:02:42 +00002591
2592 switch (BE->getBridgeKind()) {
2593 case clang::OBC_Bridge:
2594 // Do nothing.
2595 return;
2596 case clang::OBC_BridgeRetained:
2597 AE = IncRef;
2598 break;
2599 case clang::OBC_BridgeTransfer:
2600 AE = DecRefBridgedTransfered;
2601 break;
2602 }
2603
Ted Kremenek8bef8232012-01-26 21:29:00 +00002604 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002605 SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
John McCallf85e1932011-06-15 23:02:42 +00002606 if (!Sym)
2607 return;
2608 const RefVal* T = state->get<RefBindings>(Sym);
2609 if (!T)
2610 return;
2611
John McCallf85e1932011-06-15 23:02:42 +00002612 RefVal::Kind hasErr = (RefVal::Kind) 0;
Jordy Rose17a38e22011-09-02 05:55:19 +00002613 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
John McCallf85e1932011-06-15 23:02:42 +00002614
2615 if (hasErr) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002616 // FIXME: If we get an error during a bridge cast, should we report it?
2617 // Should we assert that there is no error?
John McCallf85e1932011-06-15 23:02:42 +00002618 return;
2619 }
2620
Anna Zaks0bd6b112011-10-26 21:06:34 +00002621 C.addTransition(state);
John McCallf85e1932011-06-15 23:02:42 +00002622}
2623
Jordy Rose910c4052011-09-02 06:44:22 +00002624void RetainCountChecker::checkPostStmt(const CallExpr *CE,
2625 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00002626 // Get the callee.
Ted Kremenek8bef8232012-01-26 21:29:00 +00002627 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002628 const Expr *Callee = CE->getCallee();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002629 SVal L = state->getSVal(Callee, C.getLocationContext());
Jordy Rose294396b2011-08-22 23:48:23 +00002630
Jordy Rose17a38e22011-09-02 05:55:19 +00002631 RetainSummaryManager &Summaries = getSummaryManager(C);
Ted Kremenek93edbc52011-10-05 23:54:29 +00002632 const RetainSummary *Summ = 0;
Jordy Rose294396b2011-08-22 23:48:23 +00002633
2634 // FIXME: Better support for blocks. For now we stop tracking anything
2635 // that is passed to blocks.
2636 // FIXME: Need to handle variables that are "captured" by the block.
2637 if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) {
2638 Summ = Summaries.getPersistentStopSummary();
2639 } else if (const FunctionDecl *FD = L.getAsFunctionDecl()) {
2640 Summ = Summaries.getSummary(FD);
2641 } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) {
2642 if (const CXXMethodDecl *MD = me->getMethodDecl())
2643 Summ = Summaries.getSummary(MD);
2644 }
2645
Jordy Rose294396b2011-08-22 23:48:23 +00002646 if (!Summ)
Ted Kremenek93edbc52011-10-05 23:54:29 +00002647 Summ = Summaries.getDefaultSummary();
Jordy Rose294396b2011-08-22 23:48:23 +00002648
Ted Kremenek5eca4822012-01-06 22:09:28 +00002649 checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C);
Jordy Rose294396b2011-08-22 23:48:23 +00002650}
2651
Jordy Rose910c4052011-09-02 06:44:22 +00002652void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE,
2653 CheckerContext &C) const {
Jordy Rose537716a2011-08-27 22:51:26 +00002654 const CXXConstructorDecl *Ctor = CE->getConstructor();
2655 if (!Ctor)
2656 return;
2657
Jordy Rose17a38e22011-09-02 05:55:19 +00002658 RetainSummaryManager &Summaries = getSummaryManager(C);
Ted Kremenek93edbc52011-10-05 23:54:29 +00002659 const RetainSummary *Summ = Summaries.getSummary(Ctor);
Jordy Rose537716a2011-08-27 22:51:26 +00002660
2661 // If we didn't get a summary, this constructor doesn't affect retain counts.
2662 if (!Summ)
2663 return;
2664
Ted Kremenek8bef8232012-01-26 21:29:00 +00002665 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002666 checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C);
Jordy Rose537716a2011-08-27 22:51:26 +00002667}
2668
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002669void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2670 const Expr *Ex) const {
2671 ProgramStateRef state = C.getState();
2672 const ExplodedNode *pred = C.getPredecessor();
2673 for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ;
2674 it != et ; ++it) {
2675 const Stmt *child = *it;
2676 SVal V = state->getSVal(child, pred->getLocationContext());
2677 if (SymbolRef sym = V.getAsSymbol())
2678 if (const RefVal* T = state->get<RefBindings>(sym)) {
2679 RefVal::Kind hasErr = (RefVal::Kind) 0;
2680 state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2681 if (hasErr) {
2682 processNonLeakError(state, child->getSourceRange(), hasErr, sym, C);
2683 return;
2684 }
2685 }
2686 }
2687
2688 // Return the object as autoreleased.
2689 // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2690 if (SymbolRef sym =
2691 state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2692 QualType ResultTy = Ex->getType();
2693 state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC,
2694 ResultTy));
2695 }
2696
2697 C.addTransition(state);
2698}
2699
2700void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2701 CheckerContext &C) const {
2702 // Apply the 'MayEscape' to all values.
2703 processObjCLiterals(C, AL);
2704}
2705
2706void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2707 CheckerContext &C) const {
2708 // Apply the 'MayEscape' to all keys and values.
2709 processObjCLiterals(C, DL);
2710}
2711
Jordy Rose910c4052011-09-02 06:44:22 +00002712void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg,
2713 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002714 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002715
Jordy Rose17a38e22011-09-02 05:55:19 +00002716 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002717
Ted Kremenek93edbc52011-10-05 23:54:29 +00002718 const RetainSummary *Summ;
Jordy Rose294396b2011-08-22 23:48:23 +00002719 if (Msg.isInstanceMessage()) {
Anna Zaksa2a86032011-11-01 22:41:01 +00002720 const LocationContext *LC = C.getLocationContext();
Jordy Rose294396b2011-08-22 23:48:23 +00002721 Summ = Summaries.getInstanceMethodSummary(Msg, state, LC);
2722 } else {
2723 Summ = Summaries.getClassMethodSummary(Msg);
2724 }
2725
2726 // If we didn't get a summary, this message doesn't affect retain counts.
2727 if (!Summ)
2728 return;
2729
Ted Kremenek5eca4822012-01-06 22:09:28 +00002730 checkSummary(*Summ, CallOrObjCMessage(Msg, state, C.getLocationContext()), C);
Jordy Rose294396b2011-08-22 23:48:23 +00002731}
2732
Jordy Rose910c4052011-09-02 06:44:22 +00002733/// GetReturnType - Used to get the return type of a message expression or
2734/// function call with the intention of affixing that type to a tracked symbol.
2735/// While the the return type can be queried directly from RetEx, when
2736/// invoking class methods we augment to the return type to be that of
2737/// a pointer to the class (as opposed it just being id).
2738// FIXME: We may be able to do this with related result types instead.
2739// This function is probably overestimating.
2740static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
2741 QualType RetTy = RetE->getType();
2742 // If RetE is not a message expression just return its type.
2743 // If RetE is a message expression, return its types if it is something
2744 /// more specific than id.
2745 if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
2746 if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
2747 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
2748 PT->isObjCClassType()) {
2749 // At this point we know the return type of the message expression is
2750 // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
2751 // is a call to a class method whose type we can resolve. In such
2752 // cases, promote the return type to XXX* (where XXX is the class).
2753 const ObjCInterfaceDecl *D = ME->getReceiverInterface();
2754 return !D ? RetTy :
2755 Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
2756 }
2757
2758 return RetTy;
2759}
2760
2761void RetainCountChecker::checkSummary(const RetainSummary &Summ,
2762 const CallOrObjCMessage &CallOrMsg,
2763 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002764 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002765
2766 // Evaluate the effect of the arguments.
2767 RefVal::Kind hasErr = (RefVal::Kind) 0;
2768 SourceRange ErrorRange;
2769 SymbolRef ErrorSym = 0;
2770
2771 for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
Jordy Rose537716a2011-08-27 22:51:26 +00002772 SVal V = CallOrMsg.getArgSVal(idx);
Jordy Rose294396b2011-08-22 23:48:23 +00002773
2774 if (SymbolRef Sym = V.getAsLocSymbol()) {
2775 if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) {
Jordy Rose17a38e22011-09-02 05:55:19 +00002776 state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002777 if (hasErr) {
2778 ErrorRange = CallOrMsg.getArgSourceRange(idx);
2779 ErrorSym = Sym;
2780 break;
2781 }
2782 }
2783 }
2784 }
2785
2786 // Evaluate the effect on the message receiver.
2787 bool ReceiverIsTracked = false;
Jordy Rosee38dd952011-08-28 05:16:28 +00002788 if (!hasErr && CallOrMsg.isObjCMessage()) {
Anna Zaks39ac1872011-10-26 21:06:44 +00002789 const LocationContext *LC = C.getLocationContext();
Jordy Rosee38dd952011-08-28 05:16:28 +00002790 SVal Receiver = CallOrMsg.getInstanceMessageReceiver(LC);
2791 if (SymbolRef Sym = Receiver.getAsLocSymbol()) {
Jordy Rose294396b2011-08-22 23:48:23 +00002792 if (const RefVal *T = state->get<RefBindings>(Sym)) {
2793 ReceiverIsTracked = true;
Jordy Rose17a38e22011-09-02 05:55:19 +00002794 state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
2795 hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002796 if (hasErr) {
Jordy Rosee38dd952011-08-28 05:16:28 +00002797 ErrorRange = CallOrMsg.getReceiverSourceRange();
Jordy Rose294396b2011-08-22 23:48:23 +00002798 ErrorSym = Sym;
2799 }
2800 }
2801 }
2802 }
2803
2804 // Process any errors.
2805 if (hasErr) {
2806 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
2807 return;
2808 }
2809
2810 // Consult the summary for the return value.
2811 RetEffect RE = Summ.getRetEffect();
2812
2813 if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00002814 if (ReceiverIsTracked)
Jordy Rose17a38e22011-09-02 05:55:19 +00002815 RE = getSummaryManager(C).getObjAllocRetEffect();
Jordy Roseb6cfc092011-08-25 00:10:37 +00002816 else
Jordy Rose294396b2011-08-22 23:48:23 +00002817 RE = RetEffect::MakeNoRet();
2818 }
2819
2820 switch (RE.getKind()) {
2821 default:
David Blaikie7530c032012-01-17 06:56:22 +00002822 llvm_unreachable("Unhandled RetEffect.");
Jordy Rose294396b2011-08-22 23:48:23 +00002823
2824 case RetEffect::NoRet:
2825 // No work necessary.
2826 break;
2827
2828 case RetEffect::OwnedAllocatedSymbol:
2829 case RetEffect::OwnedSymbol: {
Ted Kremenek5eca4822012-01-06 22:09:28 +00002830 SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(),
2831 C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002832 if (!Sym)
2833 break;
2834
2835 // Use the result type from callOrMsg as it automatically adjusts
2836 // for methods/functions that return references.
2837 QualType ResultTy = CallOrMsg.getResultType(C.getASTContext());
2838 state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(),
2839 ResultTy));
2840
2841 // FIXME: Add a flag to the checker where allocations are assumed to
2842 // *not* fail. (The code below is out-of-date, though.)
2843#if 0
2844 if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) {
2845 bool isFeasible;
2846 state = state.assume(loc::SymbolVal(Sym), true, isFeasible);
2847 assert(isFeasible && "Cannot assume fresh symbol is non-null.");
2848 }
2849#endif
2850
2851 break;
2852 }
2853
2854 case RetEffect::GCNotOwnedSymbol:
2855 case RetEffect::ARCNotOwnedSymbol:
2856 case RetEffect::NotOwnedSymbol: {
2857 const Expr *Ex = CallOrMsg.getOriginExpr();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002858 SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002859 if (!Sym)
2860 break;
2861
2862 // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
2863 QualType ResultTy = GetReturnType(Ex, C.getASTContext());
2864 state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(),
2865 ResultTy));
2866 break;
2867 }
2868 }
2869
2870 // This check is actually necessary; otherwise the statement builder thinks
2871 // we've hit a previously-found path.
2872 // Normally addTransition takes care of this, but we want the node pointer.
2873 ExplodedNode *NewNode;
2874 if (state == C.getState()) {
2875 NewNode = C.getPredecessor();
2876 } else {
Anna Zaks0bd6b112011-10-26 21:06:34 +00002877 NewNode = C.addTransition(state);
Jordy Rose294396b2011-08-22 23:48:23 +00002878 }
2879
Jordy Rose9c083b72011-08-24 18:56:32 +00002880 // Annotate the node with summary we used.
2881 if (NewNode) {
2882 // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
2883 if (ShouldResetSummaryLog) {
2884 SummaryLog.clear();
2885 ShouldResetSummaryLog = false;
2886 }
Jordy Roseec9ef852011-08-23 20:55:48 +00002887 SummaryLog[NewNode] = &Summ;
Jordy Rose9c083b72011-08-24 18:56:32 +00002888 }
Jordy Rose294396b2011-08-22 23:48:23 +00002889}
2890
Jordy Rosee0a5d322011-08-23 20:27:16 +00002891
Ted Kremenek8bef8232012-01-26 21:29:00 +00002892ProgramStateRef
2893RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose910c4052011-09-02 06:44:22 +00002894 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2895 CheckerContext &C) const {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002896 // In GC mode [... release] and [... retain] do nothing.
Jordy Rose910c4052011-09-02 06:44:22 +00002897 // In ARC mode they shouldn't exist at all, but we just ignore them.
Jordy Rose17a38e22011-09-02 05:55:19 +00002898 bool IgnoreRetainMsg = C.isObjCGCEnabled();
2899 if (!IgnoreRetainMsg)
David Blaikie4e4d0842012-03-11 07:00:24 +00002900 IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002901
Jordy Rosee0a5d322011-08-23 20:27:16 +00002902 switch (E) {
2903 default: break;
Jordy Rose17a38e22011-09-02 05:55:19 +00002904 case IncRefMsg: E = IgnoreRetainMsg ? DoNothing : IncRef; break;
2905 case DecRefMsg: E = IgnoreRetainMsg ? DoNothing : DecRef; break;
2906 case MakeCollectable: E = C.isObjCGCEnabled() ? DecRef : DoNothing; break;
2907 case NewAutoreleasePool: E = C.isObjCGCEnabled() ? DoNothing :
2908 NewAutoreleasePool; break;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002909 }
2910
2911 // Handle all use-after-releases.
Jordy Rose17a38e22011-09-02 05:55:19 +00002912 if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002913 V = V ^ RefVal::ErrorUseAfterRelease;
2914 hasErr = V.getKind();
2915 return state->set<RefBindings>(sym, V);
2916 }
2917
2918 switch (E) {
2919 case DecRefMsg:
2920 case IncRefMsg:
2921 case MakeCollectable:
2922 llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002923
2924 case Dealloc:
2925 // Any use of -dealloc in GC is *bad*.
Jordy Rose17a38e22011-09-02 05:55:19 +00002926 if (C.isObjCGCEnabled()) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002927 V = V ^ RefVal::ErrorDeallocGC;
2928 hasErr = V.getKind();
2929 break;
2930 }
2931
2932 switch (V.getKind()) {
2933 default:
2934 llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002935 case RefVal::Owned:
2936 // The object immediately transitions to the released state.
2937 V = V ^ RefVal::Released;
2938 V.clearCounts();
2939 return state->set<RefBindings>(sym, V);
2940 case RefVal::NotOwned:
2941 V = V ^ RefVal::ErrorDeallocNotOwned;
2942 hasErr = V.getKind();
2943 break;
2944 }
2945 break;
2946
2947 case NewAutoreleasePool:
Jordy Rose17a38e22011-09-02 05:55:19 +00002948 assert(!C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00002949 return state->add<AutoreleaseStack>(sym);
2950
2951 case MayEscape:
2952 if (V.getKind() == RefVal::Owned) {
2953 V = V ^ RefVal::NotOwned;
2954 break;
2955 }
2956
2957 // Fall-through.
2958
Jordy Rosee0a5d322011-08-23 20:27:16 +00002959 case DoNothing:
2960 return state;
2961
2962 case Autorelease:
Jordy Rose17a38e22011-09-02 05:55:19 +00002963 if (C.isObjCGCEnabled())
Jordy Rosee0a5d322011-08-23 20:27:16 +00002964 return state;
2965
2966 // Update the autorelease counts.
2967 state = SendAutorelease(state, ARCountFactory, sym);
2968 V = V.autorelease();
2969 break;
2970
2971 case StopTracking:
2972 return state->remove<RefBindings>(sym);
2973
2974 case IncRef:
2975 switch (V.getKind()) {
2976 default:
2977 llvm_unreachable("Invalid RefVal state for a retain.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002978 case RefVal::Owned:
2979 case RefVal::NotOwned:
2980 V = V + 1;
2981 break;
2982 case RefVal::Released:
2983 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00002984 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00002985 V = (V ^ RefVal::Owned) + 1;
2986 break;
2987 }
2988 break;
2989
2990 case SelfOwn:
2991 V = V ^ RefVal::NotOwned;
2992 // Fall-through.
2993 case DecRef:
2994 case DecRefBridgedTransfered:
2995 switch (V.getKind()) {
2996 default:
2997 // case 'RefVal::Released' handled above.
2998 llvm_unreachable("Invalid RefVal state for a release.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002999
3000 case RefVal::Owned:
3001 assert(V.getCount() > 0);
3002 if (V.getCount() == 1)
3003 V = V ^ (E == DecRefBridgedTransfered ?
3004 RefVal::NotOwned : RefVal::Released);
3005 V = V - 1;
3006 break;
3007
3008 case RefVal::NotOwned:
3009 if (V.getCount() > 0)
3010 V = V - 1;
3011 else {
3012 V = V ^ RefVal::ErrorReleaseNotOwned;
3013 hasErr = V.getKind();
3014 }
3015 break;
3016
3017 case RefVal::Released:
3018 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00003019 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003020 V = V ^ RefVal::ErrorUseAfterRelease;
3021 hasErr = V.getKind();
3022 break;
3023 }
3024 break;
3025 }
3026 return state->set<RefBindings>(sym, V);
3027}
3028
Ted Kremenek8bef8232012-01-26 21:29:00 +00003029void RetainCountChecker::processNonLeakError(ProgramStateRef St,
Jordy Rose910c4052011-09-02 06:44:22 +00003030 SourceRange ErrorRange,
3031 RefVal::Kind ErrorKind,
3032 SymbolRef Sym,
3033 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00003034 ExplodedNode *N = C.generateSink(St);
3035 if (!N)
3036 return;
3037
Jordy Rose294396b2011-08-22 23:48:23 +00003038 CFRefBug *BT;
3039 switch (ErrorKind) {
3040 default:
3041 llvm_unreachable("Unhandled error.");
Jordy Rose294396b2011-08-22 23:48:23 +00003042 case RefVal::ErrorUseAfterRelease:
Jordy Rosed6334e12011-08-25 00:34:03 +00003043 if (!useAfterRelease)
3044 useAfterRelease.reset(new UseAfterRelease());
3045 BT = &*useAfterRelease;
Jordy Rose294396b2011-08-22 23:48:23 +00003046 break;
3047 case RefVal::ErrorReleaseNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003048 if (!releaseNotOwned)
3049 releaseNotOwned.reset(new BadRelease());
3050 BT = &*releaseNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003051 break;
3052 case RefVal::ErrorDeallocGC:
Jordy Rosed6334e12011-08-25 00:34:03 +00003053 if (!deallocGC)
3054 deallocGC.reset(new DeallocGC());
3055 BT = &*deallocGC;
Jordy Rose294396b2011-08-22 23:48:23 +00003056 break;
3057 case RefVal::ErrorDeallocNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003058 if (!deallocNotOwned)
3059 deallocNotOwned.reset(new DeallocNotOwned());
3060 BT = &*deallocNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003061 break;
3062 }
3063
Jordy Rosed6334e12011-08-25 00:34:03 +00003064 assert(BT);
David Blaikie4e4d0842012-03-11 07:00:24 +00003065 CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003066 C.isObjCGCEnabled(), SummaryLog,
3067 N, Sym);
Jordy Rose294396b2011-08-22 23:48:23 +00003068 report->addRange(ErrorRange);
3069 C.EmitReport(report);
3070}
3071
Jordy Rose910c4052011-09-02 06:44:22 +00003072//===----------------------------------------------------------------------===//
3073// Handle the return values of retain-count-related functions.
3074//===----------------------------------------------------------------------===//
3075
3076bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
Jordy Rose76c506f2011-08-21 21:58:18 +00003077 // Get the callee. We're only interested in simple C functions.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003078 ProgramStateRef state = C.getState();
Anna Zaksb805c8f2011-12-01 05:57:37 +00003079 const FunctionDecl *FD = C.getCalleeDecl(CE);
Jordy Rose76c506f2011-08-21 21:58:18 +00003080 if (!FD)
3081 return false;
3082
3083 IdentifierInfo *II = FD->getIdentifier();
3084 if (!II)
3085 return false;
3086
3087 // For now, we're only handling the functions that return aliases of their
3088 // arguments: CFRetain and CFMakeCollectable (and their families).
3089 // Eventually we should add other functions we can model entirely,
3090 // such as CFRelease, which don't invalidate their arguments or globals.
3091 if (CE->getNumArgs() != 1)
3092 return false;
3093
3094 // Get the name of the function.
3095 StringRef FName = II->getName();
3096 FName = FName.substr(FName.find_first_not_of('_'));
3097
3098 // See if it's one of the specific functions we know how to eval.
3099 bool canEval = false;
3100
Anna Zaksb805c8f2011-12-01 05:57:37 +00003101 QualType ResultTy = CE->getCallReturnType();
Jordy Rose76c506f2011-08-21 21:58:18 +00003102 if (ResultTy->isObjCIdType()) {
3103 // Handle: id NSMakeCollectable(CFTypeRef)
3104 canEval = II->isStr("NSMakeCollectable");
3105 } else if (ResultTy->isPointerType()) {
3106 // Handle: (CF|CG)Retain
3107 // CFMakeCollectable
3108 // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3109 if (cocoa::isRefType(ResultTy, "CF", FName) ||
3110 cocoa::isRefType(ResultTy, "CG", FName)) {
3111 canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName);
3112 }
3113 }
3114
3115 if (!canEval)
3116 return false;
3117
3118 // Bind the return value.
Ted Kremenek5eca4822012-01-06 22:09:28 +00003119 const LocationContext *LCtx = C.getLocationContext();
3120 SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003121 if (RetVal.isUnknown()) {
3122 // If the receiver is unknown, conjure a return value.
3123 SValBuilder &SVB = C.getSValBuilder();
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003124 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003125 SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count);
Jordy Rose76c506f2011-08-21 21:58:18 +00003126 }
Ted Kremenek5eca4822012-01-06 22:09:28 +00003127 state = state->BindExpr(CE, LCtx, RetVal, false);
Jordy Rose76c506f2011-08-21 21:58:18 +00003128
Jordy Rose294396b2011-08-22 23:48:23 +00003129 // FIXME: This should not be necessary, but otherwise the argument seems to be
3130 // considered alive during the next statement.
3131 if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3132 // Save the refcount status of the argument.
3133 SymbolRef Sym = RetVal.getAsLocSymbol();
3134 RefBindings::data_type *Binding = 0;
3135 if (Sym)
3136 Binding = state->get<RefBindings>(Sym);
Jordy Rose76c506f2011-08-21 21:58:18 +00003137
Jordy Rose294396b2011-08-22 23:48:23 +00003138 // Invalidate the argument region.
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003139 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003140 state = state->invalidateRegions(ArgRegion, CE, Count, LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003141
Jordy Rose294396b2011-08-22 23:48:23 +00003142 // Restore the refcount status of the argument.
3143 if (Binding)
3144 state = state->set<RefBindings>(Sym, *Binding);
3145 }
3146
Anna Zaks0bd6b112011-10-26 21:06:34 +00003147 C.addTransition(state);
Jordy Rose76c506f2011-08-21 21:58:18 +00003148 return true;
3149}
3150
Jordy Rose910c4052011-09-02 06:44:22 +00003151//===----------------------------------------------------------------------===//
3152// Handle return statements.
3153//===----------------------------------------------------------------------===//
Jordy Rosef53e8c72011-08-23 19:43:16 +00003154
Ted Kremeneke5715782012-02-25 02:09:09 +00003155// Return true if the current LocationContext has no caller context.
3156static bool inTopFrame(CheckerContext &C) {
3157 const LocationContext *LC = C.getLocationContext();
3158 return LC->getParent() == 0;
3159}
3160
Jordy Rose910c4052011-09-02 06:44:22 +00003161void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3162 CheckerContext &C) const {
Ted Kremeneke5715782012-02-25 02:09:09 +00003163
3164 // Only adjust the reference count if this is the top-level call frame,
3165 // and not the result of inlining. In the future, we should do
3166 // better checking even for inlined calls, and see if they match
3167 // with their expected semantics (e.g., the method should return a retained
3168 // object, etc.).
3169 if (!inTopFrame(C))
3170 return;
3171
Jordy Rosef53e8c72011-08-23 19:43:16 +00003172 const Expr *RetE = S->getRetValue();
3173 if (!RetE)
3174 return;
3175
Ted Kremenek8bef8232012-01-26 21:29:00 +00003176 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00003177 SymbolRef Sym =
3178 state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003179 if (!Sym)
3180 return;
3181
3182 // Get the reference count binding (if any).
3183 const RefVal *T = state->get<RefBindings>(Sym);
3184 if (!T)
3185 return;
3186
3187 // Change the reference count.
3188 RefVal X = *T;
3189
3190 switch (X.getKind()) {
3191 case RefVal::Owned: {
3192 unsigned cnt = X.getCount();
3193 assert(cnt > 0);
3194 X.setCount(cnt - 1);
3195 X = X ^ RefVal::ReturnedOwned;
3196 break;
3197 }
3198
3199 case RefVal::NotOwned: {
3200 unsigned cnt = X.getCount();
3201 if (cnt) {
3202 X.setCount(cnt - 1);
3203 X = X ^ RefVal::ReturnedOwned;
3204 }
3205 else {
3206 X = X ^ RefVal::ReturnedNotOwned;
3207 }
3208 break;
3209 }
3210
3211 default:
3212 return;
3213 }
3214
3215 // Update the binding.
3216 state = state->set<RefBindings>(Sym, X);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003217 ExplodedNode *Pred = C.addTransition(state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003218
3219 // At this point we have updated the state properly.
3220 // Everything after this is merely checking to see if the return value has
3221 // been over- or under-retained.
3222
3223 // Did we cache out?
3224 if (!Pred)
3225 return;
3226
Jordy Rosef53e8c72011-08-23 19:43:16 +00003227 // Update the autorelease counts.
3228 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003229 AutoreleaseTag("RetainCountChecker : Autorelease");
Anna Zaks4eff8232011-10-05 23:44:11 +00003230 GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003231 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003232
3233 // Did we cache out?
Jordy Rose8d228632011-08-23 20:07:14 +00003234 if (!Pred)
Jordy Rosef53e8c72011-08-23 19:43:16 +00003235 return;
3236
3237 // Get the updated binding.
3238 T = state->get<RefBindings>(Sym);
3239 assert(T);
3240 X = *T;
3241
3242 // Consult the summary of the enclosing method.
Jordy Rose17a38e22011-09-02 05:55:19 +00003243 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003244 const Decl *CD = &Pred->getCodeDecl();
3245
3246 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
3247 // Unlike regular functions, /all/ ObjC methods are assumed to always
3248 // follow Cocoa retain-count conventions, not just those with special
3249 // names or attributes.
Jordy Roseb6cfc092011-08-25 00:10:37 +00003250 const RetainSummary *Summ = Summaries.getMethodSummary(MD);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003251 RetEffect RE = Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet();
3252 checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
3253 }
3254
3255 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3256 if (!isa<CXXMethodDecl>(FD))
Jordy Roseb6cfc092011-08-25 00:10:37 +00003257 if (const RetainSummary *Summ = Summaries.getSummary(FD))
Jordy Rosef53e8c72011-08-23 19:43:16 +00003258 checkReturnWithRetEffect(S, C, Pred, Summ->getRetEffect(), X,
3259 Sym, state);
3260 }
3261}
3262
Jordy Rose910c4052011-09-02 06:44:22 +00003263void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3264 CheckerContext &C,
3265 ExplodedNode *Pred,
3266 RetEffect RE, RefVal X,
3267 SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003268 ProgramStateRef state) const {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003269 // Any leaks or other errors?
3270 if (X.isReturnedOwned() && X.getCount() == 0) {
3271 if (RE.getKind() != RetEffect::NoRet) {
3272 bool hasError = false;
Jordy Rose17a38e22011-09-02 05:55:19 +00003273 if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003274 // Things are more complicated with garbage collection. If the
3275 // returned object is suppose to be an Objective-C object, we have
3276 // a leak (as the caller expects a GC'ed object) because no
3277 // method should return ownership unless it returns a CF object.
3278 hasError = true;
3279 X = X ^ RefVal::ErrorGCLeakReturned;
3280 }
3281 else if (!RE.isOwned()) {
3282 // Either we are using GC and the returned object is a CF type
3283 // or we aren't using GC. In either case, we expect that the
3284 // enclosing method is expected to return ownership.
3285 hasError = true;
3286 X = X ^ RefVal::ErrorLeakReturned;
3287 }
3288
3289 if (hasError) {
3290 // Generate an error node.
3291 state = state->set<RefBindings>(Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003292
3293 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003294 ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003295 ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003296 if (N) {
David Blaikie4e4d0842012-03-11 07:00:24 +00003297 const LangOptions &LOpts = C.getASTContext().getLangOpts();
Jordy Rose17a38e22011-09-02 05:55:19 +00003298 bool GCEnabled = C.isObjCGCEnabled();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003299 CFRefReport *report =
Jordy Rose17a38e22011-09-02 05:55:19 +00003300 new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled),
3301 LOpts, GCEnabled, SummaryLog,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003302 N, Sym, C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003303 C.EmitReport(report);
3304 }
3305 }
3306 }
3307 } else if (X.isReturnedNotOwned()) {
3308 if (RE.isOwned()) {
3309 // Trying to return a not owned object to a caller expecting an
3310 // owned object.
3311 state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003312
3313 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003314 ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003315 ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003316 if (N) {
Jordy Rosed6334e12011-08-25 00:34:03 +00003317 if (!returnNotOwnedForOwned)
3318 returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned());
3319
Jordy Rosef53e8c72011-08-23 19:43:16 +00003320 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003321 new CFRefReport(*returnNotOwnedForOwned,
David Blaikie4e4d0842012-03-11 07:00:24 +00003322 C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003323 C.isObjCGCEnabled(), SummaryLog, N, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003324 C.EmitReport(report);
3325 }
3326 }
3327 }
3328}
3329
Jordy Rose8d228632011-08-23 20:07:14 +00003330//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003331// Check various ways a symbol can be invalidated.
3332//===----------------------------------------------------------------------===//
3333
Anna Zaks390909c2011-10-06 00:43:15 +00003334void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
Jordy Rose910c4052011-09-02 06:44:22 +00003335 CheckerContext &C) const {
3336 // Are we storing to something that causes the value to "escape"?
3337 bool escapes = true;
3338
3339 // A value escapes in three possible cases (this may change):
3340 //
3341 // (1) we are binding to something that is not a memory region.
3342 // (2) we are binding to a memregion that does not have stack storage
3343 // (3) we are binding to a memregion with stack storage that the store
3344 // does not understand.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003345 ProgramStateRef state = C.getState();
Jordy Rose910c4052011-09-02 06:44:22 +00003346
3347 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
3348 escapes = !regionLoc->getRegion()->hasStackStorage();
3349
3350 if (!escapes) {
3351 // To test (3), generate a new state with the binding added. If it is
3352 // the same state, then it escapes (since the store cannot represent
3353 // the binding).
3354 escapes = (state == (state->bindLoc(*regionLoc, val)));
3355 }
3356 }
3357
3358 // If our store can represent the binding and we aren't storing to something
3359 // that doesn't have local storage then just return and have the simulation
3360 // state continue as is.
3361 if (!escapes)
3362 return;
3363
3364 // Otherwise, find all symbols referenced by 'val' that we are tracking
3365 // and stop tracking them.
3366 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00003367 C.addTransition(state);
Jordy Rose910c4052011-09-02 06:44:22 +00003368}
3369
Ted Kremenek8bef8232012-01-26 21:29:00 +00003370ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003371 SVal Cond,
3372 bool Assumption) const {
3373
3374 // FIXME: We may add to the interface of evalAssume the list of symbols
3375 // whose assumptions have changed. For now we just iterate through the
3376 // bindings and check if any of the tracked symbols are NULL. This isn't
3377 // too bad since the number of symbols we will track in practice are
3378 // probably small and evalAssume is only called at branches and a few
3379 // other places.
3380 RefBindings B = state->get<RefBindings>();
3381
3382 if (B.isEmpty())
3383 return state;
3384
3385 bool changed = false;
3386 RefBindings::Factory &RefBFactory = state->get_context<RefBindings>();
3387
3388 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3389 // Check if the symbol is null (or equal to any constant).
3390 // If this is the case, stop tracking the symbol.
3391 if (state->getSymVal(I.getKey())) {
3392 changed = true;
3393 B = RefBFactory.remove(B, I.getKey());
3394 }
3395 }
3396
3397 if (changed)
3398 state = state->set<RefBindings>(B);
3399
3400 return state;
3401}
3402
Ted Kremenek8bef8232012-01-26 21:29:00 +00003403ProgramStateRef
3404RetainCountChecker::checkRegionChanges(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003405 const StoreManager::InvalidatedSymbols *invalidated,
3406 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00003407 ArrayRef<const MemRegion *> Regions,
3408 const CallOrObjCMessage *Call) const {
Jordy Rose910c4052011-09-02 06:44:22 +00003409 if (!invalidated)
3410 return state;
3411
3412 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3413 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3414 E = ExplicitRegions.end(); I != E; ++I) {
3415 if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3416 WhitelistedSymbols.insert(SR->getSymbol());
3417 }
3418
3419 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
3420 E = invalidated->end(); I!=E; ++I) {
3421 SymbolRef sym = *I;
3422 if (WhitelistedSymbols.count(sym))
3423 continue;
3424 // Remove any existing reference-count binding.
3425 state = state->remove<RefBindings>(sym);
3426 }
3427 return state;
3428}
3429
3430//===----------------------------------------------------------------------===//
Jordy Rose8d228632011-08-23 20:07:14 +00003431// Handle dead symbols and end-of-path.
3432//===----------------------------------------------------------------------===//
3433
Ted Kremenek8bef8232012-01-26 21:29:00 +00003434std::pair<ExplodedNode *, ProgramStateRef >
3435RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003436 GenericNodeBuilderRefCount Bd,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003437 ExplodedNode *Pred,
3438 CheckerContext &Ctx,
Jordy Rose910c4052011-09-02 06:44:22 +00003439 SymbolRef Sym, RefVal V) const {
Jordy Rose8d228632011-08-23 20:07:14 +00003440 unsigned ACnt = V.getAutoreleaseCount();
3441
3442 // No autorelease counts? Nothing to be done.
3443 if (!ACnt)
3444 return std::make_pair(Pred, state);
3445
Anna Zaks6a93bd52011-10-25 19:57:11 +00003446 assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
Jordy Rose8d228632011-08-23 20:07:14 +00003447 unsigned Cnt = V.getCount();
3448
3449 // FIXME: Handle sending 'autorelease' to already released object.
3450
3451 if (V.getKind() == RefVal::ReturnedOwned)
3452 ++Cnt;
3453
3454 if (ACnt <= Cnt) {
3455 if (ACnt == Cnt) {
3456 V.clearCounts();
3457 if (V.getKind() == RefVal::ReturnedOwned)
3458 V = V ^ RefVal::ReturnedNotOwned;
3459 else
3460 V = V ^ RefVal::NotOwned;
3461 } else {
3462 V.setCount(Cnt - ACnt);
3463 V.setAutoreleaseCount(0);
3464 }
3465 state = state->set<RefBindings>(Sym, V);
3466 ExplodedNode *N = Bd.MakeNode(state, Pred);
3467 if (N == 0)
3468 state = 0;
3469 return std::make_pair(N, state);
3470 }
3471
3472 // Woah! More autorelease counts then retain counts left.
3473 // Emit hard error.
3474 V = V ^ RefVal::ErrorOverAutorelease;
3475 state = state->set<RefBindings>(Sym, V);
3476
Anna Zaksf05aac82011-10-18 23:05:58 +00003477 if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003478 SmallString<128> sbuf;
Jordy Rose8d228632011-08-23 20:07:14 +00003479 llvm::raw_svector_ostream os(sbuf);
3480 os << "Object over-autoreleased: object was sent -autorelease ";
3481 if (V.getAutoreleaseCount() > 1)
3482 os << V.getAutoreleaseCount() << " times ";
3483 os << "but the object has a +" << V.getCount() << " retain count";
3484
Jordy Rosed6334e12011-08-25 00:34:03 +00003485 if (!overAutorelease)
3486 overAutorelease.reset(new OverAutorelease());
3487
David Blaikie4e4d0842012-03-11 07:00:24 +00003488 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Jordy Rose8d228632011-08-23 20:07:14 +00003489 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003490 new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3491 SummaryLog, N, Sym, os.str());
Anna Zaks6a93bd52011-10-25 19:57:11 +00003492 Ctx.EmitReport(report);
Jordy Rose8d228632011-08-23 20:07:14 +00003493 }
3494
Ted Kremenek8bef8232012-01-26 21:29:00 +00003495 return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0);
Jordy Rose8d228632011-08-23 20:07:14 +00003496}
Jordy Rose38f17d62011-08-23 19:01:07 +00003497
Ted Kremenek8bef8232012-01-26 21:29:00 +00003498ProgramStateRef
3499RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003500 SymbolRef sid, RefVal V,
Jordy Rose38f17d62011-08-23 19:01:07 +00003501 SmallVectorImpl<SymbolRef> &Leaked) const {
Jordy Rose53376122011-08-24 04:48:19 +00003502 bool hasLeak = false;
Jordy Rose38f17d62011-08-23 19:01:07 +00003503 if (V.isOwned())
3504 hasLeak = true;
3505 else if (V.isNotOwned() || V.isReturnedOwned())
3506 hasLeak = (V.getCount() > 0);
3507
3508 if (!hasLeak)
3509 return state->remove<RefBindings>(sid);
3510
3511 Leaked.push_back(sid);
3512 return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak);
3513}
3514
3515ExplodedNode *
Ted Kremenek8bef8232012-01-26 21:29:00 +00003516RetainCountChecker::processLeaks(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003517 SmallVectorImpl<SymbolRef> &Leaked,
3518 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003519 CheckerContext &Ctx,
3520 ExplodedNode *Pred) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003521 if (Leaked.empty())
3522 return Pred;
3523
3524 // Generate an intermediate node representing the leak point.
3525 ExplodedNode *N = Builder.MakeNode(state, Pred);
3526
3527 if (N) {
3528 for (SmallVectorImpl<SymbolRef>::iterator
3529 I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3530
David Blaikie4e4d0842012-03-11 07:00:24 +00003531 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Anna Zaks6a93bd52011-10-25 19:57:11 +00003532 bool GCEnabled = Ctx.isObjCGCEnabled();
Jordy Rose17a38e22011-09-02 05:55:19 +00003533 CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3534 : getLeakAtReturnBug(LOpts, GCEnabled);
Jordy Rose38f17d62011-08-23 19:01:07 +00003535 assert(BT && "BugType not initialized.");
Jordy Rose20589562011-08-24 22:39:09 +00003536
Jordy Rose17a38e22011-09-02 05:55:19 +00003537 CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003538 SummaryLog, N, *I, Ctx);
3539 Ctx.EmitReport(report);
Jordy Rose38f17d62011-08-23 19:01:07 +00003540 }
3541 }
3542
3543 return N;
3544}
3545
Anna Zaksaf498a22011-10-25 19:56:48 +00003546void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00003547 ProgramStateRef state = Ctx.getState();
Anna Zaksaf498a22011-10-25 19:56:48 +00003548 GenericNodeBuilderRefCount Bd(Ctx);
Jordy Rose38f17d62011-08-23 19:01:07 +00003549 RefBindings B = state->get<RefBindings>();
Anna Zaksaf498a22011-10-25 19:56:48 +00003550 ExplodedNode *Pred = Ctx.getPredecessor();
Jordy Rose38f17d62011-08-23 19:01:07 +00003551
3552 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
Anna Zaks6a93bd52011-10-25 19:57:11 +00003553 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx,
Jordy Rose8d228632011-08-23 20:07:14 +00003554 I->first, I->second);
3555 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003556 return;
3557 }
3558
Ted Kremenek0cf3d472012-02-07 00:24:33 +00003559 // If the current LocationContext has a parent, don't check for leaks.
3560 // We will do that later.
3561 // FIXME: we should instead check for imblances of the retain/releases,
3562 // and suggest annotations.
3563 if (Ctx.getLocationContext()->getParent())
3564 return;
3565
Jordy Rose38f17d62011-08-23 19:01:07 +00003566 B = state->get<RefBindings>();
3567 SmallVector<SymbolRef, 10> Leaked;
3568
3569 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I)
Jordy Rose8d228632011-08-23 20:07:14 +00003570 state = handleSymbolDeath(state, I->first, I->second, Leaked);
Jordy Rose38f17d62011-08-23 19:01:07 +00003571
Anna Zaks6a93bd52011-10-25 19:57:11 +00003572 processLeaks(state, Leaked, Bd, Ctx, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003573}
3574
3575const ProgramPointTag *
Jordy Rose910c4052011-09-02 06:44:22 +00003576RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003577 const SimpleProgramPointTag *&tag = DeadSymbolTags[sym];
3578 if (!tag) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003579 SmallString<64> buf;
Jordy Rose38f17d62011-08-23 19:01:07 +00003580 llvm::raw_svector_ostream out(buf);
Anna Zaksf62ceec2011-12-05 18:58:11 +00003581 out << "RetainCountChecker : Dead Symbol : ";
3582 sym->dumpToStream(out);
Jordy Rose38f17d62011-08-23 19:01:07 +00003583 tag = new SimpleProgramPointTag(out.str());
3584 }
3585 return tag;
3586}
3587
Jordy Rose910c4052011-09-02 06:44:22 +00003588void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
3589 CheckerContext &C) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003590 ExplodedNode *Pred = C.getPredecessor();
3591
Ted Kremenek8bef8232012-01-26 21:29:00 +00003592 ProgramStateRef state = C.getState();
Jordy Rose38f17d62011-08-23 19:01:07 +00003593 RefBindings B = state->get<RefBindings>();
3594
3595 // Update counts from autorelease pools
3596 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3597 E = SymReaper.dead_end(); I != E; ++I) {
3598 SymbolRef Sym = *I;
3599 if (const RefVal *T = B.lookup(Sym)){
3600 // Use the symbol as the tag.
3601 // FIXME: This might not be as unique as we would like.
Anna Zaks4eff8232011-10-05 23:44:11 +00003602 GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym));
Anna Zaks6a93bd52011-10-25 19:57:11 +00003603 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C,
Jordy Rose8d228632011-08-23 20:07:14 +00003604 Sym, *T);
3605 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003606 return;
3607 }
3608 }
3609
3610 B = state->get<RefBindings>();
3611 SmallVector<SymbolRef, 10> Leaked;
3612
3613 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3614 E = SymReaper.dead_end(); I != E; ++I) {
3615 if (const RefVal *T = B.lookup(*I))
3616 state = handleSymbolDeath(state, *I, *T, Leaked);
3617 }
3618
3619 {
Anna Zaks4eff8232011-10-05 23:44:11 +00003620 GenericNodeBuilderRefCount Bd(C, this);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003621 Pred = processLeaks(state, Leaked, Bd, C, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003622 }
3623
3624 // Did we cache out?
3625 if (!Pred)
3626 return;
3627
3628 // Now generate a new node that nukes the old bindings.
3629 RefBindings::Factory &F = state->get_context<RefBindings>();
3630
3631 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3632 E = SymReaper.dead_end(); I != E; ++I)
3633 B = F.remove(B, *I);
3634
3635 state = state->set<RefBindings>(B);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003636 C.addTransition(state, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003637}
3638
Ted Kremenekd593eb92009-11-25 22:17:44 +00003639//===----------------------------------------------------------------------===//
Jordy Rosedbd658e2011-08-28 19:11:56 +00003640// Debug printing of refcount bindings and autorelease pools.
3641//===----------------------------------------------------------------------===//
3642
3643static void PrintPool(raw_ostream &Out, SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003644 ProgramStateRef State) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003645 Out << ' ';
3646 if (Sym)
Anna Zaksf62ceec2011-12-05 18:58:11 +00003647 Sym->dumpToStream(Out);
Jordy Rosedbd658e2011-08-28 19:11:56 +00003648 else
3649 Out << "<pool>";
3650 Out << ":{";
3651
3652 // Get the contents of the pool.
3653 if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym))
3654 for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I)
3655 Out << '(' << I.getKey() << ',' << I.getData() << ')';
3656
3657 Out << '}';
3658}
3659
Ted Kremenek8bef8232012-01-26 21:29:00 +00003660static bool UsesAutorelease(ProgramStateRef state) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003661 // A state uses autorelease if it allocated an autorelease pool or if it has
3662 // objects in the caller's autorelease pool.
3663 return !state->get<AutoreleaseStack>().isEmpty() ||
3664 state->get<AutoreleasePoolContents>(SymbolRef());
3665}
3666
Ted Kremenek8bef8232012-01-26 21:29:00 +00003667void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rose910c4052011-09-02 06:44:22 +00003668 const char *NL, const char *Sep) const {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003669
3670 RefBindings B = State->get<RefBindings>();
3671
3672 if (!B.isEmpty())
3673 Out << Sep << NL;
3674
3675 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3676 Out << I->first << " : ";
3677 I->second.print(Out);
3678 Out << NL;
3679 }
3680
3681 // Print the autorelease stack.
3682 if (UsesAutorelease(State)) {
3683 Out << Sep << NL << "AR pool stack:";
3684 ARStack Stack = State->get<AutoreleaseStack>();
3685
3686 PrintPool(Out, SymbolRef(), State); // Print the caller's pool.
3687 for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I)
3688 PrintPool(Out, *I, State);
3689
3690 Out << NL;
3691 }
3692}
3693
3694//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003695// Checker registration.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00003696//===----------------------------------------------------------------------===//
3697
Jordy Rose17a38e22011-09-02 05:55:19 +00003698void ento::registerRetainCountChecker(CheckerManager &Mgr) {
Jordy Rose910c4052011-09-02 06:44:22 +00003699 Mgr.registerChecker<RetainCountChecker>();
Jordy Rose17a38e22011-09-02 05:55:19 +00003700}
3701