Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1 | //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--// |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 10 | // This file defines the methods for RetainCountChecker, which implements |
| 11 | // a reference count checker for Core Foundation and Cocoa on (Mac OS X). |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 16 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | b277159 | 2011-03-30 17:41:19 +0000 | [diff] [blame] | 17 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 18 | #include "clang/Basic/LangOptions.h" |
| 19 | #include "clang/Basic/SourceManager.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/DomainSpecific/CocoaConventions.h" |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 21 | #include "clang/AST/ParentMap.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 23 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
| 25 | #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 26 | #include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 27 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 28 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 29 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Jordy Rose | d1e5a89 | 2011-09-02 08:02:59 +0000 | [diff] [blame] | 30 | #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 31 | #include "llvm/ADT/DenseMap.h" |
| 32 | #include "llvm/ADT/FoldingSet.h" |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 33 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 34 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 35 | #include "llvm/ADT/SmallString.h" |
Ted Kremenek | 6ed9afc | 2008-05-16 18:33:44 +0000 | [diff] [blame] | 36 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 37 | #include "llvm/ADT/StringExtras.h" |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 38 | #include <cstdarg> |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 39 | |
| 40 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 41 | using namespace ento; |
Ted Kremenek | a64e89b | 2010-01-27 06:13:48 +0000 | [diff] [blame] | 42 | using llvm::StrInStrNoCase; |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 43 | |
Ted Kremenek | d775c66 | 2010-05-21 21:57:00 +0000 | [diff] [blame] | 44 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 45 | /// Wrapper around different kinds of node builder, so that helper functions |
| 46 | /// can have a common interface. |
Francois Pichet | ea09785 | 2011-01-11 10:41:37 +0000 | [diff] [blame] | 47 | class GenericNodeBuilderRefCount { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 48 | CheckerContext *C; |
Ted Kremenek | ca80453 | 2011-08-12 23:04:46 +0000 | [diff] [blame] | 49 | const ProgramPointTag *tag; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 50 | public: |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 51 | GenericNodeBuilderRefCount(CheckerContext &c, |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 52 | const ProgramPointTag *t = 0) |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 53 | : C(&c), tag(t){} |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 54 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 55 | ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred, |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 56 | bool MarkAsSink = false) { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 57 | return C->addTransition(state, Pred, tag, MarkAsSink); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 58 | } |
| 59 | }; |
| 60 | } // end anonymous namespace |
| 61 | |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 62 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 63 | // Primitives used for constructing summaries for function/method calls. |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 64 | //===----------------------------------------------------------------------===// |
| 65 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 66 | /// ArgEffect is used to summarize a function/method call's effect on a |
| 67 | /// particular argument. |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 68 | enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 69 | DecRefBridgedTransfered, |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 70 | DecRefAndStopTracking, DecRefMsgAndStopTracking, |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 71 | IncRefMsg, IncRef, MakeCollectable, MayEscape, |
Jordan Rose | 29299c6 | 2012-06-27 00:51:18 +0000 | [diff] [blame] | 72 | NewAutoreleasePool, StopTracking }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 73 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 74 | namespace llvm { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 75 | template <> struct FoldingSetTrait<ArgEffect> { |
| 76 | static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) { |
| 77 | ID.AddInteger((unsigned) X); |
| 78 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 79 | }; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 80 | } // end llvm namespace |
| 81 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 82 | /// ArgEffects summarizes the effects of a function/method call on all of |
| 83 | /// its arguments. |
| 84 | typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects; |
| 85 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 86 | namespace { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 87 | |
| 88 | /// RetEffect is used to summarize a function/method call's behavior with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 89 | /// respect to its return value. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 90 | class RetEffect { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 91 | public: |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 92 | enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 93 | NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol, |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 94 | OwnedWhenTrackedReceiver }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 95 | |
| 96 | enum ObjKind { CF, ObjC, AnyObj }; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 97 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 98 | private: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 99 | Kind K; |
| 100 | ObjKind O; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 101 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 102 | RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 103 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 104 | public: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 105 | Kind getKind() const { return K; } |
| 106 | |
| 107 | ObjKind getObjKind() const { return O; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 108 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 109 | bool isOwned() const { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 110 | return K == OwnedSymbol || K == OwnedAllocatedSymbol || |
| 111 | K == OwnedWhenTrackedReceiver; |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 112 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 113 | |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 114 | bool operator==(const RetEffect &Other) const { |
| 115 | return K == Other.K && O == Other.O; |
| 116 | } |
| 117 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 118 | static RetEffect MakeOwnedWhenTrackedReceiver() { |
| 119 | return RetEffect(OwnedWhenTrackedReceiver, ObjC); |
| 120 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 121 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 122 | static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) { |
| 123 | return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 124 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 125 | static RetEffect MakeNotOwned(ObjKind o) { |
| 126 | return RetEffect(NotOwnedSymbol, o); |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 127 | } |
| 128 | static RetEffect MakeGCNotOwned() { |
| 129 | return RetEffect(GCNotOwnedSymbol, ObjC); |
| 130 | } |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 131 | static RetEffect MakeARCNotOwned() { |
| 132 | return RetEffect(ARCNotOwnedSymbol, ObjC); |
| 133 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 134 | static RetEffect MakeNoRet() { |
| 135 | return RetEffect(NoRet); |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 136 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 137 | |
| 138 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 139 | ID.AddInteger((unsigned) K); |
| 140 | ID.AddInteger((unsigned) O); |
| 141 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 142 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 143 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 144 | //===----------------------------------------------------------------------===// |
| 145 | // Reference-counting logic (typestate + counts). |
| 146 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 147 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 148 | class RefVal { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 149 | public: |
| 150 | enum Kind { |
| 151 | Owned = 0, // Owning reference. |
| 152 | NotOwned, // Reference is not owned by still valid (not freed). |
| 153 | Released, // Object has been released. |
| 154 | ReturnedOwned, // Returned object passes ownership to caller. |
| 155 | ReturnedNotOwned, // Return object does not pass ownership to caller. |
| 156 | ERROR_START, |
| 157 | ErrorDeallocNotOwned, // -dealloc called on non-owned object. |
| 158 | ErrorDeallocGC, // Calling -dealloc with GC enabled. |
| 159 | ErrorUseAfterRelease, // Object used after released. |
| 160 | ErrorReleaseNotOwned, // Release of an object that was not owned. |
| 161 | ERROR_LEAK_START, |
| 162 | ErrorLeak, // A memory leak due to excessive reference counts. |
| 163 | ErrorLeakReturned, // A memory leak due to the returning method not having |
| 164 | // the correct naming conventions. |
| 165 | ErrorGCLeakReturned, |
| 166 | ErrorOverAutorelease, |
| 167 | ErrorReturnedNotOwned |
| 168 | }; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 169 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 170 | private: |
| 171 | Kind kind; |
| 172 | RetEffect::ObjKind okind; |
| 173 | unsigned Cnt; |
| 174 | unsigned ACnt; |
| 175 | QualType T; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 176 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 177 | RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t) |
| 178 | : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {} |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 179 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 180 | public: |
| 181 | Kind getKind() const { return kind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 182 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 183 | RetEffect::ObjKind getObjKind() const { return okind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 184 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 185 | unsigned getCount() const { return Cnt; } |
| 186 | unsigned getAutoreleaseCount() const { return ACnt; } |
| 187 | unsigned getCombinedCounts() const { return Cnt + ACnt; } |
| 188 | void clearCounts() { Cnt = 0; ACnt = 0; } |
| 189 | void setCount(unsigned i) { Cnt = i; } |
| 190 | void setAutoreleaseCount(unsigned i) { ACnt = i; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 191 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 192 | QualType getType() const { return T; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 193 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 194 | bool isOwned() const { |
| 195 | return getKind() == Owned; |
| 196 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 197 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 198 | bool isNotOwned() const { |
| 199 | return getKind() == NotOwned; |
| 200 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 201 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 202 | bool isReturnedOwned() const { |
| 203 | return getKind() == ReturnedOwned; |
| 204 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 205 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 206 | bool isReturnedNotOwned() const { |
| 207 | return getKind() == ReturnedNotOwned; |
| 208 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 209 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 210 | static RefVal makeOwned(RetEffect::ObjKind o, QualType t, |
| 211 | unsigned Count = 1) { |
| 212 | return RefVal(Owned, o, Count, 0, t); |
| 213 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 214 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 215 | static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t, |
| 216 | unsigned Count = 0) { |
| 217 | return RefVal(NotOwned, o, Count, 0, t); |
| 218 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 219 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 220 | // Comparison, profiling, and pretty-printing. |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 221 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 222 | bool operator==(const RefVal& X) const { |
| 223 | return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt; |
| 224 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 225 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 226 | RefVal operator-(size_t i) const { |
| 227 | return RefVal(getKind(), getObjKind(), getCount() - i, |
| 228 | getAutoreleaseCount(), getType()); |
| 229 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 230 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 231 | RefVal operator+(size_t i) const { |
| 232 | return RefVal(getKind(), getObjKind(), getCount() + i, |
| 233 | getAutoreleaseCount(), getType()); |
| 234 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 235 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 236 | RefVal operator^(Kind k) const { |
| 237 | return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(), |
| 238 | getType()); |
| 239 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 240 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 241 | RefVal autorelease() const { |
| 242 | return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1, |
| 243 | getType()); |
| 244 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 245 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 246 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 247 | ID.AddInteger((unsigned) kind); |
| 248 | ID.AddInteger(Cnt); |
| 249 | ID.AddInteger(ACnt); |
| 250 | ID.Add(T); |
| 251 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 252 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 253 | void print(raw_ostream &Out) const; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 254 | }; |
| 255 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 256 | void RefVal::print(raw_ostream &Out) const { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 257 | if (!T.isNull()) |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 258 | Out << "Tracked " << T.getAsString() << '/'; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 259 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 260 | switch (getKind()) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 261 | default: llvm_unreachable("Invalid RefVal kind"); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 262 | case Owned: { |
| 263 | Out << "Owned"; |
| 264 | unsigned cnt = getCount(); |
| 265 | if (cnt) Out << " (+ " << cnt << ")"; |
| 266 | break; |
| 267 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 268 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 269 | case NotOwned: { |
| 270 | Out << "NotOwned"; |
| 271 | unsigned cnt = getCount(); |
| 272 | if (cnt) Out << " (+ " << cnt << ")"; |
| 273 | break; |
| 274 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 275 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 276 | case ReturnedOwned: { |
| 277 | Out << "ReturnedOwned"; |
| 278 | unsigned cnt = getCount(); |
| 279 | if (cnt) Out << " (+ " << cnt << ")"; |
| 280 | break; |
| 281 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 282 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 283 | case ReturnedNotOwned: { |
| 284 | Out << "ReturnedNotOwned"; |
| 285 | unsigned cnt = getCount(); |
| 286 | if (cnt) Out << " (+ " << cnt << ")"; |
| 287 | break; |
| 288 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 289 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 290 | case Released: |
| 291 | Out << "Released"; |
| 292 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 293 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 294 | case ErrorDeallocGC: |
| 295 | Out << "-dealloc (GC)"; |
| 296 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 297 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 298 | case ErrorDeallocNotOwned: |
| 299 | Out << "-dealloc (not-owned)"; |
| 300 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 301 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 302 | case ErrorLeak: |
| 303 | Out << "Leaked"; |
| 304 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 305 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 306 | case ErrorLeakReturned: |
| 307 | Out << "Leaked (Bad naming)"; |
| 308 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 309 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 310 | case ErrorGCLeakReturned: |
| 311 | Out << "Leaked (GC-ed at return)"; |
| 312 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 313 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 314 | case ErrorUseAfterRelease: |
| 315 | Out << "Use-After-Release [ERROR]"; |
| 316 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 317 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 318 | case ErrorReleaseNotOwned: |
| 319 | Out << "Release of Not-Owned [ERROR]"; |
| 320 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 321 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 322 | case RefVal::ErrorOverAutorelease: |
| 323 | Out << "Over autoreleased"; |
| 324 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 325 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 326 | case RefVal::ErrorReturnedNotOwned: |
| 327 | Out << "Non-owned object returned instead of owned"; |
| 328 | break; |
| 329 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 330 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 331 | if (ACnt) { |
| 332 | Out << " [ARC +" << ACnt << ']'; |
| 333 | } |
| 334 | } |
| 335 | } //end anonymous namespace |
| 336 | |
| 337 | //===----------------------------------------------------------------------===// |
| 338 | // RefBindings - State used to track object reference counts. |
| 339 | //===----------------------------------------------------------------------===// |
| 340 | |
| 341 | typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 342 | |
| 343 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 344 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 345 | template<> |
| 346 | struct ProgramStateTrait<RefBindings> |
| 347 | : public ProgramStatePartialTrait<RefBindings> { |
| 348 | static void *GDMIndex() { |
| 349 | static int RefBIndex = 0; |
| 350 | return &RefBIndex; |
| 351 | } |
| 352 | }; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 353 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 354 | } |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 355 | |
| 356 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 357 | // Function/Method behavior summaries. |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 358 | //===----------------------------------------------------------------------===// |
| 359 | |
| 360 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 361 | class RetainSummary { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 362 | /// Args - a map of (index, ArgEffect) pairs, where index |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 363 | /// specifies the argument (starting from 0). This can be sparsely |
| 364 | /// populated; arguments with no entry in Args use 'DefaultArgEffect'. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 365 | ArgEffects Args; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 366 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 367 | /// DefaultArgEffect - The default ArgEffect to apply to arguments that |
| 368 | /// do not have an entry in Args. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 369 | ArgEffect DefaultArgEffect; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 370 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 371 | /// Receiver - If this summary applies to an Objective-C message expression, |
| 372 | /// this is the effect applied to the state of the receiver. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 373 | ArgEffect Receiver; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 374 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 375 | /// Ret - The effect on the return value. Used to indicate if the |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 376 | /// function/method call returns a new tracked symbol. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 377 | RetEffect Ret; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 378 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 379 | public: |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 380 | RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff, |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 381 | ArgEffect ReceiverEff) |
| 382 | : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 383 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 384 | /// getArg - Return the argument effect on the argument specified by |
| 385 | /// idx (starting from 0). |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 386 | ArgEffect getArg(unsigned idx) const { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 387 | if (const ArgEffect *AE = Args.lookup(idx)) |
| 388 | return *AE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 389 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 390 | return DefaultArgEffect; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 391 | } |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 392 | |
| 393 | void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) { |
| 394 | Args = af.add(Args, idx, e); |
| 395 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 396 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 397 | /// setDefaultArgEffect - Set the default argument effect. |
| 398 | void setDefaultArgEffect(ArgEffect E) { |
| 399 | DefaultArgEffect = E; |
| 400 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 401 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 402 | /// getRetEffect - Returns the effect on the return value of the call. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 403 | RetEffect getRetEffect() const { return Ret; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 404 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 405 | /// setRetEffect - Set the effect of the return value of the call. |
| 406 | void setRetEffect(RetEffect E) { Ret = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 407 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 408 | |
| 409 | /// Sets the effect on the receiver of the message. |
| 410 | void setReceiverEffect(ArgEffect e) { Receiver = e; } |
| 411 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 412 | /// getReceiverEffect - Returns the effect on the receiver of the call. |
| 413 | /// This is only meaningful if the summary applies to an ObjCMessageExpr*. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 414 | ArgEffect getReceiverEffect() const { return Receiver; } |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 415 | |
| 416 | /// Test if two retain summaries are identical. Note that merely equivalent |
| 417 | /// summaries are not necessarily identical (for example, if an explicit |
| 418 | /// argument effect matches the default effect). |
| 419 | bool operator==(const RetainSummary &Other) const { |
| 420 | return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect && |
| 421 | Receiver == Other.Receiver && Ret == Other.Ret; |
| 422 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 423 | |
| 424 | /// Profile this summary for inclusion in a FoldingSet. |
| 425 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 426 | ID.Add(Args); |
| 427 | ID.Add(DefaultArgEffect); |
| 428 | ID.Add(Receiver); |
| 429 | ID.Add(Ret); |
| 430 | } |
| 431 | |
| 432 | /// A retain summary is simple if it has no ArgEffects other than the default. |
| 433 | bool isSimple() const { |
| 434 | return Args.isEmpty(); |
| 435 | } |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 436 | |
| 437 | private: |
| 438 | ArgEffects getArgEffects() const { return Args; } |
| 439 | ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; } |
| 440 | |
| 441 | friend class RetainSummaryManager; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 442 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 443 | } // end anonymous namespace |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 444 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 445 | //===----------------------------------------------------------------------===// |
| 446 | // Data structures for constructing summaries. |
| 447 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 53301ba | 2008-06-24 03:49:48 +0000 | [diff] [blame] | 448 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 449 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 450 | class ObjCSummaryKey { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 451 | IdentifierInfo* II; |
| 452 | Selector S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 453 | public: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 454 | ObjCSummaryKey(IdentifierInfo* ii, Selector s) |
| 455 | : II(ii), S(s) {} |
| 456 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 457 | ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 458 | : II(d ? d->getIdentifier() : 0), S(s) {} |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 459 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 460 | ObjCSummaryKey(Selector s) |
| 461 | : II(0), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 462 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 463 | IdentifierInfo *getIdentifier() const { return II; } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 464 | Selector getSelector() const { return S; } |
| 465 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 466 | } |
| 467 | |
| 468 | namespace llvm { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 469 | template <> struct DenseMapInfo<ObjCSummaryKey> { |
| 470 | static inline ObjCSummaryKey getEmptyKey() { |
| 471 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(), |
| 472 | DenseMapInfo<Selector>::getEmptyKey()); |
| 473 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 474 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 475 | static inline ObjCSummaryKey getTombstoneKey() { |
| 476 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 477 | DenseMapInfo<Selector>::getTombstoneKey()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 478 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 479 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 480 | static unsigned getHashValue(const ObjCSummaryKey &V) { |
Benjamin Kramer | 28b2307 | 2012-05-27 13:28:44 +0000 | [diff] [blame] | 481 | typedef std::pair<IdentifierInfo*, Selector> PairTy; |
| 482 | return DenseMapInfo<PairTy>::getHashValue(PairTy(V.getIdentifier(), |
| 483 | V.getSelector())); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 484 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 485 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 486 | static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) { |
Benjamin Kramer | 28b2307 | 2012-05-27 13:28:44 +0000 | [diff] [blame] | 487 | return LHS.getIdentifier() == RHS.getIdentifier() && |
| 488 | LHS.getSelector() == RHS.getSelector(); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 489 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 490 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 491 | }; |
Chris Lattner | 06159e8 | 2009-12-15 07:26:51 +0000 | [diff] [blame] | 492 | template <> |
| 493 | struct isPodLike<ObjCSummaryKey> { static const bool value = true; }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 494 | } // end llvm namespace |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 495 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 496 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 497 | class ObjCSummaryCache { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 498 | typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 499 | MapTy M; |
| 500 | public: |
| 501 | ObjCSummaryCache() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 502 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 503 | const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 504 | // Do a lookup with the (D,S) pair. If we find a match return |
| 505 | // the iterator. |
| 506 | ObjCSummaryKey K(D, S); |
| 507 | MapTy::iterator I = M.find(K); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 508 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 509 | if (I != M.end()) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 510 | return I->second; |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 511 | if (!D) |
| 512 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 513 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 514 | // Walk the super chain. If we find a hit with a parent, we'll end |
| 515 | // up returning that summary. We actually allow that key (null,S), as |
| 516 | // we cache summaries for the null ObjCInterfaceDecl* to allow us to |
| 517 | // generate initial summaries without having to worry about NSObject |
| 518 | // being declared. |
| 519 | // FIXME: We may change this at some point. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 520 | for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 521 | if ((I = M.find(ObjCSummaryKey(C, S))) != M.end()) |
| 522 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 523 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 524 | if (!C) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 525 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 526 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 527 | |
| 528 | // Cache the summary with original key to make the next lookup faster |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 529 | // and return the iterator. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 530 | const RetainSummary *Summ = I->second; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 531 | M[K] = Summ; |
| 532 | return Summ; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 533 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 534 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 535 | const RetainSummary *find(IdentifierInfo* II, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 536 | // FIXME: Class method lookup. Right now we dont' have a good way |
| 537 | // of going between IdentifierInfo* and the class hierarchy. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 538 | MapTy::iterator I = M.find(ObjCSummaryKey(II, S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 539 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 540 | if (I == M.end()) |
| 541 | I = M.find(ObjCSummaryKey(S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 542 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 543 | return I == M.end() ? NULL : I->second; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 544 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 545 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 546 | const RetainSummary *& operator[](ObjCSummaryKey K) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 547 | return M[K]; |
| 548 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 549 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 550 | const RetainSummary *& operator[](Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 551 | return M[ ObjCSummaryKey(S) ]; |
| 552 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 553 | }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 554 | } // end anonymous namespace |
| 555 | |
| 556 | //===----------------------------------------------------------------------===// |
| 557 | // Data structures for managing collections of summaries. |
| 558 | //===----------------------------------------------------------------------===// |
| 559 | |
| 560 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 561 | class RetainSummaryManager { |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 562 | |
| 563 | //==-----------------------------------------------------------------==// |
| 564 | // Typedefs. |
| 565 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 566 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 567 | typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *> |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 568 | FuncSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 569 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 570 | typedef ObjCSummaryCache ObjCMethodSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 571 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 572 | typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode; |
| 573 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 574 | //==-----------------------------------------------------------------==// |
| 575 | // Data. |
| 576 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 577 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 578 | /// Ctx - The ASTContext object for the analyzed ASTs. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 579 | ASTContext &Ctx; |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 580 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 581 | /// GCEnabled - Records whether or not the analyzed code runs in GC mode. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 582 | const bool GCEnabled; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 583 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 584 | /// Records whether or not the analyzed code runs in ARC mode. |
| 585 | const bool ARCEnabled; |
| 586 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 587 | /// FuncSummaries - A map from FunctionDecls to summaries. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 588 | FuncSummariesTy FuncSummaries; |
| 589 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 590 | /// ObjCClassMethodSummaries - A map from selectors (for instance methods) |
| 591 | /// to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 592 | ObjCMethodSummariesTy ObjCClassMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 593 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 594 | /// ObjCMethodSummaries - A map from selectors to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 595 | ObjCMethodSummariesTy ObjCMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 596 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 597 | /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects, |
| 598 | /// and all other data used by the checker. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 599 | llvm::BumpPtrAllocator BPAlloc; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 600 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 601 | /// AF - A factory for ArgEffects objects. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 602 | ArgEffects::Factory AF; |
| 603 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 604 | /// ScratchArgs - A holding buffer for construct ArgEffects. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 605 | ArgEffects ScratchArgs; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 606 | |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 607 | /// ObjCAllocRetE - Default return effect for methods returning Objective-C |
| 608 | /// objects. |
| 609 | RetEffect ObjCAllocRetE; |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 610 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 611 | /// ObjCInitRetE - Default return effect for init methods returning |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 612 | /// Objective-C objects. |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 613 | RetEffect ObjCInitRetE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 614 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 615 | /// SimpleSummaries - Used for uniquing summaries that don't have special |
| 616 | /// effects. |
| 617 | llvm::FoldingSet<CachedSummaryNode> SimpleSummaries; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 618 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 619 | //==-----------------------------------------------------------------==// |
| 620 | // Methods. |
| 621 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 622 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 623 | /// getArgEffects - Returns a persistent ArgEffects object based on the |
| 624 | /// data in ScratchArgs. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 625 | ArgEffects getArgEffects(); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 626 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 627 | enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable }; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 628 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 629 | const RetainSummary *getUnarySummary(const FunctionType* FT, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 630 | UnaryFuncKind func); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 631 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 632 | const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD); |
| 633 | const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD); |
| 634 | const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 635 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 636 | const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 637 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 638 | const RetainSummary *getPersistentSummary(RetEffect RetEff, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 639 | ArgEffect ReceiverEff = DoNothing, |
| 640 | ArgEffect DefaultEff = MayEscape) { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 641 | RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff); |
| 642 | return getPersistentSummary(Summ); |
| 643 | } |
| 644 | |
Ted Kremenek | c91fdf6 | 2012-05-08 00:12:09 +0000 | [diff] [blame] | 645 | const RetainSummary *getDoNothingSummary() { |
| 646 | return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 647 | } |
| 648 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 649 | const RetainSummary *getDefaultSummary() { |
| 650 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 651 | DoNothing, MayEscape); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 652 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 653 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 654 | const RetainSummary *getPersistentStopSummary() { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 655 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 656 | StopTracking, StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 657 | } |
Ted Kremenek | b309525 | 2008-05-06 04:20:12 +0000 | [diff] [blame] | 658 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 659 | void InitializeClassMethodSummaries(); |
| 660 | void InitializeMethodSummaries(); |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 661 | private: |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 662 | void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 663 | ObjCClassMethodSummaries[S] = Summ; |
| 664 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 665 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 666 | void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 667 | ObjCMethodSummaries[S] = Summ; |
| 668 | } |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 669 | |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 670 | void addClassMethSummary(const char* Cls, const char* name, |
| 671 | const RetainSummary *Summ, bool isNullary = true) { |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 672 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 673 | Selector S = isNullary ? GetNullarySelector(name, Ctx) |
| 674 | : GetUnarySelector(name, Ctx); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 675 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 676 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 677 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 678 | void addInstMethSummary(const char* Cls, const char* nullaryName, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 679 | const RetainSummary *Summ) { |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 680 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 681 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 682 | ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 683 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 684 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 685 | Selector generateSelector(va_list argp) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 686 | SmallVector<IdentifierInfo*, 10> II; |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 687 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 688 | while (const char* s = va_arg(argp, const char*)) |
| 689 | II.push_back(&Ctx.Idents.get(s)); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 690 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 691 | return Ctx.Selectors.getSelector(II.size(), &II[0]); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 692 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 693 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 694 | void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 695 | const RetainSummary * Summ, va_list argp) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 696 | Selector S = generateSelector(argp); |
| 697 | Summaries[ObjCSummaryKey(ClsII, S)] = Summ; |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 698 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 699 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 700 | void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 701 | va_list argp; |
| 702 | va_start(argp, Summ); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 703 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 704 | va_end(argp); |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 705 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 706 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 707 | void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 708 | va_list argp; |
| 709 | va_start(argp, Summ); |
| 710 | addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp); |
| 711 | va_end(argp); |
| 712 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 713 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 714 | void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 715 | va_list argp; |
| 716 | va_start(argp, Summ); |
| 717 | addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp); |
| 718 | va_end(argp); |
| 719 | } |
| 720 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 721 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 722 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 723 | RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC) |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 724 | : Ctx(ctx), |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 725 | GCEnabled(gcenabled), |
| 726 | ARCEnabled(usesARC), |
| 727 | AF(BPAlloc), ScratchArgs(AF.getEmptyMap()), |
| 728 | ObjCAllocRetE(gcenabled |
| 729 | ? RetEffect::MakeGCNotOwned() |
| 730 | : (usesARC ? RetEffect::MakeARCNotOwned() |
| 731 | : RetEffect::MakeOwned(RetEffect::ObjC, true))), |
| 732 | ObjCInitRetE(gcenabled |
| 733 | ? RetEffect::MakeGCNotOwned() |
| 734 | : (usesARC ? RetEffect::MakeARCNotOwned() |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 735 | : RetEffect::MakeOwnedWhenTrackedReceiver())) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 736 | InitializeClassMethodSummaries(); |
| 737 | InitializeMethodSummaries(); |
| 738 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 739 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 740 | const RetainSummary *getSummary(const CallEvent &Call, |
| 741 | ProgramStateRef State = 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 742 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 743 | const RetainSummary *getFunctionSummary(const FunctionDecl *FD); |
| 744 | |
| 745 | const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID, |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 746 | const ObjCMethodDecl *MD, |
| 747 | QualType RetTy, |
| 748 | ObjCMethodSummariesTy &CachedSummaries); |
| 749 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 750 | const RetainSummary *getInstanceMethodSummary(const ObjCMessageInvocation &M, |
| 751 | ProgramStateRef State); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 752 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 753 | const RetainSummary *getClassMethodSummary(const ObjCMessageInvocation &M) { |
| 754 | assert(!M.isInstanceMessage()); |
| 755 | const ObjCInterfaceDecl *Class = M.getReceiverInterface(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 756 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 757 | return getMethodSummary(M.getSelector(), Class, M.getDecl(), |
| 758 | M.getResultType(), ObjCClassMethodSummaries); |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 759 | } |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 760 | |
| 761 | /// getMethodSummary - This version of getMethodSummary is used to query |
| 762 | /// the summary for the current method being analyzed. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 763 | const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) { |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 764 | const ObjCInterfaceDecl *ID = MD->getClassInterface(); |
Ted Kremenek | 70a6576 | 2009-04-30 05:41:14 +0000 | [diff] [blame] | 765 | Selector S = MD->getSelector(); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 766 | QualType ResultTy = MD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 767 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 768 | ObjCMethodSummariesTy *CachedSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 769 | if (MD->isInstanceMethod()) |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 770 | CachedSummaries = &ObjCMethodSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 771 | else |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 772 | CachedSummaries = &ObjCClassMethodSummaries; |
| 773 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 774 | return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 775 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 776 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 777 | const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD, |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 778 | Selector S, QualType RetTy); |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 779 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 780 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 781 | const ObjCMethodDecl *MD); |
| 782 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 783 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 784 | const FunctionDecl *FD); |
| 785 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 786 | void updateSummaryForCall(const RetainSummary *&Summ, |
| 787 | const CallEvent &Call); |
| 788 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 789 | bool isGCEnabled() const { return GCEnabled; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 790 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 791 | bool isARCEnabled() const { return ARCEnabled; } |
| 792 | |
| 793 | bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; } |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 794 | |
| 795 | RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; } |
| 796 | |
| 797 | friend class RetainSummaryTemplate; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 798 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 799 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 800 | // Used to avoid allocating long-term (BPAlloc'd) memory for default retain |
| 801 | // summaries. If a function or method looks like it has a default summary, but |
| 802 | // it has annotations, the annotations are added to the stack-based template |
| 803 | // and then copied into managed memory. |
| 804 | class RetainSummaryTemplate { |
| 805 | RetainSummaryManager &Manager; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 806 | const RetainSummary *&RealSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 807 | RetainSummary ScratchSummary; |
| 808 | bool Accessed; |
| 809 | public: |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 810 | RetainSummaryTemplate(const RetainSummary *&real, RetainSummaryManager &mgr) |
| 811 | : Manager(mgr), RealSummary(real), ScratchSummary(*real), Accessed(false) {} |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 812 | |
| 813 | ~RetainSummaryTemplate() { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 814 | if (Accessed) |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 815 | RealSummary = Manager.getPersistentSummary(ScratchSummary); |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 816 | } |
| 817 | |
| 818 | RetainSummary &operator*() { |
| 819 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 820 | return ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 821 | } |
| 822 | |
| 823 | RetainSummary *operator->() { |
| 824 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 825 | return &ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 826 | } |
| 827 | }; |
| 828 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 829 | } // end anonymous namespace |
| 830 | |
| 831 | //===----------------------------------------------------------------------===// |
| 832 | // Implementation of checker data structures. |
| 833 | //===----------------------------------------------------------------------===// |
| 834 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 835 | ArgEffects RetainSummaryManager::getArgEffects() { |
| 836 | ArgEffects AE = ScratchArgs; |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 837 | ScratchArgs = AF.getEmptyMap(); |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 838 | return AE; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 839 | } |
| 840 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 841 | const RetainSummary * |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 842 | RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) { |
| 843 | // Unique "simple" summaries -- those without ArgEffects. |
| 844 | if (OldSumm.isSimple()) { |
| 845 | llvm::FoldingSetNodeID ID; |
| 846 | OldSumm.Profile(ID); |
| 847 | |
| 848 | void *Pos; |
| 849 | CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos); |
| 850 | |
| 851 | if (!N) { |
| 852 | N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>(); |
| 853 | new (N) CachedSummaryNode(OldSumm); |
| 854 | SimpleSummaries.InsertNode(N, Pos); |
| 855 | } |
| 856 | |
| 857 | return &N->getValue(); |
| 858 | } |
| 859 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 860 | RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>(); |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 861 | new (Summ) RetainSummary(OldSumm); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 862 | return Summ; |
| 863 | } |
| 864 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 865 | //===----------------------------------------------------------------------===// |
| 866 | // Summary creation for functions (largely uses of Core Foundation). |
| 867 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 868 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 869 | static bool isRetain(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 870 | return FName.endswith("Retain"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 871 | } |
| 872 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 873 | static bool isRelease(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 874 | return FName.endswith("Release"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 875 | } |
| 876 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 877 | static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) { |
| 878 | // FIXME: Remove FunctionDecl parameter. |
| 879 | // FIXME: Is it really okay if MakeCollectable isn't a suffix? |
| 880 | return FName.find("MakeCollectable") != StringRef::npos; |
| 881 | } |
| 882 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 883 | static ArgEffect getStopTrackingEquivalent(ArgEffect E) { |
| 884 | switch (E) { |
| 885 | case DoNothing: |
| 886 | case Autorelease: |
| 887 | case DecRefBridgedTransfered: |
| 888 | case IncRef: |
| 889 | case IncRefMsg: |
| 890 | case MakeCollectable: |
| 891 | case MayEscape: |
| 892 | case NewAutoreleasePool: |
| 893 | case StopTracking: |
| 894 | return StopTracking; |
| 895 | case DecRef: |
| 896 | case DecRefAndStopTracking: |
| 897 | return DecRefAndStopTracking; |
| 898 | case DecRefMsg: |
| 899 | case DecRefMsgAndStopTracking: |
| 900 | return DecRefMsgAndStopTracking; |
| 901 | case Dealloc: |
| 902 | return Dealloc; |
| 903 | } |
| 904 | |
| 905 | llvm_unreachable("Unknown ArgEffect kind"); |
| 906 | } |
| 907 | |
| 908 | void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S, |
| 909 | const CallEvent &Call) { |
| 910 | if (Call.hasNonZeroCallbackArg()) { |
| 911 | ArgEffect RecEffect = getStopTrackingEquivalent(S->getReceiverEffect()); |
| 912 | ArgEffect DefEffect = getStopTrackingEquivalent(S->getDefaultArgEffect()); |
| 913 | |
| 914 | ArgEffects CustomArgEffects = S->getArgEffects(); |
| 915 | for (ArgEffects::iterator I = CustomArgEffects.begin(), |
| 916 | E = CustomArgEffects.end(); |
| 917 | I != E; ++I) { |
| 918 | ArgEffect Translated = getStopTrackingEquivalent(I->second); |
| 919 | if (Translated != DefEffect) |
| 920 | ScratchArgs = AF.add(ScratchArgs, I->first, Translated); |
| 921 | } |
| 922 | |
| 923 | RetEffect RE = RetEffect::MakeNoRet(); |
| 924 | |
| 925 | // Special cases where the callback argument CANNOT free the return value. |
| 926 | // This can generally only happen if we know that the callback will only be |
| 927 | // called when the return value is already being deallocated. |
| 928 | if (const FunctionCall *FC = dyn_cast<FunctionCall>(&Call)) { |
| 929 | IdentifierInfo *Name = FC->getDecl()->getIdentifier(); |
| 930 | |
| 931 | // This callback frees the associated buffer. |
| 932 | if (Name->isStr("CGBitmapContextCreateWithData")) |
| 933 | RE = S->getRetEffect(); |
| 934 | } |
| 935 | |
| 936 | S = getPersistentSummary(RE, RecEffect, DefEffect); |
| 937 | } |
| 938 | } |
| 939 | |
Anna Zaks | 58822c4 | 2012-05-04 22:18:39 +0000 | [diff] [blame] | 940 | const RetainSummary * |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 941 | RetainSummaryManager::getSummary(const CallEvent &Call, |
| 942 | ProgramStateRef State) { |
| 943 | const RetainSummary *Summ; |
| 944 | switch (Call.getKind()) { |
| 945 | case CE_Function: |
| 946 | Summ = getFunctionSummary(cast<FunctionCall>(Call).getDecl()); |
| 947 | break; |
| 948 | case CE_CXXMember: |
| 949 | case CE_Block: |
| 950 | case CE_CXXConstructor: |
| 951 | // FIXME: These calls are currently unsupported. |
| 952 | return getPersistentStopSummary(); |
| 953 | case CE_ObjCMessage: { |
| 954 | const ObjCMessageInvocation &Msg = cast<ObjCMessageInvocation>(Call); |
| 955 | if (Msg.isInstanceMessage()) |
| 956 | Summ = getInstanceMethodSummary(Msg, State); |
| 957 | else |
| 958 | Summ = getClassMethodSummary(Msg); |
| 959 | break; |
| 960 | } |
| 961 | } |
| 962 | |
| 963 | updateSummaryForCall(Summ, Call); |
| 964 | |
| 965 | assert(Summ && "Unknown call type?"); |
| 966 | return Summ; |
| 967 | } |
| 968 | |
| 969 | const RetainSummary * |
| 970 | RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) { |
| 971 | // If we don't know what function we're calling, use our default summary. |
| 972 | if (!FD) |
| 973 | return getDefaultSummary(); |
| 974 | |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 975 | // Look up a summary in our cache of FunctionDecls -> Summaries. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 976 | FuncSummariesTy::iterator I = FuncSummaries.find(FD); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 977 | if (I != FuncSummaries.end()) |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 978 | return I->second; |
| 979 | |
Ted Kremenek | e401a0c | 2009-05-04 15:34:07 +0000 | [diff] [blame] | 980 | // No summary? Generate one. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 981 | const RetainSummary *S = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 982 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 983 | do { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 984 | // We generate "stop" summaries for implicitly defined functions. |
| 985 | if (FD->isImplicit()) { |
| 986 | S = getPersistentStopSummary(); |
| 987 | break; |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 988 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 989 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 990 | // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the |
Ted Kremenek | 9989065 | 2009-01-16 18:40:33 +0000 | [diff] [blame] | 991 | // function's type. |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 992 | const FunctionType* FT = FD->getType()->getAs<FunctionType>(); |
Ted Kremenek | 48c6d18 | 2009-12-16 06:06:43 +0000 | [diff] [blame] | 993 | const IdentifierInfo *II = FD->getIdentifier(); |
| 994 | if (!II) |
| 995 | break; |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 996 | |
| 997 | StringRef FName = II->getName(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 998 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 999 | // Strip away preceding '_'. Doing this here will effect all the checks |
| 1000 | // down below. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1001 | FName = FName.substr(FName.find_first_not_of('_')); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1002 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1003 | // Inspect the result type. |
| 1004 | QualType RetTy = FT->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1005 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1006 | // FIXME: This should all be refactored into a chain of "summary lookup" |
| 1007 | // filters. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 1008 | assert(ScratchArgs.isEmpty()); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1009 | |
Ted Kremenek | befc6d2 | 2012-04-26 04:32:23 +0000 | [diff] [blame] | 1010 | if (FName == "pthread_create" || FName == "pthread_setspecific") { |
| 1011 | // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>. |
| 1012 | // This will be addressed better with IPA. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1013 | S = getPersistentStopSummary(); |
| 1014 | } else if (FName == "NSMakeCollectable") { |
| 1015 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 1016 | S = (RetTy->isObjCIdType()) |
| 1017 | ? getUnarySummary(FT, cfmakecollectable) |
| 1018 | : getPersistentStopSummary(); |
| 1019 | } else if (FName == "IOBSDNameMatching" || |
| 1020 | FName == "IOServiceMatching" || |
| 1021 | FName == "IOServiceNameMatching" || |
Ted Kremenek | 537dd3a | 2012-05-01 05:28:27 +0000 | [diff] [blame] | 1022 | FName == "IORegistryEntrySearchCFProperty" || |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1023 | FName == "IORegistryEntryIDMatching" || |
| 1024 | FName == "IOOpenFirmwarePathMatching") { |
| 1025 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1026 | // This should be addressed using a API table. |
| 1027 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1028 | DoNothing, DoNothing); |
| 1029 | } else if (FName == "IOServiceGetMatchingService" || |
| 1030 | FName == "IOServiceGetMatchingServices") { |
| 1031 | // FIXES: <rdar://problem/6326900> |
| 1032 | // This should be addressed using a API table. This strcmp is also |
| 1033 | // a little gross, but there is no need to super optimize here. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1034 | ScratchArgs = AF.add(ScratchArgs, 1, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1035 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 1036 | } else if (FName == "IOServiceAddNotification" || |
| 1037 | FName == "IOServiceAddMatchingNotification") { |
| 1038 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1039 | // This should be addressed using a API table. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1040 | ScratchArgs = AF.add(ScratchArgs, 2, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1041 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 1042 | } else if (FName == "CVPixelBufferCreateWithBytes") { |
| 1043 | // FIXES: <rdar://problem/7283567> |
| 1044 | // Eventually this can be improved by recognizing that the pixel |
| 1045 | // buffer passed to CVPixelBufferCreateWithBytes is released via |
| 1046 | // a callback and doing full IPA to make sure this is done correctly. |
| 1047 | // FIXME: This function has an out parameter that returns an |
| 1048 | // allocated object. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1049 | ScratchArgs = AF.add(ScratchArgs, 7, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1050 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 1051 | } else if (FName == "CGBitmapContextCreateWithData") { |
| 1052 | // FIXES: <rdar://problem/7358899> |
| 1053 | // Eventually this can be improved by recognizing that 'releaseInfo' |
| 1054 | // passed to CGBitmapContextCreateWithData is released via |
| 1055 | // a callback and doing full IPA to make sure this is done correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1056 | ScratchArgs = AF.add(ScratchArgs, 8, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1057 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1058 | DoNothing, DoNothing); |
| 1059 | } else if (FName == "CVPixelBufferCreateWithPlanarBytes") { |
| 1060 | // FIXES: <rdar://problem/7283567> |
| 1061 | // Eventually this can be improved by recognizing that the pixel |
| 1062 | // buffer passed to CVPixelBufferCreateWithPlanarBytes is released |
| 1063 | // via a callback and doing full IPA to make sure this is done |
| 1064 | // correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1065 | ScratchArgs = AF.add(ScratchArgs, 12, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1066 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 06911d4 | 2012-03-22 06:29:41 +0000 | [diff] [blame] | 1067 | } else if (FName == "dispatch_set_context") { |
| 1068 | // <rdar://problem/11059275> - The analyzer currently doesn't have |
| 1069 | // a good way to reason about the finalizer function for libdispatch. |
| 1070 | // If we pass a context object that is memory managed, stop tracking it. |
| 1071 | // FIXME: this hack should possibly go away once we can handle |
| 1072 | // libdispatch finalizers. |
| 1073 | ScratchArgs = AF.add(ScratchArgs, 1, StopTracking); |
| 1074 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | c91fdf6 | 2012-05-08 00:12:09 +0000 | [diff] [blame] | 1075 | } else if (FName.startswith("NSLog")) { |
| 1076 | S = getDoNothingSummary(); |
Anna Zaks | 62a5c34 | 2012-03-30 05:48:16 +0000 | [diff] [blame] | 1077 | } else if (FName.startswith("NS") && |
| 1078 | (FName.find("Insert") != StringRef::npos)) { |
| 1079 | // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can |
| 1080 | // be deallocated by NSMapRemove. (radar://11152419) |
| 1081 | ScratchArgs = AF.add(ScratchArgs, 1, StopTracking); |
| 1082 | ScratchArgs = AF.add(ScratchArgs, 2, StopTracking); |
| 1083 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1084 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1085 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1086 | // Did we get a summary? |
| 1087 | if (S) |
| 1088 | break; |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1089 | |
| 1090 | // Enable this code once the semantics of NSDeallocateObject are resolved |
| 1091 | // for GC. <rdar://problem/6619988> |
| 1092 | #if 0 |
| 1093 | // Handle: NSDeallocateObject(id anObject); |
| 1094 | // This method does allow 'nil' (although we don't check it now). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1095 | if (strcmp(FName, "NSDeallocateObject") == 0) { |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1096 | return RetTy == Ctx.VoidTy |
| 1097 | ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc) |
| 1098 | : getPersistentStopSummary(); |
| 1099 | } |
| 1100 | #endif |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1101 | |
| 1102 | if (RetTy->isPointerType()) { |
| 1103 | // For CoreFoundation ('CF') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1104 | if (cocoa::isRefType(RetTy, "CF", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1105 | if (isRetain(FD, FName)) |
| 1106 | S = getUnarySummary(FT, cfretain); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1107 | else if (isMakeCollectable(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1108 | S = getUnarySummary(FT, cfmakecollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1109 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1110 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1111 | |
| 1112 | break; |
| 1113 | } |
| 1114 | |
| 1115 | // For CoreGraphics ('CG') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1116 | if (cocoa::isRefType(RetTy, "CG", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1117 | if (isRetain(FD, FName)) |
| 1118 | S = getUnarySummary(FT, cfretain); |
| 1119 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1120 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1121 | |
| 1122 | break; |
| 1123 | } |
| 1124 | |
| 1125 | // For the Disk Arbitration API (DiskArbitration/DADisk.h) |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1126 | if (cocoa::isRefType(RetTy, "DADisk") || |
| 1127 | cocoa::isRefType(RetTy, "DADissenter") || |
| 1128 | cocoa::isRefType(RetTy, "DASessionRef")) { |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1129 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1130 | break; |
| 1131 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1132 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1133 | break; |
| 1134 | } |
| 1135 | |
| 1136 | // Check for release functions, the only kind of functions that we care |
| 1137 | // about that don't return a pointer type. |
| 1138 | if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) { |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1139 | // Test for 'CGCF'. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1140 | FName = FName.substr(FName.startswith("CGCF") ? 4 : 2); |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1141 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1142 | if (isRelease(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1143 | S = getUnarySummary(FT, cfrelease); |
| 1144 | else { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1145 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1146 | // Remaining CoreFoundation and CoreGraphics functions. |
| 1147 | // We use to assume that they all strictly followed the ownership idiom |
| 1148 | // and that ownership cannot be transferred. While this is technically |
| 1149 | // correct, many methods allow a tracked object to escape. For example: |
| 1150 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1151 | // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1152 | // CFDictionaryAddValue(y, key, x); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1153 | // CFRelease(x); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1154 | // ... it is okay to use 'x' since 'y' has a reference to it |
| 1155 | // |
| 1156 | // We handle this and similar cases with the follow heuristic. If the |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1157 | // function name contains "InsertValue", "SetValue", "AddValue", |
| 1158 | // "AppendValue", or "SetAttribute", then we assume that arguments may |
| 1159 | // "escape." This means that something else holds on to the object, |
| 1160 | // allowing it be used even after its local retain count drops to 0. |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1161 | ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos|| |
| 1162 | StrInStrNoCase(FName, "AddValue") != StringRef::npos || |
| 1163 | StrInStrNoCase(FName, "SetValue") != StringRef::npos || |
| 1164 | StrInStrNoCase(FName, "AppendValue") != StringRef::npos|| |
Benjamin Kramer | c027e54 | 2010-01-11 20:15:06 +0000 | [diff] [blame] | 1165 | StrInStrNoCase(FName, "SetAttribute") != StringRef::npos) |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1166 | ? MayEscape : DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1167 | |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1168 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1169 | } |
| 1170 | } |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1171 | } |
| 1172 | while (0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1173 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1174 | // If we got all the way here without any luck, use a default summary. |
| 1175 | if (!S) |
| 1176 | S = getDefaultSummary(); |
| 1177 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1178 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1179 | updateSummaryFromAnnotations(S, FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1180 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1181 | FuncSummaries[FD] = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1182 | return S; |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 1183 | } |
| 1184 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1185 | const RetainSummary * |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1186 | RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) { |
| 1187 | if (coreFoundation::followsCreateRule(FD)) |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1188 | return getCFSummaryCreateRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1189 | |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 1190 | return getCFSummaryGetRule(FD); |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1191 | } |
| 1192 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1193 | const RetainSummary * |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 1194 | RetainSummaryManager::getUnarySummary(const FunctionType* FT, |
| 1195 | UnaryFuncKind func) { |
| 1196 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1197 | // Sanity check that this is *really* a unary function. This can |
| 1198 | // happen if people do weird things. |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1199 | const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1200 | if (!FTP || FTP->getNumArgs() != 1) |
| 1201 | return getPersistentStopSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1202 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1203 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1204 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1205 | ArgEffect Effect; |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1206 | switch (func) { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1207 | case cfretain: Effect = IncRef; break; |
| 1208 | case cfrelease: Effect = DecRef; break; |
| 1209 | case cfmakecollectable: Effect = MakeCollectable; break; |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 1210 | } |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1211 | |
| 1212 | ScratchArgs = AF.add(ScratchArgs, 0, Effect); |
| 1213 | return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1214 | } |
| 1215 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1216 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1217 | RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1218 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1219 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1220 | return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1221 | } |
| 1222 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1223 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1224 | RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1225 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1226 | return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF), |
| 1227 | DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1228 | } |
| 1229 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1230 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1231 | // Summary creation for Selectors. |
| 1232 | //===----------------------------------------------------------------------===// |
| 1233 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1234 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1235 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1236 | const FunctionDecl *FD) { |
| 1237 | if (!FD) |
| 1238 | return; |
| 1239 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1240 | assert(Summ && "Must have a summary to add annotations to."); |
| 1241 | RetainSummaryTemplate Template(Summ, *this); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1242 | |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1243 | // Effects on the parameters. |
| 1244 | unsigned parm_idx = 0; |
| 1245 | for (FunctionDecl::param_const_iterator pi = FD->param_begin(), |
John McCall | 98b8f16 | 2011-04-06 09:02:12 +0000 | [diff] [blame] | 1246 | pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1247 | const ParmVarDecl *pd = *pi; |
| 1248 | if (pd->getAttr<NSConsumedAttr>()) { |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1249 | if (!GCEnabled) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1250 | Template->addArg(AF, parm_idx, DecRef); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1251 | } |
| 1252 | } else if (pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1253 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1254 | } |
| 1255 | } |
| 1256 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1257 | QualType RetTy = FD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1258 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1259 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1260 | if (cocoa::isCocoaObjectRef(RetTy)) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1261 | if (FD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1262 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1263 | } |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1264 | else if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1265 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1266 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1267 | else if (FD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1268 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1269 | } |
| 1270 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1271 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1272 | } |
| 1273 | } else if (RetTy->getAs<PointerType>()) { |
| 1274 | if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1275 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1276 | } |
| 1277 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1278 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1279 | } |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1280 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1281 | } |
| 1282 | |
| 1283 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1284 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
| 1285 | const ObjCMethodDecl *MD) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1286 | if (!MD) |
| 1287 | return; |
| 1288 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1289 | assert(Summ && "Must have a valid summary to add annotations to"); |
| 1290 | RetainSummaryTemplate Template(Summ, *this); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1291 | bool isTrackedLoc = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1292 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1293 | // Effects on the receiver. |
| 1294 | if (MD->getAttr<NSConsumesSelfAttr>()) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1295 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1296 | Template->setReceiverEffect(DecRefMsg); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1297 | } |
| 1298 | |
| 1299 | // Effects on the parameters. |
| 1300 | unsigned parm_idx = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1301 | for (ObjCMethodDecl::param_const_iterator |
| 1302 | pi=MD->param_begin(), pe=MD->param_end(); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1303 | pi != pe; ++pi, ++parm_idx) { |
| 1304 | const ParmVarDecl *pd = *pi; |
| 1305 | if (pd->getAttr<NSConsumedAttr>()) { |
| 1306 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1307 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1308 | } |
| 1309 | else if(pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1310 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1311 | } |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1312 | } |
| 1313 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1314 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1315 | if (cocoa::isCocoaObjectRef(MD->getResultType())) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1316 | if (MD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1317 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1318 | return; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1319 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1320 | if (MD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1321 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1322 | return; |
| 1323 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1324 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1325 | isTrackedLoc = true; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1326 | } else { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1327 | isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1328 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1329 | |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1330 | if (isTrackedLoc) { |
| 1331 | if (MD->getAttr<CFReturnsRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1332 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1333 | else if (MD->getAttr<CFReturnsNotRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1334 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1335 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1336 | } |
| 1337 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1338 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1339 | RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD, |
| 1340 | Selector S, QualType RetTy) { |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1341 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1342 | if (MD) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1343 | // Scan the method decl for 'void*' arguments. These should be treated |
| 1344 | // as 'StopTracking' because they are often used with delegates. |
| 1345 | // Delegates are a frequent form of false positives with the retain |
| 1346 | // count checker. |
| 1347 | unsigned i = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1348 | for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(), |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1349 | E = MD->param_end(); I != E; ++I, ++i) |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1350 | if (const ParmVarDecl *PD = *I) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1351 | QualType Ty = Ctx.getCanonicalType(PD->getType()); |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 1352 | if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy) |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1353 | ScratchArgs = AF.add(ScratchArgs, i, StopTracking); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1354 | } |
| 1355 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1356 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1357 | // Any special effects? |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1358 | ArgEffect ReceiverEff = DoNothing; |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1359 | RetEffect ResultEff = RetEffect::MakeNoRet(); |
| 1360 | |
| 1361 | // Check the method family, and apply any default annotations. |
| 1362 | switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) { |
| 1363 | case OMF_None: |
| 1364 | case OMF_performSelector: |
| 1365 | // Assume all Objective-C methods follow Cocoa Memory Management rules. |
| 1366 | // FIXME: Does the non-threaded performSelector family really belong here? |
| 1367 | // The selector could be, say, @selector(copy). |
| 1368 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1369 | ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 1370 | else if (coreFoundation::isCFObjectRef(RetTy)) { |
| 1371 | // ObjCMethodDecl currently doesn't consider CF objects as valid return |
| 1372 | // values for alloc, new, copy, or mutableCopy, so we have to |
| 1373 | // double-check with the selector. This is ugly, but there aren't that |
| 1374 | // many Objective-C methods that return CF objects, right? |
| 1375 | if (MD) { |
| 1376 | switch (S.getMethodFamily()) { |
| 1377 | case OMF_alloc: |
| 1378 | case OMF_new: |
| 1379 | case OMF_copy: |
| 1380 | case OMF_mutableCopy: |
| 1381 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1382 | break; |
| 1383 | default: |
| 1384 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1385 | break; |
| 1386 | } |
| 1387 | } else { |
| 1388 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1389 | } |
| 1390 | } |
| 1391 | break; |
| 1392 | case OMF_init: |
| 1393 | ResultEff = ObjCInitRetE; |
| 1394 | ReceiverEff = DecRefMsg; |
| 1395 | break; |
| 1396 | case OMF_alloc: |
| 1397 | case OMF_new: |
| 1398 | case OMF_copy: |
| 1399 | case OMF_mutableCopy: |
| 1400 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1401 | ResultEff = ObjCAllocRetE; |
| 1402 | else if (coreFoundation::isCFObjectRef(RetTy)) |
| 1403 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1404 | break; |
| 1405 | case OMF_autorelease: |
| 1406 | ReceiverEff = Autorelease; |
| 1407 | break; |
| 1408 | case OMF_retain: |
| 1409 | ReceiverEff = IncRefMsg; |
| 1410 | break; |
| 1411 | case OMF_release: |
| 1412 | ReceiverEff = DecRefMsg; |
| 1413 | break; |
| 1414 | case OMF_dealloc: |
| 1415 | ReceiverEff = Dealloc; |
| 1416 | break; |
| 1417 | case OMF_self: |
| 1418 | // -self is handled specially by the ExprEngine to propagate the receiver. |
| 1419 | break; |
| 1420 | case OMF_retainCount: |
| 1421 | case OMF_finalize: |
| 1422 | // These methods don't return objects. |
| 1423 | break; |
| 1424 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1425 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1426 | // If one of the arguments in the selector has the keyword 'delegate' we |
| 1427 | // should stop tracking the reference count for the receiver. This is |
| 1428 | // because the reference count is quite possibly handled by a delegate |
| 1429 | // method. |
| 1430 | if (S.isKeywordSelector()) { |
Jordan Rose | 50571a9 | 2012-06-15 18:19:52 +0000 | [diff] [blame] | 1431 | for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) { |
| 1432 | StringRef Slot = S.getNameForSlot(i); |
| 1433 | if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) { |
| 1434 | if (ResultEff == ObjCInitRetE) |
| 1435 | ResultEff = RetEffect::MakeNoRet(); |
| 1436 | else |
| 1437 | ReceiverEff = StopTracking; |
| 1438 | } |
| 1439 | } |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1440 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1441 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1442 | if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing && |
| 1443 | ResultEff.getKind() == RetEffect::NoRet) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1444 | return getDefaultSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1445 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1446 | return getPersistentSummary(ResultEff, ReceiverEff, MayEscape); |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1447 | } |
| 1448 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1449 | const RetainSummary * |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1450 | RetainSummaryManager::getInstanceMethodSummary(const ObjCMessageInvocation &Msg, |
| 1451 | ProgramStateRef State) { |
| 1452 | const ObjCInterfaceDecl *ReceiverClass = 0; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1453 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1454 | // We do better tracking of the type of the object than the core ExprEngine. |
| 1455 | // See if we have its type in our private state. |
| 1456 | // FIXME: Eventually replace the use of state->get<RefBindings> with |
| 1457 | // a generic API for reasoning about the Objective-C types of symbolic |
| 1458 | // objects. |
| 1459 | SVal ReceiverV = Msg.getReceiverSVal(); |
| 1460 | if (SymbolRef Sym = ReceiverV.getAsLocSymbol()) |
| 1461 | if (const RefVal *T = State->get<RefBindings>(Sym)) |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1462 | if (const ObjCObjectPointerType *PT = |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1463 | T->getType()->getAs<ObjCObjectPointerType>()) |
| 1464 | ReceiverClass = PT->getInterfaceDecl(); |
| 1465 | |
| 1466 | // If we don't know what kind of object this is, fall back to its static type. |
| 1467 | if (!ReceiverClass) |
| 1468 | ReceiverClass = Msg.getReceiverInterface(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1469 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1470 | // FIXME: The receiver could be a reference to a class, meaning that |
| 1471 | // we should use the class method. |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1472 | // id x = [NSObject class]; |
| 1473 | // [x performSelector:... withObject:... afterDelay:...]; |
| 1474 | Selector S = Msg.getSelector(); |
| 1475 | const ObjCMethodDecl *Method = Msg.getDecl(); |
| 1476 | if (!Method && ReceiverClass) |
| 1477 | Method = ReceiverClass->getInstanceMethod(S); |
| 1478 | |
| 1479 | return getMethodSummary(S, ReceiverClass, Method, Msg.getResultType(), |
| 1480 | ObjCMethodSummaries); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1481 | } |
| 1482 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1483 | const RetainSummary * |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1484 | RetainSummaryManager::getMethodSummary(Selector S, const ObjCInterfaceDecl *ID, |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1485 | const ObjCMethodDecl *MD, QualType RetTy, |
| 1486 | ObjCMethodSummariesTy &CachedSummaries) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1487 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1488 | // Look up a summary in our summary cache. |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1489 | const RetainSummary *Summ = CachedSummaries.find(ID, S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1490 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1491 | if (!Summ) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1492 | Summ = getStandardMethodSummary(MD, S, RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1493 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1494 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1495 | updateSummaryFromAnnotations(Summ, MD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1496 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1497 | // Memoize the summary. |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 1498 | CachedSummaries[ObjCSummaryKey(ID, S)] = Summ; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1499 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1500 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1501 | return Summ; |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1502 | } |
| 1503 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1504 | void RetainSummaryManager::InitializeClassMethodSummaries() { |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1505 | assert(ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1506 | // Create the [NSAssertionHandler currentHander] summary. |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1507 | addClassMethSummary("NSAssertionHandler", "currentHandler", |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1508 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1509 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1510 | // Create the [NSAutoreleasePool addObject:] summary. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1511 | ScratchArgs = AF.add(ScratchArgs, 0, Autorelease); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1512 | addClassMethSummary("NSAutoreleasePool", "addObject", |
| 1513 | getPersistentSummary(RetEffect::MakeNoRet(), |
| 1514 | DoNothing, Autorelease)); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 1515 | } |
| 1516 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 1517 | void RetainSummaryManager::InitializeMethodSummaries() { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1518 | |
| 1519 | assert (ScratchArgs.isEmpty()); |
| 1520 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1521 | // Create the "init" selector. It just acts as a pass-through for the |
| 1522 | // receiver. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1523 | const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 1524 | addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm); |
| 1525 | |
| 1526 | // awakeAfterUsingCoder: behaves basically like an 'init' method. It |
| 1527 | // claims the receiver and returns a retained object. |
| 1528 | addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx), |
| 1529 | InitSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1530 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1531 | // The next methods are allocators. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1532 | const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE); |
| 1533 | const RetainSummary *CFAllocSumm = |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1534 | getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1535 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1536 | // Create the "retain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1537 | RetEffect NoRet = RetEffect::MakeNoRet(); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1538 | const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1539 | addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1540 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1541 | // Create the "release" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1542 | Summ = getPersistentSummary(NoRet, DecRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1543 | addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1544 | |
Ted Kremenek | 299e815 | 2008-05-07 21:17:39 +0000 | [diff] [blame] | 1545 | // Create the "drain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1546 | Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1547 | addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1548 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1549 | // Create the -dealloc summary. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1550 | Summ = getPersistentSummary(NoRet, Dealloc); |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1551 | addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1552 | |
| 1553 | // Create the "autorelease" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1554 | Summ = getPersistentSummary(NoRet, Autorelease); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1555 | addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1556 | |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1557 | // Specially handle NSAutoreleasePool. |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1558 | addInstMethSummary("NSAutoreleasePool", "init", |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1559 | getPersistentSummary(NoRet, NewAutoreleasePool)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1560 | |
| 1561 | // For NSWindow, allocated objects are (initially) self-owned. |
Ted Kremenek | 89e202d | 2009-02-23 02:51:29 +0000 | [diff] [blame] | 1562 | // FIXME: For now we opt for false negatives with NSWindow, as these objects |
| 1563 | // self-own themselves. However, they only do this once they are displayed. |
| 1564 | // Thus, we need to track an NSWindow's display status. |
| 1565 | // This is tracked in <rdar://problem/6062711>. |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1566 | // See also http://llvm.org/bugs/show_bug.cgi?id=3714. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1567 | const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(), |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1568 | StopTracking, |
| 1569 | StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1570 | |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1571 | addClassMethSummary("NSWindow", "alloc", NoTrackYet); |
| 1572 | |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1573 | #if 0 |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1574 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1575 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1576 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1577 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1578 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1579 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1580 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1581 | // For NSPanel (which subclasses NSWindow), allocated objects are not |
| 1582 | // self-owned. |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1583 | // FIXME: For now we don't track NSPanels. object for the same reason |
| 1584 | // as for NSWindow objects. |
| 1585 | addClassMethSummary("NSPanel", "alloc", NoTrackYet); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1586 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1587 | #if 0 |
| 1588 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1589 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1590 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1591 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1592 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1593 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1594 | |
Ted Kremenek | ba67f6a | 2009-05-18 23:14:34 +0000 | [diff] [blame] | 1595 | // Don't track allocated autorelease pools yet, as it is okay to prematurely |
| 1596 | // exit a method. |
| 1597 | addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 1598 | addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1599 | |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1600 | // Create summaries QCRenderer/QCView -createSnapShotImageOfType: |
| 1601 | addInstMethSummary("QCRenderer", AllocSumm, |
| 1602 | "createSnapshotImageOfType", NULL); |
| 1603 | addInstMethSummary("QCView", AllocSumm, |
| 1604 | "createSnapshotImageOfType", NULL); |
| 1605 | |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1606 | // Create summaries for CIContext, 'createCGImage' and |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1607 | // 'createCGLayerWithSize'. These objects are CF objects, and are not |
| 1608 | // automatically garbage collected. |
| 1609 | addInstMethSummary("CIContext", CFAllocSumm, |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1610 | "createCGImage", "fromRect", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1611 | addInstMethSummary("CIContext", CFAllocSumm, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1612 | "createCGImage", "fromRect", "format", "colorSpace", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1613 | addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1614 | "info", NULL); |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1615 | } |
| 1616 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1617 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1618 | // AutoreleaseBindings - State used to track objects in autorelease pools. |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1619 | //===----------------------------------------------------------------------===// |
| 1620 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1621 | typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts; |
| 1622 | typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents; |
| 1623 | typedef llvm::ImmutableList<SymbolRef> ARStack; |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1624 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1625 | static int AutoRCIndex = 0; |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1626 | static int AutoRBIndex = 0; |
| 1627 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1628 | namespace { class AutoreleasePoolContents {}; } |
| 1629 | namespace { class AutoreleaseStack {}; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1630 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1631 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 1632 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1633 | template<> struct ProgramStateTrait<AutoreleaseStack> |
| 1634 | : public ProgramStatePartialTrait<ARStack> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1635 | static inline void *GDMIndex() { return &AutoRBIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1636 | }; |
| 1637 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1638 | template<> struct ProgramStateTrait<AutoreleasePoolContents> |
| 1639 | : public ProgramStatePartialTrait<ARPoolContents> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1640 | static inline void *GDMIndex() { return &AutoRCIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1641 | }; |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 1642 | } // end GR namespace |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1643 | } // end clang namespace |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1644 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1645 | static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1646 | ARStack stack = state->get<AutoreleaseStack>(); |
| 1647 | return stack.isEmpty() ? SymbolRef() : stack.getHead(); |
| 1648 | } |
| 1649 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1650 | static ProgramStateRef |
| 1651 | SendAutorelease(ProgramStateRef state, |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1652 | ARCounts::Factory &F, |
| 1653 | SymbolRef sym) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1654 | SymbolRef pool = GetCurrentAutoreleasePool(state); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1655 | const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1656 | ARCounts newCnts(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1657 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1658 | if (cnts) { |
| 1659 | const unsigned *cnt = (*cnts).lookup(sym); |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1660 | newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1661 | } |
| 1662 | else |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1663 | newCnts = F.add(F.getEmptyMap(), sym, 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1664 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1665 | return state->set<AutoreleasePoolContents>(pool, newCnts); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1666 | } |
| 1667 | |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 1668 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1669 | // Error reporting. |
| 1670 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1671 | namespace { |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1672 | typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *> |
| 1673 | SummaryLogTy; |
| 1674 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1675 | //===-------------===// |
| 1676 | // Bug Descriptions. // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1677 | //===-------------===// |
| 1678 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1679 | class CFRefBug : public BugType { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1680 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1681 | CFRefBug(StringRef name) |
Ted Kremenek | 6fd4505 | 2012-04-05 20:43:28 +0000 | [diff] [blame] | 1682 | : BugType(name, categories::MemoryCoreFoundationObjectiveC) {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1683 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1684 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1685 | // FIXME: Eventually remove. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1686 | virtual const char *getDescription() const = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1687 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1688 | virtual bool isLeak() const { return false; } |
| 1689 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1690 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1691 | class UseAfterRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1692 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1693 | UseAfterRelease() : CFRefBug("Use-after-release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1694 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1695 | const char *getDescription() const { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1696 | return "Reference-counted object is used after it is released"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1697 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1698 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1699 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1700 | class BadRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1701 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1702 | BadRelease() : CFRefBug("Bad release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1703 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1704 | const char *getDescription() const { |
Ted Kremenek | bb206fd | 2009-10-01 17:31:50 +0000 | [diff] [blame] | 1705 | return "Incorrect decrement of the reference count of an object that is " |
| 1706 | "not owned at this point by the caller"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1707 | } |
| 1708 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1709 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1710 | class DeallocGC : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1711 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1712 | DeallocGC() |
| 1713 | : CFRefBug("-dealloc called while using garbage collection") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1714 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1715 | const char *getDescription() const { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1716 | return "-dealloc called while using garbage collection"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1717 | } |
| 1718 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1719 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1720 | class DeallocNotOwned : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1721 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1722 | DeallocNotOwned() |
| 1723 | : CFRefBug("-dealloc sent to non-exclusively owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1724 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1725 | const char *getDescription() const { |
| 1726 | return "-dealloc sent to object that may be referenced elsewhere"; |
| 1727 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1728 | }; |
| 1729 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1730 | class OverAutorelease : public CFRefBug { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1731 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1732 | OverAutorelease() |
| 1733 | : CFRefBug("Object sent -autorelease too many times") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1734 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1735 | const char *getDescription() const { |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1736 | return "Object sent -autorelease too many times"; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1737 | } |
| 1738 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1739 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1740 | class ReturnedNotOwnedForOwned : public CFRefBug { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1741 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1742 | ReturnedNotOwnedForOwned() |
| 1743 | : CFRefBug("Method should return an owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1744 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1745 | const char *getDescription() const { |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 1746 | return "Object with a +0 retain count returned to caller where a +1 " |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1747 | "(owning) retain count is expected"; |
| 1748 | } |
| 1749 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1750 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1751 | class Leak : public CFRefBug { |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 1752 | public: |
| 1753 | Leak(StringRef name) |
| 1754 | : CFRefBug(name) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 1755 | // Leaks should not be reported if they are post-dominated by a sink. |
| 1756 | setSuppressOnSink(true); |
| 1757 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1758 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1759 | const char *getDescription() const { return ""; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1760 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1761 | bool isLeak() const { return true; } |
| 1762 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1763 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1764 | //===---------===// |
| 1765 | // Bug Reports. // |
| 1766 | //===---------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1767 | |
Jordy Rose | 0115349 | 2012-03-24 02:45:35 +0000 | [diff] [blame] | 1768 | class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1769 | protected: |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1770 | SymbolRef Sym; |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1771 | const SummaryLogTy &SummaryLog; |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1772 | bool GCEnabled; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1773 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1774 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1775 | CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log) |
| 1776 | : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {} |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1777 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1778 | virtual void Profile(llvm::FoldingSetNodeID &ID) const { |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1779 | static int x = 0; |
| 1780 | ID.AddPointer(&x); |
| 1781 | ID.AddPointer(Sym); |
| 1782 | } |
| 1783 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1784 | virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 1785 | const ExplodedNode *PrevN, |
| 1786 | BugReporterContext &BRC, |
| 1787 | BugReport &BR); |
| 1788 | |
| 1789 | virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1790 | const ExplodedNode *N, |
| 1791 | BugReport &BR); |
| 1792 | }; |
| 1793 | |
| 1794 | class CFRefLeakReportVisitor : public CFRefReportVisitor { |
| 1795 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1796 | CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled, |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1797 | const SummaryLogTy &log) |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1798 | : CFRefReportVisitor(sym, GCEnabled, log) {} |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1799 | |
| 1800 | PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1801 | const ExplodedNode *N, |
| 1802 | BugReport &BR); |
Jordy Rose | 0115349 | 2012-03-24 02:45:35 +0000 | [diff] [blame] | 1803 | |
| 1804 | virtual BugReporterVisitor *clone() const { |
| 1805 | // The curiously-recurring template pattern only works for one level of |
| 1806 | // subclassing. Rather than make a new template base for |
| 1807 | // CFRefReportVisitor, we simply override clone() to do the right thing. |
| 1808 | // This could be trouble someday if BugReporterVisitorImpl is ever |
| 1809 | // used for something else besides a convenient implementation of clone(). |
| 1810 | return new CFRefLeakReportVisitor(*this); |
| 1811 | } |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1812 | }; |
| 1813 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1814 | class CFRefReport : public BugReport { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1815 | void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1816 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1817 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1818 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1819 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1820 | bool registerVisitor = true) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1821 | : BugReport(D, D.getDescription(), n) { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1822 | if (registerVisitor) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1823 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1824 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1825 | } |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1826 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1827 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1828 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1829 | StringRef endText) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1830 | : BugReport(D, D.getDescription(), endText, n) { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1831 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1832 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1833 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1834 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1835 | virtual std::pair<ranges_iterator, ranges_iterator> getRanges() { |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1836 | const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType()); |
| 1837 | if (!BugTy.isLeak()) |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1838 | return BugReport::getRanges(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1839 | else |
Argyrios Kyrtzidis | 640ccf0 | 2010-12-04 01:12:15 +0000 | [diff] [blame] | 1840 | return std::make_pair(ranges_iterator(), ranges_iterator()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1841 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1842 | }; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1843 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1844 | class CFRefLeakReport : public CFRefReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1845 | const MemRegion* AllocBinding; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1846 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1847 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1848 | CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1849 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 1850 | CheckerContext &Ctx); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1851 | |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 1852 | PathDiagnosticLocation getLocation(const SourceManager &SM) const { |
| 1853 | assert(Location.isValid()); |
| 1854 | return Location; |
| 1855 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1856 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1857 | } // end anonymous namespace |
| 1858 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1859 | void CFRefReport::addGCModeDescription(const LangOptions &LOpts, |
| 1860 | bool GCEnabled) { |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1861 | const char *GCModeDescription = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1862 | |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 1863 | switch (LOpts.getGC()) { |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1864 | case LangOptions::GCOnly: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1865 | assert(GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1866 | GCModeDescription = "Code is compiled to only use garbage collection"; |
| 1867 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1868 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1869 | case LangOptions::NonGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1870 | assert(!GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1871 | GCModeDescription = "Code is compiled to use reference counts"; |
| 1872 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1873 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1874 | case LangOptions::HybridGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1875 | if (GCEnabled) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1876 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1877 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1878 | "with GC enabled"; |
| 1879 | break; |
| 1880 | } else { |
| 1881 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1882 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1883 | "in non-GC mode"; |
| 1884 | break; |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1885 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1886 | } |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1887 | |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1888 | assert(GCModeDescription && "invalid/unknown GC mode"); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1889 | addExtraText(GCModeDescription); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1890 | } |
| 1891 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1892 | // FIXME: This should be a method on SmallVector. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1893 | static inline bool contains(const SmallVectorImpl<ArgEffect>& V, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1894 | ArgEffect X) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1895 | for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1896 | I!=E; ++I) |
| 1897 | if (*I == X) return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1898 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1899 | return false; |
| 1900 | } |
| 1901 | |
Jordy Rose | 70fdbc3 | 2012-05-12 05:10:43 +0000 | [diff] [blame] | 1902 | static bool isNumericLiteralExpression(const Expr *E) { |
| 1903 | // FIXME: This set of cases was copied from SemaExprObjC. |
| 1904 | return isa<IntegerLiteral>(E) || |
| 1905 | isa<CharacterLiteral>(E) || |
| 1906 | isa<FloatingLiteral>(E) || |
| 1907 | isa<ObjCBoolLiteralExpr>(E) || |
| 1908 | isa<CXXBoolLiteralExpr>(E); |
| 1909 | } |
| 1910 | |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 1911 | static bool isPropertyAccess(const Stmt *S, ParentMap &PM) { |
| 1912 | unsigned maxDepth = 4; |
| 1913 | while (S && maxDepth) { |
| 1914 | if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) { |
| 1915 | if (!isa<ObjCMessageExpr>(PO->getSyntacticForm())) |
| 1916 | return true; |
| 1917 | return false; |
| 1918 | } |
| 1919 | S = PM.getParent(S); |
| 1920 | --maxDepth; |
| 1921 | } |
| 1922 | return false; |
| 1923 | } |
| 1924 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1925 | PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N, |
| 1926 | const ExplodedNode *PrevN, |
| 1927 | BugReporterContext &BRC, |
| 1928 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1929 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1930 | if (!isa<StmtPoint>(N->getLocation())) |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 1931 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1932 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 1933 | // Check if the type state has changed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1934 | ProgramStateRef PrevSt = PrevN->getState(); |
| 1935 | ProgramStateRef CurrSt = N->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1936 | const LocationContext *LCtx = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1937 | |
| 1938 | const RefVal* CurrT = CurrSt->get<RefBindings>(Sym); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1939 | if (!CurrT) return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1940 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1941 | const RefVal &CurrV = *CurrT; |
| 1942 | const RefVal *PrevT = PrevSt->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1943 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1944 | // Create a string buffer to constain all the useful things we want |
| 1945 | // to tell the user. |
| 1946 | std::string sbuf; |
| 1947 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1949 | // This is the allocation site since the previous node had no bindings |
| 1950 | // for this symbol. |
| 1951 | if (!PrevT) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1952 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1953 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1954 | if (isa<ObjCArrayLiteral>(S)) { |
| 1955 | os << "NSArray literal is an object with a +0 retain count"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1956 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1957 | else if (isa<ObjCDictionaryLiteral>(S)) { |
| 1958 | os << "NSDictionary literal is an object with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1959 | } |
Jordy Rose | 70fdbc3 | 2012-05-12 05:10:43 +0000 | [diff] [blame] | 1960 | else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) { |
| 1961 | if (isNumericLiteralExpression(BL->getSubExpr())) |
| 1962 | os << "NSNumber literal is an object with a +0 retain count"; |
| 1963 | else { |
| 1964 | const ObjCInterfaceDecl *BoxClass = 0; |
| 1965 | if (const ObjCMethodDecl *Method = BL->getBoxingMethod()) |
| 1966 | BoxClass = Method->getClassInterface(); |
| 1967 | |
| 1968 | // We should always be able to find the boxing class interface, |
| 1969 | // but consider this future-proofing. |
| 1970 | if (BoxClass) |
| 1971 | os << *BoxClass << " b"; |
| 1972 | else |
| 1973 | os << "B"; |
| 1974 | |
| 1975 | os << "oxed expression produces an object with a +0 retain count"; |
| 1976 | } |
| 1977 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1978 | else { |
| 1979 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
| 1980 | // Get the name of the callee (if it is available). |
| 1981 | SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx); |
| 1982 | if (const FunctionDecl *FD = X.getAsFunctionDecl()) |
| 1983 | os << "Call to function '" << *FD << '\''; |
| 1984 | else |
| 1985 | os << "function call"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1986 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1987 | else { |
| 1988 | assert(isa<ObjCMessageExpr>(S)); |
| 1989 | // The message expression may have between written directly or as |
| 1990 | // a property access. Lazily determine which case we are looking at. |
| 1991 | os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method"); |
| 1992 | } |
| 1993 | |
| 1994 | if (CurrV.getObjKind() == RetEffect::CF) { |
| 1995 | os << " returns a Core Foundation object with a "; |
| 1996 | } |
| 1997 | else { |
| 1998 | assert (CurrV.getObjKind() == RetEffect::ObjC); |
| 1999 | os << " returns an Objective-C object with a "; |
| 2000 | } |
| 2001 | |
| 2002 | if (CurrV.isOwned()) { |
| 2003 | os << "+1 retain count"; |
| 2004 | |
| 2005 | if (GCEnabled) { |
| 2006 | assert(CurrV.getObjKind() == RetEffect::CF); |
| 2007 | os << ". " |
| 2008 | "Core Foundation objects are not automatically garbage collected."; |
| 2009 | } |
| 2010 | } |
| 2011 | else { |
| 2012 | assert (CurrV.isNotOwned()); |
| 2013 | os << "+0 retain count"; |
| 2014 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2015 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2016 | |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 2017 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 2018 | N->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2019 | return new PathDiagnosticEventPiece(Pos, os.str()); |
| 2020 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2021 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2022 | // Gather up the effects that were performed on the object at this |
| 2023 | // program point |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2024 | SmallVector<ArgEffect, 2> AEffects; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2025 | |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 2026 | const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N); |
| 2027 | if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2028 | // We only have summaries attached to nodes after evaluating CallExpr and |
| 2029 | // ObjCMessageExprs. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2030 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2031 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2032 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2033 | // Iterate through the parameter expressions and see if the symbol |
| 2034 | // was ever passed as an argument. |
| 2035 | unsigned i = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2036 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2037 | for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2038 | AI!=AE; ++AI, ++i) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2039 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2040 | // Retrieve the value of the argument. Is it the symbol |
| 2041 | // we are interested in? |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2042 | if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2043 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2044 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2045 | // We have an argument. Get the effect! |
| 2046 | AEffects.push_back(Summ->getArg(i)); |
| 2047 | } |
| 2048 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2049 | else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 2050 | if (const Expr *receiver = ME->getInstanceReceiver()) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2051 | if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx) |
| 2052 | .getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2053 | // The symbol we are tracking is the receiver. |
| 2054 | AEffects.push_back(Summ->getReceiverEffect()); |
| 2055 | } |
| 2056 | } |
| 2057 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2058 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2059 | do { |
| 2060 | // Get the previous type state. |
| 2061 | RefVal PrevV = *PrevT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2062 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2063 | // Specially handle -dealloc. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2064 | if (!GCEnabled && contains(AEffects, Dealloc)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2065 | // Determine if the object's reference count was pushed to zero. |
| 2066 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
| 2067 | // We may not have transitioned to 'release' if we hit an error. |
| 2068 | // This case is handled elsewhere. |
| 2069 | if (CurrV.getKind() == RefVal::Released) { |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2070 | assert(CurrV.getCombinedCounts() == 0); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2071 | os << "Object released by directly sending the '-dealloc' message"; |
| 2072 | break; |
| 2073 | } |
| 2074 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2075 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2076 | // Specially handle CFMakeCollectable and friends. |
| 2077 | if (contains(AEffects, MakeCollectable)) { |
| 2078 | // Get the name of the function. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2079 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2080 | SVal X = |
| 2081 | CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2082 | const FunctionDecl *FD = X.getAsFunctionDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2083 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2084 | if (GCEnabled) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2085 | // Determine if the object's reference count was pushed to zero. |
| 2086 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2087 | |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 2088 | os << "In GC mode a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2089 | << "' decrements an object's retain count and registers the " |
| 2090 | "object with the garbage collector. "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2091 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2092 | if (CurrV.getKind() == RefVal::Released) { |
| 2093 | assert(CurrV.getCount() == 0); |
| 2094 | os << "Since it now has a 0 retain count the object can be " |
| 2095 | "automatically collected by the garbage collector."; |
| 2096 | } |
| 2097 | else |
| 2098 | os << "An object must have a 0 retain count to be garbage collected. " |
| 2099 | "After this call its retain count is +" << CurrV.getCount() |
| 2100 | << '.'; |
| 2101 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2102 | else |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 2103 | os << "When GC is not enabled a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2104 | << "' has no effect on its argument."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2105 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2106 | // Nothing more to say. |
| 2107 | break; |
| 2108 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2109 | |
| 2110 | // Determine if the typestate has changed. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2111 | if (!(PrevV == CurrV)) |
| 2112 | switch (CurrV.getKind()) { |
| 2113 | case RefVal::Owned: |
| 2114 | case RefVal::NotOwned: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2115 | |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2116 | if (PrevV.getCount() == CurrV.getCount()) { |
| 2117 | // Did an autorelease message get sent? |
| 2118 | if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount()) |
| 2119 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2120 | |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2121 | assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount()); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2122 | os << "Object sent -autorelease message"; |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2123 | break; |
| 2124 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2125 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2126 | if (PrevV.getCount() > CurrV.getCount()) |
| 2127 | os << "Reference count decremented."; |
| 2128 | else |
| 2129 | os << "Reference count incremented."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2130 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2131 | if (unsigned Count = CurrV.getCount()) |
| 2132 | os << " The object now has a +" << Count << " retain count."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2133 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2134 | if (PrevV.getKind() == RefVal::Released) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2135 | assert(GCEnabled && CurrV.getCount() > 0); |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2136 | os << " The object is not eligible for garbage collection until " |
| 2137 | "the retain count reaches 0 again."; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2138 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2139 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2140 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2141 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2142 | case RefVal::Released: |
| 2143 | os << "Object released."; |
| 2144 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2145 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2146 | case RefVal::ReturnedOwned: |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2147 | // Autoreleases can be applied after marking a node ReturnedOwned. |
| 2148 | if (CurrV.getAutoreleaseCount()) |
| 2149 | return NULL; |
| 2150 | |
| 2151 | os << "Object returned to caller as an owning reference (single " |
| 2152 | "retain count transferred to caller)"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2153 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2154 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2155 | case RefVal::ReturnedNotOwned: |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2156 | os << "Object returned to caller with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2157 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2158 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2159 | default: |
| 2160 | return NULL; |
| 2161 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2162 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2163 | // Emit any remaining diagnostics for the argument effects (if any). |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2164 | for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(), |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2165 | E=AEffects.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2166 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2167 | // A bunch of things have alternate behavior under GC. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2168 | if (GCEnabled) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2169 | switch (*I) { |
| 2170 | default: break; |
| 2171 | case Autorelease: |
| 2172 | os << "In GC mode an 'autorelease' has no effect."; |
| 2173 | continue; |
| 2174 | case IncRefMsg: |
| 2175 | os << "In GC mode the 'retain' message has no effect."; |
| 2176 | continue; |
| 2177 | case DecRefMsg: |
| 2178 | os << "In GC mode the 'release' message has no effect."; |
| 2179 | continue; |
| 2180 | } |
| 2181 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2182 | } while (0); |
| 2183 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2184 | if (os.str().empty()) |
| 2185 | return 0; // We have nothing to say! |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2186 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2187 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 2188 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 2189 | N->getLocationContext()); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2190 | PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2191 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2192 | // Add the range by scanning the children of the statement for any bindings |
| 2193 | // to Sym. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2194 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2195 | I!=E; ++I) |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2196 | if (const Expr *Exp = dyn_cast_or_null<Expr>(*I)) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2197 | if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2198 | P->addRange(Exp->getSourceRange()); |
| 2199 | break; |
| 2200 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2201 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2202 | return P; |
| 2203 | } |
| 2204 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2205 | // Find the first node in the current function context that referred to the |
| 2206 | // tracked symbol and the memory location that value was stored to. Note, the |
| 2207 | // value is only reported if the allocation occurred in the same function as |
| 2208 | // the leak. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2209 | static std::pair<const ExplodedNode*,const MemRegion*> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 2210 | GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2211 | SymbolRef Sym) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2212 | const ExplodedNode *Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2213 | const MemRegion* FirstBinding = 0; |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2214 | const LocationContext *LeakContext = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2215 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2216 | while (N) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2217 | ProgramStateRef St = N->getState(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2218 | RefBindings B = St->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2219 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2220 | if (!B.lookup(Sym)) |
| 2221 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2222 | |
Anna Zaks | 27b867e | 2012-03-21 19:45:01 +0000 | [diff] [blame] | 2223 | StoreManager::FindUniqueBinding FB(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2224 | StateMgr.iterBindings(St, FB); |
| 2225 | if (FB) FirstBinding = FB.getRegion(); |
| 2226 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2227 | // Allocation node, is the last node in the current context in which the |
| 2228 | // symbol was tracked. |
| 2229 | if (N->getLocationContext() == LeakContext) |
| 2230 | Last = N; |
| 2231 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2232 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2233 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2234 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2235 | // If allocation happened in a function different from the leak node context, |
| 2236 | // do not report the binding. |
| 2237 | if (N->getLocationContext() != LeakContext) { |
| 2238 | FirstBinding = 0; |
| 2239 | } |
| 2240 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2241 | return std::make_pair(Last, FirstBinding); |
| 2242 | } |
| 2243 | |
| 2244 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2245 | CFRefReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2246 | const ExplodedNode *EndN, |
| 2247 | BugReport &BR) { |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2248 | BR.markInteresting(Sym); |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2249 | return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2250 | } |
| 2251 | |
| 2252 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2253 | CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2254 | const ExplodedNode *EndN, |
| 2255 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2256 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2257 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2258 | // assigned to different variables, etc. |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2259 | BR.markInteresting(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2260 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2261 | // We are reporting a leak. Walk up the graph to get to the first node where |
| 2262 | // the symbol appeared, and also get the first VarDecl that tracked object |
| 2263 | // is stored to. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2264 | const ExplodedNode *AllocNode = 0; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2265 | const MemRegion* FirstBinding = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2266 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2267 | llvm::tie(AllocNode, FirstBinding) = |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2268 | GetAllocationSite(BRC.getStateManager(), EndN, Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2269 | |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2270 | SourceManager& SM = BRC.getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2271 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2272 | // Compute an actual location for the leak. Sometimes a leak doesn't |
| 2273 | // occur at an actual statement (e.g., transition between blocks; end |
| 2274 | // of function) so we need to walk the graph and compute a real location. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2275 | const ExplodedNode *LeakN = EndN; |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2276 | PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2277 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2278 | std::string sbuf; |
| 2279 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2280 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2281 | os << "Object leaked: "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2282 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2283 | if (FirstBinding) { |
| 2284 | os << "object allocated and stored into '" |
| 2285 | << FirstBinding->getString() << '\''; |
| 2286 | } |
| 2287 | else |
| 2288 | os << "allocated object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2289 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2290 | // Get the retain count. |
| 2291 | const RefVal* RV = EndN->getState()->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2292 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2293 | if (RV->getKind() == RefVal::ErrorLeakReturned) { |
| 2294 | // FIXME: Per comments in rdar://6320065, "create" only applies to CF |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2295 | // objects. Only "copy", "alloc", "retain" and "new" transfer ownership |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2296 | // to the caller for NS objects. |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2297 | const Decl *D = &EndN->getCodeDecl(); |
| 2298 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
| 2299 | os << " is returned from a method whose name ('" |
| 2300 | << MD->getSelector().getAsString() |
| 2301 | << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'." |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2302 | " This violates the naming convention rules" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2303 | " given in the Memory Management Guide for Cocoa"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2304 | } |
| 2305 | else { |
| 2306 | const FunctionDecl *FD = cast<FunctionDecl>(D); |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2307 | os << " is returned from a function whose name ('" |
Benjamin Kramer | a59d20b | 2012-02-07 11:57:57 +0000 | [diff] [blame] | 2308 | << *FD |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2309 | << "') does not contain 'Copy' or 'Create'. This violates the naming" |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2310 | " convention rules given in the Memory Management Guide for Core" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2311 | " Foundation"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2312 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2313 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2314 | else if (RV->getKind() == RefVal::ErrorGCLeakReturned) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2315 | ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2316 | os << " and returned from method '" << MD.getSelector().getAsString() |
Ted Kremenek | 82f2be5 | 2009-05-10 16:52:15 +0000 | [diff] [blame] | 2317 | << "' is potentially leaked when using garbage collection. Callers " |
| 2318 | "of this method do not expect a returned object with a +1 retain " |
| 2319 | "count since they expect the object to be managed by the garbage " |
| 2320 | "collector"; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2321 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2322 | else |
Ted Kremenek | abf517c | 2010-10-15 22:50:23 +0000 | [diff] [blame] | 2323 | os << " is not referenced later in this execution path and has a retain " |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2324 | "count of +" << RV->getCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2325 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2326 | return new PathDiagnosticEventPiece(L, os.str()); |
| 2327 | } |
| 2328 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2329 | CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, |
| 2330 | bool GCEnabled, const SummaryLogTy &Log, |
| 2331 | ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2332 | CheckerContext &Ctx) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2333 | : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2334 | |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 2335 | // Most bug reports are cached at the location where they occurred. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2336 | // With leaks, we want to unique them by the location where they were |
| 2337 | // allocated, and only report a single path. To do this, we need to find |
| 2338 | // the allocation site of a piece of tracked memory, which we do via a |
| 2339 | // call to GetAllocationSite. This will walk the ExplodedGraph backwards. |
| 2340 | // Note that this is *not* the trimmed graph; we are guaranteed, however, |
| 2341 | // that all ancestor nodes that represent the allocation site have the |
| 2342 | // same SourceLocation. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2343 | const ExplodedNode *AllocNode = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2344 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2345 | const SourceManager& SMgr = Ctx.getSourceManager(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2346 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2347 | llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding. |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2348 | GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2349 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2350 | // Get the SourceLocation for the allocation site. |
| 2351 | ProgramPoint P = AllocNode->getLocation(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2352 | const Stmt *AllocStmt = cast<PostStmt>(P).getStmt(); |
| 2353 | Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr, |
| 2354 | n->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2355 | // Fill in the description of the bug. |
| 2356 | Description.clear(); |
| 2357 | llvm::raw_string_ostream os(Description); |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2358 | os << "Potential leak "; |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2359 | if (GCEnabled) |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2360 | os << "(when using garbage collection) "; |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2361 | os << "of an object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2362 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2363 | // FIXME: AllocBinding doesn't get populated for RegionStore yet. |
| 2364 | if (AllocBinding) |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2365 | os << " stored into '" << AllocBinding->getString() << '\''; |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 2366 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2367 | addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log)); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2368 | } |
| 2369 | |
| 2370 | //===----------------------------------------------------------------------===// |
| 2371 | // Main checker logic. |
| 2372 | //===----------------------------------------------------------------------===// |
| 2373 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2374 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2375 | class RetainCountChecker |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2376 | : public Checker< check::Bind, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2377 | check::DeadSymbols, |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2378 | check::EndAnalysis, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2379 | check::EndPath, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2380 | check::PostStmt<BlockExpr>, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2381 | check::PostStmt<CastExpr>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2382 | check::PostStmt<CallExpr>, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2383 | check::PostStmt<CXXConstructExpr>, |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2384 | check::PostStmt<ObjCArrayLiteral>, |
| 2385 | check::PostStmt<ObjCDictionaryLiteral>, |
Jordy Rose | 70fdbc3 | 2012-05-12 05:10:43 +0000 | [diff] [blame] | 2386 | check::PostStmt<ObjCBoxedExpr>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2387 | check::PostObjCMessage, |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2388 | check::PreStmt<ReturnStmt>, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2389 | check::RegionChanges, |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2390 | eval::Assume, |
| 2391 | eval::Call > { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2392 | mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned; |
| 2393 | mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned; |
| 2394 | mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned; |
| 2395 | mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn; |
| 2396 | mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2397 | |
| 2398 | typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap; |
| 2399 | |
| 2400 | // This map is only used to ensure proper deletion of any allocated tags. |
| 2401 | mutable SymbolTagMap DeadSymbolTags; |
| 2402 | |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2403 | mutable OwningPtr<RetainSummaryManager> Summaries; |
| 2404 | mutable OwningPtr<RetainSummaryManager> SummariesGC; |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2405 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2406 | mutable ARCounts::Factory ARCountFactory; |
| 2407 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2408 | mutable SummaryLogTy SummaryLog; |
| 2409 | mutable bool ShouldResetSummaryLog; |
| 2410 | |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2411 | public: |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2412 | RetainCountChecker() : ShouldResetSummaryLog(false) {} |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2413 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2414 | virtual ~RetainCountChecker() { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2415 | DeleteContainerSeconds(DeadSymbolTags); |
| 2416 | } |
| 2417 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2418 | void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR, |
| 2419 | ExprEngine &Eng) const { |
| 2420 | // FIXME: This is a hack to make sure the summary log gets cleared between |
| 2421 | // analyses of different code bodies. |
| 2422 | // |
| 2423 | // Why is this necessary? Because a checker's lifetime is tied to a |
| 2424 | // translation unit, but an ExplodedGraph's lifetime is just a code body. |
| 2425 | // Once in a blue moon, a new ExplodedNode will have the same address as an |
| 2426 | // old one with an associated summary, and the bug report visitor gets very |
| 2427 | // confused. (To make things worse, the summary lifetime is currently also |
| 2428 | // tied to a code body, so we get a crash instead of incorrect results.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2429 | // |
| 2430 | // Why is this a bad solution? Because if the lifetime of the ExplodedGraph |
| 2431 | // changes, things will start going wrong again. Really the lifetime of this |
| 2432 | // log needs to be tied to either the specific nodes in it or the entire |
| 2433 | // ExplodedGraph, not to a specific part of the code being analyzed. |
| 2434 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2435 | // (Also, having stateful local data means that the same checker can't be |
| 2436 | // used from multiple threads, but a lot of checkers have incorrect |
| 2437 | // assumptions about that anyway. So that wasn't a priority at the time of |
| 2438 | // this fix.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2439 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2440 | // This happens at the end of analysis, but bug reports are emitted /after/ |
| 2441 | // this point. So we can't just clear the summary log now. Instead, we mark |
| 2442 | // that the next time we access the summary log, it should be cleared. |
| 2443 | |
| 2444 | // If we never reset the summary log during /this/ code body analysis, |
| 2445 | // there were no new summaries. There might still have been summaries from |
| 2446 | // the /last/ analysis, so clear them out to make sure the bug report |
| 2447 | // visitors don't get confused. |
| 2448 | if (ShouldResetSummaryLog) |
| 2449 | SummaryLog.clear(); |
| 2450 | |
| 2451 | ShouldResetSummaryLog = !SummaryLog.empty(); |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2452 | } |
| 2453 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2454 | CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts, |
| 2455 | bool GCEnabled) const { |
| 2456 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2457 | if (!leakWithinFunctionGC) |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2458 | leakWithinFunctionGC.reset(new Leak("Leak of object when using " |
| 2459 | "garbage collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2460 | return leakWithinFunctionGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2461 | } else { |
| 2462 | if (!leakWithinFunction) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2463 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2464 | leakWithinFunction.reset(new Leak("Leak of object when not using " |
| 2465 | "garbage collection (GC) in " |
| 2466 | "dual GC/non-GC code")); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2467 | } else { |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2468 | leakWithinFunction.reset(new Leak("Leak")); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2469 | } |
| 2470 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2471 | return leakWithinFunction.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2472 | } |
| 2473 | } |
| 2474 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2475 | CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const { |
| 2476 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2477 | if (!leakAtReturnGC) |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2478 | leakAtReturnGC.reset(new Leak("Leak of returned object when using " |
| 2479 | "garbage collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2480 | return leakAtReturnGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2481 | } else { |
| 2482 | if (!leakAtReturn) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2483 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2484 | leakAtReturn.reset(new Leak("Leak of returned object when not using " |
| 2485 | "garbage collection (GC) in dual " |
| 2486 | "GC/non-GC code")); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2487 | } else { |
Benjamin Kramer | facde17 | 2012-06-06 17:32:50 +0000 | [diff] [blame] | 2488 | leakAtReturn.reset(new Leak("Leak of returned object")); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2489 | } |
| 2490 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2491 | return leakAtReturn.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2492 | } |
| 2493 | } |
| 2494 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2495 | RetainSummaryManager &getSummaryManager(ASTContext &Ctx, |
| 2496 | bool GCEnabled) const { |
| 2497 | // FIXME: We don't support ARC being turned on and off during one analysis. |
| 2498 | // (nor, for that matter, do we support changing ASTContexts) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2499 | bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2500 | if (GCEnabled) { |
| 2501 | if (!SummariesGC) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2502 | SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2503 | else |
| 2504 | assert(SummariesGC->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2505 | return *SummariesGC; |
| 2506 | } else { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2507 | if (!Summaries) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2508 | Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2509 | else |
| 2510 | assert(Summaries->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2511 | return *Summaries; |
| 2512 | } |
| 2513 | } |
| 2514 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2515 | RetainSummaryManager &getSummaryManager(CheckerContext &C) const { |
| 2516 | return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled()); |
| 2517 | } |
| 2518 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2519 | void printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 2520 | const char *NL, const char *Sep) const; |
| 2521 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 2522 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2523 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
| 2524 | void checkPostStmt(const CastExpr *CE, CheckerContext &C) const; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2525 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2526 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2527 | void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2528 | void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const; |
| 2529 | void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const; |
Jordy Rose | 70fdbc3 | 2012-05-12 05:10:43 +0000 | [diff] [blame] | 2530 | void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const; |
| 2531 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2532 | void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2533 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2534 | void checkSummary(const RetainSummary &Summ, const CallEvent &Call, |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2535 | CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2536 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2537 | bool evalCall(const CallExpr *CE, CheckerContext &C) const; |
| 2538 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2539 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2540 | bool Assumption) const; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2541 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2542 | ProgramStateRef |
| 2543 | checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2544 | const StoreManager::InvalidatedSymbols *invalidated, |
| 2545 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 2546 | ArrayRef<const MemRegion *> Regions, |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 2547 | const CallEvent *Call) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2548 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2549 | bool wantsRegionChangeUpdate(ProgramStateRef state) const { |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2550 | return true; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2551 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2552 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2553 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
| 2554 | void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, |
| 2555 | ExplodedNode *Pred, RetEffect RE, RefVal X, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2556 | SymbolRef Sym, ProgramStateRef state) const; |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2557 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2558 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 2559 | void checkEndPath(CheckerContext &C) const; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2560 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2561 | ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2562 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2563 | CheckerContext &C) const; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2564 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2565 | void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2566 | RefVal::Kind ErrorKind, SymbolRef Sym, |
| 2567 | CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2568 | |
| 2569 | void processObjCLiterals(CheckerContext &C, const Expr *Ex) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2570 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2571 | const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const; |
| 2572 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2573 | ProgramStateRef handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2574 | SymbolRef sid, RefVal V, |
| 2575 | SmallVectorImpl<SymbolRef> &Leaked) const; |
| 2576 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2577 | std::pair<ExplodedNode *, ProgramStateRef > |
| 2578 | handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2579 | GenericNodeBuilderRefCount Bd, ExplodedNode *Pred, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2580 | CheckerContext &Ctx, SymbolRef Sym, RefVal V) const; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2581 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2582 | ExplodedNode *processLeaks(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2583 | SmallVectorImpl<SymbolRef> &Leaked, |
| 2584 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2585 | CheckerContext &Ctx, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2586 | ExplodedNode *Pred = 0) const; |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2587 | }; |
| 2588 | } // end anonymous namespace |
| 2589 | |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2590 | namespace { |
| 2591 | class StopTrackingCallback : public SymbolVisitor { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2592 | ProgramStateRef state; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2593 | public: |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2594 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 2595 | ProgramStateRef getState() const { return state; } |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2596 | |
| 2597 | bool VisitSymbol(SymbolRef sym) { |
| 2598 | state = state->remove<RefBindings>(sym); |
| 2599 | return true; |
| 2600 | } |
| 2601 | }; |
| 2602 | } // end anonymous namespace |
| 2603 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2604 | //===----------------------------------------------------------------------===// |
| 2605 | // Handle statements that may have an effect on refcounts. |
| 2606 | //===----------------------------------------------------------------------===// |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2607 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2608 | void RetainCountChecker::checkPostStmt(const BlockExpr *BE, |
| 2609 | CheckerContext &C) const { |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2610 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2611 | // Scan the BlockDecRefExprs for any object the retain count checker |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2612 | // may be tracking. |
John McCall | 469a1eb | 2011-02-02 13:00:07 +0000 | [diff] [blame] | 2613 | if (!BE->getBlockDecl()->hasCaptures()) |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2614 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2615 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2616 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2617 | const BlockDataRegion *R = |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2618 | cast<BlockDataRegion>(state->getSVal(BE, |
| 2619 | C.getLocationContext()).getAsRegion()); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2620 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2621 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 2622 | E = R->referenced_vars_end(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2623 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2624 | if (I == E) |
| 2625 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2626 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2627 | // FIXME: For now we invalidate the tracking of all symbols passed to blocks |
| 2628 | // via captured variables, even though captured variables result in a copy |
| 2629 | // and in implicit increment/decrement of a retain count. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2630 | SmallVector<const MemRegion*, 10> Regions; |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2631 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2632 | MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2633 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2634 | for ( ; I != E; ++I) { |
| 2635 | const VarRegion *VR = *I; |
| 2636 | if (VR->getSuperRegion() == R) { |
| 2637 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 2638 | } |
| 2639 | Regions.push_back(VR); |
| 2640 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2641 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2642 | state = |
| 2643 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 2644 | Regions.data() + Regions.size()).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2645 | C.addTransition(state); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2646 | } |
| 2647 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2648 | void RetainCountChecker::checkPostStmt(const CastExpr *CE, |
| 2649 | CheckerContext &C) const { |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2650 | const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE); |
| 2651 | if (!BE) |
| 2652 | return; |
| 2653 | |
John McCall | 71c482c | 2011-06-17 06:50:50 +0000 | [diff] [blame] | 2654 | ArgEffect AE = IncRef; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2655 | |
| 2656 | switch (BE->getBridgeKind()) { |
| 2657 | case clang::OBC_Bridge: |
| 2658 | // Do nothing. |
| 2659 | return; |
| 2660 | case clang::OBC_BridgeRetained: |
| 2661 | AE = IncRef; |
| 2662 | break; |
| 2663 | case clang::OBC_BridgeTransfer: |
| 2664 | AE = DecRefBridgedTransfered; |
| 2665 | break; |
| 2666 | } |
| 2667 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2668 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2669 | SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol(); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2670 | if (!Sym) |
| 2671 | return; |
| 2672 | const RefVal* T = state->get<RefBindings>(Sym); |
| 2673 | if (!T) |
| 2674 | return; |
| 2675 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2676 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2677 | state = updateSymbol(state, Sym, *T, AE, hasErr, C); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2678 | |
| 2679 | if (hasErr) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2680 | // FIXME: If we get an error during a bridge cast, should we report it? |
| 2681 | // Should we assert that there is no error? |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2682 | return; |
| 2683 | } |
| 2684 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2685 | C.addTransition(state); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2686 | } |
| 2687 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2688 | void RetainCountChecker::checkPostStmt(const CallExpr *CE, |
| 2689 | CheckerContext &C) const { |
Ted Kremenek | 514f2c9 | 2012-03-23 06:26:56 +0000 | [diff] [blame] | 2690 | if (C.wasInlined) |
| 2691 | return; |
| 2692 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2693 | // Get the callee. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2694 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2695 | const Expr *Callee = CE->getCallee(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2696 | SVal L = state->getSVal(Callee, C.getLocationContext()); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2697 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2698 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2699 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2700 | // FIXME: This tree of switching can go away if/when we add a check::postCall. |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2701 | if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) { |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2702 | // FIXME: Better support for blocks. For now we stop tracking anything |
| 2703 | // that is passed to blocks. |
| 2704 | // FIXME: Need to handle variables that are "captured" by the block. |
| 2705 | BlockCall Call(CE, state, C.getLocationContext()); |
| 2706 | const RetainSummary *Summ = Summaries.getSummary(Call, state); |
| 2707 | checkSummary(*Summ, Call, C); |
| 2708 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2709 | } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) { |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2710 | CXXMemberCall Call(me, state, C.getLocationContext()); |
| 2711 | const RetainSummary *Summ = Summaries.getSummary(Call, state); |
| 2712 | checkSummary(*Summ, Call, C); |
| 2713 | |
| 2714 | } else { |
| 2715 | FunctionCall Call(CE, state, C.getLocationContext()); |
| 2716 | const RetainSummary *Summ = Summaries.getSummary(Call, state); |
| 2717 | checkSummary(*Summ, Call, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2718 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2719 | } |
| 2720 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2721 | void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE, |
| 2722 | CheckerContext &C) const { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2723 | const CXXConstructorDecl *Ctor = CE->getConstructor(); |
| 2724 | if (!Ctor) |
| 2725 | return; |
| 2726 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2727 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Anna Zaks | 58822c4 | 2012-05-04 22:18:39 +0000 | [diff] [blame] | 2728 | ProgramStateRef state = C.getState(); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2729 | CXXConstructorCall Call(CE, state, C.getLocationContext()); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2730 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2731 | const RetainSummary *Summ = Summaries.getSummary(Call, state); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2732 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2733 | checkSummary(*Summ, Call, C); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2734 | } |
| 2735 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2736 | void RetainCountChecker::processObjCLiterals(CheckerContext &C, |
| 2737 | const Expr *Ex) const { |
| 2738 | ProgramStateRef state = C.getState(); |
| 2739 | const ExplodedNode *pred = C.getPredecessor(); |
| 2740 | for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ; |
| 2741 | it != et ; ++it) { |
| 2742 | const Stmt *child = *it; |
| 2743 | SVal V = state->getSVal(child, pred->getLocationContext()); |
| 2744 | if (SymbolRef sym = V.getAsSymbol()) |
| 2745 | if (const RefVal* T = state->get<RefBindings>(sym)) { |
| 2746 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2747 | state = updateSymbol(state, sym, *T, MayEscape, hasErr, C); |
| 2748 | if (hasErr) { |
| 2749 | processNonLeakError(state, child->getSourceRange(), hasErr, sym, C); |
| 2750 | return; |
| 2751 | } |
| 2752 | } |
| 2753 | } |
| 2754 | |
| 2755 | // Return the object as autoreleased. |
| 2756 | // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 2757 | if (SymbolRef sym = |
| 2758 | state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { |
| 2759 | QualType ResultTy = Ex->getType(); |
| 2760 | state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC, |
| 2761 | ResultTy)); |
| 2762 | } |
| 2763 | |
| 2764 | C.addTransition(state); |
| 2765 | } |
| 2766 | |
| 2767 | void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL, |
| 2768 | CheckerContext &C) const { |
| 2769 | // Apply the 'MayEscape' to all values. |
| 2770 | processObjCLiterals(C, AL); |
| 2771 | } |
| 2772 | |
| 2773 | void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL, |
| 2774 | CheckerContext &C) const { |
| 2775 | // Apply the 'MayEscape' to all keys and values. |
| 2776 | processObjCLiterals(C, DL); |
| 2777 | } |
| 2778 | |
Jordy Rose | 70fdbc3 | 2012-05-12 05:10:43 +0000 | [diff] [blame] | 2779 | void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex, |
| 2780 | CheckerContext &C) const { |
| 2781 | const ExplodedNode *Pred = C.getPredecessor(); |
| 2782 | const LocationContext *LCtx = Pred->getLocationContext(); |
| 2783 | ProgramStateRef State = Pred->getState(); |
| 2784 | |
| 2785 | if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) { |
| 2786 | QualType ResultTy = Ex->getType(); |
| 2787 | State = State->set<RefBindings>(Sym, RefVal::makeNotOwned(RetEffect::ObjC, |
| 2788 | ResultTy)); |
| 2789 | } |
| 2790 | |
| 2791 | C.addTransition(State); |
| 2792 | } |
| 2793 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2794 | void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg, |
| 2795 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2796 | ProgramStateRef state = C.getState(); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2797 | const LocationContext *LC = C.getLocationContext(); |
| 2798 | ObjCMessageInvocation Call(Msg, state, LC); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2799 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2800 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2801 | const RetainSummary *Summ = Summaries.getSummary(Call, state); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2802 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2803 | checkSummary(*Summ, Call, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2804 | } |
| 2805 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2806 | /// GetReturnType - Used to get the return type of a message expression or |
| 2807 | /// function call with the intention of affixing that type to a tracked symbol. |
| 2808 | /// While the the return type can be queried directly from RetEx, when |
| 2809 | /// invoking class methods we augment to the return type to be that of |
| 2810 | /// a pointer to the class (as opposed it just being id). |
| 2811 | // FIXME: We may be able to do this with related result types instead. |
| 2812 | // This function is probably overestimating. |
| 2813 | static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) { |
| 2814 | QualType RetTy = RetE->getType(); |
| 2815 | // If RetE is not a message expression just return its type. |
| 2816 | // If RetE is a message expression, return its types if it is something |
| 2817 | /// more specific than id. |
| 2818 | if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE)) |
| 2819 | if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>()) |
| 2820 | if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() || |
| 2821 | PT->isObjCClassType()) { |
| 2822 | // At this point we know the return type of the message expression is |
| 2823 | // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this |
| 2824 | // is a call to a class method whose type we can resolve. In such |
| 2825 | // cases, promote the return type to XXX* (where XXX is the class). |
| 2826 | const ObjCInterfaceDecl *D = ME->getReceiverInterface(); |
| 2827 | return !D ? RetTy : |
| 2828 | Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D)); |
| 2829 | } |
| 2830 | |
| 2831 | return RetTy; |
| 2832 | } |
| 2833 | |
| 2834 | void RetainCountChecker::checkSummary(const RetainSummary &Summ, |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2835 | const CallEvent &CallOrMsg, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2836 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2837 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2838 | |
| 2839 | // Evaluate the effect of the arguments. |
| 2840 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2841 | SourceRange ErrorRange; |
| 2842 | SymbolRef ErrorSym = 0; |
| 2843 | |
| 2844 | for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2845 | SVal V = CallOrMsg.getArgSVal(idx); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2846 | |
| 2847 | if (SymbolRef Sym = V.getAsLocSymbol()) { |
| 2848 | if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2849 | state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2850 | if (hasErr) { |
| 2851 | ErrorRange = CallOrMsg.getArgSourceRange(idx); |
| 2852 | ErrorSym = Sym; |
| 2853 | break; |
| 2854 | } |
| 2855 | } |
| 2856 | } |
| 2857 | } |
| 2858 | |
| 2859 | // Evaluate the effect on the message receiver. |
| 2860 | bool ReceiverIsTracked = false; |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2861 | if (!hasErr) { |
| 2862 | const ObjCMessageInvocation *MsgInvocation = |
| 2863 | dyn_cast<ObjCMessageInvocation>(&CallOrMsg); |
| 2864 | if (MsgInvocation) { |
| 2865 | if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) { |
| 2866 | if (const RefVal *T = state->get<RefBindings>(Sym)) { |
| 2867 | ReceiverIsTracked = true; |
| 2868 | state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(), |
| 2869 | hasErr, C); |
| 2870 | if (hasErr) { |
| 2871 | ErrorRange = MsgInvocation->getReceiverSourceRange(); |
| 2872 | ErrorSym = Sym; |
| 2873 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2874 | } |
| 2875 | } |
| 2876 | } |
| 2877 | } |
| 2878 | |
| 2879 | // Process any errors. |
| 2880 | if (hasErr) { |
| 2881 | processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C); |
| 2882 | return; |
| 2883 | } |
| 2884 | |
| 2885 | // Consult the summary for the return value. |
| 2886 | RetEffect RE = Summ.getRetEffect(); |
| 2887 | |
| 2888 | if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2889 | if (ReceiverIsTracked) |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2890 | RE = getSummaryManager(C).getObjAllocRetEffect(); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2891 | else |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2892 | RE = RetEffect::MakeNoRet(); |
| 2893 | } |
| 2894 | |
| 2895 | switch (RE.getKind()) { |
| 2896 | default: |
David Blaikie | 7530c03 | 2012-01-17 06:56:22 +0000 | [diff] [blame] | 2897 | llvm_unreachable("Unhandled RetEffect."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2898 | |
| 2899 | case RetEffect::NoRet: |
| 2900 | // No work necessary. |
| 2901 | break; |
| 2902 | |
| 2903 | case RetEffect::OwnedAllocatedSymbol: |
| 2904 | case RetEffect::OwnedSymbol: { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2905 | SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(), |
| 2906 | C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2907 | if (!Sym) |
| 2908 | break; |
| 2909 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2910 | // Use the result type from the CallEvent as it automatically adjusts |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2911 | // for methods/functions that return references. |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2912 | QualType ResultTy = CallOrMsg.getResultType(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2913 | state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(), |
| 2914 | ResultTy)); |
| 2915 | |
| 2916 | // FIXME: Add a flag to the checker where allocations are assumed to |
| 2917 | // *not* fail. (The code below is out-of-date, though.) |
| 2918 | #if 0 |
| 2919 | if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) { |
| 2920 | bool isFeasible; |
| 2921 | state = state.assume(loc::SymbolVal(Sym), true, isFeasible); |
| 2922 | assert(isFeasible && "Cannot assume fresh symbol is non-null."); |
| 2923 | } |
| 2924 | #endif |
| 2925 | |
| 2926 | break; |
| 2927 | } |
| 2928 | |
| 2929 | case RetEffect::GCNotOwnedSymbol: |
| 2930 | case RetEffect::ARCNotOwnedSymbol: |
| 2931 | case RetEffect::NotOwnedSymbol: { |
| 2932 | const Expr *Ex = CallOrMsg.getOriginExpr(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2933 | SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2934 | if (!Sym) |
| 2935 | break; |
| 2936 | |
| 2937 | // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *. |
| 2938 | QualType ResultTy = GetReturnType(Ex, C.getASTContext()); |
| 2939 | state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(), |
| 2940 | ResultTy)); |
| 2941 | break; |
| 2942 | } |
| 2943 | } |
| 2944 | |
| 2945 | // This check is actually necessary; otherwise the statement builder thinks |
| 2946 | // we've hit a previously-found path. |
| 2947 | // Normally addTransition takes care of this, but we want the node pointer. |
| 2948 | ExplodedNode *NewNode; |
| 2949 | if (state == C.getState()) { |
| 2950 | NewNode = C.getPredecessor(); |
| 2951 | } else { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2952 | NewNode = C.addTransition(state); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2953 | } |
| 2954 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2955 | // Annotate the node with summary we used. |
| 2956 | if (NewNode) { |
| 2957 | // FIXME: This is ugly. See checkEndAnalysis for why it's necessary. |
| 2958 | if (ShouldResetSummaryLog) { |
| 2959 | SummaryLog.clear(); |
| 2960 | ShouldResetSummaryLog = false; |
| 2961 | } |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 2962 | SummaryLog[NewNode] = &Summ; |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2963 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2964 | } |
| 2965 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2966 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2967 | ProgramStateRef |
| 2968 | RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2969 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2970 | CheckerContext &C) const { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2971 | // In GC mode [... release] and [... retain] do nothing. |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2972 | // In ARC mode they shouldn't exist at all, but we just ignore them. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2973 | bool IgnoreRetainMsg = C.isObjCGCEnabled(); |
| 2974 | if (!IgnoreRetainMsg) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2975 | IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2976 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2977 | switch (E) { |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 2978 | default: |
| 2979 | break; |
| 2980 | case IncRefMsg: |
| 2981 | E = IgnoreRetainMsg ? DoNothing : IncRef; |
| 2982 | break; |
| 2983 | case DecRefMsg: |
| 2984 | E = IgnoreRetainMsg ? DoNothing : DecRef; |
| 2985 | break; |
| 2986 | case DecRefMsgAndStopTracking: |
| 2987 | E = IgnoreRetainMsg ? StopTracking : DecRefAndStopTracking; |
| 2988 | break; |
| 2989 | case MakeCollectable: |
| 2990 | E = C.isObjCGCEnabled() ? DecRef : DoNothing; |
| 2991 | break; |
| 2992 | case NewAutoreleasePool: |
| 2993 | E = C.isObjCGCEnabled() ? DoNothing : NewAutoreleasePool; |
| 2994 | break; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2995 | } |
| 2996 | |
| 2997 | // Handle all use-after-releases. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2998 | if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2999 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3000 | hasErr = V.getKind(); |
| 3001 | return state->set<RefBindings>(sym, V); |
| 3002 | } |
| 3003 | |
| 3004 | switch (E) { |
| 3005 | case DecRefMsg: |
| 3006 | case IncRefMsg: |
| 3007 | case MakeCollectable: |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3008 | case DecRefMsgAndStopTracking: |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3009 | llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted"); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3010 | |
| 3011 | case Dealloc: |
| 3012 | // Any use of -dealloc in GC is *bad*. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3013 | if (C.isObjCGCEnabled()) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3014 | V = V ^ RefVal::ErrorDeallocGC; |
| 3015 | hasErr = V.getKind(); |
| 3016 | break; |
| 3017 | } |
| 3018 | |
| 3019 | switch (V.getKind()) { |
| 3020 | default: |
| 3021 | llvm_unreachable("Invalid RefVal state for an explicit dealloc."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3022 | case RefVal::Owned: |
| 3023 | // The object immediately transitions to the released state. |
| 3024 | V = V ^ RefVal::Released; |
| 3025 | V.clearCounts(); |
| 3026 | return state->set<RefBindings>(sym, V); |
| 3027 | case RefVal::NotOwned: |
| 3028 | V = V ^ RefVal::ErrorDeallocNotOwned; |
| 3029 | hasErr = V.getKind(); |
| 3030 | break; |
| 3031 | } |
| 3032 | break; |
| 3033 | |
| 3034 | case NewAutoreleasePool: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3035 | assert(!C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3036 | return state->add<AutoreleaseStack>(sym); |
| 3037 | |
| 3038 | case MayEscape: |
| 3039 | if (V.getKind() == RefVal::Owned) { |
| 3040 | V = V ^ RefVal::NotOwned; |
| 3041 | break; |
| 3042 | } |
| 3043 | |
| 3044 | // Fall-through. |
| 3045 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3046 | case DoNothing: |
| 3047 | return state; |
| 3048 | |
| 3049 | case Autorelease: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3050 | if (C.isObjCGCEnabled()) |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3051 | return state; |
| 3052 | |
| 3053 | // Update the autorelease counts. |
| 3054 | state = SendAutorelease(state, ARCountFactory, sym); |
| 3055 | V = V.autorelease(); |
| 3056 | break; |
| 3057 | |
| 3058 | case StopTracking: |
| 3059 | return state->remove<RefBindings>(sym); |
| 3060 | |
| 3061 | case IncRef: |
| 3062 | switch (V.getKind()) { |
| 3063 | default: |
| 3064 | llvm_unreachable("Invalid RefVal state for a retain."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3065 | case RefVal::Owned: |
| 3066 | case RefVal::NotOwned: |
| 3067 | V = V + 1; |
| 3068 | break; |
| 3069 | case RefVal::Released: |
| 3070 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3071 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3072 | V = (V ^ RefVal::Owned) + 1; |
| 3073 | break; |
| 3074 | } |
| 3075 | break; |
| 3076 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3077 | case DecRef: |
| 3078 | case DecRefBridgedTransfered: |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3079 | case DecRefAndStopTracking: |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3080 | switch (V.getKind()) { |
| 3081 | default: |
| 3082 | // case 'RefVal::Released' handled above. |
| 3083 | llvm_unreachable("Invalid RefVal state for a release."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3084 | |
| 3085 | case RefVal::Owned: |
| 3086 | assert(V.getCount() > 0); |
| 3087 | if (V.getCount() == 1) |
| 3088 | V = V ^ (E == DecRefBridgedTransfered ? |
| 3089 | RefVal::NotOwned : RefVal::Released); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3090 | else if (E == DecRefAndStopTracking) |
| 3091 | return state->remove<RefBindings>(sym); |
| 3092 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3093 | V = V - 1; |
| 3094 | break; |
| 3095 | |
| 3096 | case RefVal::NotOwned: |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3097 | if (V.getCount() > 0) { |
| 3098 | if (E == DecRefAndStopTracking) |
| 3099 | return state->remove<RefBindings>(sym); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3100 | V = V - 1; |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3101 | } else { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3102 | V = V ^ RefVal::ErrorReleaseNotOwned; |
| 3103 | hasErr = V.getKind(); |
| 3104 | } |
| 3105 | break; |
| 3106 | |
| 3107 | case RefVal::Released: |
| 3108 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3109 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3110 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3111 | hasErr = V.getKind(); |
| 3112 | break; |
| 3113 | } |
| 3114 | break; |
| 3115 | } |
| 3116 | return state->set<RefBindings>(sym, V); |
| 3117 | } |
| 3118 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3119 | void RetainCountChecker::processNonLeakError(ProgramStateRef St, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3120 | SourceRange ErrorRange, |
| 3121 | RefVal::Kind ErrorKind, |
| 3122 | SymbolRef Sym, |
| 3123 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3124 | ExplodedNode *N = C.generateSink(St); |
| 3125 | if (!N) |
| 3126 | return; |
| 3127 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3128 | CFRefBug *BT; |
| 3129 | switch (ErrorKind) { |
| 3130 | default: |
| 3131 | llvm_unreachable("Unhandled error."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3132 | case RefVal::ErrorUseAfterRelease: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3133 | if (!useAfterRelease) |
| 3134 | useAfterRelease.reset(new UseAfterRelease()); |
| 3135 | BT = &*useAfterRelease; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3136 | break; |
| 3137 | case RefVal::ErrorReleaseNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3138 | if (!releaseNotOwned) |
| 3139 | releaseNotOwned.reset(new BadRelease()); |
| 3140 | BT = &*releaseNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3141 | break; |
| 3142 | case RefVal::ErrorDeallocGC: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3143 | if (!deallocGC) |
| 3144 | deallocGC.reset(new DeallocGC()); |
| 3145 | BT = &*deallocGC; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3146 | break; |
| 3147 | case RefVal::ErrorDeallocNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3148 | if (!deallocNotOwned) |
| 3149 | deallocNotOwned.reset(new DeallocNotOwned()); |
| 3150 | BT = &*deallocNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3151 | break; |
| 3152 | } |
| 3153 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3154 | assert(BT); |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3155 | CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3156 | C.isObjCGCEnabled(), SummaryLog, |
| 3157 | N, Sym); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3158 | report->addRange(ErrorRange); |
| 3159 | C.EmitReport(report); |
| 3160 | } |
| 3161 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3162 | //===----------------------------------------------------------------------===// |
| 3163 | // Handle the return values of retain-count-related functions. |
| 3164 | //===----------------------------------------------------------------------===// |
| 3165 | |
| 3166 | bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3167 | // Get the callee. We're only interested in simple C functions. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3168 | ProgramStateRef state = C.getState(); |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3169 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3170 | if (!FD) |
| 3171 | return false; |
| 3172 | |
| 3173 | IdentifierInfo *II = FD->getIdentifier(); |
| 3174 | if (!II) |
| 3175 | return false; |
| 3176 | |
| 3177 | // For now, we're only handling the functions that return aliases of their |
| 3178 | // arguments: CFRetain and CFMakeCollectable (and their families). |
| 3179 | // Eventually we should add other functions we can model entirely, |
| 3180 | // such as CFRelease, which don't invalidate their arguments or globals. |
| 3181 | if (CE->getNumArgs() != 1) |
| 3182 | return false; |
| 3183 | |
| 3184 | // Get the name of the function. |
| 3185 | StringRef FName = II->getName(); |
| 3186 | FName = FName.substr(FName.find_first_not_of('_')); |
| 3187 | |
| 3188 | // See if it's one of the specific functions we know how to eval. |
| 3189 | bool canEval = false; |
| 3190 | |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3191 | QualType ResultTy = CE->getCallReturnType(); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3192 | if (ResultTy->isObjCIdType()) { |
| 3193 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 3194 | canEval = II->isStr("NSMakeCollectable"); |
| 3195 | } else if (ResultTy->isPointerType()) { |
| 3196 | // Handle: (CF|CG)Retain |
| 3197 | // CFMakeCollectable |
| 3198 | // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist). |
| 3199 | if (cocoa::isRefType(ResultTy, "CF", FName) || |
| 3200 | cocoa::isRefType(ResultTy, "CG", FName)) { |
| 3201 | canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName); |
| 3202 | } |
| 3203 | } |
| 3204 | |
| 3205 | if (!canEval) |
| 3206 | return false; |
| 3207 | |
| 3208 | // Bind the return value. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3209 | const LocationContext *LCtx = C.getLocationContext(); |
| 3210 | SVal RetVal = state->getSVal(CE->getArg(0), LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3211 | if (RetVal.isUnknown()) { |
| 3212 | // If the receiver is unknown, conjure a return value. |
| 3213 | SValBuilder &SVB = C.getSValBuilder(); |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3214 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3215 | SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3216 | } |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3217 | state = state->BindExpr(CE, LCtx, RetVal, false); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3218 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3219 | // FIXME: This should not be necessary, but otherwise the argument seems to be |
| 3220 | // considered alive during the next statement. |
| 3221 | if (const MemRegion *ArgRegion = RetVal.getAsRegion()) { |
| 3222 | // Save the refcount status of the argument. |
| 3223 | SymbolRef Sym = RetVal.getAsLocSymbol(); |
| 3224 | RefBindings::data_type *Binding = 0; |
| 3225 | if (Sym) |
| 3226 | Binding = state->get<RefBindings>(Sym); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3227 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3228 | // Invalidate the argument region. |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3229 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3230 | state = state->invalidateRegions(ArgRegion, CE, Count, LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3231 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3232 | // Restore the refcount status of the argument. |
| 3233 | if (Binding) |
| 3234 | state = state->set<RefBindings>(Sym, *Binding); |
| 3235 | } |
| 3236 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3237 | C.addTransition(state); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3238 | return true; |
| 3239 | } |
| 3240 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3241 | //===----------------------------------------------------------------------===// |
| 3242 | // Handle return statements. |
| 3243 | //===----------------------------------------------------------------------===// |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3244 | |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3245 | // Return true if the current LocationContext has no caller context. |
| 3246 | static bool inTopFrame(CheckerContext &C) { |
| 3247 | const LocationContext *LC = C.getLocationContext(); |
| 3248 | return LC->getParent() == 0; |
| 3249 | } |
| 3250 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3251 | void RetainCountChecker::checkPreStmt(const ReturnStmt *S, |
| 3252 | CheckerContext &C) const { |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3253 | |
| 3254 | // Only adjust the reference count if this is the top-level call frame, |
| 3255 | // and not the result of inlining. In the future, we should do |
| 3256 | // better checking even for inlined calls, and see if they match |
| 3257 | // with their expected semantics (e.g., the method should return a retained |
| 3258 | // object, etc.). |
| 3259 | if (!inTopFrame(C)) |
| 3260 | return; |
| 3261 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3262 | const Expr *RetE = S->getRetValue(); |
| 3263 | if (!RetE) |
| 3264 | return; |
| 3265 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3266 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3267 | SymbolRef Sym = |
| 3268 | state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3269 | if (!Sym) |
| 3270 | return; |
| 3271 | |
| 3272 | // Get the reference count binding (if any). |
| 3273 | const RefVal *T = state->get<RefBindings>(Sym); |
| 3274 | if (!T) |
| 3275 | return; |
| 3276 | |
| 3277 | // Change the reference count. |
| 3278 | RefVal X = *T; |
| 3279 | |
| 3280 | switch (X.getKind()) { |
| 3281 | case RefVal::Owned: { |
| 3282 | unsigned cnt = X.getCount(); |
| 3283 | assert(cnt > 0); |
| 3284 | X.setCount(cnt - 1); |
| 3285 | X = X ^ RefVal::ReturnedOwned; |
| 3286 | break; |
| 3287 | } |
| 3288 | |
| 3289 | case RefVal::NotOwned: { |
| 3290 | unsigned cnt = X.getCount(); |
| 3291 | if (cnt) { |
| 3292 | X.setCount(cnt - 1); |
| 3293 | X = X ^ RefVal::ReturnedOwned; |
| 3294 | } |
| 3295 | else { |
| 3296 | X = X ^ RefVal::ReturnedNotOwned; |
| 3297 | } |
| 3298 | break; |
| 3299 | } |
| 3300 | |
| 3301 | default: |
| 3302 | return; |
| 3303 | } |
| 3304 | |
| 3305 | // Update the binding. |
| 3306 | state = state->set<RefBindings>(Sym, X); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3307 | ExplodedNode *Pred = C.addTransition(state); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3308 | |
| 3309 | // At this point we have updated the state properly. |
| 3310 | // Everything after this is merely checking to see if the return value has |
| 3311 | // been over- or under-retained. |
| 3312 | |
| 3313 | // Did we cache out? |
| 3314 | if (!Pred) |
| 3315 | return; |
| 3316 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3317 | // Update the autorelease counts. |
| 3318 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3319 | AutoreleaseTag("RetainCountChecker : Autorelease"); |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3320 | GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3321 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3322 | |
| 3323 | // Did we cache out? |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3324 | if (!Pred) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3325 | return; |
| 3326 | |
| 3327 | // Get the updated binding. |
| 3328 | T = state->get<RefBindings>(Sym); |
| 3329 | assert(T); |
| 3330 | X = *T; |
| 3331 | |
| 3332 | // Consult the summary of the enclosing method. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3333 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3334 | const Decl *CD = &Pred->getCodeDecl(); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3335 | RetEffect RE = RetEffect::MakeNoRet(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3336 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3337 | // FIXME: What is the convention for blocks? Is there one? |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3338 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) { |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3339 | const RetainSummary *Summ = Summaries.getMethodSummary(MD); |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3340 | RE = Summ->getRetEffect(); |
| 3341 | } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) { |
| 3342 | if (!isa<CXXMethodDecl>(FD)) { |
| 3343 | const RetainSummary *Summ = Summaries.getFunctionSummary(FD); |
| 3344 | RE = Summ->getRetEffect(); |
| 3345 | } |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3346 | } |
| 3347 | |
Jordan Rose | 4531b7d | 2012-07-02 19:27:43 +0000 | [diff] [blame^] | 3348 | checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3349 | } |
| 3350 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3351 | void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S, |
| 3352 | CheckerContext &C, |
| 3353 | ExplodedNode *Pred, |
| 3354 | RetEffect RE, RefVal X, |
| 3355 | SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3356 | ProgramStateRef state) const { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3357 | // Any leaks or other errors? |
| 3358 | if (X.isReturnedOwned() && X.getCount() == 0) { |
| 3359 | if (RE.getKind() != RetEffect::NoRet) { |
| 3360 | bool hasError = false; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3361 | if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3362 | // Things are more complicated with garbage collection. If the |
| 3363 | // returned object is suppose to be an Objective-C object, we have |
| 3364 | // a leak (as the caller expects a GC'ed object) because no |
| 3365 | // method should return ownership unless it returns a CF object. |
| 3366 | hasError = true; |
| 3367 | X = X ^ RefVal::ErrorGCLeakReturned; |
| 3368 | } |
| 3369 | else if (!RE.isOwned()) { |
| 3370 | // Either we are using GC and the returned object is a CF type |
| 3371 | // or we aren't using GC. In either case, we expect that the |
| 3372 | // enclosing method is expected to return ownership. |
| 3373 | hasError = true; |
| 3374 | X = X ^ RefVal::ErrorLeakReturned; |
| 3375 | } |
| 3376 | |
| 3377 | if (hasError) { |
| 3378 | // Generate an error node. |
| 3379 | state = state->set<RefBindings>(Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3380 | |
| 3381 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3382 | ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3383 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3384 | if (N) { |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3385 | const LangOptions &LOpts = C.getASTContext().getLangOpts(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3386 | bool GCEnabled = C.isObjCGCEnabled(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3387 | CFRefReport *report = |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3388 | new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled), |
| 3389 | LOpts, GCEnabled, SummaryLog, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3390 | N, Sym, C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3391 | C.EmitReport(report); |
| 3392 | } |
| 3393 | } |
| 3394 | } |
| 3395 | } else if (X.isReturnedNotOwned()) { |
| 3396 | if (RE.isOwned()) { |
| 3397 | // Trying to return a not owned object to a caller expecting an |
| 3398 | // owned object. |
| 3399 | state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3400 | |
| 3401 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3402 | ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3403 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3404 | if (N) { |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3405 | if (!returnNotOwnedForOwned) |
| 3406 | returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned()); |
| 3407 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3408 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3409 | new CFRefReport(*returnNotOwnedForOwned, |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3410 | C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3411 | C.isObjCGCEnabled(), SummaryLog, N, Sym); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3412 | C.EmitReport(report); |
| 3413 | } |
| 3414 | } |
| 3415 | } |
| 3416 | } |
| 3417 | |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3418 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3419 | // Check various ways a symbol can be invalidated. |
| 3420 | //===----------------------------------------------------------------------===// |
| 3421 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 3422 | void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3423 | CheckerContext &C) const { |
| 3424 | // Are we storing to something that causes the value to "escape"? |
| 3425 | bool escapes = true; |
| 3426 | |
| 3427 | // A value escapes in three possible cases (this may change): |
| 3428 | // |
| 3429 | // (1) we are binding to something that is not a memory region. |
| 3430 | // (2) we are binding to a memregion that does not have stack storage |
| 3431 | // (3) we are binding to a memregion with stack storage that the store |
| 3432 | // does not understand. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3433 | ProgramStateRef state = C.getState(); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3434 | |
| 3435 | if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { |
| 3436 | escapes = !regionLoc->getRegion()->hasStackStorage(); |
| 3437 | |
| 3438 | if (!escapes) { |
| 3439 | // To test (3), generate a new state with the binding added. If it is |
| 3440 | // the same state, then it escapes (since the store cannot represent |
| 3441 | // the binding). |
Anna Zaks | e7958da | 2012-05-02 00:15:40 +0000 | [diff] [blame] | 3442 | // Do this only if we know that the store is not supposed to generate the |
| 3443 | // same state. |
| 3444 | SVal StoredVal = state->getSVal(regionLoc->getRegion()); |
| 3445 | if (StoredVal != val) |
| 3446 | escapes = (state == (state->bindLoc(*regionLoc, val))); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3447 | } |
Ted Kremenek | de5b4fb | 2012-03-27 01:12:45 +0000 | [diff] [blame] | 3448 | if (!escapes) { |
| 3449 | // Case 4: We do not currently model what happens when a symbol is |
| 3450 | // assigned to a struct field, so be conservative here and let the symbol |
| 3451 | // go. TODO: This could definitely be improved upon. |
| 3452 | escapes = !isa<VarRegion>(regionLoc->getRegion()); |
| 3453 | } |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3454 | } |
| 3455 | |
| 3456 | // If our store can represent the binding and we aren't storing to something |
| 3457 | // that doesn't have local storage then just return and have the simulation |
| 3458 | // state continue as is. |
| 3459 | if (!escapes) |
| 3460 | return; |
| 3461 | |
| 3462 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 3463 | // and stop tracking them. |
| 3464 | state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3465 | C.addTransition(state); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3466 | } |
| 3467 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3468 | ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3469 | SVal Cond, |
| 3470 | bool Assumption) const { |
| 3471 | |
| 3472 | // FIXME: We may add to the interface of evalAssume the list of symbols |
| 3473 | // whose assumptions have changed. For now we just iterate through the |
| 3474 | // bindings and check if any of the tracked symbols are NULL. This isn't |
| 3475 | // too bad since the number of symbols we will track in practice are |
| 3476 | // probably small and evalAssume is only called at branches and a few |
| 3477 | // other places. |
| 3478 | RefBindings B = state->get<RefBindings>(); |
| 3479 | |
| 3480 | if (B.isEmpty()) |
| 3481 | return state; |
| 3482 | |
| 3483 | bool changed = false; |
| 3484 | RefBindings::Factory &RefBFactory = state->get_context<RefBindings>(); |
| 3485 | |
| 3486 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3487 | // Check if the symbol is null (or equal to any constant). |
| 3488 | // If this is the case, stop tracking the symbol. |
| 3489 | if (state->getSymVal(I.getKey())) { |
| 3490 | changed = true; |
| 3491 | B = RefBFactory.remove(B, I.getKey()); |
| 3492 | } |
| 3493 | } |
| 3494 | |
| 3495 | if (changed) |
| 3496 | state = state->set<RefBindings>(B); |
| 3497 | |
| 3498 | return state; |
| 3499 | } |
| 3500 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3501 | ProgramStateRef |
| 3502 | RetainCountChecker::checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3503 | const StoreManager::InvalidatedSymbols *invalidated, |
| 3504 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 3505 | ArrayRef<const MemRegion *> Regions, |
Jordan Rose | 740d490 | 2012-07-02 19:27:35 +0000 | [diff] [blame] | 3506 | const CallEvent *Call) const { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3507 | if (!invalidated) |
| 3508 | return state; |
| 3509 | |
| 3510 | llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; |
| 3511 | for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), |
| 3512 | E = ExplicitRegions.end(); I != E; ++I) { |
| 3513 | if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>()) |
| 3514 | WhitelistedSymbols.insert(SR->getSymbol()); |
| 3515 | } |
| 3516 | |
| 3517 | for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), |
| 3518 | E = invalidated->end(); I!=E; ++I) { |
| 3519 | SymbolRef sym = *I; |
| 3520 | if (WhitelistedSymbols.count(sym)) |
| 3521 | continue; |
| 3522 | // Remove any existing reference-count binding. |
| 3523 | state = state->remove<RefBindings>(sym); |
| 3524 | } |
| 3525 | return state; |
| 3526 | } |
| 3527 | |
| 3528 | //===----------------------------------------------------------------------===// |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3529 | // Handle dead symbols and end-of-path. |
| 3530 | //===----------------------------------------------------------------------===// |
| 3531 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3532 | std::pair<ExplodedNode *, ProgramStateRef > |
| 3533 | RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3534 | GenericNodeBuilderRefCount Bd, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3535 | ExplodedNode *Pred, |
| 3536 | CheckerContext &Ctx, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3537 | SymbolRef Sym, RefVal V) const { |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3538 | unsigned ACnt = V.getAutoreleaseCount(); |
| 3539 | |
| 3540 | // No autorelease counts? Nothing to be done. |
| 3541 | if (!ACnt) |
| 3542 | return std::make_pair(Pred, state); |
| 3543 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3544 | assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?"); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3545 | unsigned Cnt = V.getCount(); |
| 3546 | |
| 3547 | // FIXME: Handle sending 'autorelease' to already released object. |
| 3548 | |
| 3549 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3550 | ++Cnt; |
| 3551 | |
| 3552 | if (ACnt <= Cnt) { |
| 3553 | if (ACnt == Cnt) { |
| 3554 | V.clearCounts(); |
| 3555 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3556 | V = V ^ RefVal::ReturnedNotOwned; |
| 3557 | else |
| 3558 | V = V ^ RefVal::NotOwned; |
| 3559 | } else { |
| 3560 | V.setCount(Cnt - ACnt); |
| 3561 | V.setAutoreleaseCount(0); |
| 3562 | } |
| 3563 | state = state->set<RefBindings>(Sym, V); |
| 3564 | ExplodedNode *N = Bd.MakeNode(state, Pred); |
| 3565 | if (N == 0) |
| 3566 | state = 0; |
| 3567 | return std::make_pair(N, state); |
| 3568 | } |
| 3569 | |
| 3570 | // Woah! More autorelease counts then retain counts left. |
| 3571 | // Emit hard error. |
| 3572 | V = V ^ RefVal::ErrorOverAutorelease; |
| 3573 | state = state->set<RefBindings>(Sym, V); |
| 3574 | |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 3575 | if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3576 | SmallString<128> sbuf; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3577 | llvm::raw_svector_ostream os(sbuf); |
| 3578 | os << "Object over-autoreleased: object was sent -autorelease "; |
| 3579 | if (V.getAutoreleaseCount() > 1) |
| 3580 | os << V.getAutoreleaseCount() << " times "; |
| 3581 | os << "but the object has a +" << V.getCount() << " retain count"; |
| 3582 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3583 | if (!overAutorelease) |
| 3584 | overAutorelease.reset(new OverAutorelease()); |
| 3585 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3586 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3587 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3588 | new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false, |
| 3589 | SummaryLog, N, Sym, os.str()); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3590 | Ctx.EmitReport(report); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3591 | } |
| 3592 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3593 | return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3594 | } |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3595 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3596 | ProgramStateRef |
| 3597 | RetainCountChecker::handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3598 | SymbolRef sid, RefVal V, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3599 | SmallVectorImpl<SymbolRef> &Leaked) const { |
Jordy Rose | 5337612 | 2011-08-24 04:48:19 +0000 | [diff] [blame] | 3600 | bool hasLeak = false; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3601 | if (V.isOwned()) |
| 3602 | hasLeak = true; |
| 3603 | else if (V.isNotOwned() || V.isReturnedOwned()) |
| 3604 | hasLeak = (V.getCount() > 0); |
| 3605 | |
| 3606 | if (!hasLeak) |
| 3607 | return state->remove<RefBindings>(sid); |
| 3608 | |
| 3609 | Leaked.push_back(sid); |
| 3610 | return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak); |
| 3611 | } |
| 3612 | |
| 3613 | ExplodedNode * |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3614 | RetainCountChecker::processLeaks(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3615 | SmallVectorImpl<SymbolRef> &Leaked, |
| 3616 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3617 | CheckerContext &Ctx, |
| 3618 | ExplodedNode *Pred) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3619 | if (Leaked.empty()) |
| 3620 | return Pred; |
| 3621 | |
| 3622 | // Generate an intermediate node representing the leak point. |
| 3623 | ExplodedNode *N = Builder.MakeNode(state, Pred); |
| 3624 | |
| 3625 | if (N) { |
| 3626 | for (SmallVectorImpl<SymbolRef>::iterator |
| 3627 | I = Leaked.begin(), E = Leaked.end(); I != E; ++I) { |
| 3628 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3629 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3630 | bool GCEnabled = Ctx.isObjCGCEnabled(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3631 | CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled) |
| 3632 | : getLeakAtReturnBug(LOpts, GCEnabled); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3633 | assert(BT && "BugType not initialized."); |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 3634 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3635 | CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3636 | SummaryLog, N, *I, Ctx); |
| 3637 | Ctx.EmitReport(report); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3638 | } |
| 3639 | } |
| 3640 | |
| 3641 | return N; |
| 3642 | } |
| 3643 | |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3644 | void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3645 | ProgramStateRef state = Ctx.getState(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3646 | GenericNodeBuilderRefCount Bd(Ctx); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3647 | RefBindings B = state->get<RefBindings>(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3648 | ExplodedNode *Pred = Ctx.getPredecessor(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3649 | |
| 3650 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3651 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3652 | I->first, I->second); |
| 3653 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3654 | return; |
| 3655 | } |
| 3656 | |
Ted Kremenek | 0cf3d47 | 2012-02-07 00:24:33 +0000 | [diff] [blame] | 3657 | // If the current LocationContext has a parent, don't check for leaks. |
| 3658 | // We will do that later. |
| 3659 | // FIXME: we should instead check for imblances of the retain/releases, |
| 3660 | // and suggest annotations. |
| 3661 | if (Ctx.getLocationContext()->getParent()) |
| 3662 | return; |
| 3663 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3664 | B = state->get<RefBindings>(); |
| 3665 | SmallVector<SymbolRef, 10> Leaked; |
| 3666 | |
| 3667 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3668 | state = handleSymbolDeath(state, I->first, I->second, Leaked); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3669 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3670 | processLeaks(state, Leaked, Bd, Ctx, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3671 | } |
| 3672 | |
| 3673 | const ProgramPointTag * |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3674 | RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3675 | const SimpleProgramPointTag *&tag = DeadSymbolTags[sym]; |
| 3676 | if (!tag) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3677 | SmallString<64> buf; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3678 | llvm::raw_svector_ostream out(buf); |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3679 | out << "RetainCountChecker : Dead Symbol : "; |
| 3680 | sym->dumpToStream(out); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3681 | tag = new SimpleProgramPointTag(out.str()); |
| 3682 | } |
| 3683 | return tag; |
| 3684 | } |
| 3685 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3686 | void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 3687 | CheckerContext &C) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3688 | ExplodedNode *Pred = C.getPredecessor(); |
| 3689 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3690 | ProgramStateRef state = C.getState(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3691 | RefBindings B = state->get<RefBindings>(); |
| 3692 | |
| 3693 | // Update counts from autorelease pools |
| 3694 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3695 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3696 | SymbolRef Sym = *I; |
| 3697 | if (const RefVal *T = B.lookup(Sym)){ |
| 3698 | // Use the symbol as the tag. |
| 3699 | // FIXME: This might not be as unique as we would like. |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3700 | GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym)); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3701 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3702 | Sym, *T); |
| 3703 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3704 | return; |
| 3705 | } |
| 3706 | } |
| 3707 | |
| 3708 | B = state->get<RefBindings>(); |
| 3709 | SmallVector<SymbolRef, 10> Leaked; |
| 3710 | |
| 3711 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3712 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3713 | if (const RefVal *T = B.lookup(*I)) |
| 3714 | state = handleSymbolDeath(state, *I, *T, Leaked); |
| 3715 | } |
| 3716 | |
| 3717 | { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3718 | GenericNodeBuilderRefCount Bd(C, this); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3719 | Pred = processLeaks(state, Leaked, Bd, C, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3720 | } |
| 3721 | |
| 3722 | // Did we cache out? |
| 3723 | if (!Pred) |
| 3724 | return; |
| 3725 | |
| 3726 | // Now generate a new node that nukes the old bindings. |
| 3727 | RefBindings::Factory &F = state->get_context<RefBindings>(); |
| 3728 | |
| 3729 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3730 | E = SymReaper.dead_end(); I != E; ++I) |
| 3731 | B = F.remove(B, *I); |
| 3732 | |
| 3733 | state = state->set<RefBindings>(B); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3734 | C.addTransition(state, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3735 | } |
| 3736 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3737 | //===----------------------------------------------------------------------===// |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3738 | // Debug printing of refcount bindings and autorelease pools. |
| 3739 | //===----------------------------------------------------------------------===// |
| 3740 | |
| 3741 | static void PrintPool(raw_ostream &Out, SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3742 | ProgramStateRef State) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3743 | Out << ' '; |
| 3744 | if (Sym) |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3745 | Sym->dumpToStream(Out); |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3746 | else |
| 3747 | Out << "<pool>"; |
| 3748 | Out << ":{"; |
| 3749 | |
| 3750 | // Get the contents of the pool. |
| 3751 | if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym)) |
| 3752 | for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I) |
| 3753 | Out << '(' << I.getKey() << ',' << I.getData() << ')'; |
| 3754 | |
| 3755 | Out << '}'; |
| 3756 | } |
| 3757 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3758 | static bool UsesAutorelease(ProgramStateRef state) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3759 | // A state uses autorelease if it allocated an autorelease pool or if it has |
| 3760 | // objects in the caller's autorelease pool. |
| 3761 | return !state->get<AutoreleaseStack>().isEmpty() || |
| 3762 | state->get<AutoreleasePoolContents>(SymbolRef()); |
| 3763 | } |
| 3764 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3765 | void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3766 | const char *NL, const char *Sep) const { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3767 | |
| 3768 | RefBindings B = State->get<RefBindings>(); |
| 3769 | |
| 3770 | if (!B.isEmpty()) |
| 3771 | Out << Sep << NL; |
| 3772 | |
| 3773 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3774 | Out << I->first << " : "; |
| 3775 | I->second.print(Out); |
| 3776 | Out << NL; |
| 3777 | } |
| 3778 | |
| 3779 | // Print the autorelease stack. |
| 3780 | if (UsesAutorelease(State)) { |
| 3781 | Out << Sep << NL << "AR pool stack:"; |
| 3782 | ARStack Stack = State->get<AutoreleaseStack>(); |
| 3783 | |
| 3784 | PrintPool(Out, SymbolRef(), State); // Print the caller's pool. |
| 3785 | for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I) |
| 3786 | PrintPool(Out, *I, State); |
| 3787 | |
| 3788 | Out << NL; |
| 3789 | } |
| 3790 | } |
| 3791 | |
| 3792 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3793 | // Checker registration. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3794 | //===----------------------------------------------------------------------===// |
| 3795 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3796 | void ento::registerRetainCountChecker(CheckerManager &Mgr) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3797 | Mgr.registerChecker<RetainCountChecker>(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3798 | } |
| 3799 | |