blob: d43b2cde26bb98aa73502d2b3ba5335d2f40c60c [file] [log] [blame]
Jordy Rose910c4052011-09-02 06:44:22 +00001//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
Ted Kremenek2fff37e2008-03-06 00:08:09 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Jordy Rose910c4052011-09-02 06:44:22 +000010// This file defines the methods for RetainCountChecker, which implements
11// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
Ted Kremenek2fff37e2008-03-06 00:08:09 +000012//
13//===----------------------------------------------------------------------===//
14
Jordy Rose910c4052011-09-02 06:44:22 +000015#include "ClangSACheckers.h"
Mike Stump1eb44332009-09-09 15:08:12 +000016#include "clang/AST/DeclObjC.h"
Ted Kremenekb2771592011-03-30 17:41:19 +000017#include "clang/AST/DeclCXX.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000018#include "clang/Basic/LangOptions.h"
19#include "clang/Basic/SourceManager.h"
Jordy Rose910c4052011-09-02 06:44:22 +000020#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
Ted Kremenek4c42bb72011-11-14 21:59:21 +000021#include "clang/AST/ParentMap.h"
Jordy Rose910c4052011-09-02 06:44:22 +000022#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000024#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
Jordan Rose4531b7d2012-07-02 19:27:43 +000026#include "clang/StaticAnalyzer/Core/PathSensitive/Calls.h"
Jordy Rose910c4052011-09-02 06:44:22 +000027#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000028#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000029#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Jordy Rosed1e5a892011-09-02 08:02:59 +000030#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h"
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000031#include "llvm/ADT/DenseMap.h"
32#include "llvm/ADT/FoldingSet.h"
Ted Kremenek6d348932008-10-21 15:53:15 +000033#include "llvm/ADT/ImmutableList.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000034#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000035#include "llvm/ADT/SmallString.h"
Ted Kremenek6ed9afc2008-05-16 18:33:44 +000036#include "llvm/ADT/STLExtras.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000037#include "llvm/ADT/StringExtras.h"
Chris Lattner5f9e2722011-07-23 10:55:15 +000038#include <cstdarg>
Ted Kremenek2fff37e2008-03-06 00:08:09 +000039
40using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000041using namespace ento;
Ted Kremeneka64e89b2010-01-27 06:13:48 +000042using llvm::StrInStrNoCase;
Ted Kremenek4c79e552008-11-05 16:54:44 +000043
Ted Kremenekd775c662010-05-21 21:57:00 +000044namespace {
Jordy Rose910c4052011-09-02 06:44:22 +000045/// Wrapper around different kinds of node builder, so that helper functions
46/// can have a common interface.
Francois Pichetea097852011-01-11 10:41:37 +000047class GenericNodeBuilderRefCount {
Anna Zaks4eff8232011-10-05 23:44:11 +000048 CheckerContext *C;
Ted Kremenekca804532011-08-12 23:04:46 +000049 const ProgramPointTag *tag;
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000050public:
Anna Zaks4eff8232011-10-05 23:44:11 +000051 GenericNodeBuilderRefCount(CheckerContext &c,
Anna Zaksaf498a22011-10-25 19:56:48 +000052 const ProgramPointTag *t = 0)
Anna Zaks6a93bd52011-10-25 19:57:11 +000053 : C(&c), tag(t){}
Zhongxing Xu031ccc02009-08-06 12:48:26 +000054
Ted Kremenek8bef8232012-01-26 21:29:00 +000055 ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred,
Anna Zaksf05aac82011-10-18 23:05:58 +000056 bool MarkAsSink = false) {
Anna Zaks0bd6b112011-10-26 21:06:34 +000057 return C->addTransition(state, Pred, tag, MarkAsSink);
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000058 }
59};
60} // end anonymous namespace
61
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000062//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +000063// Primitives used for constructing summaries for function/method calls.
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000064//===----------------------------------------------------------------------===//
65
Ted Kremenek553cf182008-06-25 21:21:56 +000066/// ArgEffect is used to summarize a function/method call's effect on a
67/// particular argument.
Jordy Rosebd85b132011-08-24 19:10:50 +000068enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg,
John McCallf85e1932011-06-15 23:02:42 +000069 DecRefBridgedTransfered,
Jordan Rose4531b7d2012-07-02 19:27:43 +000070 DecRefAndStopTracking, DecRefMsgAndStopTracking,
Jordy Rosebd85b132011-08-24 19:10:50 +000071 IncRefMsg, IncRef, MakeCollectable, MayEscape,
Jordan Rose29299c62012-06-27 00:51:18 +000072 NewAutoreleasePool, StopTracking };
Ted Kremenek553cf182008-06-25 21:21:56 +000073
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000074namespace llvm {
Ted Kremenekb77449c2009-05-03 05:20:50 +000075template <> struct FoldingSetTrait<ArgEffect> {
76static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) {
77 ID.AddInteger((unsigned) X);
78}
Ted Kremenek553cf182008-06-25 21:21:56 +000079};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000080} // end llvm namespace
81
Ted Kremenekb77449c2009-05-03 05:20:50 +000082/// ArgEffects summarizes the effects of a function/method call on all of
83/// its arguments.
84typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects;
85
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000086namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +000087
88/// RetEffect is used to summarize a function/method call's behavior with
Mike Stump1eb44332009-09-09 15:08:12 +000089/// respect to its return value.
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000090class RetEffect {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000091public:
Jordy Rose76c506f2011-08-21 21:58:18 +000092 enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol,
John McCallf85e1932011-06-15 23:02:42 +000093 NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol,
Ted Kremenek78a35a32009-05-12 20:06:54 +000094 OwnedWhenTrackedReceiver };
Mike Stump1eb44332009-09-09 15:08:12 +000095
96 enum ObjKind { CF, ObjC, AnyObj };
Ted Kremenek2d1652e2009-01-28 05:56:51 +000097
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000098private:
Ted Kremenek2d1652e2009-01-28 05:56:51 +000099 Kind K;
100 ObjKind O;
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000101
Jordy Rose76c506f2011-08-21 21:58:18 +0000102 RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000103
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000104public:
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000105 Kind getKind() const { return K; }
106
107 ObjKind getObjKind() const { return O; }
Mike Stump1eb44332009-09-09 15:08:12 +0000108
Ted Kremeneka8833552009-04-29 23:03:22 +0000109 bool isOwned() const {
Ted Kremenek78a35a32009-05-12 20:06:54 +0000110 return K == OwnedSymbol || K == OwnedAllocatedSymbol ||
111 K == OwnedWhenTrackedReceiver;
Ted Kremeneka8833552009-04-29 23:03:22 +0000112 }
Mike Stump1eb44332009-09-09 15:08:12 +0000113
Jordy Rose4df54fe2011-08-23 04:27:15 +0000114 bool operator==(const RetEffect &Other) const {
115 return K == Other.K && O == Other.O;
116 }
117
Ted Kremenek78a35a32009-05-12 20:06:54 +0000118 static RetEffect MakeOwnedWhenTrackedReceiver() {
119 return RetEffect(OwnedWhenTrackedReceiver, ObjC);
120 }
Mike Stump1eb44332009-09-09 15:08:12 +0000121
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000122 static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) {
123 return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o);
Mike Stump1eb44332009-09-09 15:08:12 +0000124 }
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000125 static RetEffect MakeNotOwned(ObjKind o) {
126 return RetEffect(NotOwnedSymbol, o);
Ted Kremeneke798e7c2009-04-27 19:14:45 +0000127 }
128 static RetEffect MakeGCNotOwned() {
129 return RetEffect(GCNotOwnedSymbol, ObjC);
130 }
John McCallf85e1932011-06-15 23:02:42 +0000131 static RetEffect MakeARCNotOwned() {
132 return RetEffect(ARCNotOwnedSymbol, ObjC);
133 }
Ted Kremenek553cf182008-06-25 21:21:56 +0000134 static RetEffect MakeNoRet() {
135 return RetEffect(NoRet);
Ted Kremeneka7344702008-06-23 18:02:52 +0000136 }
Jordy Roseef945882012-03-18 01:26:10 +0000137
138 void Profile(llvm::FoldingSetNodeID& ID) const {
139 ID.AddInteger((unsigned) K);
140 ID.AddInteger((unsigned) O);
141 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000142};
Mike Stump1eb44332009-09-09 15:08:12 +0000143
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000144//===----------------------------------------------------------------------===//
145// Reference-counting logic (typestate + counts).
146//===----------------------------------------------------------------------===//
Mike Stump1eb44332009-09-09 15:08:12 +0000147
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000148class RefVal {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000149public:
150 enum Kind {
151 Owned = 0, // Owning reference.
152 NotOwned, // Reference is not owned by still valid (not freed).
153 Released, // Object has been released.
154 ReturnedOwned, // Returned object passes ownership to caller.
155 ReturnedNotOwned, // Return object does not pass ownership to caller.
156 ERROR_START,
157 ErrorDeallocNotOwned, // -dealloc called on non-owned object.
158 ErrorDeallocGC, // Calling -dealloc with GC enabled.
159 ErrorUseAfterRelease, // Object used after released.
160 ErrorReleaseNotOwned, // Release of an object that was not owned.
161 ERROR_LEAK_START,
162 ErrorLeak, // A memory leak due to excessive reference counts.
163 ErrorLeakReturned, // A memory leak due to the returning method not having
164 // the correct naming conventions.
165 ErrorGCLeakReturned,
166 ErrorOverAutorelease,
167 ErrorReturnedNotOwned
168 };
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000169
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000170private:
171 Kind kind;
172 RetEffect::ObjKind okind;
173 unsigned Cnt;
174 unsigned ACnt;
175 QualType T;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000176
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000177 RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t)
178 : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {}
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000179
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000180public:
181 Kind getKind() const { return kind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000182
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000183 RetEffect::ObjKind getObjKind() const { return okind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000184
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000185 unsigned getCount() const { return Cnt; }
186 unsigned getAutoreleaseCount() const { return ACnt; }
187 unsigned getCombinedCounts() const { return Cnt + ACnt; }
188 void clearCounts() { Cnt = 0; ACnt = 0; }
189 void setCount(unsigned i) { Cnt = i; }
190 void setAutoreleaseCount(unsigned i) { ACnt = i; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000191
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000192 QualType getType() const { return T; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000193
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000194 bool isOwned() const {
195 return getKind() == Owned;
196 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000197
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000198 bool isNotOwned() const {
199 return getKind() == NotOwned;
200 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000201
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000202 bool isReturnedOwned() const {
203 return getKind() == ReturnedOwned;
204 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000205
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000206 bool isReturnedNotOwned() const {
207 return getKind() == ReturnedNotOwned;
208 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000209
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000210 static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
211 unsigned Count = 1) {
212 return RefVal(Owned, o, Count, 0, t);
213 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000214
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000215 static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
216 unsigned Count = 0) {
217 return RefVal(NotOwned, o, Count, 0, t);
218 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000219
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000220 // Comparison, profiling, and pretty-printing.
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000221
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000222 bool operator==(const RefVal& X) const {
223 return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt;
224 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000225
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000226 RefVal operator-(size_t i) const {
227 return RefVal(getKind(), getObjKind(), getCount() - i,
228 getAutoreleaseCount(), getType());
229 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000230
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000231 RefVal operator+(size_t i) const {
232 return RefVal(getKind(), getObjKind(), getCount() + i,
233 getAutoreleaseCount(), getType());
234 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000235
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000236 RefVal operator^(Kind k) const {
237 return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
238 getType());
239 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000240
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000241 RefVal autorelease() const {
242 return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
243 getType());
244 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000245
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000246 void Profile(llvm::FoldingSetNodeID& ID) const {
247 ID.AddInteger((unsigned) kind);
248 ID.AddInteger(Cnt);
249 ID.AddInteger(ACnt);
250 ID.Add(T);
251 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000252
Ted Kremenek9c378f72011-08-12 23:37:29 +0000253 void print(raw_ostream &Out) const;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000254};
255
Ted Kremenek9c378f72011-08-12 23:37:29 +0000256void RefVal::print(raw_ostream &Out) const {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000257 if (!T.isNull())
Jordy Rosedbd658e2011-08-28 19:11:56 +0000258 Out << "Tracked " << T.getAsString() << '/';
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000259
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000260 switch (getKind()) {
Jordy Rose910c4052011-09-02 06:44:22 +0000261 default: llvm_unreachable("Invalid RefVal kind");
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000262 case Owned: {
263 Out << "Owned";
264 unsigned cnt = getCount();
265 if (cnt) Out << " (+ " << cnt << ")";
266 break;
267 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000268
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000269 case NotOwned: {
270 Out << "NotOwned";
271 unsigned cnt = getCount();
272 if (cnt) Out << " (+ " << cnt << ")";
273 break;
274 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000275
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000276 case ReturnedOwned: {
277 Out << "ReturnedOwned";
278 unsigned cnt = getCount();
279 if (cnt) Out << " (+ " << cnt << ")";
280 break;
281 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000282
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000283 case ReturnedNotOwned: {
284 Out << "ReturnedNotOwned";
285 unsigned cnt = getCount();
286 if (cnt) Out << " (+ " << cnt << ")";
287 break;
288 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000289
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000290 case Released:
291 Out << "Released";
292 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000293
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000294 case ErrorDeallocGC:
295 Out << "-dealloc (GC)";
296 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000297
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000298 case ErrorDeallocNotOwned:
299 Out << "-dealloc (not-owned)";
300 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000301
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000302 case ErrorLeak:
303 Out << "Leaked";
304 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000305
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000306 case ErrorLeakReturned:
307 Out << "Leaked (Bad naming)";
308 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000309
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000310 case ErrorGCLeakReturned:
311 Out << "Leaked (GC-ed at return)";
312 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000313
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000314 case ErrorUseAfterRelease:
315 Out << "Use-After-Release [ERROR]";
316 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000317
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000318 case ErrorReleaseNotOwned:
319 Out << "Release of Not-Owned [ERROR]";
320 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000321
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000322 case RefVal::ErrorOverAutorelease:
323 Out << "Over autoreleased";
324 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000325
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000326 case RefVal::ErrorReturnedNotOwned:
327 Out << "Non-owned object returned instead of owned";
328 break;
329 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000330
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000331 if (ACnt) {
332 Out << " [ARC +" << ACnt << ']';
333 }
334}
335} //end anonymous namespace
336
337//===----------------------------------------------------------------------===//
338// RefBindings - State used to track object reference counts.
339//===----------------------------------------------------------------------===//
340
341typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000342
343namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000344namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000345template<>
346struct ProgramStateTrait<RefBindings>
347 : public ProgramStatePartialTrait<RefBindings> {
348 static void *GDMIndex() {
349 static int RefBIndex = 0;
350 return &RefBIndex;
351 }
352};
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000353}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000354}
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000355
356//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +0000357// Function/Method behavior summaries.
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000358//===----------------------------------------------------------------------===//
359
360namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000361class RetainSummary {
Jordy Roseef945882012-03-18 01:26:10 +0000362 /// Args - a map of (index, ArgEffect) pairs, where index
Ted Kremenek1bffd742008-05-06 15:44:25 +0000363 /// specifies the argument (starting from 0). This can be sparsely
364 /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000365 ArgEffects Args;
Mike Stump1eb44332009-09-09 15:08:12 +0000366
Ted Kremenek1bffd742008-05-06 15:44:25 +0000367 /// DefaultArgEffect - The default ArgEffect to apply to arguments that
368 /// do not have an entry in Args.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000369 ArgEffect DefaultArgEffect;
Mike Stump1eb44332009-09-09 15:08:12 +0000370
Ted Kremenek553cf182008-06-25 21:21:56 +0000371 /// Receiver - If this summary applies to an Objective-C message expression,
372 /// this is the effect applied to the state of the receiver.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000373 ArgEffect Receiver;
Mike Stump1eb44332009-09-09 15:08:12 +0000374
Ted Kremenek553cf182008-06-25 21:21:56 +0000375 /// Ret - The effect on the return value. Used to indicate if the
Jordy Rose76c506f2011-08-21 21:58:18 +0000376 /// function/method call returns a new tracked symbol.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000377 RetEffect Ret;
Mike Stump1eb44332009-09-09 15:08:12 +0000378
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000379public:
Ted Kremenekb77449c2009-05-03 05:20:50 +0000380 RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
Jordy Rosee62e87b2011-08-20 20:55:40 +0000381 ArgEffect ReceiverEff)
382 : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000383
Ted Kremenek553cf182008-06-25 21:21:56 +0000384 /// getArg - Return the argument effect on the argument specified by
385 /// idx (starting from 0).
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000386 ArgEffect getArg(unsigned idx) const {
Ted Kremenekb77449c2009-05-03 05:20:50 +0000387 if (const ArgEffect *AE = Args.lookup(idx))
388 return *AE;
Mike Stump1eb44332009-09-09 15:08:12 +0000389
Ted Kremenek1bffd742008-05-06 15:44:25 +0000390 return DefaultArgEffect;
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000391 }
Ted Kremenek11fe1752011-01-27 18:43:03 +0000392
393 void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
394 Args = af.add(Args, idx, e);
395 }
Mike Stump1eb44332009-09-09 15:08:12 +0000396
Ted Kremenek885c27b2009-05-04 05:31:22 +0000397 /// setDefaultArgEffect - Set the default argument effect.
398 void setDefaultArgEffect(ArgEffect E) {
399 DefaultArgEffect = E;
400 }
Mike Stump1eb44332009-09-09 15:08:12 +0000401
Ted Kremenek553cf182008-06-25 21:21:56 +0000402 /// getRetEffect - Returns the effect on the return value of the call.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000403 RetEffect getRetEffect() const { return Ret; }
Mike Stump1eb44332009-09-09 15:08:12 +0000404
Ted Kremenek885c27b2009-05-04 05:31:22 +0000405 /// setRetEffect - Set the effect of the return value of the call.
406 void setRetEffect(RetEffect E) { Ret = E; }
Mike Stump1eb44332009-09-09 15:08:12 +0000407
Ted Kremenek12b94342011-01-27 06:54:14 +0000408
409 /// Sets the effect on the receiver of the message.
410 void setReceiverEffect(ArgEffect e) { Receiver = e; }
411
Ted Kremenek553cf182008-06-25 21:21:56 +0000412 /// getReceiverEffect - Returns the effect on the receiver of the call.
413 /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000414 ArgEffect getReceiverEffect() const { return Receiver; }
Jordy Rose4df54fe2011-08-23 04:27:15 +0000415
416 /// Test if two retain summaries are identical. Note that merely equivalent
417 /// summaries are not necessarily identical (for example, if an explicit
418 /// argument effect matches the default effect).
419 bool operator==(const RetainSummary &Other) const {
420 return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
421 Receiver == Other.Receiver && Ret == Other.Ret;
422 }
Jordy Roseef945882012-03-18 01:26:10 +0000423
424 /// Profile this summary for inclusion in a FoldingSet.
425 void Profile(llvm::FoldingSetNodeID& ID) const {
426 ID.Add(Args);
427 ID.Add(DefaultArgEffect);
428 ID.Add(Receiver);
429 ID.Add(Ret);
430 }
431
432 /// A retain summary is simple if it has no ArgEffects other than the default.
433 bool isSimple() const {
434 return Args.isEmpty();
435 }
Jordan Rose4531b7d2012-07-02 19:27:43 +0000436
437private:
438 ArgEffects getArgEffects() const { return Args; }
439 ArgEffect getDefaultArgEffect() const { return DefaultArgEffect; }
440
441 friend class RetainSummaryManager;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000442};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000443} // end anonymous namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000444
Ted Kremenek553cf182008-06-25 21:21:56 +0000445//===----------------------------------------------------------------------===//
446// Data structures for constructing summaries.
447//===----------------------------------------------------------------------===//
Ted Kremenek53301ba2008-06-24 03:49:48 +0000448
Ted Kremenek553cf182008-06-25 21:21:56 +0000449namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000450class ObjCSummaryKey {
Ted Kremenek553cf182008-06-25 21:21:56 +0000451 IdentifierInfo* II;
452 Selector S;
Mike Stump1eb44332009-09-09 15:08:12 +0000453public:
Ted Kremenek553cf182008-06-25 21:21:56 +0000454 ObjCSummaryKey(IdentifierInfo* ii, Selector s)
455 : II(ii), S(s) {}
456
Ted Kremenek9c378f72011-08-12 23:37:29 +0000457 ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
Ted Kremenek553cf182008-06-25 21:21:56 +0000458 : II(d ? d->getIdentifier() : 0), S(s) {}
Ted Kremenek70b6a832009-05-13 18:16:01 +0000459
Ted Kremenek553cf182008-06-25 21:21:56 +0000460 ObjCSummaryKey(Selector s)
461 : II(0), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000462
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000463 IdentifierInfo *getIdentifier() const { return II; }
Ted Kremenek553cf182008-06-25 21:21:56 +0000464 Selector getSelector() const { return S; }
465};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000466}
467
468namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000469template <> struct DenseMapInfo<ObjCSummaryKey> {
470 static inline ObjCSummaryKey getEmptyKey() {
471 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
472 DenseMapInfo<Selector>::getEmptyKey());
473 }
Mike Stump1eb44332009-09-09 15:08:12 +0000474
Ted Kremenek553cf182008-06-25 21:21:56 +0000475 static inline ObjCSummaryKey getTombstoneKey() {
476 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
Mike Stump1eb44332009-09-09 15:08:12 +0000477 DenseMapInfo<Selector>::getTombstoneKey());
Ted Kremenek553cf182008-06-25 21:21:56 +0000478 }
Mike Stump1eb44332009-09-09 15:08:12 +0000479
Ted Kremenek553cf182008-06-25 21:21:56 +0000480 static unsigned getHashValue(const ObjCSummaryKey &V) {
Benjamin Kramer28b23072012-05-27 13:28:44 +0000481 typedef std::pair<IdentifierInfo*, Selector> PairTy;
482 return DenseMapInfo<PairTy>::getHashValue(PairTy(V.getIdentifier(),
483 V.getSelector()));
Ted Kremenek553cf182008-06-25 21:21:56 +0000484 }
Mike Stump1eb44332009-09-09 15:08:12 +0000485
Ted Kremenek553cf182008-06-25 21:21:56 +0000486 static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
Benjamin Kramer28b23072012-05-27 13:28:44 +0000487 return LHS.getIdentifier() == RHS.getIdentifier() &&
488 LHS.getSelector() == RHS.getSelector();
Ted Kremenek553cf182008-06-25 21:21:56 +0000489 }
Mike Stump1eb44332009-09-09 15:08:12 +0000490
Ted Kremenek553cf182008-06-25 21:21:56 +0000491};
Chris Lattner06159e82009-12-15 07:26:51 +0000492template <>
493struct isPodLike<ObjCSummaryKey> { static const bool value = true; };
Ted Kremenek4f22a782008-06-23 23:30:29 +0000494} // end llvm namespace
Mike Stump1eb44332009-09-09 15:08:12 +0000495
Ted Kremenek4f22a782008-06-23 23:30:29 +0000496namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000497class ObjCSummaryCache {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000498 typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
Ted Kremenek553cf182008-06-25 21:21:56 +0000499 MapTy M;
500public:
501 ObjCSummaryCache() {}
Mike Stump1eb44332009-09-09 15:08:12 +0000502
Ted Kremenek93edbc52011-10-05 23:54:29 +0000503 const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000504 // Do a lookup with the (D,S) pair. If we find a match return
505 // the iterator.
506 ObjCSummaryKey K(D, S);
507 MapTy::iterator I = M.find(K);
Mike Stump1eb44332009-09-09 15:08:12 +0000508
Jordan Rose4531b7d2012-07-02 19:27:43 +0000509 if (I != M.end())
Ted Kremenek614cc542009-07-21 23:27:57 +0000510 return I->second;
Jordan Rose4531b7d2012-07-02 19:27:43 +0000511 if (!D)
512 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +0000513
Ted Kremenek553cf182008-06-25 21:21:56 +0000514 // Walk the super chain. If we find a hit with a parent, we'll end
515 // up returning that summary. We actually allow that key (null,S), as
516 // we cache summaries for the null ObjCInterfaceDecl* to allow us to
517 // generate initial summaries without having to worry about NSObject
518 // being declared.
519 // FIXME: We may change this at some point.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000520 for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000521 if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
522 break;
Mike Stump1eb44332009-09-09 15:08:12 +0000523
Ted Kremenek553cf182008-06-25 21:21:56 +0000524 if (!C)
Ted Kremenek614cc542009-07-21 23:27:57 +0000525 return NULL;
Ted Kremenek553cf182008-06-25 21:21:56 +0000526 }
Mike Stump1eb44332009-09-09 15:08:12 +0000527
528 // Cache the summary with original key to make the next lookup faster
Ted Kremenek553cf182008-06-25 21:21:56 +0000529 // and return the iterator.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000530 const RetainSummary *Summ = I->second;
Ted Kremenek614cc542009-07-21 23:27:57 +0000531 M[K] = Summ;
532 return Summ;
Ted Kremenek553cf182008-06-25 21:21:56 +0000533 }
Mike Stump1eb44332009-09-09 15:08:12 +0000534
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000535 const RetainSummary *find(IdentifierInfo* II, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000536 // FIXME: Class method lookup. Right now we dont' have a good way
537 // of going between IdentifierInfo* and the class hierarchy.
Ted Kremenek614cc542009-07-21 23:27:57 +0000538 MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
Mike Stump1eb44332009-09-09 15:08:12 +0000539
Ted Kremenek614cc542009-07-21 23:27:57 +0000540 if (I == M.end())
541 I = M.find(ObjCSummaryKey(S));
Mike Stump1eb44332009-09-09 15:08:12 +0000542
Ted Kremenek614cc542009-07-21 23:27:57 +0000543 return I == M.end() ? NULL : I->second;
Ted Kremenek553cf182008-06-25 21:21:56 +0000544 }
Mike Stump1eb44332009-09-09 15:08:12 +0000545
Ted Kremenek93edbc52011-10-05 23:54:29 +0000546 const RetainSummary *& operator[](ObjCSummaryKey K) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000547 return M[K];
548 }
Mike Stump1eb44332009-09-09 15:08:12 +0000549
Ted Kremenek93edbc52011-10-05 23:54:29 +0000550 const RetainSummary *& operator[](Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000551 return M[ ObjCSummaryKey(S) ];
552 }
Mike Stump1eb44332009-09-09 15:08:12 +0000553};
Ted Kremenek553cf182008-06-25 21:21:56 +0000554} // end anonymous namespace
555
556//===----------------------------------------------------------------------===//
557// Data structures for managing collections of summaries.
558//===----------------------------------------------------------------------===//
559
560namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000561class RetainSummaryManager {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000562
563 //==-----------------------------------------------------------------==//
564 // Typedefs.
565 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000566
Ted Kremenek93edbc52011-10-05 23:54:29 +0000567 typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000568 FuncSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000569
Ted Kremenek4f22a782008-06-23 23:30:29 +0000570 typedef ObjCSummaryCache ObjCMethodSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000571
Jordy Roseef945882012-03-18 01:26:10 +0000572 typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode;
573
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000574 //==-----------------------------------------------------------------==//
575 // Data.
576 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000577
Ted Kremenek553cf182008-06-25 21:21:56 +0000578 /// Ctx - The ASTContext object for the analyzed ASTs.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000579 ASTContext &Ctx;
Ted Kremenek179064e2008-07-01 17:21:27 +0000580
Ted Kremenek553cf182008-06-25 21:21:56 +0000581 /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
Ted Kremenek377e2302008-04-29 05:33:51 +0000582 const bool GCEnabled;
Mike Stump1eb44332009-09-09 15:08:12 +0000583
John McCallf85e1932011-06-15 23:02:42 +0000584 /// Records whether or not the analyzed code runs in ARC mode.
585 const bool ARCEnabled;
586
Ted Kremenek553cf182008-06-25 21:21:56 +0000587 /// FuncSummaries - A map from FunctionDecls to summaries.
Mike Stump1eb44332009-09-09 15:08:12 +0000588 FuncSummariesTy FuncSummaries;
589
Ted Kremenek553cf182008-06-25 21:21:56 +0000590 /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
591 /// to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000592 ObjCMethodSummariesTy ObjCClassMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000593
Ted Kremenek553cf182008-06-25 21:21:56 +0000594 /// ObjCMethodSummaries - A map from selectors to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000595 ObjCMethodSummariesTy ObjCMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000596
Ted Kremenek553cf182008-06-25 21:21:56 +0000597 /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
598 /// and all other data used by the checker.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000599 llvm::BumpPtrAllocator BPAlloc;
Mike Stump1eb44332009-09-09 15:08:12 +0000600
Ted Kremenekb77449c2009-05-03 05:20:50 +0000601 /// AF - A factory for ArgEffects objects.
Mike Stump1eb44332009-09-09 15:08:12 +0000602 ArgEffects::Factory AF;
603
Ted Kremenek553cf182008-06-25 21:21:56 +0000604 /// ScratchArgs - A holding buffer for construct ArgEffects.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000605 ArgEffects ScratchArgs;
Mike Stump1eb44332009-09-09 15:08:12 +0000606
Ted Kremenekec315332009-05-07 23:40:42 +0000607 /// ObjCAllocRetE - Default return effect for methods returning Objective-C
608 /// objects.
609 RetEffect ObjCAllocRetE;
Ted Kremenek547d4952009-06-05 23:18:01 +0000610
Mike Stump1eb44332009-09-09 15:08:12 +0000611 /// ObjCInitRetE - Default return effect for init methods returning
Ted Kremenekac02f202009-08-20 05:13:36 +0000612 /// Objective-C objects.
Ted Kremenek547d4952009-06-05 23:18:01 +0000613 RetEffect ObjCInitRetE;
Mike Stump1eb44332009-09-09 15:08:12 +0000614
Jordy Roseef945882012-03-18 01:26:10 +0000615 /// SimpleSummaries - Used for uniquing summaries that don't have special
616 /// effects.
617 llvm::FoldingSet<CachedSummaryNode> SimpleSummaries;
Mike Stump1eb44332009-09-09 15:08:12 +0000618
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000619 //==-----------------------------------------------------------------==//
620 // Methods.
621 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000622
Ted Kremenek553cf182008-06-25 21:21:56 +0000623 /// getArgEffects - Returns a persistent ArgEffects object based on the
624 /// data in ScratchArgs.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000625 ArgEffects getArgEffects();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000626
Mike Stump1eb44332009-09-09 15:08:12 +0000627 enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
Ted Kremenek93edbc52011-10-05 23:54:29 +0000628
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000629 const RetainSummary *getUnarySummary(const FunctionType* FT,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000630 UnaryFuncKind func);
Mike Stump1eb44332009-09-09 15:08:12 +0000631
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000632 const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
633 const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
634 const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000635
Jordy Roseef945882012-03-18 01:26:10 +0000636 const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm);
Ted Kremenek706522f2008-10-29 04:07:07 +0000637
Jordy Roseef945882012-03-18 01:26:10 +0000638 const RetainSummary *getPersistentSummary(RetEffect RetEff,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000639 ArgEffect ReceiverEff = DoNothing,
640 ArgEffect DefaultEff = MayEscape) {
Jordy Roseef945882012-03-18 01:26:10 +0000641 RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff);
642 return getPersistentSummary(Summ);
643 }
644
Ted Kremenekc91fdf62012-05-08 00:12:09 +0000645 const RetainSummary *getDoNothingSummary() {
646 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
647 }
648
Jordy Roseef945882012-03-18 01:26:10 +0000649 const RetainSummary *getDefaultSummary() {
650 return getPersistentSummary(RetEffect::MakeNoRet(),
651 DoNothing, MayEscape);
Ted Kremenek9c32d082008-05-06 00:30:21 +0000652 }
Mike Stump1eb44332009-09-09 15:08:12 +0000653
Ted Kremenek93edbc52011-10-05 23:54:29 +0000654 const RetainSummary *getPersistentStopSummary() {
Jordy Roseef945882012-03-18 01:26:10 +0000655 return getPersistentSummary(RetEffect::MakeNoRet(),
656 StopTracking, StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +0000657 }
Ted Kremenekb3095252008-05-06 04:20:12 +0000658
Ted Kremenek1f180c32008-06-23 22:21:20 +0000659 void InitializeClassMethodSummaries();
660 void InitializeMethodSummaries();
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000661private:
Ted Kremenek93edbc52011-10-05 23:54:29 +0000662 void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000663 ObjCClassMethodSummaries[S] = Summ;
664 }
Mike Stump1eb44332009-09-09 15:08:12 +0000665
Ted Kremenek93edbc52011-10-05 23:54:29 +0000666 void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000667 ObjCMethodSummaries[S] = Summ;
668 }
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000669
Ted Kremeneka9797122012-02-18 21:37:48 +0000670 void addClassMethSummary(const char* Cls, const char* name,
671 const RetainSummary *Summ, bool isNullary = true) {
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000672 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
Ted Kremeneka9797122012-02-18 21:37:48 +0000673 Selector S = isNullary ? GetNullarySelector(name, Ctx)
674 : GetUnarySelector(name, Ctx);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000675 ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
676 }
Mike Stump1eb44332009-09-09 15:08:12 +0000677
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000678 void addInstMethSummary(const char* Cls, const char* nullaryName,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000679 const RetainSummary *Summ) {
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000680 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
681 Selector S = GetNullarySelector(nullaryName, Ctx);
682 ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
683 }
Mike Stump1eb44332009-09-09 15:08:12 +0000684
Ted Kremenekde4d5332009-04-24 17:50:11 +0000685 Selector generateSelector(va_list argp) {
Chris Lattner5f9e2722011-07-23 10:55:15 +0000686 SmallVector<IdentifierInfo*, 10> II;
Ted Kremenekde4d5332009-04-24 17:50:11 +0000687
Ted Kremenek9e476de2008-08-12 18:30:56 +0000688 while (const char* s = va_arg(argp, const char*))
689 II.push_back(&Ctx.Idents.get(s));
Ted Kremenekde4d5332009-04-24 17:50:11 +0000690
Mike Stump1eb44332009-09-09 15:08:12 +0000691 return Ctx.Selectors.getSelector(II.size(), &II[0]);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000692 }
Mike Stump1eb44332009-09-09 15:08:12 +0000693
Ted Kremenekde4d5332009-04-24 17:50:11 +0000694 void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000695 const RetainSummary * Summ, va_list argp) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000696 Selector S = generateSelector(argp);
697 Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
Ted Kremenek70a733e2008-07-18 17:24:20 +0000698 }
Mike Stump1eb44332009-09-09 15:08:12 +0000699
Ted Kremenek93edbc52011-10-05 23:54:29 +0000700 void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000701 va_list argp;
702 va_start(argp, Summ);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000703 addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp);
Mike Stump1eb44332009-09-09 15:08:12 +0000704 va_end(argp);
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000705 }
Mike Stump1eb44332009-09-09 15:08:12 +0000706
Ted Kremenek93edbc52011-10-05 23:54:29 +0000707 void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000708 va_list argp;
709 va_start(argp, Summ);
710 addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp);
711 va_end(argp);
712 }
Mike Stump1eb44332009-09-09 15:08:12 +0000713
Ted Kremenek93edbc52011-10-05 23:54:29 +0000714 void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000715 va_list argp;
716 va_start(argp, Summ);
717 addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp);
718 va_end(argp);
719 }
720
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000721public:
Mike Stump1eb44332009-09-09 15:08:12 +0000722
Ted Kremenek9c378f72011-08-12 23:37:29 +0000723 RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
Ted Kremenek179064e2008-07-01 17:21:27 +0000724 : Ctx(ctx),
John McCallf85e1932011-06-15 23:02:42 +0000725 GCEnabled(gcenabled),
726 ARCEnabled(usesARC),
727 AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
728 ObjCAllocRetE(gcenabled
729 ? RetEffect::MakeGCNotOwned()
730 : (usesARC ? RetEffect::MakeARCNotOwned()
731 : RetEffect::MakeOwned(RetEffect::ObjC, true))),
732 ObjCInitRetE(gcenabled
733 ? RetEffect::MakeGCNotOwned()
734 : (usesARC ? RetEffect::MakeARCNotOwned()
Jordy Roseef945882012-03-18 01:26:10 +0000735 : RetEffect::MakeOwnedWhenTrackedReceiver())) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000736 InitializeClassMethodSummaries();
737 InitializeMethodSummaries();
738 }
Mike Stump1eb44332009-09-09 15:08:12 +0000739
Jordan Rose4531b7d2012-07-02 19:27:43 +0000740 const RetainSummary *getSummary(const CallEvent &Call,
741 ProgramStateRef State = 0);
Mike Stump1eb44332009-09-09 15:08:12 +0000742
Jordan Rose4531b7d2012-07-02 19:27:43 +0000743 const RetainSummary *getFunctionSummary(const FunctionDecl *FD);
744
745 const RetainSummary *getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
Jordy Rosef3aae582012-03-17 21:13:07 +0000746 const ObjCMethodDecl *MD,
747 QualType RetTy,
748 ObjCMethodSummariesTy &CachedSummaries);
749
Jordan Rose4531b7d2012-07-02 19:27:43 +0000750 const RetainSummary *getInstanceMethodSummary(const ObjCMessageInvocation &M,
751 ProgramStateRef State);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000752
Jordan Rose4531b7d2012-07-02 19:27:43 +0000753 const RetainSummary *getClassMethodSummary(const ObjCMessageInvocation &M) {
754 assert(!M.isInstanceMessage());
755 const ObjCInterfaceDecl *Class = M.getReceiverInterface();
Mike Stump1eb44332009-09-09 15:08:12 +0000756
Jordan Rose4531b7d2012-07-02 19:27:43 +0000757 return getMethodSummary(M.getSelector(), Class, M.getDecl(),
758 M.getResultType(), ObjCClassMethodSummaries);
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +0000759 }
Ted Kremenek552333c2009-04-29 17:17:48 +0000760
761 /// getMethodSummary - This version of getMethodSummary is used to query
762 /// the summary for the current method being analyzed.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000763 const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
Ted Kremeneka8833552009-04-29 23:03:22 +0000764 const ObjCInterfaceDecl *ID = MD->getClassInterface();
Ted Kremenek70a65762009-04-30 05:41:14 +0000765 Selector S = MD->getSelector();
Ted Kremenek552333c2009-04-29 17:17:48 +0000766 QualType ResultTy = MD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000767
Jordy Rosef3aae582012-03-17 21:13:07 +0000768 ObjCMethodSummariesTy *CachedSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000769 if (MD->isInstanceMethod())
Jordy Rosef3aae582012-03-17 21:13:07 +0000770 CachedSummaries = &ObjCMethodSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000771 else
Jordy Rosef3aae582012-03-17 21:13:07 +0000772 CachedSummaries = &ObjCClassMethodSummaries;
773
Jordan Rose4531b7d2012-07-02 19:27:43 +0000774 return getMethodSummary(S, ID, MD, ResultTy, *CachedSummaries);
Ted Kremenek552333c2009-04-29 17:17:48 +0000775 }
Mike Stump1eb44332009-09-09 15:08:12 +0000776
Jordy Rosef3aae582012-03-17 21:13:07 +0000777 const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
Jordan Rose4531b7d2012-07-02 19:27:43 +0000778 Selector S, QualType RetTy);
Ted Kremeneka8833552009-04-29 23:03:22 +0000779
Ted Kremenek93edbc52011-10-05 23:54:29 +0000780 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000781 const ObjCMethodDecl *MD);
782
Ted Kremenek93edbc52011-10-05 23:54:29 +0000783 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000784 const FunctionDecl *FD);
785
Jordan Rose4531b7d2012-07-02 19:27:43 +0000786 void updateSummaryForCall(const RetainSummary *&Summ,
787 const CallEvent &Call);
788
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000789 bool isGCEnabled() const { return GCEnabled; }
Mike Stump1eb44332009-09-09 15:08:12 +0000790
John McCallf85e1932011-06-15 23:02:42 +0000791 bool isARCEnabled() const { return ARCEnabled; }
792
793 bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
Jordan Rose4531b7d2012-07-02 19:27:43 +0000794
795 RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
796
797 friend class RetainSummaryTemplate;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000798};
Mike Stump1eb44332009-09-09 15:08:12 +0000799
Jordy Rose0fe62f82011-08-24 09:02:37 +0000800// Used to avoid allocating long-term (BPAlloc'd) memory for default retain
801// summaries. If a function or method looks like it has a default summary, but
802// it has annotations, the annotations are added to the stack-based template
803// and then copied into managed memory.
804class RetainSummaryTemplate {
805 RetainSummaryManager &Manager;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000806 const RetainSummary *&RealSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000807 RetainSummary ScratchSummary;
808 bool Accessed;
809public:
Jordan Rose4531b7d2012-07-02 19:27:43 +0000810 RetainSummaryTemplate(const RetainSummary *&real, RetainSummaryManager &mgr)
811 : Manager(mgr), RealSummary(real), ScratchSummary(*real), Accessed(false) {}
Jordy Rose0fe62f82011-08-24 09:02:37 +0000812
813 ~RetainSummaryTemplate() {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000814 if (Accessed)
Jordy Roseef945882012-03-18 01:26:10 +0000815 RealSummary = Manager.getPersistentSummary(ScratchSummary);
Jordy Rose0fe62f82011-08-24 09:02:37 +0000816 }
817
818 RetainSummary &operator*() {
819 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000820 return ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000821 }
822
823 RetainSummary *operator->() {
824 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000825 return &ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000826 }
827};
828
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000829} // end anonymous namespace
830
831//===----------------------------------------------------------------------===//
832// Implementation of checker data structures.
833//===----------------------------------------------------------------------===//
834
Ted Kremenekb77449c2009-05-03 05:20:50 +0000835ArgEffects RetainSummaryManager::getArgEffects() {
836 ArgEffects AE = ScratchArgs;
Ted Kremenek3baf6722010-11-24 00:54:37 +0000837 ScratchArgs = AF.getEmptyMap();
Ted Kremenekb77449c2009-05-03 05:20:50 +0000838 return AE;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000839}
840
Ted Kremenek93edbc52011-10-05 23:54:29 +0000841const RetainSummary *
Jordy Roseef945882012-03-18 01:26:10 +0000842RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) {
843 // Unique "simple" summaries -- those without ArgEffects.
844 if (OldSumm.isSimple()) {
845 llvm::FoldingSetNodeID ID;
846 OldSumm.Profile(ID);
847
848 void *Pos;
849 CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos);
850
851 if (!N) {
852 N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>();
853 new (N) CachedSummaryNode(OldSumm);
854 SimpleSummaries.InsertNode(N, Pos);
855 }
856
857 return &N->getValue();
858 }
859
Ted Kremenek93edbc52011-10-05 23:54:29 +0000860 RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
Jordy Roseef945882012-03-18 01:26:10 +0000861 new (Summ) RetainSummary(OldSumm);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000862 return Summ;
863}
864
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000865//===----------------------------------------------------------------------===//
866// Summary creation for functions (largely uses of Core Foundation).
867//===----------------------------------------------------------------------===//
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000868
Ted Kremenek9c378f72011-08-12 23:37:29 +0000869static bool isRetain(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000870 return FName.endswith("Retain");
Ted Kremenek12619382009-01-12 21:45:02 +0000871}
872
Ted Kremenek9c378f72011-08-12 23:37:29 +0000873static bool isRelease(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000874 return FName.endswith("Release");
Ted Kremenek12619382009-01-12 21:45:02 +0000875}
876
Jordy Rose76c506f2011-08-21 21:58:18 +0000877static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
878 // FIXME: Remove FunctionDecl parameter.
879 // FIXME: Is it really okay if MakeCollectable isn't a suffix?
880 return FName.find("MakeCollectable") != StringRef::npos;
881}
882
Jordan Rose4531b7d2012-07-02 19:27:43 +0000883static ArgEffect getStopTrackingEquivalent(ArgEffect E) {
884 switch (E) {
885 case DoNothing:
886 case Autorelease:
887 case DecRefBridgedTransfered:
888 case IncRef:
889 case IncRefMsg:
890 case MakeCollectable:
891 case MayEscape:
892 case NewAutoreleasePool:
893 case StopTracking:
894 return StopTracking;
895 case DecRef:
896 case DecRefAndStopTracking:
897 return DecRefAndStopTracking;
898 case DecRefMsg:
899 case DecRefMsgAndStopTracking:
900 return DecRefMsgAndStopTracking;
901 case Dealloc:
902 return Dealloc;
903 }
904
905 llvm_unreachable("Unknown ArgEffect kind");
906}
907
908void RetainSummaryManager::updateSummaryForCall(const RetainSummary *&S,
909 const CallEvent &Call) {
910 if (Call.hasNonZeroCallbackArg()) {
911 ArgEffect RecEffect = getStopTrackingEquivalent(S->getReceiverEffect());
912 ArgEffect DefEffect = getStopTrackingEquivalent(S->getDefaultArgEffect());
913
914 ArgEffects CustomArgEffects = S->getArgEffects();
915 for (ArgEffects::iterator I = CustomArgEffects.begin(),
916 E = CustomArgEffects.end();
917 I != E; ++I) {
918 ArgEffect Translated = getStopTrackingEquivalent(I->second);
919 if (Translated != DefEffect)
920 ScratchArgs = AF.add(ScratchArgs, I->first, Translated);
921 }
922
923 RetEffect RE = RetEffect::MakeNoRet();
924
925 // Special cases where the callback argument CANNOT free the return value.
926 // This can generally only happen if we know that the callback will only be
927 // called when the return value is already being deallocated.
928 if (const FunctionCall *FC = dyn_cast<FunctionCall>(&Call)) {
929 IdentifierInfo *Name = FC->getDecl()->getIdentifier();
930
931 // This callback frees the associated buffer.
932 if (Name->isStr("CGBitmapContextCreateWithData"))
933 RE = S->getRetEffect();
934 }
935
936 S = getPersistentSummary(RE, RecEffect, DefEffect);
937 }
938}
939
Anna Zaks58822c42012-05-04 22:18:39 +0000940const RetainSummary *
Jordan Rose4531b7d2012-07-02 19:27:43 +0000941RetainSummaryManager::getSummary(const CallEvent &Call,
942 ProgramStateRef State) {
943 const RetainSummary *Summ;
944 switch (Call.getKind()) {
945 case CE_Function:
946 Summ = getFunctionSummary(cast<FunctionCall>(Call).getDecl());
947 break;
948 case CE_CXXMember:
949 case CE_Block:
950 case CE_CXXConstructor:
951 // FIXME: These calls are currently unsupported.
952 return getPersistentStopSummary();
953 case CE_ObjCMessage: {
954 const ObjCMessageInvocation &Msg = cast<ObjCMessageInvocation>(Call);
955 if (Msg.isInstanceMessage())
956 Summ = getInstanceMethodSummary(Msg, State);
957 else
958 Summ = getClassMethodSummary(Msg);
959 break;
960 }
961 }
962
963 updateSummaryForCall(Summ, Call);
964
965 assert(Summ && "Unknown call type?");
966 return Summ;
967}
968
969const RetainSummary *
970RetainSummaryManager::getFunctionSummary(const FunctionDecl *FD) {
971 // If we don't know what function we're calling, use our default summary.
972 if (!FD)
973 return getDefaultSummary();
974
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000975 // Look up a summary in our cache of FunctionDecls -> Summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000976 FuncSummariesTy::iterator I = FuncSummaries.find(FD);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000977 if (I != FuncSummaries.end())
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000978 return I->second;
979
Ted Kremeneke401a0c2009-05-04 15:34:07 +0000980 // No summary? Generate one.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000981 const RetainSummary *S = 0;
Mike Stump1eb44332009-09-09 15:08:12 +0000982
Ted Kremenek37d785b2008-07-15 16:50:12 +0000983 do {
Ted Kremenek12619382009-01-12 21:45:02 +0000984 // We generate "stop" summaries for implicitly defined functions.
985 if (FD->isImplicit()) {
986 S = getPersistentStopSummary();
987 break;
Ted Kremenek37d785b2008-07-15 16:50:12 +0000988 }
Mike Stump1eb44332009-09-09 15:08:12 +0000989
John McCall183700f2009-09-21 23:43:11 +0000990 // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
Ted Kremenek99890652009-01-16 18:40:33 +0000991 // function's type.
John McCall183700f2009-09-21 23:43:11 +0000992 const FunctionType* FT = FD->getType()->getAs<FunctionType>();
Ted Kremenek48c6d182009-12-16 06:06:43 +0000993 const IdentifierInfo *II = FD->getIdentifier();
994 if (!II)
995 break;
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000996
997 StringRef FName = II->getName();
Mike Stump1eb44332009-09-09 15:08:12 +0000998
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +0000999 // Strip away preceding '_'. Doing this here will effect all the checks
1000 // down below.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001001 FName = FName.substr(FName.find_first_not_of('_'));
Mike Stump1eb44332009-09-09 15:08:12 +00001002
Ted Kremenek12619382009-01-12 21:45:02 +00001003 // Inspect the result type.
1004 QualType RetTy = FT->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001005
Ted Kremenek12619382009-01-12 21:45:02 +00001006 // FIXME: This should all be refactored into a chain of "summary lookup"
1007 // filters.
Ted Kremenek008636a2009-10-14 00:27:24 +00001008 assert(ScratchArgs.isEmpty());
Ted Kremenek39d88b02009-06-15 20:36:07 +00001009
Ted Kremenekbefc6d22012-04-26 04:32:23 +00001010 if (FName == "pthread_create" || FName == "pthread_setspecific") {
1011 // Part of: <rdar://problem/7299394> and <rdar://problem/11282706>.
1012 // This will be addressed better with IPA.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001013 S = getPersistentStopSummary();
1014 } else if (FName == "NSMakeCollectable") {
1015 // Handle: id NSMakeCollectable(CFTypeRef)
1016 S = (RetTy->isObjCIdType())
1017 ? getUnarySummary(FT, cfmakecollectable)
1018 : getPersistentStopSummary();
1019 } else if (FName == "IOBSDNameMatching" ||
1020 FName == "IOServiceMatching" ||
1021 FName == "IOServiceNameMatching" ||
Ted Kremenek537dd3a2012-05-01 05:28:27 +00001022 FName == "IORegistryEntrySearchCFProperty" ||
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001023 FName == "IORegistryEntryIDMatching" ||
1024 FName == "IOOpenFirmwarePathMatching") {
1025 // Part of <rdar://problem/6961230>. (IOKit)
1026 // This should be addressed using a API table.
1027 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1028 DoNothing, DoNothing);
1029 } else if (FName == "IOServiceGetMatchingService" ||
1030 FName == "IOServiceGetMatchingServices") {
1031 // FIXES: <rdar://problem/6326900>
1032 // This should be addressed using a API table. This strcmp is also
1033 // a little gross, but there is no need to super optimize here.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001034 ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001035 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1036 } else if (FName == "IOServiceAddNotification" ||
1037 FName == "IOServiceAddMatchingNotification") {
1038 // Part of <rdar://problem/6961230>. (IOKit)
1039 // This should be addressed using a API table.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001040 ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001041 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1042 } else if (FName == "CVPixelBufferCreateWithBytes") {
1043 // FIXES: <rdar://problem/7283567>
1044 // Eventually this can be improved by recognizing that the pixel
1045 // buffer passed to CVPixelBufferCreateWithBytes is released via
1046 // a callback and doing full IPA to make sure this is done correctly.
1047 // FIXME: This function has an out parameter that returns an
1048 // allocated object.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001049 ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001050 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
1051 } else if (FName == "CGBitmapContextCreateWithData") {
1052 // FIXES: <rdar://problem/7358899>
1053 // Eventually this can be improved by recognizing that 'releaseInfo'
1054 // passed to CGBitmapContextCreateWithData is released via
1055 // a callback and doing full IPA to make sure this is done correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001056 ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001057 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
1058 DoNothing, DoNothing);
1059 } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
1060 // FIXES: <rdar://problem/7283567>
1061 // Eventually this can be improved by recognizing that the pixel
1062 // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
1063 // via a callback and doing full IPA to make sure this is done
1064 // correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001065 ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001066 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek06911d42012-03-22 06:29:41 +00001067 } else if (FName == "dispatch_set_context") {
1068 // <rdar://problem/11059275> - The analyzer currently doesn't have
1069 // a good way to reason about the finalizer function for libdispatch.
1070 // If we pass a context object that is memory managed, stop tracking it.
1071 // FIXME: this hack should possibly go away once we can handle
1072 // libdispatch finalizers.
1073 ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1074 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekc91fdf62012-05-08 00:12:09 +00001075 } else if (FName.startswith("NSLog")) {
1076 S = getDoNothingSummary();
Anna Zaks62a5c342012-03-30 05:48:16 +00001077 } else if (FName.startswith("NS") &&
1078 (FName.find("Insert") != StringRef::npos)) {
1079 // Whitelist NSXXInsertXX, for example NSMapInsertIfAbsent, since they can
1080 // be deallocated by NSMapRemove. (radar://11152419)
1081 ScratchArgs = AF.add(ScratchArgs, 1, StopTracking);
1082 ScratchArgs = AF.add(ScratchArgs, 2, StopTracking);
1083 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekb04cb592009-06-11 18:17:24 +00001084 }
Mike Stump1eb44332009-09-09 15:08:12 +00001085
Ted Kremenekb04cb592009-06-11 18:17:24 +00001086 // Did we get a summary?
1087 if (S)
1088 break;
Ted Kremenek61991902009-03-17 22:43:44 +00001089
1090 // Enable this code once the semantics of NSDeallocateObject are resolved
1091 // for GC. <rdar://problem/6619988>
1092#if 0
1093 // Handle: NSDeallocateObject(id anObject);
1094 // This method does allow 'nil' (although we don't check it now).
Mike Stump1eb44332009-09-09 15:08:12 +00001095 if (strcmp(FName, "NSDeallocateObject") == 0) {
Ted Kremenek61991902009-03-17 22:43:44 +00001096 return RetTy == Ctx.VoidTy
1097 ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc)
1098 : getPersistentStopSummary();
1099 }
1100#endif
Ted Kremenek12619382009-01-12 21:45:02 +00001101
1102 if (RetTy->isPointerType()) {
1103 // For CoreFoundation ('CF') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001104 if (cocoa::isRefType(RetTy, "CF", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001105 if (isRetain(FD, FName))
1106 S = getUnarySummary(FT, cfretain);
Jordy Rose76c506f2011-08-21 21:58:18 +00001107 else if (isMakeCollectable(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001108 S = getUnarySummary(FT, cfmakecollectable);
Mike Stump1eb44332009-09-09 15:08:12 +00001109 else
John McCall7df2ff42011-10-01 00:48:56 +00001110 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001111
1112 break;
1113 }
1114
1115 // For CoreGraphics ('CG') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001116 if (cocoa::isRefType(RetTy, "CG", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001117 if (isRetain(FD, FName))
1118 S = getUnarySummary(FT, cfretain);
1119 else
John McCall7df2ff42011-10-01 00:48:56 +00001120 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001121
1122 break;
1123 }
1124
1125 // For the Disk Arbitration API (DiskArbitration/DADisk.h)
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001126 if (cocoa::isRefType(RetTy, "DADisk") ||
1127 cocoa::isRefType(RetTy, "DADissenter") ||
1128 cocoa::isRefType(RetTy, "DASessionRef")) {
John McCall7df2ff42011-10-01 00:48:56 +00001129 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001130 break;
1131 }
Mike Stump1eb44332009-09-09 15:08:12 +00001132
Ted Kremenek12619382009-01-12 21:45:02 +00001133 break;
1134 }
1135
1136 // Check for release functions, the only kind of functions that we care
1137 // about that don't return a pointer type.
1138 if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
Ted Kremeneke7d03122010-02-08 16:45:01 +00001139 // Test for 'CGCF'.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001140 FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
Ted Kremeneke7d03122010-02-08 16:45:01 +00001141
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +00001142 if (isRelease(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001143 S = getUnarySummary(FT, cfrelease);
1144 else {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001145 assert (ScratchArgs.isEmpty());
Ted Kremenek68189282009-01-29 22:45:13 +00001146 // Remaining CoreFoundation and CoreGraphics functions.
1147 // We use to assume that they all strictly followed the ownership idiom
1148 // and that ownership cannot be transferred. While this is technically
1149 // correct, many methods allow a tracked object to escape. For example:
1150 //
Mike Stump1eb44332009-09-09 15:08:12 +00001151 // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
Ted Kremenek68189282009-01-29 22:45:13 +00001152 // CFDictionaryAddValue(y, key, x);
Mike Stump1eb44332009-09-09 15:08:12 +00001153 // CFRelease(x);
Ted Kremenek68189282009-01-29 22:45:13 +00001154 // ... it is okay to use 'x' since 'y' has a reference to it
1155 //
1156 // We handle this and similar cases with the follow heuristic. If the
Ted Kremenekc4843812009-08-20 00:57:22 +00001157 // function name contains "InsertValue", "SetValue", "AddValue",
1158 // "AppendValue", or "SetAttribute", then we assume that arguments may
1159 // "escape." This means that something else holds on to the object,
1160 // allowing it be used even after its local retain count drops to 0.
Benjamin Kramere45c1492010-01-11 19:46:28 +00001161 ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1162 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1163 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1164 StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
Benjamin Kramerc027e542010-01-11 20:15:06 +00001165 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
Ted Kremenek68189282009-01-29 22:45:13 +00001166 ? MayEscape : DoNothing;
Mike Stump1eb44332009-09-09 15:08:12 +00001167
Ted Kremenek68189282009-01-29 22:45:13 +00001168 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
Ted Kremenek12619382009-01-12 21:45:02 +00001169 }
1170 }
Ted Kremenek37d785b2008-07-15 16:50:12 +00001171 }
1172 while (0);
Mike Stump1eb44332009-09-09 15:08:12 +00001173
Jordan Rose4531b7d2012-07-02 19:27:43 +00001174 // If we got all the way here without any luck, use a default summary.
1175 if (!S)
1176 S = getDefaultSummary();
1177
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001178 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001179 updateSummaryFromAnnotations(S, FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001180
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001181 FuncSummaries[FD] = S;
Mike Stump1eb44332009-09-09 15:08:12 +00001182 return S;
Ted Kremenek2fff37e2008-03-06 00:08:09 +00001183}
1184
Ted Kremenek93edbc52011-10-05 23:54:29 +00001185const RetainSummary *
John McCall7df2ff42011-10-01 00:48:56 +00001186RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1187 if (coreFoundation::followsCreateRule(FD))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001188 return getCFSummaryCreateRule(FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001189
Ted Kremenekd368d712011-05-25 06:19:45 +00001190 return getCFSummaryGetRule(FD);
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001191}
1192
Ted Kremenek93edbc52011-10-05 23:54:29 +00001193const RetainSummary *
Ted Kremenek6ad315a2009-02-23 16:51:39 +00001194RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1195 UnaryFuncKind func) {
1196
Ted Kremenek12619382009-01-12 21:45:02 +00001197 // Sanity check that this is *really* a unary function. This can
1198 // happen if people do weird things.
Douglas Gregor72564e72009-02-26 23:50:07 +00001199 const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
Ted Kremenek12619382009-01-12 21:45:02 +00001200 if (!FTP || FTP->getNumArgs() != 1)
1201 return getPersistentStopSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001202
Ted Kremenekb77449c2009-05-03 05:20:50 +00001203 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001204
Jordy Rose76c506f2011-08-21 21:58:18 +00001205 ArgEffect Effect;
Ted Kremenek377e2302008-04-29 05:33:51 +00001206 switch (func) {
Jordy Rose76c506f2011-08-21 21:58:18 +00001207 case cfretain: Effect = IncRef; break;
1208 case cfrelease: Effect = DecRef; break;
1209 case cfmakecollectable: Effect = MakeCollectable; break;
Ted Kremenek940b1d82008-04-10 23:44:06 +00001210 }
Jordy Rose76c506f2011-08-21 21:58:18 +00001211
1212 ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1213 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001214}
1215
Ted Kremenek93edbc52011-10-05 23:54:29 +00001216const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001217RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001218 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001219
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001220 return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001221}
1222
Ted Kremenek93edbc52011-10-05 23:54:29 +00001223const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001224RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
Mike Stump1eb44332009-09-09 15:08:12 +00001225 assert (ScratchArgs.isEmpty());
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001226 return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1227 DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001228}
1229
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001230//===----------------------------------------------------------------------===//
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001231// Summary creation for Selectors.
1232//===----------------------------------------------------------------------===//
1233
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001234void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001235RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001236 const FunctionDecl *FD) {
1237 if (!FD)
1238 return;
1239
Jordan Rose4531b7d2012-07-02 19:27:43 +00001240 assert(Summ && "Must have a summary to add annotations to.");
1241 RetainSummaryTemplate Template(Summ, *this);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001242
Ted Kremenek11fe1752011-01-27 18:43:03 +00001243 // Effects on the parameters.
1244 unsigned parm_idx = 0;
1245 for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
John McCall98b8f162011-04-06 09:02:12 +00001246 pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001247 const ParmVarDecl *pd = *pi;
1248 if (pd->getAttr<NSConsumedAttr>()) {
Jordy Rose4df54fe2011-08-23 04:27:15 +00001249 if (!GCEnabled) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001250 Template->addArg(AF, parm_idx, DecRef);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001251 }
1252 } else if (pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001253 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001254 }
1255 }
1256
Ted Kremenekb04cb592009-06-11 18:17:24 +00001257 QualType RetTy = FD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001258
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001259 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001260 if (cocoa::isCocoaObjectRef(RetTy)) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001261 if (FD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001262 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001263 }
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001264 else if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001265 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenekb04cb592009-06-11 18:17:24 +00001266 }
Ted Kremenek60411112010-02-18 00:06:12 +00001267 else if (FD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001268 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001269 }
1270 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001271 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001272 }
1273 } else if (RetTy->getAs<PointerType>()) {
1274 if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001275 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001276 }
1277 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001278 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001279 }
Ted Kremenekb04cb592009-06-11 18:17:24 +00001280 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001281}
1282
1283void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001284RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1285 const ObjCMethodDecl *MD) {
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001286 if (!MD)
1287 return;
1288
Jordan Rose4531b7d2012-07-02 19:27:43 +00001289 assert(Summ && "Must have a valid summary to add annotations to");
1290 RetainSummaryTemplate Template(Summ, *this);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001291 bool isTrackedLoc = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001292
Ted Kremenek12b94342011-01-27 06:54:14 +00001293 // Effects on the receiver.
1294 if (MD->getAttr<NSConsumesSelfAttr>()) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001295 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001296 Template->setReceiverEffect(DecRefMsg);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001297 }
1298
1299 // Effects on the parameters.
1300 unsigned parm_idx = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001301 for (ObjCMethodDecl::param_const_iterator
1302 pi=MD->param_begin(), pe=MD->param_end();
Ted Kremenek11fe1752011-01-27 18:43:03 +00001303 pi != pe; ++pi, ++parm_idx) {
1304 const ParmVarDecl *pd = *pi;
1305 if (pd->getAttr<NSConsumedAttr>()) {
1306 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001307 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001308 }
1309 else if(pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001310 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001311 }
Ted Kremenek12b94342011-01-27 06:54:14 +00001312 }
1313
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001314 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001315 if (cocoa::isCocoaObjectRef(MD->getResultType())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001316 if (MD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001317 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001318 return;
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001319 }
Ted Kremenek60411112010-02-18 00:06:12 +00001320 if (MD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001321 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001322 return;
1323 }
Mike Stump1eb44332009-09-09 15:08:12 +00001324
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001325 isTrackedLoc = true;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001326 } else {
Ted Kremenek6217b802009-07-29 21:53:49 +00001327 isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001328 }
Mike Stump1eb44332009-09-09 15:08:12 +00001329
Ted Kremenek60411112010-02-18 00:06:12 +00001330 if (isTrackedLoc) {
1331 if (MD->getAttr<CFReturnsRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001332 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek60411112010-02-18 00:06:12 +00001333 else if (MD->getAttr<CFReturnsNotRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001334 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001335 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001336}
1337
Ted Kremenek93edbc52011-10-05 23:54:29 +00001338const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001339RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1340 Selector S, QualType RetTy) {
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001341
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +00001342 if (MD) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001343 // Scan the method decl for 'void*' arguments. These should be treated
1344 // as 'StopTracking' because they are often used with delegates.
1345 // Delegates are a frequent form of false positives with the retain
1346 // count checker.
1347 unsigned i = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001348 for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(),
Ted Kremenek376d1e72009-04-24 18:00:17 +00001349 E = MD->param_end(); I != E; ++I, ++i)
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001350 if (const ParmVarDecl *PD = *I) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001351 QualType Ty = Ctx.getCanonicalType(PD->getType());
Douglas Gregora4923eb2009-11-16 21:35:15 +00001352 if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy)
Ted Kremenek3baf6722010-11-24 00:54:37 +00001353 ScratchArgs = AF.add(ScratchArgs, i, StopTracking);
Ted Kremenek376d1e72009-04-24 18:00:17 +00001354 }
1355 }
Mike Stump1eb44332009-09-09 15:08:12 +00001356
Jordy Rosee921b1a2012-03-17 19:53:04 +00001357 // Any special effects?
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001358 ArgEffect ReceiverEff = DoNothing;
Jordy Rosee921b1a2012-03-17 19:53:04 +00001359 RetEffect ResultEff = RetEffect::MakeNoRet();
1360
1361 // Check the method family, and apply any default annotations.
1362 switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1363 case OMF_None:
1364 case OMF_performSelector:
1365 // Assume all Objective-C methods follow Cocoa Memory Management rules.
1366 // FIXME: Does the non-threaded performSelector family really belong here?
1367 // The selector could be, say, @selector(copy).
1368 if (cocoa::isCocoaObjectRef(RetTy))
1369 ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
1370 else if (coreFoundation::isCFObjectRef(RetTy)) {
1371 // ObjCMethodDecl currently doesn't consider CF objects as valid return
1372 // values for alloc, new, copy, or mutableCopy, so we have to
1373 // double-check with the selector. This is ugly, but there aren't that
1374 // many Objective-C methods that return CF objects, right?
1375 if (MD) {
1376 switch (S.getMethodFamily()) {
1377 case OMF_alloc:
1378 case OMF_new:
1379 case OMF_copy:
1380 case OMF_mutableCopy:
1381 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1382 break;
1383 default:
1384 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1385 break;
1386 }
1387 } else {
1388 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1389 }
1390 }
1391 break;
1392 case OMF_init:
1393 ResultEff = ObjCInitRetE;
1394 ReceiverEff = DecRefMsg;
1395 break;
1396 case OMF_alloc:
1397 case OMF_new:
1398 case OMF_copy:
1399 case OMF_mutableCopy:
1400 if (cocoa::isCocoaObjectRef(RetTy))
1401 ResultEff = ObjCAllocRetE;
1402 else if (coreFoundation::isCFObjectRef(RetTy))
1403 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1404 break;
1405 case OMF_autorelease:
1406 ReceiverEff = Autorelease;
1407 break;
1408 case OMF_retain:
1409 ReceiverEff = IncRefMsg;
1410 break;
1411 case OMF_release:
1412 ReceiverEff = DecRefMsg;
1413 break;
1414 case OMF_dealloc:
1415 ReceiverEff = Dealloc;
1416 break;
1417 case OMF_self:
1418 // -self is handled specially by the ExprEngine to propagate the receiver.
1419 break;
1420 case OMF_retainCount:
1421 case OMF_finalize:
1422 // These methods don't return objects.
1423 break;
1424 }
Mike Stump1eb44332009-09-09 15:08:12 +00001425
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001426 // If one of the arguments in the selector has the keyword 'delegate' we
1427 // should stop tracking the reference count for the receiver. This is
1428 // because the reference count is quite possibly handled by a delegate
1429 // method.
1430 if (S.isKeywordSelector()) {
Jordan Rose50571a92012-06-15 18:19:52 +00001431 for (unsigned i = 0, e = S.getNumArgs(); i != e; ++i) {
1432 StringRef Slot = S.getNameForSlot(i);
1433 if (Slot.substr(Slot.size() - 8).equals_lower("delegate")) {
1434 if (ResultEff == ObjCInitRetE)
1435 ResultEff = RetEffect::MakeNoRet();
1436 else
1437 ReceiverEff = StopTracking;
1438 }
1439 }
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001440 }
Mike Stump1eb44332009-09-09 15:08:12 +00001441
Jordy Rosee921b1a2012-03-17 19:53:04 +00001442 if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1443 ResultEff.getKind() == RetEffect::NoRet)
Ted Kremenek93edbc52011-10-05 23:54:29 +00001444 return getDefaultSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001445
Jordy Rosee921b1a2012-03-17 19:53:04 +00001446 return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
Ted Kremenek250b1fa2009-04-23 23:08:22 +00001447}
1448
Ted Kremenek93edbc52011-10-05 23:54:29 +00001449const RetainSummary *
Jordan Rose4531b7d2012-07-02 19:27:43 +00001450RetainSummaryManager::getInstanceMethodSummary(const ObjCMessageInvocation &Msg,
1451 ProgramStateRef State) {
1452 const ObjCInterfaceDecl *ReceiverClass = 0;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001453
Jordan Rose4531b7d2012-07-02 19:27:43 +00001454 // We do better tracking of the type of the object than the core ExprEngine.
1455 // See if we have its type in our private state.
1456 // FIXME: Eventually replace the use of state->get<RefBindings> with
1457 // a generic API for reasoning about the Objective-C types of symbolic
1458 // objects.
1459 SVal ReceiverV = Msg.getReceiverSVal();
1460 if (SymbolRef Sym = ReceiverV.getAsLocSymbol())
1461 if (const RefVal *T = State->get<RefBindings>(Sym))
Douglas Gregor04badcf2010-04-21 00:45:42 +00001462 if (const ObjCObjectPointerType *PT =
Jordan Rose4531b7d2012-07-02 19:27:43 +00001463 T->getType()->getAs<ObjCObjectPointerType>())
1464 ReceiverClass = PT->getInterfaceDecl();
1465
1466 // If we don't know what kind of object this is, fall back to its static type.
1467 if (!ReceiverClass)
1468 ReceiverClass = Msg.getReceiverInterface();
Douglas Gregor04badcf2010-04-21 00:45:42 +00001469
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001470 // FIXME: The receiver could be a reference to a class, meaning that
1471 // we should use the class method.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001472 // id x = [NSObject class];
1473 // [x performSelector:... withObject:... afterDelay:...];
1474 Selector S = Msg.getSelector();
1475 const ObjCMethodDecl *Method = Msg.getDecl();
1476 if (!Method && ReceiverClass)
1477 Method = ReceiverClass->getInstanceMethod(S);
1478
1479 return getMethodSummary(S, ReceiverClass, Method, Msg.getResultType(),
1480 ObjCMethodSummaries);
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001481}
1482
Ted Kremenek93edbc52011-10-05 23:54:29 +00001483const RetainSummary *
Jordan Rose4531b7d2012-07-02 19:27:43 +00001484RetainSummaryManager::getMethodSummary(Selector S, const ObjCInterfaceDecl *ID,
Jordy Rosef3aae582012-03-17 21:13:07 +00001485 const ObjCMethodDecl *MD, QualType RetTy,
1486 ObjCMethodSummariesTy &CachedSummaries) {
Ted Kremenek1bffd742008-05-06 15:44:25 +00001487
Ted Kremenek8711c032009-04-29 05:04:30 +00001488 // Look up a summary in our summary cache.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001489 const RetainSummary *Summ = CachedSummaries.find(ID, S);
Mike Stump1eb44332009-09-09 15:08:12 +00001490
Ted Kremenek614cc542009-07-21 23:27:57 +00001491 if (!Summ) {
Jordy Rosef3aae582012-03-17 21:13:07 +00001492 Summ = getStandardMethodSummary(MD, S, RetTy);
Mike Stump1eb44332009-09-09 15:08:12 +00001493
Ted Kremenek614cc542009-07-21 23:27:57 +00001494 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001495 updateSummaryFromAnnotations(Summ, MD);
Mike Stump1eb44332009-09-09 15:08:12 +00001496
Ted Kremenek614cc542009-07-21 23:27:57 +00001497 // Memoize the summary.
Jordan Rose4531b7d2012-07-02 19:27:43 +00001498 CachedSummaries[ObjCSummaryKey(ID, S)] = Summ;
Ted Kremenek614cc542009-07-21 23:27:57 +00001499 }
Mike Stump1eb44332009-09-09 15:08:12 +00001500
Ted Kremeneke87450e2009-04-23 19:11:35 +00001501 return Summ;
Ted Kremenekc8395602008-05-06 21:26:51 +00001502}
1503
Mike Stump1eb44332009-09-09 15:08:12 +00001504void RetainSummaryManager::InitializeClassMethodSummaries() {
Ted Kremenekec315332009-05-07 23:40:42 +00001505 assert(ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001506 // Create the [NSAssertionHandler currentHander] summary.
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001507 addClassMethSummary("NSAssertionHandler", "currentHandler",
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001508 getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
Mike Stump1eb44332009-09-09 15:08:12 +00001509
Ted Kremenek6d348932008-10-21 15:53:15 +00001510 // Create the [NSAutoreleasePool addObject:] summary.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001511 ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001512 addClassMethSummary("NSAutoreleasePool", "addObject",
1513 getPersistentSummary(RetEffect::MakeNoRet(),
1514 DoNothing, Autorelease));
Ted Kremenek9c32d082008-05-06 00:30:21 +00001515}
1516
Ted Kremenek1f180c32008-06-23 22:21:20 +00001517void RetainSummaryManager::InitializeMethodSummaries() {
Mike Stump1eb44332009-09-09 15:08:12 +00001518
1519 assert (ScratchArgs.isEmpty());
1520
Ted Kremenekc8395602008-05-06 21:26:51 +00001521 // Create the "init" selector. It just acts as a pass-through for the
1522 // receiver.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001523 const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
Ted Kremenekac02f202009-08-20 05:13:36 +00001524 addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1525
1526 // awakeAfterUsingCoder: behaves basically like an 'init' method. It
1527 // claims the receiver and returns a retained object.
1528 addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1529 InitSumm);
Mike Stump1eb44332009-09-09 15:08:12 +00001530
Ted Kremenekc8395602008-05-06 21:26:51 +00001531 // The next methods are allocators.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001532 const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1533 const RetainSummary *CFAllocSumm =
Ted Kremeneka834fb42009-08-28 19:52:12 +00001534 getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Mike Stump1eb44332009-09-09 15:08:12 +00001535
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001536 // Create the "retain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001537 RetEffect NoRet = RetEffect::MakeNoRet();
Ted Kremenek93edbc52011-10-05 23:54:29 +00001538 const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001539 addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001540
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001541 // Create the "release" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001542 Summ = getPersistentSummary(NoRet, DecRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001543 addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001544
Ted Kremenek299e8152008-05-07 21:17:39 +00001545 // Create the "drain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001546 Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001547 addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001548
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001549 // Create the -dealloc summary.
Jordy Rose500abad2011-08-21 19:41:36 +00001550 Summ = getPersistentSummary(NoRet, Dealloc);
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001551 addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001552
1553 // Create the "autorelease" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001554 Summ = getPersistentSummary(NoRet, Autorelease);
Ted Kremenek553cf182008-06-25 21:21:56 +00001555 addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001556
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001557 // Specially handle NSAutoreleasePool.
Ted Kremenek6c4becb2009-02-25 02:54:57 +00001558 addInstMethSummary("NSAutoreleasePool", "init",
Jordy Rose500abad2011-08-21 19:41:36 +00001559 getPersistentSummary(NoRet, NewAutoreleasePool));
Mike Stump1eb44332009-09-09 15:08:12 +00001560
1561 // For NSWindow, allocated objects are (initially) self-owned.
Ted Kremenek89e202d2009-02-23 02:51:29 +00001562 // FIXME: For now we opt for false negatives with NSWindow, as these objects
1563 // self-own themselves. However, they only do this once they are displayed.
1564 // Thus, we need to track an NSWindow's display status.
1565 // This is tracked in <rdar://problem/6062711>.
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001566 // See also http://llvm.org/bugs/show_bug.cgi?id=3714.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001567 const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
Ted Kremenek78a35a32009-05-12 20:06:54 +00001568 StopTracking,
1569 StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +00001570
Ted Kremenek99d02692009-04-03 19:02:51 +00001571 addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1572
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001573#if 0
Ted Kremenek78a35a32009-05-12 20:06:54 +00001574 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001575 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001576
Ted Kremenek78a35a32009-05-12 20:06:54 +00001577 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001578 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001579#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001580
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001581 // For NSPanel (which subclasses NSWindow), allocated objects are not
1582 // self-owned.
Ted Kremenek99d02692009-04-03 19:02:51 +00001583 // FIXME: For now we don't track NSPanels. object for the same reason
1584 // as for NSWindow objects.
1585 addClassMethSummary("NSPanel", "alloc", NoTrackYet);
Mike Stump1eb44332009-09-09 15:08:12 +00001586
Ted Kremenek78a35a32009-05-12 20:06:54 +00001587#if 0
1588 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001589 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001590
Ted Kremenek78a35a32009-05-12 20:06:54 +00001591 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001592 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek78a35a32009-05-12 20:06:54 +00001593#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001594
Ted Kremenekba67f6a2009-05-18 23:14:34 +00001595 // Don't track allocated autorelease pools yet, as it is okay to prematurely
1596 // exit a method.
1597 addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
Ted Kremeneka9797122012-02-18 21:37:48 +00001598 addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
Ted Kremenek553cf182008-06-25 21:21:56 +00001599
Ted Kremenek767d6492009-05-20 22:39:57 +00001600 // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1601 addInstMethSummary("QCRenderer", AllocSumm,
1602 "createSnapshotImageOfType", NULL);
1603 addInstMethSummary("QCView", AllocSumm,
1604 "createSnapshotImageOfType", NULL);
1605
Ted Kremenek211a9c62009-06-15 20:58:58 +00001606 // Create summaries for CIContext, 'createCGImage' and
Ted Kremeneka834fb42009-08-28 19:52:12 +00001607 // 'createCGLayerWithSize'. These objects are CF objects, and are not
1608 // automatically garbage collected.
1609 addInstMethSummary("CIContext", CFAllocSumm,
Ted Kremenek767d6492009-05-20 22:39:57 +00001610 "createCGImage", "fromRect", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001611 addInstMethSummary("CIContext", CFAllocSumm,
Mike Stump1eb44332009-09-09 15:08:12 +00001612 "createCGImage", "fromRect", "format", "colorSpace", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001613 addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize",
Ted Kremenek211a9c62009-06-15 20:58:58 +00001614 "info", NULL);
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001615}
1616
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001617//===----------------------------------------------------------------------===//
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001618// AutoreleaseBindings - State used to track objects in autorelease pools.
Ted Kremenek6d348932008-10-21 15:53:15 +00001619//===----------------------------------------------------------------------===//
1620
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001621typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts;
1622typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents;
1623typedef llvm::ImmutableList<SymbolRef> ARStack;
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001624
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001625static int AutoRCIndex = 0;
Ted Kremenek6d348932008-10-21 15:53:15 +00001626static int AutoRBIndex = 0;
1627
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001628namespace { class AutoreleasePoolContents {}; }
1629namespace { class AutoreleaseStack {}; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001630
Ted Kremenek6d348932008-10-21 15:53:15 +00001631namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +00001632namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001633template<> struct ProgramStateTrait<AutoreleaseStack>
1634 : public ProgramStatePartialTrait<ARStack> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001635 static inline void *GDMIndex() { return &AutoRBIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001636};
1637
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001638template<> struct ProgramStateTrait<AutoreleasePoolContents>
1639 : public ProgramStatePartialTrait<ARPoolContents> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001640 static inline void *GDMIndex() { return &AutoRCIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001641};
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +00001642} // end GR namespace
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001643} // end clang namespace
Ted Kremenek6d348932008-10-21 15:53:15 +00001644
Ted Kremenek8bef8232012-01-26 21:29:00 +00001645static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001646 ARStack stack = state->get<AutoreleaseStack>();
1647 return stack.isEmpty() ? SymbolRef() : stack.getHead();
1648}
1649
Ted Kremenek8bef8232012-01-26 21:29:00 +00001650static ProgramStateRef
1651SendAutorelease(ProgramStateRef state,
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001652 ARCounts::Factory &F,
1653 SymbolRef sym) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001654 SymbolRef pool = GetCurrentAutoreleasePool(state);
Ted Kremenekb65be702009-06-18 01:23:53 +00001655 const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001656 ARCounts newCnts(0);
Mike Stump1eb44332009-09-09 15:08:12 +00001657
Ted Kremenek7037ab82009-03-20 17:34:15 +00001658 if (cnts) {
1659 const unsigned *cnt = (*cnts).lookup(sym);
Ted Kremenek3baf6722010-11-24 00:54:37 +00001660 newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001661 }
1662 else
Ted Kremenek3baf6722010-11-24 00:54:37 +00001663 newCnts = F.add(F.getEmptyMap(), sym, 1);
Mike Stump1eb44332009-09-09 15:08:12 +00001664
Ted Kremenekb65be702009-06-18 01:23:53 +00001665 return state->set<AutoreleasePoolContents>(pool, newCnts);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001666}
1667
Ted Kremenek13922612008-04-16 20:40:59 +00001668//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001669// Error reporting.
1670//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001671namespace {
Jordy Roseec9ef852011-08-23 20:55:48 +00001672 typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1673 SummaryLogTy;
1674
Ted Kremenekc887d132009-04-29 18:50:19 +00001675 //===-------------===//
1676 // Bug Descriptions. //
Mike Stump1eb44332009-09-09 15:08:12 +00001677 //===-------------===//
1678
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001679 class CFRefBug : public BugType {
Ted Kremenekc887d132009-04-29 18:50:19 +00001680 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001681 CFRefBug(StringRef name)
Ted Kremenek6fd45052012-04-05 20:43:28 +00001682 : BugType(name, categories::MemoryCoreFoundationObjectiveC) {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001683 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001684
Ted Kremenekc887d132009-04-29 18:50:19 +00001685 // FIXME: Eventually remove.
Jordy Rose35c86952011-08-24 05:47:39 +00001686 virtual const char *getDescription() const = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001687
Ted Kremenekc887d132009-04-29 18:50:19 +00001688 virtual bool isLeak() const { return false; }
1689 };
Mike Stump1eb44332009-09-09 15:08:12 +00001690
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001691 class UseAfterRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001692 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001693 UseAfterRelease() : CFRefBug("Use-after-release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001694
Jordy Rose35c86952011-08-24 05:47:39 +00001695 const char *getDescription() const {
Ted Kremenekc887d132009-04-29 18:50:19 +00001696 return "Reference-counted object is used after it is released";
Mike Stump1eb44332009-09-09 15:08:12 +00001697 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001698 };
Mike Stump1eb44332009-09-09 15:08:12 +00001699
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001700 class BadRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001701 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001702 BadRelease() : CFRefBug("Bad release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001703
Jordy Rose35c86952011-08-24 05:47:39 +00001704 const char *getDescription() const {
Ted Kremenekbb206fd2009-10-01 17:31:50 +00001705 return "Incorrect decrement of the reference count of an object that is "
1706 "not owned at this point by the caller";
Ted Kremenekc887d132009-04-29 18:50:19 +00001707 }
1708 };
Mike Stump1eb44332009-09-09 15:08:12 +00001709
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001710 class DeallocGC : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001711 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001712 DeallocGC()
1713 : CFRefBug("-dealloc called while using garbage collection") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001714
Ted Kremenekc887d132009-04-29 18:50:19 +00001715 const char *getDescription() const {
Ted Kremenek369de562009-05-09 00:10:05 +00001716 return "-dealloc called while using garbage collection";
Ted Kremenekc887d132009-04-29 18:50:19 +00001717 }
1718 };
Mike Stump1eb44332009-09-09 15:08:12 +00001719
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001720 class DeallocNotOwned : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001721 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001722 DeallocNotOwned()
1723 : CFRefBug("-dealloc sent to non-exclusively owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001724
Ted Kremenekc887d132009-04-29 18:50:19 +00001725 const char *getDescription() const {
1726 return "-dealloc sent to object that may be referenced elsewhere";
1727 }
Mike Stump1eb44332009-09-09 15:08:12 +00001728 };
1729
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001730 class OverAutorelease : public CFRefBug {
Ted Kremenek369de562009-05-09 00:10:05 +00001731 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001732 OverAutorelease()
1733 : CFRefBug("Object sent -autorelease too many times") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001734
Ted Kremenek369de562009-05-09 00:10:05 +00001735 const char *getDescription() const {
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001736 return "Object sent -autorelease too many times";
Ted Kremenek369de562009-05-09 00:10:05 +00001737 }
1738 };
Mike Stump1eb44332009-09-09 15:08:12 +00001739
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001740 class ReturnedNotOwnedForOwned : public CFRefBug {
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001741 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001742 ReturnedNotOwnedForOwned()
1743 : CFRefBug("Method should return an owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001744
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001745 const char *getDescription() const {
Jordy Rose5b5402b2011-07-15 22:17:54 +00001746 return "Object with a +0 retain count returned to caller where a +1 "
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001747 "(owning) retain count is expected";
1748 }
1749 };
Mike Stump1eb44332009-09-09 15:08:12 +00001750
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001751 class Leak : public CFRefBug {
Benjamin Kramerfacde172012-06-06 17:32:50 +00001752 public:
1753 Leak(StringRef name)
1754 : CFRefBug(name) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00001755 // Leaks should not be reported if they are post-dominated by a sink.
1756 setSuppressOnSink(true);
1757 }
Mike Stump1eb44332009-09-09 15:08:12 +00001758
Jordy Rose35c86952011-08-24 05:47:39 +00001759 const char *getDescription() const { return ""; }
Mike Stump1eb44332009-09-09 15:08:12 +00001760
Ted Kremenekc887d132009-04-29 18:50:19 +00001761 bool isLeak() const { return true; }
1762 };
Mike Stump1eb44332009-09-09 15:08:12 +00001763
Ted Kremenekc887d132009-04-29 18:50:19 +00001764 //===---------===//
1765 // Bug Reports. //
1766 //===---------===//
Mike Stump1eb44332009-09-09 15:08:12 +00001767
Jordy Rose01153492012-03-24 02:45:35 +00001768 class CFRefReportVisitor : public BugReporterVisitorImpl<CFRefReportVisitor> {
Anna Zaks23f395e2011-08-20 01:27:22 +00001769 protected:
Anna Zaksdc757b02011-08-19 23:21:56 +00001770 SymbolRef Sym;
Jordy Roseec9ef852011-08-23 20:55:48 +00001771 const SummaryLogTy &SummaryLog;
Jordy Rose35c86952011-08-24 05:47:39 +00001772 bool GCEnabled;
Anna Zaks23f395e2011-08-20 01:27:22 +00001773
Anna Zaksdc757b02011-08-19 23:21:56 +00001774 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001775 CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1776 : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
Anna Zaksdc757b02011-08-19 23:21:56 +00001777
Anna Zaks23f395e2011-08-20 01:27:22 +00001778 virtual void Profile(llvm::FoldingSetNodeID &ID) const {
Anna Zaksdc757b02011-08-19 23:21:56 +00001779 static int x = 0;
1780 ID.AddPointer(&x);
1781 ID.AddPointer(Sym);
1782 }
1783
Anna Zaks23f395e2011-08-20 01:27:22 +00001784 virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
1785 const ExplodedNode *PrevN,
1786 BugReporterContext &BRC,
1787 BugReport &BR);
1788
1789 virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1790 const ExplodedNode *N,
1791 BugReport &BR);
1792 };
1793
1794 class CFRefLeakReportVisitor : public CFRefReportVisitor {
1795 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001796 CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
Jordy Roseec9ef852011-08-23 20:55:48 +00001797 const SummaryLogTy &log)
Jordy Rose35c86952011-08-24 05:47:39 +00001798 : CFRefReportVisitor(sym, GCEnabled, log) {}
Anna Zaks23f395e2011-08-20 01:27:22 +00001799
1800 PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1801 const ExplodedNode *N,
1802 BugReport &BR);
Jordy Rose01153492012-03-24 02:45:35 +00001803
1804 virtual BugReporterVisitor *clone() const {
1805 // The curiously-recurring template pattern only works for one level of
1806 // subclassing. Rather than make a new template base for
1807 // CFRefReportVisitor, we simply override clone() to do the right thing.
1808 // This could be trouble someday if BugReporterVisitorImpl is ever
1809 // used for something else besides a convenient implementation of clone().
1810 return new CFRefLeakReportVisitor(*this);
1811 }
Anna Zaksdc757b02011-08-19 23:21:56 +00001812 };
1813
Anna Zakse172e8b2011-08-17 23:00:25 +00001814 class CFRefReport : public BugReport {
Jordy Rose20589562011-08-24 22:39:09 +00001815 void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001816
Ted Kremenekc887d132009-04-29 18:50:19 +00001817 public:
Jordy Rose20589562011-08-24 22:39:09 +00001818 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1819 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1820 bool registerVisitor = true)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001821 : BugReport(D, D.getDescription(), n) {
Anna Zaks23f395e2011-08-20 01:27:22 +00001822 if (registerVisitor)
Jordy Rose20589562011-08-24 22:39:09 +00001823 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1824 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001825 }
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001826
Jordy Rose20589562011-08-24 22:39:09 +00001827 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1828 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1829 StringRef endText)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001830 : BugReport(D, D.getDescription(), endText, n) {
Jordy Rose20589562011-08-24 22:39:09 +00001831 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1832 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001833 }
Mike Stump1eb44332009-09-09 15:08:12 +00001834
Anna Zakse172e8b2011-08-17 23:00:25 +00001835 virtual std::pair<ranges_iterator, ranges_iterator> getRanges() {
Anna Zaksedf4dae2011-08-22 18:54:07 +00001836 const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1837 if (!BugTy.isLeak())
Anna Zakse172e8b2011-08-17 23:00:25 +00001838 return BugReport::getRanges();
Ted Kremenekc887d132009-04-29 18:50:19 +00001839 else
Argyrios Kyrtzidis640ccf02010-12-04 01:12:15 +00001840 return std::make_pair(ranges_iterator(), ranges_iterator());
Ted Kremenekc887d132009-04-29 18:50:19 +00001841 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001842 };
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001843
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001844 class CFRefLeakReport : public CFRefReport {
Ted Kremenekc887d132009-04-29 18:50:19 +00001845 const MemRegion* AllocBinding;
Anna Zaks23f395e2011-08-20 01:27:22 +00001846
Ted Kremenekc887d132009-04-29 18:50:19 +00001847 public:
Jordy Rose20589562011-08-24 22:39:09 +00001848 CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1849 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00001850 CheckerContext &Ctx);
Mike Stump1eb44332009-09-09 15:08:12 +00001851
Anna Zaks590dd8e2011-09-20 21:38:35 +00001852 PathDiagnosticLocation getLocation(const SourceManager &SM) const {
1853 assert(Location.isValid());
1854 return Location;
1855 }
Mike Stump1eb44332009-09-09 15:08:12 +00001856 };
Ted Kremenekc887d132009-04-29 18:50:19 +00001857} // end anonymous namespace
1858
Jordy Rose20589562011-08-24 22:39:09 +00001859void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1860 bool GCEnabled) {
Jordy Rosef95b19d2011-08-24 20:38:42 +00001861 const char *GCModeDescription = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001862
Douglas Gregore289d812011-09-13 17:21:33 +00001863 switch (LOpts.getGC()) {
Anna Zaks7f2531c2011-08-22 20:31:28 +00001864 case LangOptions::GCOnly:
Jordy Rose20589562011-08-24 22:39:09 +00001865 assert(GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001866 GCModeDescription = "Code is compiled to only use garbage collection";
1867 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001868
Anna Zaks7f2531c2011-08-22 20:31:28 +00001869 case LangOptions::NonGC:
Jordy Rose20589562011-08-24 22:39:09 +00001870 assert(!GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001871 GCModeDescription = "Code is compiled to use reference counts";
1872 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001873
Anna Zaks7f2531c2011-08-22 20:31:28 +00001874 case LangOptions::HybridGC:
Jordy Rose20589562011-08-24 22:39:09 +00001875 if (GCEnabled) {
Jordy Rose35c86952011-08-24 05:47:39 +00001876 GCModeDescription = "Code is compiled to use either garbage collection "
1877 "(GC) or reference counts (non-GC). The bug occurs "
1878 "with GC enabled";
1879 break;
1880 } else {
1881 GCModeDescription = "Code is compiled to use either garbage collection "
1882 "(GC) or reference counts (non-GC). The bug occurs "
1883 "in non-GC mode";
1884 break;
Anna Zaks7f2531c2011-08-22 20:31:28 +00001885 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001886 }
Jordy Rose35c86952011-08-24 05:47:39 +00001887
Jordy Rosef95b19d2011-08-24 20:38:42 +00001888 assert(GCModeDescription && "invalid/unknown GC mode");
Jordy Rose35c86952011-08-24 05:47:39 +00001889 addExtraText(GCModeDescription);
Ted Kremenekc887d132009-04-29 18:50:19 +00001890}
1891
Jordy Rose910c4052011-09-02 06:44:22 +00001892// FIXME: This should be a method on SmallVector.
Chris Lattner5f9e2722011-07-23 10:55:15 +00001893static inline bool contains(const SmallVectorImpl<ArgEffect>& V,
Ted Kremenekc887d132009-04-29 18:50:19 +00001894 ArgEffect X) {
Chris Lattner5f9e2722011-07-23 10:55:15 +00001895 for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001896 I!=E; ++I)
1897 if (*I == X) return true;
Mike Stump1eb44332009-09-09 15:08:12 +00001898
Ted Kremenekc887d132009-04-29 18:50:19 +00001899 return false;
1900}
1901
Jordy Rose70fdbc32012-05-12 05:10:43 +00001902static bool isNumericLiteralExpression(const Expr *E) {
1903 // FIXME: This set of cases was copied from SemaExprObjC.
1904 return isa<IntegerLiteral>(E) ||
1905 isa<CharacterLiteral>(E) ||
1906 isa<FloatingLiteral>(E) ||
1907 isa<ObjCBoolLiteralExpr>(E) ||
1908 isa<CXXBoolLiteralExpr>(E);
1909}
1910
Ted Kremenek4c42bb72011-11-14 21:59:21 +00001911static bool isPropertyAccess(const Stmt *S, ParentMap &PM) {
1912 unsigned maxDepth = 4;
1913 while (S && maxDepth) {
1914 if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) {
1915 if (!isa<ObjCMessageExpr>(PO->getSyntacticForm()))
1916 return true;
1917 return false;
1918 }
1919 S = PM.getParent(S);
1920 --maxDepth;
1921 }
1922 return false;
1923}
1924
Anna Zaksdc757b02011-08-19 23:21:56 +00001925PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N,
1926 const ExplodedNode *PrevN,
1927 BugReporterContext &BRC,
1928 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00001929
Jordy Rosef53e8c72011-08-23 19:43:16 +00001930 if (!isa<StmtPoint>(N->getLocation()))
Ted Kremenek2033a952009-05-13 07:12:33 +00001931 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001932
Ted Kremenek8966bc12009-05-06 21:39:49 +00001933 // Check if the type state has changed.
Ted Kremenek8bef8232012-01-26 21:29:00 +00001934 ProgramStateRef PrevSt = PrevN->getState();
1935 ProgramStateRef CurrSt = N->getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001936 const LocationContext *LCtx = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00001937
1938 const RefVal* CurrT = CurrSt->get<RefBindings>(Sym);
Ted Kremenekc887d132009-04-29 18:50:19 +00001939 if (!CurrT) return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001940
Ted Kremenekb65be702009-06-18 01:23:53 +00001941 const RefVal &CurrV = *CurrT;
1942 const RefVal *PrevT = PrevSt->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00001943
Ted Kremenekc887d132009-04-29 18:50:19 +00001944 // Create a string buffer to constain all the useful things we want
1945 // to tell the user.
1946 std::string sbuf;
1947 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00001948
Ted Kremenekc887d132009-04-29 18:50:19 +00001949 // This is the allocation site since the previous node had no bindings
1950 // for this symbol.
1951 if (!PrevT) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00001952 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001953
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001954 if (isa<ObjCArrayLiteral>(S)) {
1955 os << "NSArray literal is an object with a +0 retain count";
Mike Stump1eb44332009-09-09 15:08:12 +00001956 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001957 else if (isa<ObjCDictionaryLiteral>(S)) {
1958 os << "NSDictionary literal is an object with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00001959 }
Jordy Rose70fdbc32012-05-12 05:10:43 +00001960 else if (const ObjCBoxedExpr *BL = dyn_cast<ObjCBoxedExpr>(S)) {
1961 if (isNumericLiteralExpression(BL->getSubExpr()))
1962 os << "NSNumber literal is an object with a +0 retain count";
1963 else {
1964 const ObjCInterfaceDecl *BoxClass = 0;
1965 if (const ObjCMethodDecl *Method = BL->getBoxingMethod())
1966 BoxClass = Method->getClassInterface();
1967
1968 // We should always be able to find the boxing class interface,
1969 // but consider this future-proofing.
1970 if (BoxClass)
1971 os << *BoxClass << " b";
1972 else
1973 os << "B";
1974
1975 os << "oxed expression produces an object with a +0 retain count";
1976 }
1977 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001978 else {
1979 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1980 // Get the name of the callee (if it is available).
1981 SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
1982 if (const FunctionDecl *FD = X.getAsFunctionDecl())
1983 os << "Call to function '" << *FD << '\'';
1984 else
1985 os << "function call";
Ted Kremenekc887d132009-04-29 18:50:19 +00001986 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001987 else {
1988 assert(isa<ObjCMessageExpr>(S));
1989 // The message expression may have between written directly or as
1990 // a property access. Lazily determine which case we are looking at.
1991 os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method");
1992 }
1993
1994 if (CurrV.getObjKind() == RetEffect::CF) {
1995 os << " returns a Core Foundation object with a ";
1996 }
1997 else {
1998 assert (CurrV.getObjKind() == RetEffect::ObjC);
1999 os << " returns an Objective-C object with a ";
2000 }
2001
2002 if (CurrV.isOwned()) {
2003 os << "+1 retain count";
2004
2005 if (GCEnabled) {
2006 assert(CurrV.getObjKind() == RetEffect::CF);
2007 os << ". "
2008 "Core Foundation objects are not automatically garbage collected.";
2009 }
2010 }
2011 else {
2012 assert (CurrV.isNotOwned());
2013 os << "+0 retain count";
2014 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002015 }
Mike Stump1eb44332009-09-09 15:08:12 +00002016
Anna Zaks220ac8c2011-09-15 01:08:34 +00002017 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2018 N->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00002019 return new PathDiagnosticEventPiece(Pos, os.str());
2020 }
Mike Stump1eb44332009-09-09 15:08:12 +00002021
Ted Kremenekc887d132009-04-29 18:50:19 +00002022 // Gather up the effects that were performed on the object at this
2023 // program point
Chris Lattner5f9e2722011-07-23 10:55:15 +00002024 SmallVector<ArgEffect, 2> AEffects;
Mike Stump1eb44332009-09-09 15:08:12 +00002025
Jordy Roseec9ef852011-08-23 20:55:48 +00002026 const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
2027 if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002028 // We only have summaries attached to nodes after evaluating CallExpr and
2029 // ObjCMessageExprs.
Jordy Rosef53e8c72011-08-23 19:43:16 +00002030 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00002031
Ted Kremenek5f85e172009-07-22 22:35:28 +00002032 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002033 // Iterate through the parameter expressions and see if the symbol
2034 // was ever passed as an argument.
2035 unsigned i = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002036
Ted Kremenek5f85e172009-07-22 22:35:28 +00002037 for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
Ted Kremenekc887d132009-04-29 18:50:19 +00002038 AI!=AE; ++AI, ++i) {
Mike Stump1eb44332009-09-09 15:08:12 +00002039
Ted Kremenekc887d132009-04-29 18:50:19 +00002040 // Retrieve the value of the argument. Is it the symbol
2041 // we are interested in?
Ted Kremenek5eca4822012-01-06 22:09:28 +00002042 if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
Ted Kremenekc887d132009-04-29 18:50:19 +00002043 continue;
Mike Stump1eb44332009-09-09 15:08:12 +00002044
Ted Kremenekc887d132009-04-29 18:50:19 +00002045 // We have an argument. Get the effect!
2046 AEffects.push_back(Summ->getArg(i));
2047 }
2048 }
Mike Stump1eb44332009-09-09 15:08:12 +00002049 else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
Douglas Gregor04badcf2010-04-21 00:45:42 +00002050 if (const Expr *receiver = ME->getInstanceReceiver())
Ted Kremenek5eca4822012-01-06 22:09:28 +00002051 if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
2052 .getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002053 // The symbol we are tracking is the receiver.
2054 AEffects.push_back(Summ->getReceiverEffect());
2055 }
2056 }
2057 }
Mike Stump1eb44332009-09-09 15:08:12 +00002058
Ted Kremenekc887d132009-04-29 18:50:19 +00002059 do {
2060 // Get the previous type state.
2061 RefVal PrevV = *PrevT;
Mike Stump1eb44332009-09-09 15:08:12 +00002062
Ted Kremenekc887d132009-04-29 18:50:19 +00002063 // Specially handle -dealloc.
Jordy Rose35c86952011-08-24 05:47:39 +00002064 if (!GCEnabled && contains(AEffects, Dealloc)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002065 // Determine if the object's reference count was pushed to zero.
2066 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
2067 // We may not have transitioned to 'release' if we hit an error.
2068 // This case is handled elsewhere.
2069 if (CurrV.getKind() == RefVal::Released) {
Ted Kremenekf21332e2009-05-08 20:01:42 +00002070 assert(CurrV.getCombinedCounts() == 0);
Ted Kremenekc887d132009-04-29 18:50:19 +00002071 os << "Object released by directly sending the '-dealloc' message";
2072 break;
2073 }
2074 }
Mike Stump1eb44332009-09-09 15:08:12 +00002075
Ted Kremenekc887d132009-04-29 18:50:19 +00002076 // Specially handle CFMakeCollectable and friends.
2077 if (contains(AEffects, MakeCollectable)) {
2078 // Get the name of the function.
Jordy Rosef53e8c72011-08-23 19:43:16 +00002079 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002080 SVal X =
2081 CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
Ted Kremenek9c378f72011-08-12 23:37:29 +00002082 const FunctionDecl *FD = X.getAsFunctionDecl();
Mike Stump1eb44332009-09-09 15:08:12 +00002083
Jordy Rose35c86952011-08-24 05:47:39 +00002084 if (GCEnabled) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002085 // Determine if the object's reference count was pushed to zero.
2086 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
Mike Stump1eb44332009-09-09 15:08:12 +00002087
Benjamin Kramerb8989f22011-10-14 18:45:37 +00002088 os << "In GC mode a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00002089 << "' decrements an object's retain count and registers the "
2090 "object with the garbage collector. ";
Mike Stump1eb44332009-09-09 15:08:12 +00002091
Ted Kremenekc887d132009-04-29 18:50:19 +00002092 if (CurrV.getKind() == RefVal::Released) {
2093 assert(CurrV.getCount() == 0);
2094 os << "Since it now has a 0 retain count the object can be "
2095 "automatically collected by the garbage collector.";
2096 }
2097 else
2098 os << "An object must have a 0 retain count to be garbage collected. "
2099 "After this call its retain count is +" << CurrV.getCount()
2100 << '.';
2101 }
Mike Stump1eb44332009-09-09 15:08:12 +00002102 else
Benjamin Kramerb8989f22011-10-14 18:45:37 +00002103 os << "When GC is not enabled a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00002104 << "' has no effect on its argument.";
Mike Stump1eb44332009-09-09 15:08:12 +00002105
Ted Kremenekc887d132009-04-29 18:50:19 +00002106 // Nothing more to say.
2107 break;
2108 }
Mike Stump1eb44332009-09-09 15:08:12 +00002109
2110 // Determine if the typestate has changed.
Ted Kremenekc887d132009-04-29 18:50:19 +00002111 if (!(PrevV == CurrV))
2112 switch (CurrV.getKind()) {
2113 case RefVal::Owned:
2114 case RefVal::NotOwned:
Mike Stump1eb44332009-09-09 15:08:12 +00002115
Ted Kremenekf21332e2009-05-08 20:01:42 +00002116 if (PrevV.getCount() == CurrV.getCount()) {
2117 // Did an autorelease message get sent?
2118 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
2119 return 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002120
Zhongxing Xu264e9372009-05-12 10:10:00 +00002121 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
Ted Kremenekeaedfea2009-05-10 05:11:21 +00002122 os << "Object sent -autorelease message";
Ted Kremenekf21332e2009-05-08 20:01:42 +00002123 break;
2124 }
Mike Stump1eb44332009-09-09 15:08:12 +00002125
Ted Kremenekc887d132009-04-29 18:50:19 +00002126 if (PrevV.getCount() > CurrV.getCount())
2127 os << "Reference count decremented.";
2128 else
2129 os << "Reference count incremented.";
Mike Stump1eb44332009-09-09 15:08:12 +00002130
Ted Kremenekc887d132009-04-29 18:50:19 +00002131 if (unsigned Count = CurrV.getCount())
2132 os << " The object now has a +" << Count << " retain count.";
Mike Stump1eb44332009-09-09 15:08:12 +00002133
Ted Kremenekc887d132009-04-29 18:50:19 +00002134 if (PrevV.getKind() == RefVal::Released) {
Jordy Rose35c86952011-08-24 05:47:39 +00002135 assert(GCEnabled && CurrV.getCount() > 0);
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002136 os << " The object is not eligible for garbage collection until "
2137 "the retain count reaches 0 again.";
Ted Kremenekc887d132009-04-29 18:50:19 +00002138 }
Mike Stump1eb44332009-09-09 15:08:12 +00002139
Ted Kremenekc887d132009-04-29 18:50:19 +00002140 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002141
Ted Kremenekc887d132009-04-29 18:50:19 +00002142 case RefVal::Released:
2143 os << "Object released.";
2144 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002145
Ted Kremenekc887d132009-04-29 18:50:19 +00002146 case RefVal::ReturnedOwned:
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002147 // Autoreleases can be applied after marking a node ReturnedOwned.
2148 if (CurrV.getAutoreleaseCount())
2149 return NULL;
2150
2151 os << "Object returned to caller as an owning reference (single "
2152 "retain count transferred to caller)";
Ted Kremenekc887d132009-04-29 18:50:19 +00002153 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002154
Ted Kremenekc887d132009-04-29 18:50:19 +00002155 case RefVal::ReturnedNotOwned:
Ted Kremenekf1365462011-05-26 18:45:44 +00002156 os << "Object returned to caller with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00002157 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002158
Ted Kremenekc887d132009-04-29 18:50:19 +00002159 default:
2160 return NULL;
2161 }
Mike Stump1eb44332009-09-09 15:08:12 +00002162
Ted Kremenekc887d132009-04-29 18:50:19 +00002163 // Emit any remaining diagnostics for the argument effects (if any).
Chris Lattner5f9e2722011-07-23 10:55:15 +00002164 for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
Ted Kremenekc887d132009-04-29 18:50:19 +00002165 E=AEffects.end(); I != E; ++I) {
Mike Stump1eb44332009-09-09 15:08:12 +00002166
Ted Kremenekc887d132009-04-29 18:50:19 +00002167 // A bunch of things have alternate behavior under GC.
Jordy Rose35c86952011-08-24 05:47:39 +00002168 if (GCEnabled)
Ted Kremenekc887d132009-04-29 18:50:19 +00002169 switch (*I) {
2170 default: break;
2171 case Autorelease:
2172 os << "In GC mode an 'autorelease' has no effect.";
2173 continue;
2174 case IncRefMsg:
2175 os << "In GC mode the 'retain' message has no effect.";
2176 continue;
2177 case DecRefMsg:
2178 os << "In GC mode the 'release' message has no effect.";
2179 continue;
2180 }
2181 }
Mike Stump1eb44332009-09-09 15:08:12 +00002182 } while (0);
2183
Ted Kremenekc887d132009-04-29 18:50:19 +00002184 if (os.str().empty())
2185 return 0; // We have nothing to say!
Ted Kremenek2033a952009-05-13 07:12:33 +00002186
Jordy Rosef53e8c72011-08-23 19:43:16 +00002187 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Anna Zaks220ac8c2011-09-15 01:08:34 +00002188 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2189 N->getLocationContext());
Ted Kremenek9c378f72011-08-12 23:37:29 +00002190 PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str());
Mike Stump1eb44332009-09-09 15:08:12 +00002191
Ted Kremenekc887d132009-04-29 18:50:19 +00002192 // Add the range by scanning the children of the statement for any bindings
2193 // to Sym.
Mike Stump1eb44332009-09-09 15:08:12 +00002194 for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
Ted Kremenek5f85e172009-07-22 22:35:28 +00002195 I!=E; ++I)
Ted Kremenek9c378f72011-08-12 23:37:29 +00002196 if (const Expr *Exp = dyn_cast_or_null<Expr>(*I))
Ted Kremenek5eca4822012-01-06 22:09:28 +00002197 if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002198 P->addRange(Exp->getSourceRange());
2199 break;
2200 }
Mike Stump1eb44332009-09-09 15:08:12 +00002201
Ted Kremenekc887d132009-04-29 18:50:19 +00002202 return P;
2203}
2204
Anna Zakse7e01682012-02-28 22:39:22 +00002205// Find the first node in the current function context that referred to the
2206// tracked symbol and the memory location that value was stored to. Note, the
2207// value is only reported if the allocation occurred in the same function as
2208// the leak.
Zhongxing Xuc5619d92009-08-06 01:32:16 +00002209static std::pair<const ExplodedNode*,const MemRegion*>
Ted Kremenek18c66fd2011-08-15 22:09:50 +00002210GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N,
Ted Kremenekc887d132009-04-29 18:50:19 +00002211 SymbolRef Sym) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002212 const ExplodedNode *Last = N;
Mike Stump1eb44332009-09-09 15:08:12 +00002213 const MemRegion* FirstBinding = 0;
Anna Zakse7e01682012-02-28 22:39:22 +00002214 const LocationContext *LeakContext = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00002215
Ted Kremenekc887d132009-04-29 18:50:19 +00002216 while (N) {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002217 ProgramStateRef St = N->getState();
Ted Kremenekc887d132009-04-29 18:50:19 +00002218 RefBindings B = St->get<RefBindings>();
Mike Stump1eb44332009-09-09 15:08:12 +00002219
Ted Kremenekc887d132009-04-29 18:50:19 +00002220 if (!B.lookup(Sym))
2221 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002222
Anna Zaks27b867e2012-03-21 19:45:01 +00002223 StoreManager::FindUniqueBinding FB(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002224 StateMgr.iterBindings(St, FB);
2225 if (FB) FirstBinding = FB.getRegion();
2226
Anna Zakse7e01682012-02-28 22:39:22 +00002227 // Allocation node, is the last node in the current context in which the
2228 // symbol was tracked.
2229 if (N->getLocationContext() == LeakContext)
2230 Last = N;
2231
Mike Stump1eb44332009-09-09 15:08:12 +00002232 N = N->pred_empty() ? NULL : *(N->pred_begin());
Ted Kremenekc887d132009-04-29 18:50:19 +00002233 }
Mike Stump1eb44332009-09-09 15:08:12 +00002234
Anna Zakse7e01682012-02-28 22:39:22 +00002235 // If allocation happened in a function different from the leak node context,
2236 // do not report the binding.
2237 if (N->getLocationContext() != LeakContext) {
2238 FirstBinding = 0;
2239 }
2240
Ted Kremenekc887d132009-04-29 18:50:19 +00002241 return std::make_pair(Last, FirstBinding);
2242}
2243
2244PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002245CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2246 const ExplodedNode *EndN,
2247 BugReport &BR) {
Ted Kremenek76aadc32012-03-09 01:13:14 +00002248 BR.markInteresting(Sym);
Anna Zaks23f395e2011-08-20 01:27:22 +00002249 return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
Ted Kremenekc887d132009-04-29 18:50:19 +00002250}
2251
2252PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002253CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2254 const ExplodedNode *EndN,
2255 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00002256
Ted Kremenek8966bc12009-05-06 21:39:49 +00002257 // Tell the BugReporterContext to report cases when the tracked symbol is
Ted Kremenekc887d132009-04-29 18:50:19 +00002258 // assigned to different variables, etc.
Ted Kremenek76aadc32012-03-09 01:13:14 +00002259 BR.markInteresting(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002260
Ted Kremenekc887d132009-04-29 18:50:19 +00002261 // We are reporting a leak. Walk up the graph to get to the first node where
2262 // the symbol appeared, and also get the first VarDecl that tracked object
2263 // is stored to.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002264 const ExplodedNode *AllocNode = 0;
Ted Kremenekc887d132009-04-29 18:50:19 +00002265 const MemRegion* FirstBinding = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002266
Ted Kremenekc887d132009-04-29 18:50:19 +00002267 llvm::tie(AllocNode, FirstBinding) =
Ted Kremenekf04dced2009-05-08 23:32:51 +00002268 GetAllocationSite(BRC.getStateManager(), EndN, Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002269
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002270 SourceManager& SM = BRC.getSourceManager();
Mike Stump1eb44332009-09-09 15:08:12 +00002271
Ted Kremenekc887d132009-04-29 18:50:19 +00002272 // Compute an actual location for the leak. Sometimes a leak doesn't
2273 // occur at an actual statement (e.g., transition between blocks; end
2274 // of function) so we need to walk the graph and compute a real location.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002275 const ExplodedNode *LeakN = EndN;
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002276 PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
Mike Stump1eb44332009-09-09 15:08:12 +00002277
Ted Kremenekc887d132009-04-29 18:50:19 +00002278 std::string sbuf;
2279 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00002280
Ted Kremenekf1365462011-05-26 18:45:44 +00002281 os << "Object leaked: ";
Mike Stump1eb44332009-09-09 15:08:12 +00002282
Ted Kremenekf1365462011-05-26 18:45:44 +00002283 if (FirstBinding) {
2284 os << "object allocated and stored into '"
2285 << FirstBinding->getString() << '\'';
2286 }
2287 else
2288 os << "allocated object";
Mike Stump1eb44332009-09-09 15:08:12 +00002289
Ted Kremenekc887d132009-04-29 18:50:19 +00002290 // Get the retain count.
2291 const RefVal* RV = EndN->getState()->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002292
Ted Kremenekc887d132009-04-29 18:50:19 +00002293 if (RV->getKind() == RefVal::ErrorLeakReturned) {
2294 // FIXME: Per comments in rdar://6320065, "create" only applies to CF
Jordy Rose5b5402b2011-07-15 22:17:54 +00002295 // objects. Only "copy", "alloc", "retain" and "new" transfer ownership
Ted Kremenekc887d132009-04-29 18:50:19 +00002296 // to the caller for NS objects.
Ted Kremenekd368d712011-05-25 06:19:45 +00002297 const Decl *D = &EndN->getCodeDecl();
2298 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2299 os << " is returned from a method whose name ('"
2300 << MD->getSelector().getAsString()
2301 << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
Jordy Rose5b5402b2011-07-15 22:17:54 +00002302 " This violates the naming convention rules"
Ted Kremenekf1365462011-05-26 18:45:44 +00002303 " given in the Memory Management Guide for Cocoa";
Ted Kremenekd368d712011-05-25 06:19:45 +00002304 }
2305 else {
2306 const FunctionDecl *FD = cast<FunctionDecl>(D);
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002307 os << " is returned from a function whose name ('"
Benjamin Kramera59d20b2012-02-07 11:57:57 +00002308 << *FD
Ted Kremenekd368d712011-05-25 06:19:45 +00002309 << "') does not contain 'Copy' or 'Create'. This violates the naming"
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002310 " convention rules given in the Memory Management Guide for Core"
Ted Kremenekf1365462011-05-26 18:45:44 +00002311 " Foundation";
Ted Kremenekd368d712011-05-25 06:19:45 +00002312 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002313 }
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002314 else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002315 ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002316 os << " and returned from method '" << MD.getSelector().getAsString()
Ted Kremenek82f2be52009-05-10 16:52:15 +00002317 << "' is potentially leaked when using garbage collection. Callers "
2318 "of this method do not expect a returned object with a +1 retain "
2319 "count since they expect the object to be managed by the garbage "
2320 "collector";
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002321 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002322 else
Ted Kremenekabf517c2010-10-15 22:50:23 +00002323 os << " is not referenced later in this execution path and has a retain "
Ted Kremenekf1365462011-05-26 18:45:44 +00002324 "count of +" << RV->getCount();
Mike Stump1eb44332009-09-09 15:08:12 +00002325
Ted Kremenekc887d132009-04-29 18:50:19 +00002326 return new PathDiagnosticEventPiece(L, os.str());
2327}
2328
Jordy Rose20589562011-08-24 22:39:09 +00002329CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2330 bool GCEnabled, const SummaryLogTy &Log,
2331 ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002332 CheckerContext &Ctx)
Jordy Rose20589562011-08-24 22:39:09 +00002333: CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
Mike Stump1eb44332009-09-09 15:08:12 +00002334
Chris Lattnerfc8f0e12011-04-15 05:22:18 +00002335 // Most bug reports are cached at the location where they occurred.
Ted Kremenekc887d132009-04-29 18:50:19 +00002336 // With leaks, we want to unique them by the location where they were
2337 // allocated, and only report a single path. To do this, we need to find
2338 // the allocation site of a piece of tracked memory, which we do via a
2339 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
2340 // Note that this is *not* the trimmed graph; we are guaranteed, however,
2341 // that all ancestor nodes that represent the allocation site have the
2342 // same SourceLocation.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002343 const ExplodedNode *AllocNode = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002344
Anna Zaks6a93bd52011-10-25 19:57:11 +00002345 const SourceManager& SMgr = Ctx.getSourceManager();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002346
Ted Kremenekc887d132009-04-29 18:50:19 +00002347 llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding.
Anna Zaks6a93bd52011-10-25 19:57:11 +00002348 GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002349
Ted Kremenekc887d132009-04-29 18:50:19 +00002350 // Get the SourceLocation for the allocation site.
2351 ProgramPoint P = AllocNode->getLocation();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002352 const Stmt *AllocStmt = cast<PostStmt>(P).getStmt();
2353 Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2354 n->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00002355 // Fill in the description of the bug.
2356 Description.clear();
2357 llvm::raw_string_ostream os(Description);
Ted Kremenekdd924e22009-05-02 19:05:19 +00002358 os << "Potential leak ";
Jordy Rose20589562011-08-24 22:39:09 +00002359 if (GCEnabled)
Ted Kremenekdd924e22009-05-02 19:05:19 +00002360 os << "(when using garbage collection) ";
Anna Zaks212000e2012-02-28 21:49:08 +00002361 os << "of an object";
Mike Stump1eb44332009-09-09 15:08:12 +00002362
Ted Kremenekc887d132009-04-29 18:50:19 +00002363 // FIXME: AllocBinding doesn't get populated for RegionStore yet.
2364 if (AllocBinding)
Anna Zaks212000e2012-02-28 21:49:08 +00002365 os << " stored into '" << AllocBinding->getString() << '\'';
Anna Zaksdc757b02011-08-19 23:21:56 +00002366
Jordy Rose20589562011-08-24 22:39:09 +00002367 addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log));
Ted Kremenekc887d132009-04-29 18:50:19 +00002368}
2369
2370//===----------------------------------------------------------------------===//
2371// Main checker logic.
2372//===----------------------------------------------------------------------===//
2373
Ted Kremenekd593eb92009-11-25 22:17:44 +00002374namespace {
Jordy Rose910c4052011-09-02 06:44:22 +00002375class RetainCountChecker
Jordy Rose9c083b72011-08-24 18:56:32 +00002376 : public Checker< check::Bind,
Jordy Rose38f17d62011-08-23 19:01:07 +00002377 check::DeadSymbols,
Jordy Rose9c083b72011-08-24 18:56:32 +00002378 check::EndAnalysis,
Jordy Rose38f17d62011-08-23 19:01:07 +00002379 check::EndPath,
Jordy Rose67044292011-08-17 21:27:39 +00002380 check::PostStmt<BlockExpr>,
John McCallf85e1932011-06-15 23:02:42 +00002381 check::PostStmt<CastExpr>,
Jordy Rose294396b2011-08-22 23:48:23 +00002382 check::PostStmt<CallExpr>,
Jordy Rose537716a2011-08-27 22:51:26 +00002383 check::PostStmt<CXXConstructExpr>,
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002384 check::PostStmt<ObjCArrayLiteral>,
2385 check::PostStmt<ObjCDictionaryLiteral>,
Jordy Rose70fdbc32012-05-12 05:10:43 +00002386 check::PostStmt<ObjCBoxedExpr>,
Jordy Rose294396b2011-08-22 23:48:23 +00002387 check::PostObjCMessage,
Jordy Rosef53e8c72011-08-23 19:43:16 +00002388 check::PreStmt<ReturnStmt>,
Jordy Rose67044292011-08-17 21:27:39 +00002389 check::RegionChanges,
Jordy Rose76c506f2011-08-21 21:58:18 +00002390 eval::Assume,
2391 eval::Call > {
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002392 mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned;
2393 mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned;
2394 mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2395 mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn;
2396 mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
Jordy Rose38f17d62011-08-23 19:01:07 +00002397
2398 typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap;
2399
2400 // This map is only used to ensure proper deletion of any allocated tags.
2401 mutable SymbolTagMap DeadSymbolTags;
2402
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002403 mutable OwningPtr<RetainSummaryManager> Summaries;
2404 mutable OwningPtr<RetainSummaryManager> SummariesGC;
Jordy Roseb6cfc092011-08-25 00:10:37 +00002405
Jordy Rosee0a5d322011-08-23 20:27:16 +00002406 mutable ARCounts::Factory ARCountFactory;
2407
Jordy Rose9c083b72011-08-24 18:56:32 +00002408 mutable SummaryLogTy SummaryLog;
2409 mutable bool ShouldResetSummaryLog;
2410
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002411public:
Jordy Rose910c4052011-09-02 06:44:22 +00002412 RetainCountChecker() : ShouldResetSummaryLog(false) {}
Jordy Rose38f17d62011-08-23 19:01:07 +00002413
Jordy Rose910c4052011-09-02 06:44:22 +00002414 virtual ~RetainCountChecker() {
Jordy Rose38f17d62011-08-23 19:01:07 +00002415 DeleteContainerSeconds(DeadSymbolTags);
2416 }
2417
Jordy Rose9c083b72011-08-24 18:56:32 +00002418 void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2419 ExprEngine &Eng) const {
2420 // FIXME: This is a hack to make sure the summary log gets cleared between
2421 // analyses of different code bodies.
2422 //
2423 // Why is this necessary? Because a checker's lifetime is tied to a
2424 // translation unit, but an ExplodedGraph's lifetime is just a code body.
2425 // Once in a blue moon, a new ExplodedNode will have the same address as an
2426 // old one with an associated summary, and the bug report visitor gets very
2427 // confused. (To make things worse, the summary lifetime is currently also
2428 // tied to a code body, so we get a crash instead of incorrect results.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002429 //
2430 // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2431 // changes, things will start going wrong again. Really the lifetime of this
2432 // log needs to be tied to either the specific nodes in it or the entire
2433 // ExplodedGraph, not to a specific part of the code being analyzed.
2434 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002435 // (Also, having stateful local data means that the same checker can't be
2436 // used from multiple threads, but a lot of checkers have incorrect
2437 // assumptions about that anyway. So that wasn't a priority at the time of
2438 // this fix.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002439 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002440 // This happens at the end of analysis, but bug reports are emitted /after/
2441 // this point. So we can't just clear the summary log now. Instead, we mark
2442 // that the next time we access the summary log, it should be cleared.
2443
2444 // If we never reset the summary log during /this/ code body analysis,
2445 // there were no new summaries. There might still have been summaries from
2446 // the /last/ analysis, so clear them out to make sure the bug report
2447 // visitors don't get confused.
2448 if (ShouldResetSummaryLog)
2449 SummaryLog.clear();
2450
2451 ShouldResetSummaryLog = !SummaryLog.empty();
Jordy Rose1ab51c72011-08-24 09:27:24 +00002452 }
2453
Jordy Rose17a38e22011-09-02 05:55:19 +00002454 CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2455 bool GCEnabled) const {
2456 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002457 if (!leakWithinFunctionGC)
Benjamin Kramerfacde172012-06-06 17:32:50 +00002458 leakWithinFunctionGC.reset(new Leak("Leak of object when using "
2459 "garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002460 return leakWithinFunctionGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002461 } else {
2462 if (!leakWithinFunction) {
Douglas Gregore289d812011-09-13 17:21:33 +00002463 if (LOpts.getGC() == LangOptions::HybridGC) {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002464 leakWithinFunction.reset(new Leak("Leak of object when not using "
2465 "garbage collection (GC) in "
2466 "dual GC/non-GC code"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002467 } else {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002468 leakWithinFunction.reset(new Leak("Leak"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002469 }
2470 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002471 return leakWithinFunction.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002472 }
2473 }
2474
Jordy Rose17a38e22011-09-02 05:55:19 +00002475 CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2476 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002477 if (!leakAtReturnGC)
Benjamin Kramerfacde172012-06-06 17:32:50 +00002478 leakAtReturnGC.reset(new Leak("Leak of returned object when using "
2479 "garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002480 return leakAtReturnGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002481 } else {
2482 if (!leakAtReturn) {
Douglas Gregore289d812011-09-13 17:21:33 +00002483 if (LOpts.getGC() == LangOptions::HybridGC) {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002484 leakAtReturn.reset(new Leak("Leak of returned object when not using "
2485 "garbage collection (GC) in dual "
2486 "GC/non-GC code"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002487 } else {
Benjamin Kramerfacde172012-06-06 17:32:50 +00002488 leakAtReturn.reset(new Leak("Leak of returned object"));
Jordy Rosedb92bb62011-08-25 01:14:38 +00002489 }
2490 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002491 return leakAtReturn.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002492 }
2493 }
2494
Jordy Rose17a38e22011-09-02 05:55:19 +00002495 RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2496 bool GCEnabled) const {
2497 // FIXME: We don't support ARC being turned on and off during one analysis.
2498 // (nor, for that matter, do we support changing ASTContexts)
David Blaikie4e4d0842012-03-11 07:00:24 +00002499 bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002500 if (GCEnabled) {
2501 if (!SummariesGC)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002502 SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002503 else
2504 assert(SummariesGC->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002505 return *SummariesGC;
2506 } else {
Jordy Rose17a38e22011-09-02 05:55:19 +00002507 if (!Summaries)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002508 Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002509 else
2510 assert(Summaries->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002511 return *Summaries;
2512 }
2513 }
2514
Jordy Rose17a38e22011-09-02 05:55:19 +00002515 RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2516 return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2517 }
2518
Ted Kremenek8bef8232012-01-26 21:29:00 +00002519 void printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rosedbd658e2011-08-28 19:11:56 +00002520 const char *NL, const char *Sep) const;
2521
Anna Zaks390909c2011-10-06 00:43:15 +00002522 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002523 void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2524 void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
John McCallf85e1932011-06-15 23:02:42 +00002525
Jordy Rose294396b2011-08-22 23:48:23 +00002526 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
Jordy Rose537716a2011-08-27 22:51:26 +00002527 void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002528 void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2529 void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
Jordy Rose70fdbc32012-05-12 05:10:43 +00002530 void checkPostStmt(const ObjCBoxedExpr *BE, CheckerContext &C) const;
2531
Jordy Rose294396b2011-08-22 23:48:23 +00002532 void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002533
Jordan Rose4531b7d2012-07-02 19:27:43 +00002534 void checkSummary(const RetainSummary &Summ, const CallEvent &Call,
Jordy Rosee38dd952011-08-28 05:16:28 +00002535 CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002536
Jordy Rose76c506f2011-08-21 21:58:18 +00002537 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2538
Ted Kremenek8bef8232012-01-26 21:29:00 +00002539 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
Jordy Roseab027fd2011-08-20 21:16:58 +00002540 bool Assumption) const;
Jordy Rose67044292011-08-17 21:27:39 +00002541
Ted Kremenek8bef8232012-01-26 21:29:00 +00002542 ProgramStateRef
2543 checkRegionChanges(ProgramStateRef state,
Jordy Rose537716a2011-08-27 22:51:26 +00002544 const StoreManager::InvalidatedSymbols *invalidated,
2545 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00002546 ArrayRef<const MemRegion *> Regions,
Jordan Rose740d4902012-07-02 19:27:35 +00002547 const CallEvent *Call) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002548
Ted Kremenek8bef8232012-01-26 21:29:00 +00002549 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002550 return true;
Jordy Roseab027fd2011-08-20 21:16:58 +00002551 }
Jordy Rose294396b2011-08-22 23:48:23 +00002552
Jordy Rosef53e8c72011-08-23 19:43:16 +00002553 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2554 void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2555 ExplodedNode *Pred, RetEffect RE, RefVal X,
Ted Kremenek8bef8232012-01-26 21:29:00 +00002556 SymbolRef Sym, ProgramStateRef state) const;
Jordy Rosef53e8c72011-08-23 19:43:16 +00002557
Jordy Rose38f17d62011-08-23 19:01:07 +00002558 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +00002559 void checkEndPath(CheckerContext &C) const;
Jordy Rose38f17d62011-08-23 19:01:07 +00002560
Ted Kremenek8bef8232012-01-26 21:29:00 +00002561 ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose17a38e22011-09-02 05:55:19 +00002562 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2563 CheckerContext &C) const;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002564
Ted Kremenek8bef8232012-01-26 21:29:00 +00002565 void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
Jordy Rose294396b2011-08-22 23:48:23 +00002566 RefVal::Kind ErrorKind, SymbolRef Sym,
2567 CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002568
2569 void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002570
Jordy Rose38f17d62011-08-23 19:01:07 +00002571 const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2572
Ted Kremenek8bef8232012-01-26 21:29:00 +00002573 ProgramStateRef handleSymbolDeath(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002574 SymbolRef sid, RefVal V,
2575 SmallVectorImpl<SymbolRef> &Leaked) const;
2576
Ted Kremenek8bef8232012-01-26 21:29:00 +00002577 std::pair<ExplodedNode *, ProgramStateRef >
2578 handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose8d228632011-08-23 20:07:14 +00002579 GenericNodeBuilderRefCount Bd, ExplodedNode *Pred,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002580 CheckerContext &Ctx, SymbolRef Sym, RefVal V) const;
Jordy Rose8d228632011-08-23 20:07:14 +00002581
Ted Kremenek8bef8232012-01-26 21:29:00 +00002582 ExplodedNode *processLeaks(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002583 SmallVectorImpl<SymbolRef> &Leaked,
2584 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002585 CheckerContext &Ctx,
Jordy Rose38f17d62011-08-23 19:01:07 +00002586 ExplodedNode *Pred = 0) const;
Ted Kremenekd593eb92009-11-25 22:17:44 +00002587};
2588} // end anonymous namespace
2589
Jordy Rose67044292011-08-17 21:27:39 +00002590namespace {
2591class StopTrackingCallback : public SymbolVisitor {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002592 ProgramStateRef state;
Jordy Rose67044292011-08-17 21:27:39 +00002593public:
Ted Kremenek8bef8232012-01-26 21:29:00 +00002594 StopTrackingCallback(ProgramStateRef st) : state(st) {}
2595 ProgramStateRef getState() const { return state; }
Jordy Rose67044292011-08-17 21:27:39 +00002596
2597 bool VisitSymbol(SymbolRef sym) {
2598 state = state->remove<RefBindings>(sym);
2599 return true;
2600 }
2601};
2602} // end anonymous namespace
2603
Jordy Rose910c4052011-09-02 06:44:22 +00002604//===----------------------------------------------------------------------===//
2605// Handle statements that may have an effect on refcounts.
2606//===----------------------------------------------------------------------===//
Jordy Rose67044292011-08-17 21:27:39 +00002607
Jordy Rose910c4052011-09-02 06:44:22 +00002608void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2609 CheckerContext &C) const {
Jordy Rose67044292011-08-17 21:27:39 +00002610
Jordy Rose910c4052011-09-02 06:44:22 +00002611 // Scan the BlockDecRefExprs for any object the retain count checker
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002612 // may be tracking.
John McCall469a1eb2011-02-02 13:00:07 +00002613 if (!BE->getBlockDecl()->hasCaptures())
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002614 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002615
Ted Kremenek8bef8232012-01-26 21:29:00 +00002616 ProgramStateRef state = C.getState();
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002617 const BlockDataRegion *R =
Ted Kremenek5eca4822012-01-06 22:09:28 +00002618 cast<BlockDataRegion>(state->getSVal(BE,
2619 C.getLocationContext()).getAsRegion());
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002620
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002621 BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
2622 E = R->referenced_vars_end();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002623
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002624 if (I == E)
2625 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002626
Ted Kremenek67d12872009-12-07 22:05:27 +00002627 // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2628 // via captured variables, even though captured variables result in a copy
2629 // and in implicit increment/decrement of a retain count.
Chris Lattner5f9e2722011-07-23 10:55:15 +00002630 SmallVector<const MemRegion*, 10> Regions;
Anna Zaks39ac1872011-10-26 21:06:44 +00002631 const LocationContext *LC = C.getLocationContext();
Ted Kremenekc8413fd2010-12-02 07:49:45 +00002632 MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002633
Ted Kremenek67d12872009-12-07 22:05:27 +00002634 for ( ; I != E; ++I) {
2635 const VarRegion *VR = *I;
2636 if (VR->getSuperRegion() == R) {
2637 VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2638 }
2639 Regions.push_back(VR);
2640 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002641
Ted Kremenek67d12872009-12-07 22:05:27 +00002642 state =
2643 state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2644 Regions.data() + Regions.size()).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00002645 C.addTransition(state);
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002646}
2647
Jordy Rose910c4052011-09-02 06:44:22 +00002648void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2649 CheckerContext &C) const {
John McCallf85e1932011-06-15 23:02:42 +00002650 const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2651 if (!BE)
2652 return;
2653
John McCall71c482c2011-06-17 06:50:50 +00002654 ArgEffect AE = IncRef;
John McCallf85e1932011-06-15 23:02:42 +00002655
2656 switch (BE->getBridgeKind()) {
2657 case clang::OBC_Bridge:
2658 // Do nothing.
2659 return;
2660 case clang::OBC_BridgeRetained:
2661 AE = IncRef;
2662 break;
2663 case clang::OBC_BridgeTransfer:
2664 AE = DecRefBridgedTransfered;
2665 break;
2666 }
2667
Ted Kremenek8bef8232012-01-26 21:29:00 +00002668 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002669 SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
John McCallf85e1932011-06-15 23:02:42 +00002670 if (!Sym)
2671 return;
2672 const RefVal* T = state->get<RefBindings>(Sym);
2673 if (!T)
2674 return;
2675
John McCallf85e1932011-06-15 23:02:42 +00002676 RefVal::Kind hasErr = (RefVal::Kind) 0;
Jordy Rose17a38e22011-09-02 05:55:19 +00002677 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
John McCallf85e1932011-06-15 23:02:42 +00002678
2679 if (hasErr) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002680 // FIXME: If we get an error during a bridge cast, should we report it?
2681 // Should we assert that there is no error?
John McCallf85e1932011-06-15 23:02:42 +00002682 return;
2683 }
2684
Anna Zaks0bd6b112011-10-26 21:06:34 +00002685 C.addTransition(state);
John McCallf85e1932011-06-15 23:02:42 +00002686}
2687
Jordy Rose910c4052011-09-02 06:44:22 +00002688void RetainCountChecker::checkPostStmt(const CallExpr *CE,
2689 CheckerContext &C) const {
Ted Kremenek514f2c92012-03-23 06:26:56 +00002690 if (C.wasInlined)
2691 return;
2692
Jordy Rose294396b2011-08-22 23:48:23 +00002693 // Get the callee.
Ted Kremenek8bef8232012-01-26 21:29:00 +00002694 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002695 const Expr *Callee = CE->getCallee();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002696 SVal L = state->getSVal(Callee, C.getLocationContext());
Jordy Rose294396b2011-08-22 23:48:23 +00002697
Jordy Rose17a38e22011-09-02 05:55:19 +00002698 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Rose294396b2011-08-22 23:48:23 +00002699
Jordan Rose4531b7d2012-07-02 19:27:43 +00002700 // FIXME: This tree of switching can go away if/when we add a check::postCall.
Jordy Rose294396b2011-08-22 23:48:23 +00002701 if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) {
Jordan Rose4531b7d2012-07-02 19:27:43 +00002702 // FIXME: Better support for blocks. For now we stop tracking anything
2703 // that is passed to blocks.
2704 // FIXME: Need to handle variables that are "captured" by the block.
2705 BlockCall Call(CE, state, C.getLocationContext());
2706 const RetainSummary *Summ = Summaries.getSummary(Call, state);
2707 checkSummary(*Summ, Call, C);
2708
Jordy Rose294396b2011-08-22 23:48:23 +00002709 } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) {
Jordan Rose4531b7d2012-07-02 19:27:43 +00002710 CXXMemberCall Call(me, state, C.getLocationContext());
2711 const RetainSummary *Summ = Summaries.getSummary(Call, state);
2712 checkSummary(*Summ, Call, C);
2713
2714 } else {
2715 FunctionCall Call(CE, state, C.getLocationContext());
2716 const RetainSummary *Summ = Summaries.getSummary(Call, state);
2717 checkSummary(*Summ, Call, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002718 }
Jordy Rose294396b2011-08-22 23:48:23 +00002719}
2720
Jordy Rose910c4052011-09-02 06:44:22 +00002721void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE,
2722 CheckerContext &C) const {
Jordy Rose537716a2011-08-27 22:51:26 +00002723 const CXXConstructorDecl *Ctor = CE->getConstructor();
2724 if (!Ctor)
2725 return;
2726
Jordy Rose17a38e22011-09-02 05:55:19 +00002727 RetainSummaryManager &Summaries = getSummaryManager(C);
Anna Zaks58822c42012-05-04 22:18:39 +00002728 ProgramStateRef state = C.getState();
Jordan Rose4531b7d2012-07-02 19:27:43 +00002729 CXXConstructorCall Call(CE, state, C.getLocationContext());
Jordy Rose537716a2011-08-27 22:51:26 +00002730
Jordan Rose4531b7d2012-07-02 19:27:43 +00002731 const RetainSummary *Summ = Summaries.getSummary(Call, state);
Jordy Rose537716a2011-08-27 22:51:26 +00002732
Jordan Rose4531b7d2012-07-02 19:27:43 +00002733 checkSummary(*Summ, Call, C);
Jordy Rose537716a2011-08-27 22:51:26 +00002734}
2735
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002736void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2737 const Expr *Ex) const {
2738 ProgramStateRef state = C.getState();
2739 const ExplodedNode *pred = C.getPredecessor();
2740 for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ;
2741 it != et ; ++it) {
2742 const Stmt *child = *it;
2743 SVal V = state->getSVal(child, pred->getLocationContext());
2744 if (SymbolRef sym = V.getAsSymbol())
2745 if (const RefVal* T = state->get<RefBindings>(sym)) {
2746 RefVal::Kind hasErr = (RefVal::Kind) 0;
2747 state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2748 if (hasErr) {
2749 processNonLeakError(state, child->getSourceRange(), hasErr, sym, C);
2750 return;
2751 }
2752 }
2753 }
2754
2755 // Return the object as autoreleased.
2756 // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2757 if (SymbolRef sym =
2758 state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2759 QualType ResultTy = Ex->getType();
2760 state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC,
2761 ResultTy));
2762 }
2763
2764 C.addTransition(state);
2765}
2766
2767void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2768 CheckerContext &C) const {
2769 // Apply the 'MayEscape' to all values.
2770 processObjCLiterals(C, AL);
2771}
2772
2773void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2774 CheckerContext &C) const {
2775 // Apply the 'MayEscape' to all keys and values.
2776 processObjCLiterals(C, DL);
2777}
2778
Jordy Rose70fdbc32012-05-12 05:10:43 +00002779void RetainCountChecker::checkPostStmt(const ObjCBoxedExpr *Ex,
2780 CheckerContext &C) const {
2781 const ExplodedNode *Pred = C.getPredecessor();
2782 const LocationContext *LCtx = Pred->getLocationContext();
2783 ProgramStateRef State = Pred->getState();
2784
2785 if (SymbolRef Sym = State->getSVal(Ex, LCtx).getAsSymbol()) {
2786 QualType ResultTy = Ex->getType();
2787 State = State->set<RefBindings>(Sym, RefVal::makeNotOwned(RetEffect::ObjC,
2788 ResultTy));
2789 }
2790
2791 C.addTransition(State);
2792}
2793
Jordy Rose910c4052011-09-02 06:44:22 +00002794void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg,
2795 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002796 ProgramStateRef state = C.getState();
Jordan Rose4531b7d2012-07-02 19:27:43 +00002797 const LocationContext *LC = C.getLocationContext();
2798 ObjCMessageInvocation Call(Msg, state, LC);
Jordy Rose294396b2011-08-22 23:48:23 +00002799
Jordy Rose17a38e22011-09-02 05:55:19 +00002800 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordan Rose4531b7d2012-07-02 19:27:43 +00002801 const RetainSummary *Summ = Summaries.getSummary(Call, state);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002802
Jordan Rose4531b7d2012-07-02 19:27:43 +00002803 checkSummary(*Summ, Call, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002804}
2805
Jordy Rose910c4052011-09-02 06:44:22 +00002806/// GetReturnType - Used to get the return type of a message expression or
2807/// function call with the intention of affixing that type to a tracked symbol.
2808/// While the the return type can be queried directly from RetEx, when
2809/// invoking class methods we augment to the return type to be that of
2810/// a pointer to the class (as opposed it just being id).
2811// FIXME: We may be able to do this with related result types instead.
2812// This function is probably overestimating.
2813static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
2814 QualType RetTy = RetE->getType();
2815 // If RetE is not a message expression just return its type.
2816 // If RetE is a message expression, return its types if it is something
2817 /// more specific than id.
2818 if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
2819 if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
2820 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
2821 PT->isObjCClassType()) {
2822 // At this point we know the return type of the message expression is
2823 // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
2824 // is a call to a class method whose type we can resolve. In such
2825 // cases, promote the return type to XXX* (where XXX is the class).
2826 const ObjCInterfaceDecl *D = ME->getReceiverInterface();
2827 return !D ? RetTy :
2828 Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
2829 }
2830
2831 return RetTy;
2832}
2833
2834void RetainCountChecker::checkSummary(const RetainSummary &Summ,
Jordan Rose4531b7d2012-07-02 19:27:43 +00002835 const CallEvent &CallOrMsg,
Jordy Rose910c4052011-09-02 06:44:22 +00002836 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002837 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002838
2839 // Evaluate the effect of the arguments.
2840 RefVal::Kind hasErr = (RefVal::Kind) 0;
2841 SourceRange ErrorRange;
2842 SymbolRef ErrorSym = 0;
2843
2844 for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
Jordy Rose537716a2011-08-27 22:51:26 +00002845 SVal V = CallOrMsg.getArgSVal(idx);
Jordy Rose294396b2011-08-22 23:48:23 +00002846
2847 if (SymbolRef Sym = V.getAsLocSymbol()) {
2848 if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) {
Jordy Rose17a38e22011-09-02 05:55:19 +00002849 state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002850 if (hasErr) {
2851 ErrorRange = CallOrMsg.getArgSourceRange(idx);
2852 ErrorSym = Sym;
2853 break;
2854 }
2855 }
2856 }
2857 }
2858
2859 // Evaluate the effect on the message receiver.
2860 bool ReceiverIsTracked = false;
Jordan Rose4531b7d2012-07-02 19:27:43 +00002861 if (!hasErr) {
2862 const ObjCMessageInvocation *MsgInvocation =
2863 dyn_cast<ObjCMessageInvocation>(&CallOrMsg);
2864 if (MsgInvocation) {
2865 if (SymbolRef Sym = MsgInvocation->getReceiverSVal().getAsLocSymbol()) {
2866 if (const RefVal *T = state->get<RefBindings>(Sym)) {
2867 ReceiverIsTracked = true;
2868 state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
2869 hasErr, C);
2870 if (hasErr) {
2871 ErrorRange = MsgInvocation->getReceiverSourceRange();
2872 ErrorSym = Sym;
2873 }
Jordy Rose294396b2011-08-22 23:48:23 +00002874 }
2875 }
2876 }
2877 }
2878
2879 // Process any errors.
2880 if (hasErr) {
2881 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
2882 return;
2883 }
2884
2885 // Consult the summary for the return value.
2886 RetEffect RE = Summ.getRetEffect();
2887
2888 if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00002889 if (ReceiverIsTracked)
Jordy Rose17a38e22011-09-02 05:55:19 +00002890 RE = getSummaryManager(C).getObjAllocRetEffect();
Jordy Roseb6cfc092011-08-25 00:10:37 +00002891 else
Jordy Rose294396b2011-08-22 23:48:23 +00002892 RE = RetEffect::MakeNoRet();
2893 }
2894
2895 switch (RE.getKind()) {
2896 default:
David Blaikie7530c032012-01-17 06:56:22 +00002897 llvm_unreachable("Unhandled RetEffect.");
Jordy Rose294396b2011-08-22 23:48:23 +00002898
2899 case RetEffect::NoRet:
2900 // No work necessary.
2901 break;
2902
2903 case RetEffect::OwnedAllocatedSymbol:
2904 case RetEffect::OwnedSymbol: {
Ted Kremenek5eca4822012-01-06 22:09:28 +00002905 SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(),
2906 C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002907 if (!Sym)
2908 break;
2909
Jordan Rose4531b7d2012-07-02 19:27:43 +00002910 // Use the result type from the CallEvent as it automatically adjusts
Jordy Rose294396b2011-08-22 23:48:23 +00002911 // for methods/functions that return references.
Jordan Rose4531b7d2012-07-02 19:27:43 +00002912 QualType ResultTy = CallOrMsg.getResultType();
Jordy Rose294396b2011-08-22 23:48:23 +00002913 state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(),
2914 ResultTy));
2915
2916 // FIXME: Add a flag to the checker where allocations are assumed to
2917 // *not* fail. (The code below is out-of-date, though.)
2918#if 0
2919 if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) {
2920 bool isFeasible;
2921 state = state.assume(loc::SymbolVal(Sym), true, isFeasible);
2922 assert(isFeasible && "Cannot assume fresh symbol is non-null.");
2923 }
2924#endif
2925
2926 break;
2927 }
2928
2929 case RetEffect::GCNotOwnedSymbol:
2930 case RetEffect::ARCNotOwnedSymbol:
2931 case RetEffect::NotOwnedSymbol: {
2932 const Expr *Ex = CallOrMsg.getOriginExpr();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002933 SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002934 if (!Sym)
2935 break;
2936
2937 // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
2938 QualType ResultTy = GetReturnType(Ex, C.getASTContext());
2939 state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(),
2940 ResultTy));
2941 break;
2942 }
2943 }
2944
2945 // This check is actually necessary; otherwise the statement builder thinks
2946 // we've hit a previously-found path.
2947 // Normally addTransition takes care of this, but we want the node pointer.
2948 ExplodedNode *NewNode;
2949 if (state == C.getState()) {
2950 NewNode = C.getPredecessor();
2951 } else {
Anna Zaks0bd6b112011-10-26 21:06:34 +00002952 NewNode = C.addTransition(state);
Jordy Rose294396b2011-08-22 23:48:23 +00002953 }
2954
Jordy Rose9c083b72011-08-24 18:56:32 +00002955 // Annotate the node with summary we used.
2956 if (NewNode) {
2957 // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
2958 if (ShouldResetSummaryLog) {
2959 SummaryLog.clear();
2960 ShouldResetSummaryLog = false;
2961 }
Jordy Roseec9ef852011-08-23 20:55:48 +00002962 SummaryLog[NewNode] = &Summ;
Jordy Rose9c083b72011-08-24 18:56:32 +00002963 }
Jordy Rose294396b2011-08-22 23:48:23 +00002964}
2965
Jordy Rosee0a5d322011-08-23 20:27:16 +00002966
Ted Kremenek8bef8232012-01-26 21:29:00 +00002967ProgramStateRef
2968RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose910c4052011-09-02 06:44:22 +00002969 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2970 CheckerContext &C) const {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002971 // In GC mode [... release] and [... retain] do nothing.
Jordy Rose910c4052011-09-02 06:44:22 +00002972 // In ARC mode they shouldn't exist at all, but we just ignore them.
Jordy Rose17a38e22011-09-02 05:55:19 +00002973 bool IgnoreRetainMsg = C.isObjCGCEnabled();
2974 if (!IgnoreRetainMsg)
David Blaikie4e4d0842012-03-11 07:00:24 +00002975 IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002976
Jordy Rosee0a5d322011-08-23 20:27:16 +00002977 switch (E) {
Jordan Rose4531b7d2012-07-02 19:27:43 +00002978 default:
2979 break;
2980 case IncRefMsg:
2981 E = IgnoreRetainMsg ? DoNothing : IncRef;
2982 break;
2983 case DecRefMsg:
2984 E = IgnoreRetainMsg ? DoNothing : DecRef;
2985 break;
2986 case DecRefMsgAndStopTracking:
2987 E = IgnoreRetainMsg ? StopTracking : DecRefAndStopTracking;
2988 break;
2989 case MakeCollectable:
2990 E = C.isObjCGCEnabled() ? DecRef : DoNothing;
2991 break;
2992 case NewAutoreleasePool:
2993 E = C.isObjCGCEnabled() ? DoNothing : NewAutoreleasePool;
2994 break;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002995 }
2996
2997 // Handle all use-after-releases.
Jordy Rose17a38e22011-09-02 05:55:19 +00002998 if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002999 V = V ^ RefVal::ErrorUseAfterRelease;
3000 hasErr = V.getKind();
3001 return state->set<RefBindings>(sym, V);
3002 }
3003
3004 switch (E) {
3005 case DecRefMsg:
3006 case IncRefMsg:
3007 case MakeCollectable:
Jordan Rose4531b7d2012-07-02 19:27:43 +00003008 case DecRefMsgAndStopTracking:
Jordy Rosee0a5d322011-08-23 20:27:16 +00003009 llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
Jordy Rosee0a5d322011-08-23 20:27:16 +00003010
3011 case Dealloc:
3012 // Any use of -dealloc in GC is *bad*.
Jordy Rose17a38e22011-09-02 05:55:19 +00003013 if (C.isObjCGCEnabled()) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00003014 V = V ^ RefVal::ErrorDeallocGC;
3015 hasErr = V.getKind();
3016 break;
3017 }
3018
3019 switch (V.getKind()) {
3020 default:
3021 llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00003022 case RefVal::Owned:
3023 // The object immediately transitions to the released state.
3024 V = V ^ RefVal::Released;
3025 V.clearCounts();
3026 return state->set<RefBindings>(sym, V);
3027 case RefVal::NotOwned:
3028 V = V ^ RefVal::ErrorDeallocNotOwned;
3029 hasErr = V.getKind();
3030 break;
3031 }
3032 break;
3033
3034 case NewAutoreleasePool:
Jordy Rose17a38e22011-09-02 05:55:19 +00003035 assert(!C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003036 return state->add<AutoreleaseStack>(sym);
3037
3038 case MayEscape:
3039 if (V.getKind() == RefVal::Owned) {
3040 V = V ^ RefVal::NotOwned;
3041 break;
3042 }
3043
3044 // Fall-through.
3045
Jordy Rosee0a5d322011-08-23 20:27:16 +00003046 case DoNothing:
3047 return state;
3048
3049 case Autorelease:
Jordy Rose17a38e22011-09-02 05:55:19 +00003050 if (C.isObjCGCEnabled())
Jordy Rosee0a5d322011-08-23 20:27:16 +00003051 return state;
3052
3053 // Update the autorelease counts.
3054 state = SendAutorelease(state, ARCountFactory, sym);
3055 V = V.autorelease();
3056 break;
3057
3058 case StopTracking:
3059 return state->remove<RefBindings>(sym);
3060
3061 case IncRef:
3062 switch (V.getKind()) {
3063 default:
3064 llvm_unreachable("Invalid RefVal state for a retain.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00003065 case RefVal::Owned:
3066 case RefVal::NotOwned:
3067 V = V + 1;
3068 break;
3069 case RefVal::Released:
3070 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00003071 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003072 V = (V ^ RefVal::Owned) + 1;
3073 break;
3074 }
3075 break;
3076
Jordy Rosee0a5d322011-08-23 20:27:16 +00003077 case DecRef:
3078 case DecRefBridgedTransfered:
Jordan Rose4531b7d2012-07-02 19:27:43 +00003079 case DecRefAndStopTracking:
Jordy Rosee0a5d322011-08-23 20:27:16 +00003080 switch (V.getKind()) {
3081 default:
3082 // case 'RefVal::Released' handled above.
3083 llvm_unreachable("Invalid RefVal state for a release.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00003084
3085 case RefVal::Owned:
3086 assert(V.getCount() > 0);
3087 if (V.getCount() == 1)
3088 V = V ^ (E == DecRefBridgedTransfered ?
3089 RefVal::NotOwned : RefVal::Released);
Jordan Rose4531b7d2012-07-02 19:27:43 +00003090 else if (E == DecRefAndStopTracking)
3091 return state->remove<RefBindings>(sym);
3092
Jordy Rosee0a5d322011-08-23 20:27:16 +00003093 V = V - 1;
3094 break;
3095
3096 case RefVal::NotOwned:
Jordan Rose4531b7d2012-07-02 19:27:43 +00003097 if (V.getCount() > 0) {
3098 if (E == DecRefAndStopTracking)
3099 return state->remove<RefBindings>(sym);
Jordy Rosee0a5d322011-08-23 20:27:16 +00003100 V = V - 1;
Jordan Rose4531b7d2012-07-02 19:27:43 +00003101 } else {
Jordy Rosee0a5d322011-08-23 20:27:16 +00003102 V = V ^ RefVal::ErrorReleaseNotOwned;
3103 hasErr = V.getKind();
3104 }
3105 break;
3106
3107 case RefVal::Released:
3108 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00003109 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003110 V = V ^ RefVal::ErrorUseAfterRelease;
3111 hasErr = V.getKind();
3112 break;
3113 }
3114 break;
3115 }
3116 return state->set<RefBindings>(sym, V);
3117}
3118
Ted Kremenek8bef8232012-01-26 21:29:00 +00003119void RetainCountChecker::processNonLeakError(ProgramStateRef St,
Jordy Rose910c4052011-09-02 06:44:22 +00003120 SourceRange ErrorRange,
3121 RefVal::Kind ErrorKind,
3122 SymbolRef Sym,
3123 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00003124 ExplodedNode *N = C.generateSink(St);
3125 if (!N)
3126 return;
3127
Jordy Rose294396b2011-08-22 23:48:23 +00003128 CFRefBug *BT;
3129 switch (ErrorKind) {
3130 default:
3131 llvm_unreachable("Unhandled error.");
Jordy Rose294396b2011-08-22 23:48:23 +00003132 case RefVal::ErrorUseAfterRelease:
Jordy Rosed6334e12011-08-25 00:34:03 +00003133 if (!useAfterRelease)
3134 useAfterRelease.reset(new UseAfterRelease());
3135 BT = &*useAfterRelease;
Jordy Rose294396b2011-08-22 23:48:23 +00003136 break;
3137 case RefVal::ErrorReleaseNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003138 if (!releaseNotOwned)
3139 releaseNotOwned.reset(new BadRelease());
3140 BT = &*releaseNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003141 break;
3142 case RefVal::ErrorDeallocGC:
Jordy Rosed6334e12011-08-25 00:34:03 +00003143 if (!deallocGC)
3144 deallocGC.reset(new DeallocGC());
3145 BT = &*deallocGC;
Jordy Rose294396b2011-08-22 23:48:23 +00003146 break;
3147 case RefVal::ErrorDeallocNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003148 if (!deallocNotOwned)
3149 deallocNotOwned.reset(new DeallocNotOwned());
3150 BT = &*deallocNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003151 break;
3152 }
3153
Jordy Rosed6334e12011-08-25 00:34:03 +00003154 assert(BT);
David Blaikie4e4d0842012-03-11 07:00:24 +00003155 CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003156 C.isObjCGCEnabled(), SummaryLog,
3157 N, Sym);
Jordy Rose294396b2011-08-22 23:48:23 +00003158 report->addRange(ErrorRange);
3159 C.EmitReport(report);
3160}
3161
Jordy Rose910c4052011-09-02 06:44:22 +00003162//===----------------------------------------------------------------------===//
3163// Handle the return values of retain-count-related functions.
3164//===----------------------------------------------------------------------===//
3165
3166bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
Jordy Rose76c506f2011-08-21 21:58:18 +00003167 // Get the callee. We're only interested in simple C functions.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003168 ProgramStateRef state = C.getState();
Anna Zaksb805c8f2011-12-01 05:57:37 +00003169 const FunctionDecl *FD = C.getCalleeDecl(CE);
Jordy Rose76c506f2011-08-21 21:58:18 +00003170 if (!FD)
3171 return false;
3172
3173 IdentifierInfo *II = FD->getIdentifier();
3174 if (!II)
3175 return false;
3176
3177 // For now, we're only handling the functions that return aliases of their
3178 // arguments: CFRetain and CFMakeCollectable (and their families).
3179 // Eventually we should add other functions we can model entirely,
3180 // such as CFRelease, which don't invalidate their arguments or globals.
3181 if (CE->getNumArgs() != 1)
3182 return false;
3183
3184 // Get the name of the function.
3185 StringRef FName = II->getName();
3186 FName = FName.substr(FName.find_first_not_of('_'));
3187
3188 // See if it's one of the specific functions we know how to eval.
3189 bool canEval = false;
3190
Anna Zaksb805c8f2011-12-01 05:57:37 +00003191 QualType ResultTy = CE->getCallReturnType();
Jordy Rose76c506f2011-08-21 21:58:18 +00003192 if (ResultTy->isObjCIdType()) {
3193 // Handle: id NSMakeCollectable(CFTypeRef)
3194 canEval = II->isStr("NSMakeCollectable");
3195 } else if (ResultTy->isPointerType()) {
3196 // Handle: (CF|CG)Retain
3197 // CFMakeCollectable
3198 // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3199 if (cocoa::isRefType(ResultTy, "CF", FName) ||
3200 cocoa::isRefType(ResultTy, "CG", FName)) {
3201 canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName);
3202 }
3203 }
3204
3205 if (!canEval)
3206 return false;
3207
3208 // Bind the return value.
Ted Kremenek5eca4822012-01-06 22:09:28 +00003209 const LocationContext *LCtx = C.getLocationContext();
3210 SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003211 if (RetVal.isUnknown()) {
3212 // If the receiver is unknown, conjure a return value.
3213 SValBuilder &SVB = C.getSValBuilder();
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003214 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003215 SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count);
Jordy Rose76c506f2011-08-21 21:58:18 +00003216 }
Ted Kremenek5eca4822012-01-06 22:09:28 +00003217 state = state->BindExpr(CE, LCtx, RetVal, false);
Jordy Rose76c506f2011-08-21 21:58:18 +00003218
Jordy Rose294396b2011-08-22 23:48:23 +00003219 // FIXME: This should not be necessary, but otherwise the argument seems to be
3220 // considered alive during the next statement.
3221 if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3222 // Save the refcount status of the argument.
3223 SymbolRef Sym = RetVal.getAsLocSymbol();
3224 RefBindings::data_type *Binding = 0;
3225 if (Sym)
3226 Binding = state->get<RefBindings>(Sym);
Jordy Rose76c506f2011-08-21 21:58:18 +00003227
Jordy Rose294396b2011-08-22 23:48:23 +00003228 // Invalidate the argument region.
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003229 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003230 state = state->invalidateRegions(ArgRegion, CE, Count, LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003231
Jordy Rose294396b2011-08-22 23:48:23 +00003232 // Restore the refcount status of the argument.
3233 if (Binding)
3234 state = state->set<RefBindings>(Sym, *Binding);
3235 }
3236
Anna Zaks0bd6b112011-10-26 21:06:34 +00003237 C.addTransition(state);
Jordy Rose76c506f2011-08-21 21:58:18 +00003238 return true;
3239}
3240
Jordy Rose910c4052011-09-02 06:44:22 +00003241//===----------------------------------------------------------------------===//
3242// Handle return statements.
3243//===----------------------------------------------------------------------===//
Jordy Rosef53e8c72011-08-23 19:43:16 +00003244
Ted Kremeneke5715782012-02-25 02:09:09 +00003245// Return true if the current LocationContext has no caller context.
3246static bool inTopFrame(CheckerContext &C) {
3247 const LocationContext *LC = C.getLocationContext();
3248 return LC->getParent() == 0;
3249}
3250
Jordy Rose910c4052011-09-02 06:44:22 +00003251void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3252 CheckerContext &C) const {
Ted Kremeneke5715782012-02-25 02:09:09 +00003253
3254 // Only adjust the reference count if this is the top-level call frame,
3255 // and not the result of inlining. In the future, we should do
3256 // better checking even for inlined calls, and see if they match
3257 // with their expected semantics (e.g., the method should return a retained
3258 // object, etc.).
3259 if (!inTopFrame(C))
3260 return;
3261
Jordy Rosef53e8c72011-08-23 19:43:16 +00003262 const Expr *RetE = S->getRetValue();
3263 if (!RetE)
3264 return;
3265
Ted Kremenek8bef8232012-01-26 21:29:00 +00003266 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00003267 SymbolRef Sym =
3268 state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003269 if (!Sym)
3270 return;
3271
3272 // Get the reference count binding (if any).
3273 const RefVal *T = state->get<RefBindings>(Sym);
3274 if (!T)
3275 return;
3276
3277 // Change the reference count.
3278 RefVal X = *T;
3279
3280 switch (X.getKind()) {
3281 case RefVal::Owned: {
3282 unsigned cnt = X.getCount();
3283 assert(cnt > 0);
3284 X.setCount(cnt - 1);
3285 X = X ^ RefVal::ReturnedOwned;
3286 break;
3287 }
3288
3289 case RefVal::NotOwned: {
3290 unsigned cnt = X.getCount();
3291 if (cnt) {
3292 X.setCount(cnt - 1);
3293 X = X ^ RefVal::ReturnedOwned;
3294 }
3295 else {
3296 X = X ^ RefVal::ReturnedNotOwned;
3297 }
3298 break;
3299 }
3300
3301 default:
3302 return;
3303 }
3304
3305 // Update the binding.
3306 state = state->set<RefBindings>(Sym, X);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003307 ExplodedNode *Pred = C.addTransition(state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003308
3309 // At this point we have updated the state properly.
3310 // Everything after this is merely checking to see if the return value has
3311 // been over- or under-retained.
3312
3313 // Did we cache out?
3314 if (!Pred)
3315 return;
3316
Jordy Rosef53e8c72011-08-23 19:43:16 +00003317 // Update the autorelease counts.
3318 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003319 AutoreleaseTag("RetainCountChecker : Autorelease");
Anna Zaks4eff8232011-10-05 23:44:11 +00003320 GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003321 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003322
3323 // Did we cache out?
Jordy Rose8d228632011-08-23 20:07:14 +00003324 if (!Pred)
Jordy Rosef53e8c72011-08-23 19:43:16 +00003325 return;
3326
3327 // Get the updated binding.
3328 T = state->get<RefBindings>(Sym);
3329 assert(T);
3330 X = *T;
3331
3332 // Consult the summary of the enclosing method.
Jordy Rose17a38e22011-09-02 05:55:19 +00003333 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003334 const Decl *CD = &Pred->getCodeDecl();
Jordan Rose4531b7d2012-07-02 19:27:43 +00003335 RetEffect RE = RetEffect::MakeNoRet();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003336
Jordan Rose4531b7d2012-07-02 19:27:43 +00003337 // FIXME: What is the convention for blocks? Is there one?
Jordy Rosef53e8c72011-08-23 19:43:16 +00003338 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00003339 const RetainSummary *Summ = Summaries.getMethodSummary(MD);
Jordan Rose4531b7d2012-07-02 19:27:43 +00003340 RE = Summ->getRetEffect();
3341 } else if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3342 if (!isa<CXXMethodDecl>(FD)) {
3343 const RetainSummary *Summ = Summaries.getFunctionSummary(FD);
3344 RE = Summ->getRetEffect();
3345 }
Jordy Rosef53e8c72011-08-23 19:43:16 +00003346 }
3347
Jordan Rose4531b7d2012-07-02 19:27:43 +00003348 checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003349}
3350
Jordy Rose910c4052011-09-02 06:44:22 +00003351void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3352 CheckerContext &C,
3353 ExplodedNode *Pred,
3354 RetEffect RE, RefVal X,
3355 SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003356 ProgramStateRef state) const {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003357 // Any leaks or other errors?
3358 if (X.isReturnedOwned() && X.getCount() == 0) {
3359 if (RE.getKind() != RetEffect::NoRet) {
3360 bool hasError = false;
Jordy Rose17a38e22011-09-02 05:55:19 +00003361 if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003362 // Things are more complicated with garbage collection. If the
3363 // returned object is suppose to be an Objective-C object, we have
3364 // a leak (as the caller expects a GC'ed object) because no
3365 // method should return ownership unless it returns a CF object.
3366 hasError = true;
3367 X = X ^ RefVal::ErrorGCLeakReturned;
3368 }
3369 else if (!RE.isOwned()) {
3370 // Either we are using GC and the returned object is a CF type
3371 // or we aren't using GC. In either case, we expect that the
3372 // enclosing method is expected to return ownership.
3373 hasError = true;
3374 X = X ^ RefVal::ErrorLeakReturned;
3375 }
3376
3377 if (hasError) {
3378 // Generate an error node.
3379 state = state->set<RefBindings>(Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003380
3381 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003382 ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003383 ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003384 if (N) {
David Blaikie4e4d0842012-03-11 07:00:24 +00003385 const LangOptions &LOpts = C.getASTContext().getLangOpts();
Jordy Rose17a38e22011-09-02 05:55:19 +00003386 bool GCEnabled = C.isObjCGCEnabled();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003387 CFRefReport *report =
Jordy Rose17a38e22011-09-02 05:55:19 +00003388 new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled),
3389 LOpts, GCEnabled, SummaryLog,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003390 N, Sym, C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003391 C.EmitReport(report);
3392 }
3393 }
3394 }
3395 } else if (X.isReturnedNotOwned()) {
3396 if (RE.isOwned()) {
3397 // Trying to return a not owned object to a caller expecting an
3398 // owned object.
3399 state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003400
3401 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003402 ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003403 ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003404 if (N) {
Jordy Rosed6334e12011-08-25 00:34:03 +00003405 if (!returnNotOwnedForOwned)
3406 returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned());
3407
Jordy Rosef53e8c72011-08-23 19:43:16 +00003408 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003409 new CFRefReport(*returnNotOwnedForOwned,
David Blaikie4e4d0842012-03-11 07:00:24 +00003410 C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003411 C.isObjCGCEnabled(), SummaryLog, N, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003412 C.EmitReport(report);
3413 }
3414 }
3415 }
3416}
3417
Jordy Rose8d228632011-08-23 20:07:14 +00003418//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003419// Check various ways a symbol can be invalidated.
3420//===----------------------------------------------------------------------===//
3421
Anna Zaks390909c2011-10-06 00:43:15 +00003422void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
Jordy Rose910c4052011-09-02 06:44:22 +00003423 CheckerContext &C) const {
3424 // Are we storing to something that causes the value to "escape"?
3425 bool escapes = true;
3426
3427 // A value escapes in three possible cases (this may change):
3428 //
3429 // (1) we are binding to something that is not a memory region.
3430 // (2) we are binding to a memregion that does not have stack storage
3431 // (3) we are binding to a memregion with stack storage that the store
3432 // does not understand.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003433 ProgramStateRef state = C.getState();
Jordy Rose910c4052011-09-02 06:44:22 +00003434
3435 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
3436 escapes = !regionLoc->getRegion()->hasStackStorage();
3437
3438 if (!escapes) {
3439 // To test (3), generate a new state with the binding added. If it is
3440 // the same state, then it escapes (since the store cannot represent
3441 // the binding).
Anna Zakse7958da2012-05-02 00:15:40 +00003442 // Do this only if we know that the store is not supposed to generate the
3443 // same state.
3444 SVal StoredVal = state->getSVal(regionLoc->getRegion());
3445 if (StoredVal != val)
3446 escapes = (state == (state->bindLoc(*regionLoc, val)));
Jordy Rose910c4052011-09-02 06:44:22 +00003447 }
Ted Kremenekde5b4fb2012-03-27 01:12:45 +00003448 if (!escapes) {
3449 // Case 4: We do not currently model what happens when a symbol is
3450 // assigned to a struct field, so be conservative here and let the symbol
3451 // go. TODO: This could definitely be improved upon.
3452 escapes = !isa<VarRegion>(regionLoc->getRegion());
3453 }
Jordy Rose910c4052011-09-02 06:44:22 +00003454 }
3455
3456 // If our store can represent the binding and we aren't storing to something
3457 // that doesn't have local storage then just return and have the simulation
3458 // state continue as is.
3459 if (!escapes)
3460 return;
3461
3462 // Otherwise, find all symbols referenced by 'val' that we are tracking
3463 // and stop tracking them.
3464 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00003465 C.addTransition(state);
Jordy Rose910c4052011-09-02 06:44:22 +00003466}
3467
Ted Kremenek8bef8232012-01-26 21:29:00 +00003468ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003469 SVal Cond,
3470 bool Assumption) const {
3471
3472 // FIXME: We may add to the interface of evalAssume the list of symbols
3473 // whose assumptions have changed. For now we just iterate through the
3474 // bindings and check if any of the tracked symbols are NULL. This isn't
3475 // too bad since the number of symbols we will track in practice are
3476 // probably small and evalAssume is only called at branches and a few
3477 // other places.
3478 RefBindings B = state->get<RefBindings>();
3479
3480 if (B.isEmpty())
3481 return state;
3482
3483 bool changed = false;
3484 RefBindings::Factory &RefBFactory = state->get_context<RefBindings>();
3485
3486 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3487 // Check if the symbol is null (or equal to any constant).
3488 // If this is the case, stop tracking the symbol.
3489 if (state->getSymVal(I.getKey())) {
3490 changed = true;
3491 B = RefBFactory.remove(B, I.getKey());
3492 }
3493 }
3494
3495 if (changed)
3496 state = state->set<RefBindings>(B);
3497
3498 return state;
3499}
3500
Ted Kremenek8bef8232012-01-26 21:29:00 +00003501ProgramStateRef
3502RetainCountChecker::checkRegionChanges(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003503 const StoreManager::InvalidatedSymbols *invalidated,
3504 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00003505 ArrayRef<const MemRegion *> Regions,
Jordan Rose740d4902012-07-02 19:27:35 +00003506 const CallEvent *Call) const {
Jordy Rose910c4052011-09-02 06:44:22 +00003507 if (!invalidated)
3508 return state;
3509
3510 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3511 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3512 E = ExplicitRegions.end(); I != E; ++I) {
3513 if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3514 WhitelistedSymbols.insert(SR->getSymbol());
3515 }
3516
3517 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
3518 E = invalidated->end(); I!=E; ++I) {
3519 SymbolRef sym = *I;
3520 if (WhitelistedSymbols.count(sym))
3521 continue;
3522 // Remove any existing reference-count binding.
3523 state = state->remove<RefBindings>(sym);
3524 }
3525 return state;
3526}
3527
3528//===----------------------------------------------------------------------===//
Jordy Rose8d228632011-08-23 20:07:14 +00003529// Handle dead symbols and end-of-path.
3530//===----------------------------------------------------------------------===//
3531
Ted Kremenek8bef8232012-01-26 21:29:00 +00003532std::pair<ExplodedNode *, ProgramStateRef >
3533RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003534 GenericNodeBuilderRefCount Bd,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003535 ExplodedNode *Pred,
3536 CheckerContext &Ctx,
Jordy Rose910c4052011-09-02 06:44:22 +00003537 SymbolRef Sym, RefVal V) const {
Jordy Rose8d228632011-08-23 20:07:14 +00003538 unsigned ACnt = V.getAutoreleaseCount();
3539
3540 // No autorelease counts? Nothing to be done.
3541 if (!ACnt)
3542 return std::make_pair(Pred, state);
3543
Anna Zaks6a93bd52011-10-25 19:57:11 +00003544 assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
Jordy Rose8d228632011-08-23 20:07:14 +00003545 unsigned Cnt = V.getCount();
3546
3547 // FIXME: Handle sending 'autorelease' to already released object.
3548
3549 if (V.getKind() == RefVal::ReturnedOwned)
3550 ++Cnt;
3551
3552 if (ACnt <= Cnt) {
3553 if (ACnt == Cnt) {
3554 V.clearCounts();
3555 if (V.getKind() == RefVal::ReturnedOwned)
3556 V = V ^ RefVal::ReturnedNotOwned;
3557 else
3558 V = V ^ RefVal::NotOwned;
3559 } else {
3560 V.setCount(Cnt - ACnt);
3561 V.setAutoreleaseCount(0);
3562 }
3563 state = state->set<RefBindings>(Sym, V);
3564 ExplodedNode *N = Bd.MakeNode(state, Pred);
3565 if (N == 0)
3566 state = 0;
3567 return std::make_pair(N, state);
3568 }
3569
3570 // Woah! More autorelease counts then retain counts left.
3571 // Emit hard error.
3572 V = V ^ RefVal::ErrorOverAutorelease;
3573 state = state->set<RefBindings>(Sym, V);
3574
Anna Zaksf05aac82011-10-18 23:05:58 +00003575 if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003576 SmallString<128> sbuf;
Jordy Rose8d228632011-08-23 20:07:14 +00003577 llvm::raw_svector_ostream os(sbuf);
3578 os << "Object over-autoreleased: object was sent -autorelease ";
3579 if (V.getAutoreleaseCount() > 1)
3580 os << V.getAutoreleaseCount() << " times ";
3581 os << "but the object has a +" << V.getCount() << " retain count";
3582
Jordy Rosed6334e12011-08-25 00:34:03 +00003583 if (!overAutorelease)
3584 overAutorelease.reset(new OverAutorelease());
3585
David Blaikie4e4d0842012-03-11 07:00:24 +00003586 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Jordy Rose8d228632011-08-23 20:07:14 +00003587 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003588 new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3589 SummaryLog, N, Sym, os.str());
Anna Zaks6a93bd52011-10-25 19:57:11 +00003590 Ctx.EmitReport(report);
Jordy Rose8d228632011-08-23 20:07:14 +00003591 }
3592
Ted Kremenek8bef8232012-01-26 21:29:00 +00003593 return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0);
Jordy Rose8d228632011-08-23 20:07:14 +00003594}
Jordy Rose38f17d62011-08-23 19:01:07 +00003595
Ted Kremenek8bef8232012-01-26 21:29:00 +00003596ProgramStateRef
3597RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003598 SymbolRef sid, RefVal V,
Jordy Rose38f17d62011-08-23 19:01:07 +00003599 SmallVectorImpl<SymbolRef> &Leaked) const {
Jordy Rose53376122011-08-24 04:48:19 +00003600 bool hasLeak = false;
Jordy Rose38f17d62011-08-23 19:01:07 +00003601 if (V.isOwned())
3602 hasLeak = true;
3603 else if (V.isNotOwned() || V.isReturnedOwned())
3604 hasLeak = (V.getCount() > 0);
3605
3606 if (!hasLeak)
3607 return state->remove<RefBindings>(sid);
3608
3609 Leaked.push_back(sid);
3610 return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak);
3611}
3612
3613ExplodedNode *
Ted Kremenek8bef8232012-01-26 21:29:00 +00003614RetainCountChecker::processLeaks(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003615 SmallVectorImpl<SymbolRef> &Leaked,
3616 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003617 CheckerContext &Ctx,
3618 ExplodedNode *Pred) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003619 if (Leaked.empty())
3620 return Pred;
3621
3622 // Generate an intermediate node representing the leak point.
3623 ExplodedNode *N = Builder.MakeNode(state, Pred);
3624
3625 if (N) {
3626 for (SmallVectorImpl<SymbolRef>::iterator
3627 I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3628
David Blaikie4e4d0842012-03-11 07:00:24 +00003629 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Anna Zaks6a93bd52011-10-25 19:57:11 +00003630 bool GCEnabled = Ctx.isObjCGCEnabled();
Jordy Rose17a38e22011-09-02 05:55:19 +00003631 CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3632 : getLeakAtReturnBug(LOpts, GCEnabled);
Jordy Rose38f17d62011-08-23 19:01:07 +00003633 assert(BT && "BugType not initialized.");
Jordy Rose20589562011-08-24 22:39:09 +00003634
Jordy Rose17a38e22011-09-02 05:55:19 +00003635 CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003636 SummaryLog, N, *I, Ctx);
3637 Ctx.EmitReport(report);
Jordy Rose38f17d62011-08-23 19:01:07 +00003638 }
3639 }
3640
3641 return N;
3642}
3643
Anna Zaksaf498a22011-10-25 19:56:48 +00003644void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00003645 ProgramStateRef state = Ctx.getState();
Anna Zaksaf498a22011-10-25 19:56:48 +00003646 GenericNodeBuilderRefCount Bd(Ctx);
Jordy Rose38f17d62011-08-23 19:01:07 +00003647 RefBindings B = state->get<RefBindings>();
Anna Zaksaf498a22011-10-25 19:56:48 +00003648 ExplodedNode *Pred = Ctx.getPredecessor();
Jordy Rose38f17d62011-08-23 19:01:07 +00003649
3650 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
Anna Zaks6a93bd52011-10-25 19:57:11 +00003651 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx,
Jordy Rose8d228632011-08-23 20:07:14 +00003652 I->first, I->second);
3653 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003654 return;
3655 }
3656
Ted Kremenek0cf3d472012-02-07 00:24:33 +00003657 // If the current LocationContext has a parent, don't check for leaks.
3658 // We will do that later.
3659 // FIXME: we should instead check for imblances of the retain/releases,
3660 // and suggest annotations.
3661 if (Ctx.getLocationContext()->getParent())
3662 return;
3663
Jordy Rose38f17d62011-08-23 19:01:07 +00003664 B = state->get<RefBindings>();
3665 SmallVector<SymbolRef, 10> Leaked;
3666
3667 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I)
Jordy Rose8d228632011-08-23 20:07:14 +00003668 state = handleSymbolDeath(state, I->first, I->second, Leaked);
Jordy Rose38f17d62011-08-23 19:01:07 +00003669
Anna Zaks6a93bd52011-10-25 19:57:11 +00003670 processLeaks(state, Leaked, Bd, Ctx, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003671}
3672
3673const ProgramPointTag *
Jordy Rose910c4052011-09-02 06:44:22 +00003674RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003675 const SimpleProgramPointTag *&tag = DeadSymbolTags[sym];
3676 if (!tag) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003677 SmallString<64> buf;
Jordy Rose38f17d62011-08-23 19:01:07 +00003678 llvm::raw_svector_ostream out(buf);
Anna Zaksf62ceec2011-12-05 18:58:11 +00003679 out << "RetainCountChecker : Dead Symbol : ";
3680 sym->dumpToStream(out);
Jordy Rose38f17d62011-08-23 19:01:07 +00003681 tag = new SimpleProgramPointTag(out.str());
3682 }
3683 return tag;
3684}
3685
Jordy Rose910c4052011-09-02 06:44:22 +00003686void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
3687 CheckerContext &C) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003688 ExplodedNode *Pred = C.getPredecessor();
3689
Ted Kremenek8bef8232012-01-26 21:29:00 +00003690 ProgramStateRef state = C.getState();
Jordy Rose38f17d62011-08-23 19:01:07 +00003691 RefBindings B = state->get<RefBindings>();
3692
3693 // Update counts from autorelease pools
3694 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3695 E = SymReaper.dead_end(); I != E; ++I) {
3696 SymbolRef Sym = *I;
3697 if (const RefVal *T = B.lookup(Sym)){
3698 // Use the symbol as the tag.
3699 // FIXME: This might not be as unique as we would like.
Anna Zaks4eff8232011-10-05 23:44:11 +00003700 GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym));
Anna Zaks6a93bd52011-10-25 19:57:11 +00003701 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C,
Jordy Rose8d228632011-08-23 20:07:14 +00003702 Sym, *T);
3703 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003704 return;
3705 }
3706 }
3707
3708 B = state->get<RefBindings>();
3709 SmallVector<SymbolRef, 10> Leaked;
3710
3711 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3712 E = SymReaper.dead_end(); I != E; ++I) {
3713 if (const RefVal *T = B.lookup(*I))
3714 state = handleSymbolDeath(state, *I, *T, Leaked);
3715 }
3716
3717 {
Anna Zaks4eff8232011-10-05 23:44:11 +00003718 GenericNodeBuilderRefCount Bd(C, this);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003719 Pred = processLeaks(state, Leaked, Bd, C, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003720 }
3721
3722 // Did we cache out?
3723 if (!Pred)
3724 return;
3725
3726 // Now generate a new node that nukes the old bindings.
3727 RefBindings::Factory &F = state->get_context<RefBindings>();
3728
3729 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3730 E = SymReaper.dead_end(); I != E; ++I)
3731 B = F.remove(B, *I);
3732
3733 state = state->set<RefBindings>(B);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003734 C.addTransition(state, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003735}
3736
Ted Kremenekd593eb92009-11-25 22:17:44 +00003737//===----------------------------------------------------------------------===//
Jordy Rosedbd658e2011-08-28 19:11:56 +00003738// Debug printing of refcount bindings and autorelease pools.
3739//===----------------------------------------------------------------------===//
3740
3741static void PrintPool(raw_ostream &Out, SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003742 ProgramStateRef State) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003743 Out << ' ';
3744 if (Sym)
Anna Zaksf62ceec2011-12-05 18:58:11 +00003745 Sym->dumpToStream(Out);
Jordy Rosedbd658e2011-08-28 19:11:56 +00003746 else
3747 Out << "<pool>";
3748 Out << ":{";
3749
3750 // Get the contents of the pool.
3751 if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym))
3752 for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I)
3753 Out << '(' << I.getKey() << ',' << I.getData() << ')';
3754
3755 Out << '}';
3756}
3757
Ted Kremenek8bef8232012-01-26 21:29:00 +00003758static bool UsesAutorelease(ProgramStateRef state) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003759 // A state uses autorelease if it allocated an autorelease pool or if it has
3760 // objects in the caller's autorelease pool.
3761 return !state->get<AutoreleaseStack>().isEmpty() ||
3762 state->get<AutoreleasePoolContents>(SymbolRef());
3763}
3764
Ted Kremenek8bef8232012-01-26 21:29:00 +00003765void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rose910c4052011-09-02 06:44:22 +00003766 const char *NL, const char *Sep) const {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003767
3768 RefBindings B = State->get<RefBindings>();
3769
3770 if (!B.isEmpty())
3771 Out << Sep << NL;
3772
3773 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3774 Out << I->first << " : ";
3775 I->second.print(Out);
3776 Out << NL;
3777 }
3778
3779 // Print the autorelease stack.
3780 if (UsesAutorelease(State)) {
3781 Out << Sep << NL << "AR pool stack:";
3782 ARStack Stack = State->get<AutoreleaseStack>();
3783
3784 PrintPool(Out, SymbolRef(), State); // Print the caller's pool.
3785 for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I)
3786 PrintPool(Out, *I, State);
3787
3788 Out << NL;
3789 }
3790}
3791
3792//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003793// Checker registration.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00003794//===----------------------------------------------------------------------===//
3795
Jordy Rose17a38e22011-09-02 05:55:19 +00003796void ento::registerRetainCountChecker(CheckerManager &Mgr) {
Jordy Rose910c4052011-09-02 06:44:22 +00003797 Mgr.registerChecker<RetainCountChecker>();
Jordy Rose17a38e22011-09-02 05:55:19 +00003798}
3799