Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1 | //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--// |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 10 | // This file defines the methods for RetainCountChecker, which implements |
| 11 | // a reference count checker for Core Foundation and Cocoa on (Mac OS X). |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 16 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | b277159 | 2011-03-30 17:41:19 +0000 | [diff] [blame] | 17 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 18 | #include "clang/Basic/LangOptions.h" |
| 19 | #include "clang/Basic/SourceManager.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/DomainSpecific/CocoaConventions.h" |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 21 | #include "clang/AST/ParentMap.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 23 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
| 25 | #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 26 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 27 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 28 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Jordy Rose | d1e5a89 | 2011-09-02 08:02:59 +0000 | [diff] [blame] | 29 | #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 30 | #include "llvm/ADT/DenseMap.h" |
| 31 | #include "llvm/ADT/FoldingSet.h" |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 32 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 33 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 34 | #include "llvm/ADT/SmallString.h" |
Ted Kremenek | 6ed9afc | 2008-05-16 18:33:44 +0000 | [diff] [blame] | 35 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 36 | #include "llvm/ADT/StringExtras.h" |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 37 | #include <cstdarg> |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 38 | |
| 39 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 40 | using namespace ento; |
Ted Kremenek | a64e89b | 2010-01-27 06:13:48 +0000 | [diff] [blame] | 41 | using llvm::StrInStrNoCase; |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | d775c66 | 2010-05-21 21:57:00 +0000 | [diff] [blame] | 43 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 44 | /// Wrapper around different kinds of node builder, so that helper functions |
| 45 | /// can have a common interface. |
Francois Pichet | ea09785 | 2011-01-11 10:41:37 +0000 | [diff] [blame] | 46 | class GenericNodeBuilderRefCount { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 47 | CheckerContext *C; |
Ted Kremenek | ca80453 | 2011-08-12 23:04:46 +0000 | [diff] [blame] | 48 | const ProgramPointTag *tag; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 49 | public: |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 50 | GenericNodeBuilderRefCount(CheckerContext &c, |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 51 | const ProgramPointTag *t = 0) |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 52 | : C(&c), tag(t){} |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 53 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 54 | ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred, |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 55 | bool MarkAsSink = false) { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 56 | return C->addTransition(state, Pred, tag, MarkAsSink); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 57 | } |
| 58 | }; |
| 59 | } // end anonymous namespace |
| 60 | |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 61 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 62 | // Primitives used for constructing summaries for function/method calls. |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 63 | //===----------------------------------------------------------------------===// |
| 64 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 65 | /// ArgEffect is used to summarize a function/method call's effect on a |
| 66 | /// particular argument. |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 67 | enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 68 | DecRefBridgedTransfered, |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 69 | IncRefMsg, IncRef, MakeCollectable, MayEscape, |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 70 | NewAutoreleasePool, SelfOwn, StopTracking }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 71 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 72 | namespace llvm { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 73 | template <> struct FoldingSetTrait<ArgEffect> { |
| 74 | static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) { |
| 75 | ID.AddInteger((unsigned) X); |
| 76 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 77 | }; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 78 | } // end llvm namespace |
| 79 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 80 | /// ArgEffects summarizes the effects of a function/method call on all of |
| 81 | /// its arguments. |
| 82 | typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects; |
| 83 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 84 | namespace { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 85 | |
| 86 | /// RetEffect is used to summarize a function/method call's behavior with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 87 | /// respect to its return value. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 88 | class RetEffect { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 89 | public: |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 90 | enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 91 | NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol, |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 92 | OwnedWhenTrackedReceiver }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 93 | |
| 94 | enum ObjKind { CF, ObjC, AnyObj }; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 96 | private: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 97 | Kind K; |
| 98 | ObjKind O; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 99 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 100 | RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 101 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 102 | public: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 103 | Kind getKind() const { return K; } |
| 104 | |
| 105 | ObjKind getObjKind() const { return O; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 106 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 107 | bool isOwned() const { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 108 | return K == OwnedSymbol || K == OwnedAllocatedSymbol || |
| 109 | K == OwnedWhenTrackedReceiver; |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 110 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 111 | |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 112 | bool operator==(const RetEffect &Other) const { |
| 113 | return K == Other.K && O == Other.O; |
| 114 | } |
| 115 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 116 | static RetEffect MakeOwnedWhenTrackedReceiver() { |
| 117 | return RetEffect(OwnedWhenTrackedReceiver, ObjC); |
| 118 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 120 | static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) { |
| 121 | return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 122 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 123 | static RetEffect MakeNotOwned(ObjKind o) { |
| 124 | return RetEffect(NotOwnedSymbol, o); |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 125 | } |
| 126 | static RetEffect MakeGCNotOwned() { |
| 127 | return RetEffect(GCNotOwnedSymbol, ObjC); |
| 128 | } |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 129 | static RetEffect MakeARCNotOwned() { |
| 130 | return RetEffect(ARCNotOwnedSymbol, ObjC); |
| 131 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 132 | static RetEffect MakeNoRet() { |
| 133 | return RetEffect(NoRet); |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 134 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 135 | |
| 136 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 137 | ID.AddInteger((unsigned) K); |
| 138 | ID.AddInteger((unsigned) O); |
| 139 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 140 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 141 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 142 | //===----------------------------------------------------------------------===// |
| 143 | // Reference-counting logic (typestate + counts). |
| 144 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 145 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 146 | class RefVal { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 147 | public: |
| 148 | enum Kind { |
| 149 | Owned = 0, // Owning reference. |
| 150 | NotOwned, // Reference is not owned by still valid (not freed). |
| 151 | Released, // Object has been released. |
| 152 | ReturnedOwned, // Returned object passes ownership to caller. |
| 153 | ReturnedNotOwned, // Return object does not pass ownership to caller. |
| 154 | ERROR_START, |
| 155 | ErrorDeallocNotOwned, // -dealloc called on non-owned object. |
| 156 | ErrorDeallocGC, // Calling -dealloc with GC enabled. |
| 157 | ErrorUseAfterRelease, // Object used after released. |
| 158 | ErrorReleaseNotOwned, // Release of an object that was not owned. |
| 159 | ERROR_LEAK_START, |
| 160 | ErrorLeak, // A memory leak due to excessive reference counts. |
| 161 | ErrorLeakReturned, // A memory leak due to the returning method not having |
| 162 | // the correct naming conventions. |
| 163 | ErrorGCLeakReturned, |
| 164 | ErrorOverAutorelease, |
| 165 | ErrorReturnedNotOwned |
| 166 | }; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 167 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 168 | private: |
| 169 | Kind kind; |
| 170 | RetEffect::ObjKind okind; |
| 171 | unsigned Cnt; |
| 172 | unsigned ACnt; |
| 173 | QualType T; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 174 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 175 | RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t) |
| 176 | : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {} |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 177 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 178 | public: |
| 179 | Kind getKind() const { return kind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 180 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 181 | RetEffect::ObjKind getObjKind() const { return okind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 182 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 183 | unsigned getCount() const { return Cnt; } |
| 184 | unsigned getAutoreleaseCount() const { return ACnt; } |
| 185 | unsigned getCombinedCounts() const { return Cnt + ACnt; } |
| 186 | void clearCounts() { Cnt = 0; ACnt = 0; } |
| 187 | void setCount(unsigned i) { Cnt = i; } |
| 188 | void setAutoreleaseCount(unsigned i) { ACnt = i; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 190 | QualType getType() const { return T; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 191 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 192 | bool isOwned() const { |
| 193 | return getKind() == Owned; |
| 194 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 195 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 196 | bool isNotOwned() const { |
| 197 | return getKind() == NotOwned; |
| 198 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 199 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 200 | bool isReturnedOwned() const { |
| 201 | return getKind() == ReturnedOwned; |
| 202 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 203 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 204 | bool isReturnedNotOwned() const { |
| 205 | return getKind() == ReturnedNotOwned; |
| 206 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 207 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 208 | static RefVal makeOwned(RetEffect::ObjKind o, QualType t, |
| 209 | unsigned Count = 1) { |
| 210 | return RefVal(Owned, o, Count, 0, t); |
| 211 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 213 | static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t, |
| 214 | unsigned Count = 0) { |
| 215 | return RefVal(NotOwned, o, Count, 0, t); |
| 216 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 217 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 218 | // Comparison, profiling, and pretty-printing. |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 219 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 220 | bool operator==(const RefVal& X) const { |
| 221 | return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt; |
| 222 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 223 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 224 | RefVal operator-(size_t i) const { |
| 225 | return RefVal(getKind(), getObjKind(), getCount() - i, |
| 226 | getAutoreleaseCount(), getType()); |
| 227 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 228 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 229 | RefVal operator+(size_t i) const { |
| 230 | return RefVal(getKind(), getObjKind(), getCount() + i, |
| 231 | getAutoreleaseCount(), getType()); |
| 232 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 234 | RefVal operator^(Kind k) const { |
| 235 | return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(), |
| 236 | getType()); |
| 237 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 238 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 239 | RefVal autorelease() const { |
| 240 | return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1, |
| 241 | getType()); |
| 242 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 243 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 244 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 245 | ID.AddInteger((unsigned) kind); |
| 246 | ID.AddInteger(Cnt); |
| 247 | ID.AddInteger(ACnt); |
| 248 | ID.Add(T); |
| 249 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 250 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 251 | void print(raw_ostream &Out) const; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 252 | }; |
| 253 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 254 | void RefVal::print(raw_ostream &Out) const { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 255 | if (!T.isNull()) |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 256 | Out << "Tracked " << T.getAsString() << '/'; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 257 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 258 | switch (getKind()) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 259 | default: llvm_unreachable("Invalid RefVal kind"); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 260 | case Owned: { |
| 261 | Out << "Owned"; |
| 262 | unsigned cnt = getCount(); |
| 263 | if (cnt) Out << " (+ " << cnt << ")"; |
| 264 | break; |
| 265 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 266 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 267 | case NotOwned: { |
| 268 | Out << "NotOwned"; |
| 269 | unsigned cnt = getCount(); |
| 270 | if (cnt) Out << " (+ " << cnt << ")"; |
| 271 | break; |
| 272 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 273 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 274 | case ReturnedOwned: { |
| 275 | Out << "ReturnedOwned"; |
| 276 | unsigned cnt = getCount(); |
| 277 | if (cnt) Out << " (+ " << cnt << ")"; |
| 278 | break; |
| 279 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 280 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 281 | case ReturnedNotOwned: { |
| 282 | Out << "ReturnedNotOwned"; |
| 283 | unsigned cnt = getCount(); |
| 284 | if (cnt) Out << " (+ " << cnt << ")"; |
| 285 | break; |
| 286 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 287 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 288 | case Released: |
| 289 | Out << "Released"; |
| 290 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 291 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 292 | case ErrorDeallocGC: |
| 293 | Out << "-dealloc (GC)"; |
| 294 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 295 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 296 | case ErrorDeallocNotOwned: |
| 297 | Out << "-dealloc (not-owned)"; |
| 298 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 299 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 300 | case ErrorLeak: |
| 301 | Out << "Leaked"; |
| 302 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 303 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 304 | case ErrorLeakReturned: |
| 305 | Out << "Leaked (Bad naming)"; |
| 306 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 307 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 308 | case ErrorGCLeakReturned: |
| 309 | Out << "Leaked (GC-ed at return)"; |
| 310 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 311 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 312 | case ErrorUseAfterRelease: |
| 313 | Out << "Use-After-Release [ERROR]"; |
| 314 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 315 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 316 | case ErrorReleaseNotOwned: |
| 317 | Out << "Release of Not-Owned [ERROR]"; |
| 318 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 319 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 320 | case RefVal::ErrorOverAutorelease: |
| 321 | Out << "Over autoreleased"; |
| 322 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 323 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 324 | case RefVal::ErrorReturnedNotOwned: |
| 325 | Out << "Non-owned object returned instead of owned"; |
| 326 | break; |
| 327 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 328 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 329 | if (ACnt) { |
| 330 | Out << " [ARC +" << ACnt << ']'; |
| 331 | } |
| 332 | } |
| 333 | } //end anonymous namespace |
| 334 | |
| 335 | //===----------------------------------------------------------------------===// |
| 336 | // RefBindings - State used to track object reference counts. |
| 337 | //===----------------------------------------------------------------------===// |
| 338 | |
| 339 | typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 340 | |
| 341 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 342 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 343 | template<> |
| 344 | struct ProgramStateTrait<RefBindings> |
| 345 | : public ProgramStatePartialTrait<RefBindings> { |
| 346 | static void *GDMIndex() { |
| 347 | static int RefBIndex = 0; |
| 348 | return &RefBIndex; |
| 349 | } |
| 350 | }; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 351 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 352 | } |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 353 | |
| 354 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 355 | // Function/Method behavior summaries. |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 356 | //===----------------------------------------------------------------------===// |
| 357 | |
| 358 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 359 | class RetainSummary { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 360 | /// Args - a map of (index, ArgEffect) pairs, where index |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 361 | /// specifies the argument (starting from 0). This can be sparsely |
| 362 | /// populated; arguments with no entry in Args use 'DefaultArgEffect'. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 363 | ArgEffects Args; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 364 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 365 | /// DefaultArgEffect - The default ArgEffect to apply to arguments that |
| 366 | /// do not have an entry in Args. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 367 | ArgEffect DefaultArgEffect; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 368 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 369 | /// Receiver - If this summary applies to an Objective-C message expression, |
| 370 | /// this is the effect applied to the state of the receiver. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 371 | ArgEffect Receiver; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 372 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 373 | /// Ret - The effect on the return value. Used to indicate if the |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 374 | /// function/method call returns a new tracked symbol. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 375 | RetEffect Ret; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 376 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 377 | public: |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 378 | RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff, |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 379 | ArgEffect ReceiverEff) |
| 380 | : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 381 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 382 | /// getArg - Return the argument effect on the argument specified by |
| 383 | /// idx (starting from 0). |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 384 | ArgEffect getArg(unsigned idx) const { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 385 | if (const ArgEffect *AE = Args.lookup(idx)) |
| 386 | return *AE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 387 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 388 | return DefaultArgEffect; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 389 | } |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 390 | |
| 391 | void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) { |
| 392 | Args = af.add(Args, idx, e); |
| 393 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 394 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 395 | /// setDefaultArgEffect - Set the default argument effect. |
| 396 | void setDefaultArgEffect(ArgEffect E) { |
| 397 | DefaultArgEffect = E; |
| 398 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 399 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 400 | /// getRetEffect - Returns the effect on the return value of the call. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 401 | RetEffect getRetEffect() const { return Ret; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 402 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 403 | /// setRetEffect - Set the effect of the return value of the call. |
| 404 | void setRetEffect(RetEffect E) { Ret = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 405 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 406 | |
| 407 | /// Sets the effect on the receiver of the message. |
| 408 | void setReceiverEffect(ArgEffect e) { Receiver = e; } |
| 409 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 410 | /// getReceiverEffect - Returns the effect on the receiver of the call. |
| 411 | /// This is only meaningful if the summary applies to an ObjCMessageExpr*. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 412 | ArgEffect getReceiverEffect() const { return Receiver; } |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 413 | |
| 414 | /// Test if two retain summaries are identical. Note that merely equivalent |
| 415 | /// summaries are not necessarily identical (for example, if an explicit |
| 416 | /// argument effect matches the default effect). |
| 417 | bool operator==(const RetainSummary &Other) const { |
| 418 | return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect && |
| 419 | Receiver == Other.Receiver && Ret == Other.Ret; |
| 420 | } |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 421 | |
| 422 | /// Profile this summary for inclusion in a FoldingSet. |
| 423 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 424 | ID.Add(Args); |
| 425 | ID.Add(DefaultArgEffect); |
| 426 | ID.Add(Receiver); |
| 427 | ID.Add(Ret); |
| 428 | } |
| 429 | |
| 430 | /// A retain summary is simple if it has no ArgEffects other than the default. |
| 431 | bool isSimple() const { |
| 432 | return Args.isEmpty(); |
| 433 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 434 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 435 | } // end anonymous namespace |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 436 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 437 | //===----------------------------------------------------------------------===// |
| 438 | // Data structures for constructing summaries. |
| 439 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 53301ba | 2008-06-24 03:49:48 +0000 | [diff] [blame] | 440 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 441 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 442 | class ObjCSummaryKey { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 443 | IdentifierInfo* II; |
| 444 | Selector S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 445 | public: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 446 | ObjCSummaryKey(IdentifierInfo* ii, Selector s) |
| 447 | : II(ii), S(s) {} |
| 448 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 449 | ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 450 | : II(d ? d->getIdentifier() : 0), S(s) {} |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 451 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 452 | ObjCSummaryKey(const ObjCInterfaceDecl *d, IdentifierInfo *ii, Selector s) |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 453 | : II(d ? d->getIdentifier() : ii), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 454 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 455 | ObjCSummaryKey(Selector s) |
| 456 | : II(0), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 457 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 458 | IdentifierInfo *getIdentifier() const { return II; } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 459 | Selector getSelector() const { return S; } |
| 460 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 461 | } |
| 462 | |
| 463 | namespace llvm { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 464 | template <> struct DenseMapInfo<ObjCSummaryKey> { |
| 465 | static inline ObjCSummaryKey getEmptyKey() { |
| 466 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(), |
| 467 | DenseMapInfo<Selector>::getEmptyKey()); |
| 468 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 469 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 470 | static inline ObjCSummaryKey getTombstoneKey() { |
| 471 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 472 | DenseMapInfo<Selector>::getTombstoneKey()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 473 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 474 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 475 | static unsigned getHashValue(const ObjCSummaryKey &V) { |
| 476 | return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier()) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 477 | & 0x88888888) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 478 | | (DenseMapInfo<Selector>::getHashValue(V.getSelector()) |
| 479 | & 0x55555555); |
| 480 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 481 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 482 | static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) { |
| 483 | return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(), |
| 484 | RHS.getIdentifier()) && |
| 485 | DenseMapInfo<Selector>::isEqual(LHS.getSelector(), |
| 486 | RHS.getSelector()); |
| 487 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 488 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 489 | }; |
Chris Lattner | 06159e8 | 2009-12-15 07:26:51 +0000 | [diff] [blame] | 490 | template <> |
| 491 | struct isPodLike<ObjCSummaryKey> { static const bool value = true; }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 492 | } // end llvm namespace |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 493 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 494 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 495 | class ObjCSummaryCache { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 496 | typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 497 | MapTy M; |
| 498 | public: |
| 499 | ObjCSummaryCache() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 500 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 501 | const RetainSummary * find(const ObjCInterfaceDecl *D, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 502 | Selector S) { |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 503 | // Lookup the method using the decl for the class @interface. If we |
| 504 | // have no decl, lookup using the class name. |
| 505 | return D ? find(D, S) : find(ClsName, S); |
| 506 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 507 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 508 | const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 509 | // Do a lookup with the (D,S) pair. If we find a match return |
| 510 | // the iterator. |
| 511 | ObjCSummaryKey K(D, S); |
| 512 | MapTy::iterator I = M.find(K); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 513 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 514 | if (I != M.end() || !D) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 515 | return I->second; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 516 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 517 | // Walk the super chain. If we find a hit with a parent, we'll end |
| 518 | // up returning that summary. We actually allow that key (null,S), as |
| 519 | // we cache summaries for the null ObjCInterfaceDecl* to allow us to |
| 520 | // generate initial summaries without having to worry about NSObject |
| 521 | // being declared. |
| 522 | // FIXME: We may change this at some point. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 523 | for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 524 | if ((I = M.find(ObjCSummaryKey(C, S))) != M.end()) |
| 525 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 526 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 527 | if (!C) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 528 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 529 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 530 | |
| 531 | // Cache the summary with original key to make the next lookup faster |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 532 | // and return the iterator. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 533 | const RetainSummary *Summ = I->second; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 534 | M[K] = Summ; |
| 535 | return Summ; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 536 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 537 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 538 | const RetainSummary *find(IdentifierInfo* II, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 539 | // FIXME: Class method lookup. Right now we dont' have a good way |
| 540 | // of going between IdentifierInfo* and the class hierarchy. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 541 | MapTy::iterator I = M.find(ObjCSummaryKey(II, S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 542 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 543 | if (I == M.end()) |
| 544 | I = M.find(ObjCSummaryKey(S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 545 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 546 | return I == M.end() ? NULL : I->second; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 547 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 548 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 549 | const RetainSummary *& operator[](ObjCSummaryKey K) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 550 | return M[K]; |
| 551 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 552 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 553 | const RetainSummary *& operator[](Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 554 | return M[ ObjCSummaryKey(S) ]; |
| 555 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 556 | }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 557 | } // end anonymous namespace |
| 558 | |
| 559 | //===----------------------------------------------------------------------===// |
| 560 | // Data structures for managing collections of summaries. |
| 561 | //===----------------------------------------------------------------------===// |
| 562 | |
| 563 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 564 | class RetainSummaryManager { |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 565 | |
| 566 | //==-----------------------------------------------------------------==// |
| 567 | // Typedefs. |
| 568 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 569 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 570 | typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *> |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 571 | FuncSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 572 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 573 | typedef ObjCSummaryCache ObjCMethodSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 574 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 575 | typedef llvm::FoldingSetNodeWrapper<RetainSummary> CachedSummaryNode; |
| 576 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 577 | //==-----------------------------------------------------------------==// |
| 578 | // Data. |
| 579 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 580 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 581 | /// Ctx - The ASTContext object for the analyzed ASTs. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 582 | ASTContext &Ctx; |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 583 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 584 | /// GCEnabled - Records whether or not the analyzed code runs in GC mode. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 585 | const bool GCEnabled; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 586 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 587 | /// Records whether or not the analyzed code runs in ARC mode. |
| 588 | const bool ARCEnabled; |
| 589 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 590 | /// FuncSummaries - A map from FunctionDecls to summaries. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 591 | FuncSummariesTy FuncSummaries; |
| 592 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 593 | /// ObjCClassMethodSummaries - A map from selectors (for instance methods) |
| 594 | /// to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 595 | ObjCMethodSummariesTy ObjCClassMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 596 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 597 | /// ObjCMethodSummaries - A map from selectors to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 598 | ObjCMethodSummariesTy ObjCMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 599 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 600 | /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects, |
| 601 | /// and all other data used by the checker. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 602 | llvm::BumpPtrAllocator BPAlloc; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 603 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 604 | /// AF - A factory for ArgEffects objects. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 605 | ArgEffects::Factory AF; |
| 606 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 607 | /// ScratchArgs - A holding buffer for construct ArgEffects. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 608 | ArgEffects ScratchArgs; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 609 | |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 610 | /// ObjCAllocRetE - Default return effect for methods returning Objective-C |
| 611 | /// objects. |
| 612 | RetEffect ObjCAllocRetE; |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 613 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 614 | /// ObjCInitRetE - Default return effect for init methods returning |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 615 | /// Objective-C objects. |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 616 | RetEffect ObjCInitRetE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 617 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 618 | /// SimpleSummaries - Used for uniquing summaries that don't have special |
| 619 | /// effects. |
| 620 | llvm::FoldingSet<CachedSummaryNode> SimpleSummaries; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 621 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 622 | //==-----------------------------------------------------------------==// |
| 623 | // Methods. |
| 624 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 625 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 626 | /// getArgEffects - Returns a persistent ArgEffects object based on the |
| 627 | /// data in ScratchArgs. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 628 | ArgEffects getArgEffects(); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 629 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 630 | enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable }; |
| 631 | |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 632 | public: |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 633 | RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; } |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 634 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 635 | const RetainSummary *getUnarySummary(const FunctionType* FT, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 636 | UnaryFuncKind func); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 637 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 638 | const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD); |
| 639 | const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD); |
| 640 | const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 641 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 642 | const RetainSummary *getPersistentSummary(const RetainSummary &OldSumm); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 643 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 644 | const RetainSummary *getPersistentSummary(RetEffect RetEff, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 645 | ArgEffect ReceiverEff = DoNothing, |
| 646 | ArgEffect DefaultEff = MayEscape) { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 647 | RetainSummary Summ(getArgEffects(), RetEff, DefaultEff, ReceiverEff); |
| 648 | return getPersistentSummary(Summ); |
| 649 | } |
| 650 | |
| 651 | const RetainSummary *getDefaultSummary() { |
| 652 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 653 | DoNothing, MayEscape); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 654 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 655 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 656 | const RetainSummary *getPersistentStopSummary() { |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 657 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 658 | StopTracking, StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 659 | } |
Ted Kremenek | b309525 | 2008-05-06 04:20:12 +0000 | [diff] [blame] | 660 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 661 | void InitializeClassMethodSummaries(); |
| 662 | void InitializeMethodSummaries(); |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 663 | private: |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 664 | void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 665 | ObjCClassMethodSummaries[S] = Summ; |
| 666 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 667 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 668 | void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 669 | ObjCMethodSummaries[S] = Summ; |
| 670 | } |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 671 | |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 672 | void addClassMethSummary(const char* Cls, const char* name, |
| 673 | const RetainSummary *Summ, bool isNullary = true) { |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 674 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 675 | Selector S = isNullary ? GetNullarySelector(name, Ctx) |
| 676 | : GetUnarySelector(name, Ctx); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 677 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 678 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 679 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 680 | void addInstMethSummary(const char* Cls, const char* nullaryName, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 681 | const RetainSummary *Summ) { |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 682 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 683 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 684 | ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 685 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 686 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 687 | Selector generateSelector(va_list argp) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 688 | SmallVector<IdentifierInfo*, 10> II; |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 689 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 690 | while (const char* s = va_arg(argp, const char*)) |
| 691 | II.push_back(&Ctx.Idents.get(s)); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 692 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 693 | return Ctx.Selectors.getSelector(II.size(), &II[0]); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 694 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 695 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 696 | void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 697 | const RetainSummary * Summ, va_list argp) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 698 | Selector S = generateSelector(argp); |
| 699 | Summaries[ObjCSummaryKey(ClsII, S)] = Summ; |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 700 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 701 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 702 | void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 703 | va_list argp; |
| 704 | va_start(argp, Summ); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 705 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 706 | va_end(argp); |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 707 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 708 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 709 | void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 710 | va_list argp; |
| 711 | va_start(argp, Summ); |
| 712 | addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp); |
| 713 | va_end(argp); |
| 714 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 715 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 716 | void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 717 | va_list argp; |
| 718 | va_start(argp, Summ); |
| 719 | addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp); |
| 720 | va_end(argp); |
| 721 | } |
| 722 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 723 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 724 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 725 | RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC) |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 726 | : Ctx(ctx), |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 727 | GCEnabled(gcenabled), |
| 728 | ARCEnabled(usesARC), |
| 729 | AF(BPAlloc), ScratchArgs(AF.getEmptyMap()), |
| 730 | ObjCAllocRetE(gcenabled |
| 731 | ? RetEffect::MakeGCNotOwned() |
| 732 | : (usesARC ? RetEffect::MakeARCNotOwned() |
| 733 | : RetEffect::MakeOwned(RetEffect::ObjC, true))), |
| 734 | ObjCInitRetE(gcenabled |
| 735 | ? RetEffect::MakeGCNotOwned() |
| 736 | : (usesARC ? RetEffect::MakeARCNotOwned() |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 737 | : RetEffect::MakeOwnedWhenTrackedReceiver())) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 738 | InitializeClassMethodSummaries(); |
| 739 | InitializeMethodSummaries(); |
| 740 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 741 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 742 | const RetainSummary *getSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 743 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 744 | const RetainSummary *getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 745 | const ObjCInterfaceDecl *ID, |
| 746 | const ObjCMethodDecl *MD, |
| 747 | QualType RetTy, |
| 748 | ObjCMethodSummariesTy &CachedSummaries); |
| 749 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 750 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 751 | ProgramStateRef state, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 752 | const LocationContext *LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 753 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 754 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 755 | const ObjCInterfaceDecl *ID) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 756 | return getMethodSummary(msg.getSelector(), 0, ID, msg.getMethodDecl(), |
| 757 | msg.getType(Ctx), ObjCMethodSummaries); |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 758 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 759 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 760 | const RetainSummary *getClassMethodSummary(const ObjCMessage &msg) { |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 761 | const ObjCInterfaceDecl *Class = 0; |
| 762 | if (!msg.isInstanceMessage()) |
| 763 | Class = msg.getReceiverInterface(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 764 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 765 | return getMethodSummary(msg.getSelector(), Class->getIdentifier(), |
| 766 | Class, msg.getMethodDecl(), msg.getType(Ctx), |
| 767 | ObjCClassMethodSummaries); |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 768 | } |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 769 | |
| 770 | /// getMethodSummary - This version of getMethodSummary is used to query |
| 771 | /// the summary for the current method being analyzed. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 772 | const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) { |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 773 | // FIXME: Eventually this should be unneeded. |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 774 | const ObjCInterfaceDecl *ID = MD->getClassInterface(); |
Ted Kremenek | 70a6576 | 2009-04-30 05:41:14 +0000 | [diff] [blame] | 775 | Selector S = MD->getSelector(); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 776 | IdentifierInfo *ClsName = ID->getIdentifier(); |
| 777 | QualType ResultTy = MD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 778 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 779 | ObjCMethodSummariesTy *CachedSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 780 | if (MD->isInstanceMethod()) |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 781 | CachedSummaries = &ObjCMethodSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 782 | else |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 783 | CachedSummaries = &ObjCClassMethodSummaries; |
| 784 | |
| 785 | return getMethodSummary(S, ClsName, ID, MD, ResultTy, *CachedSummaries); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 786 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 787 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 788 | const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 789 | Selector S, QualType RetTy); |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 790 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 791 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 792 | const ObjCMethodDecl *MD); |
| 793 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 794 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 795 | const FunctionDecl *FD); |
| 796 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 797 | bool isGCEnabled() const { return GCEnabled; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 798 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 799 | bool isARCEnabled() const { return ARCEnabled; } |
| 800 | |
| 801 | bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 802 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 803 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 804 | // Used to avoid allocating long-term (BPAlloc'd) memory for default retain |
| 805 | // summaries. If a function or method looks like it has a default summary, but |
| 806 | // it has annotations, the annotations are added to the stack-based template |
| 807 | // and then copied into managed memory. |
| 808 | class RetainSummaryTemplate { |
| 809 | RetainSummaryManager &Manager; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 810 | const RetainSummary *&RealSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 811 | RetainSummary ScratchSummary; |
| 812 | bool Accessed; |
| 813 | public: |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 814 | RetainSummaryTemplate(const RetainSummary *&real, const RetainSummary &base, |
| 815 | RetainSummaryManager &mgr) |
| 816 | : Manager(mgr), RealSummary(real), ScratchSummary(real ? *real : base), |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 817 | Accessed(false) {} |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 818 | |
| 819 | ~RetainSummaryTemplate() { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 820 | if (Accessed) |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 821 | RealSummary = Manager.getPersistentSummary(ScratchSummary); |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 822 | } |
| 823 | |
| 824 | RetainSummary &operator*() { |
| 825 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 826 | return ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 827 | } |
| 828 | |
| 829 | RetainSummary *operator->() { |
| 830 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 831 | return &ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 832 | } |
| 833 | }; |
| 834 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 835 | } // end anonymous namespace |
| 836 | |
| 837 | //===----------------------------------------------------------------------===// |
| 838 | // Implementation of checker data structures. |
| 839 | //===----------------------------------------------------------------------===// |
| 840 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 841 | ArgEffects RetainSummaryManager::getArgEffects() { |
| 842 | ArgEffects AE = ScratchArgs; |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 843 | ScratchArgs = AF.getEmptyMap(); |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 844 | return AE; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 845 | } |
| 846 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 847 | const RetainSummary * |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 848 | RetainSummaryManager::getPersistentSummary(const RetainSummary &OldSumm) { |
| 849 | // Unique "simple" summaries -- those without ArgEffects. |
| 850 | if (OldSumm.isSimple()) { |
| 851 | llvm::FoldingSetNodeID ID; |
| 852 | OldSumm.Profile(ID); |
| 853 | |
| 854 | void *Pos; |
| 855 | CachedSummaryNode *N = SimpleSummaries.FindNodeOrInsertPos(ID, Pos); |
| 856 | |
| 857 | if (!N) { |
| 858 | N = (CachedSummaryNode *) BPAlloc.Allocate<CachedSummaryNode>(); |
| 859 | new (N) CachedSummaryNode(OldSumm); |
| 860 | SimpleSummaries.InsertNode(N, Pos); |
| 861 | } |
| 862 | |
| 863 | return &N->getValue(); |
| 864 | } |
| 865 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 866 | RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>(); |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 867 | new (Summ) RetainSummary(OldSumm); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 868 | return Summ; |
| 869 | } |
| 870 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 871 | //===----------------------------------------------------------------------===// |
| 872 | // Summary creation for functions (largely uses of Core Foundation). |
| 873 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 875 | static bool isRetain(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 876 | return FName.endswith("Retain"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 877 | } |
| 878 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 879 | static bool isRelease(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 880 | return FName.endswith("Release"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 881 | } |
| 882 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 883 | static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) { |
| 884 | // FIXME: Remove FunctionDecl parameter. |
| 885 | // FIXME: Is it really okay if MakeCollectable isn't a suffix? |
| 886 | return FName.find("MakeCollectable") != StringRef::npos; |
| 887 | } |
| 888 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 889 | const RetainSummary * RetainSummaryManager::getSummary(const FunctionDecl *FD) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 890 | // Look up a summary in our cache of FunctionDecls -> Summaries. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 891 | FuncSummariesTy::iterator I = FuncSummaries.find(FD); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 892 | if (I != FuncSummaries.end()) |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 893 | return I->second; |
| 894 | |
Ted Kremenek | e401a0c | 2009-05-04 15:34:07 +0000 | [diff] [blame] | 895 | // No summary? Generate one. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 896 | const RetainSummary *S = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 897 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 898 | do { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 899 | // We generate "stop" summaries for implicitly defined functions. |
| 900 | if (FD->isImplicit()) { |
| 901 | S = getPersistentStopSummary(); |
| 902 | break; |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 903 | } |
Ted Kremenek | 9ca2851 | 2011-05-02 21:21:42 +0000 | [diff] [blame] | 904 | // For C++ methods, generate an implicit "stop" summary as well. We |
| 905 | // can relax this once we have a clear policy for C++ methods and |
| 906 | // ownership attributes. |
| 907 | if (isa<CXXMethodDecl>(FD)) { |
| 908 | S = getPersistentStopSummary(); |
| 909 | break; |
| 910 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 911 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 912 | // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the |
Ted Kremenek | 9989065 | 2009-01-16 18:40:33 +0000 | [diff] [blame] | 913 | // function's type. |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 914 | const FunctionType* FT = FD->getType()->getAs<FunctionType>(); |
Ted Kremenek | 48c6d18 | 2009-12-16 06:06:43 +0000 | [diff] [blame] | 915 | const IdentifierInfo *II = FD->getIdentifier(); |
| 916 | if (!II) |
| 917 | break; |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 918 | |
| 919 | StringRef FName = II->getName(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 920 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 921 | // Strip away preceding '_'. Doing this here will effect all the checks |
| 922 | // down below. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 923 | FName = FName.substr(FName.find_first_not_of('_')); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 924 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 925 | // Inspect the result type. |
| 926 | QualType RetTy = FT->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 927 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 928 | // FIXME: This should all be refactored into a chain of "summary lookup" |
| 929 | // filters. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 930 | assert(ScratchArgs.isEmpty()); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 931 | |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 932 | if (FName == "pthread_create") { |
| 933 | // Part of: <rdar://problem/7299394>. This will be addressed |
| 934 | // better with IPA. |
| 935 | S = getPersistentStopSummary(); |
| 936 | } else if (FName == "NSMakeCollectable") { |
| 937 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 938 | S = (RetTy->isObjCIdType()) |
| 939 | ? getUnarySummary(FT, cfmakecollectable) |
| 940 | : getPersistentStopSummary(); |
| 941 | } else if (FName == "IOBSDNameMatching" || |
| 942 | FName == "IOServiceMatching" || |
| 943 | FName == "IOServiceNameMatching" || |
| 944 | FName == "IORegistryEntryIDMatching" || |
| 945 | FName == "IOOpenFirmwarePathMatching") { |
| 946 | // Part of <rdar://problem/6961230>. (IOKit) |
| 947 | // This should be addressed using a API table. |
| 948 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 949 | DoNothing, DoNothing); |
| 950 | } else if (FName == "IOServiceGetMatchingService" || |
| 951 | FName == "IOServiceGetMatchingServices") { |
| 952 | // FIXES: <rdar://problem/6326900> |
| 953 | // This should be addressed using a API table. This strcmp is also |
| 954 | // a little gross, but there is no need to super optimize here. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 955 | ScratchArgs = AF.add(ScratchArgs, 1, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 956 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 957 | } else if (FName == "IOServiceAddNotification" || |
| 958 | FName == "IOServiceAddMatchingNotification") { |
| 959 | // Part of <rdar://problem/6961230>. (IOKit) |
| 960 | // This should be addressed using a API table. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 961 | ScratchArgs = AF.add(ScratchArgs, 2, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 962 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 963 | } else if (FName == "CVPixelBufferCreateWithBytes") { |
| 964 | // FIXES: <rdar://problem/7283567> |
| 965 | // Eventually this can be improved by recognizing that the pixel |
| 966 | // buffer passed to CVPixelBufferCreateWithBytes is released via |
| 967 | // a callback and doing full IPA to make sure this is done correctly. |
| 968 | // FIXME: This function has an out parameter that returns an |
| 969 | // allocated object. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 970 | ScratchArgs = AF.add(ScratchArgs, 7, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 971 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 972 | } else if (FName == "CGBitmapContextCreateWithData") { |
| 973 | // FIXES: <rdar://problem/7358899> |
| 974 | // Eventually this can be improved by recognizing that 'releaseInfo' |
| 975 | // passed to CGBitmapContextCreateWithData is released via |
| 976 | // a callback and doing full IPA to make sure this is done correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 977 | ScratchArgs = AF.add(ScratchArgs, 8, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 978 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 979 | DoNothing, DoNothing); |
| 980 | } else if (FName == "CVPixelBufferCreateWithPlanarBytes") { |
| 981 | // FIXES: <rdar://problem/7283567> |
| 982 | // Eventually this can be improved by recognizing that the pixel |
| 983 | // buffer passed to CVPixelBufferCreateWithPlanarBytes is released |
| 984 | // via a callback and doing full IPA to make sure this is done |
| 985 | // correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 986 | ScratchArgs = AF.add(ScratchArgs, 12, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 987 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 06911d4 | 2012-03-22 06:29:41 +0000 | [diff] [blame] | 988 | } else if (FName == "dispatch_set_context") { |
| 989 | // <rdar://problem/11059275> - The analyzer currently doesn't have |
| 990 | // a good way to reason about the finalizer function for libdispatch. |
| 991 | // If we pass a context object that is memory managed, stop tracking it. |
| 992 | // FIXME: this hack should possibly go away once we can handle |
| 993 | // libdispatch finalizers. |
| 994 | ScratchArgs = AF.add(ScratchArgs, 1, StopTracking); |
| 995 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 996 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 997 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 998 | // Did we get a summary? |
| 999 | if (S) |
| 1000 | break; |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1001 | |
| 1002 | // Enable this code once the semantics of NSDeallocateObject are resolved |
| 1003 | // for GC. <rdar://problem/6619988> |
| 1004 | #if 0 |
| 1005 | // Handle: NSDeallocateObject(id anObject); |
| 1006 | // This method does allow 'nil' (although we don't check it now). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1007 | if (strcmp(FName, "NSDeallocateObject") == 0) { |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1008 | return RetTy == Ctx.VoidTy |
| 1009 | ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc) |
| 1010 | : getPersistentStopSummary(); |
| 1011 | } |
| 1012 | #endif |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1013 | |
| 1014 | if (RetTy->isPointerType()) { |
| 1015 | // For CoreFoundation ('CF') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1016 | if (cocoa::isRefType(RetTy, "CF", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1017 | if (isRetain(FD, FName)) |
| 1018 | S = getUnarySummary(FT, cfretain); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1019 | else if (isMakeCollectable(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1020 | S = getUnarySummary(FT, cfmakecollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1021 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1022 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1023 | |
| 1024 | break; |
| 1025 | } |
| 1026 | |
| 1027 | // For CoreGraphics ('CG') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1028 | if (cocoa::isRefType(RetTy, "CG", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1029 | if (isRetain(FD, FName)) |
| 1030 | S = getUnarySummary(FT, cfretain); |
| 1031 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1032 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1033 | |
| 1034 | break; |
| 1035 | } |
| 1036 | |
| 1037 | // For the Disk Arbitration API (DiskArbitration/DADisk.h) |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1038 | if (cocoa::isRefType(RetTy, "DADisk") || |
| 1039 | cocoa::isRefType(RetTy, "DADissenter") || |
| 1040 | cocoa::isRefType(RetTy, "DASessionRef")) { |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1041 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1042 | break; |
| 1043 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1044 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1045 | break; |
| 1046 | } |
| 1047 | |
| 1048 | // Check for release functions, the only kind of functions that we care |
| 1049 | // about that don't return a pointer type. |
| 1050 | if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) { |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1051 | // Test for 'CGCF'. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1052 | FName = FName.substr(FName.startswith("CGCF") ? 4 : 2); |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1053 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1054 | if (isRelease(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1055 | S = getUnarySummary(FT, cfrelease); |
| 1056 | else { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1057 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1058 | // Remaining CoreFoundation and CoreGraphics functions. |
| 1059 | // We use to assume that they all strictly followed the ownership idiom |
| 1060 | // and that ownership cannot be transferred. While this is technically |
| 1061 | // correct, many methods allow a tracked object to escape. For example: |
| 1062 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1063 | // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1064 | // CFDictionaryAddValue(y, key, x); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1065 | // CFRelease(x); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1066 | // ... it is okay to use 'x' since 'y' has a reference to it |
| 1067 | // |
| 1068 | // We handle this and similar cases with the follow heuristic. If the |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1069 | // function name contains "InsertValue", "SetValue", "AddValue", |
| 1070 | // "AppendValue", or "SetAttribute", then we assume that arguments may |
| 1071 | // "escape." This means that something else holds on to the object, |
| 1072 | // allowing it be used even after its local retain count drops to 0. |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1073 | ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos|| |
| 1074 | StrInStrNoCase(FName, "AddValue") != StringRef::npos || |
| 1075 | StrInStrNoCase(FName, "SetValue") != StringRef::npos || |
| 1076 | StrInStrNoCase(FName, "AppendValue") != StringRef::npos|| |
Benjamin Kramer | c027e54 | 2010-01-11 20:15:06 +0000 | [diff] [blame] | 1077 | StrInStrNoCase(FName, "SetAttribute") != StringRef::npos) |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1078 | ? MayEscape : DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1079 | |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1080 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1081 | } |
| 1082 | } |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1083 | } |
| 1084 | while (0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1085 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1086 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1087 | updateSummaryFromAnnotations(S, FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1088 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1089 | FuncSummaries[FD] = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1090 | return S; |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 1091 | } |
| 1092 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1093 | const RetainSummary * |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1094 | RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) { |
| 1095 | if (coreFoundation::followsCreateRule(FD)) |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1096 | return getCFSummaryCreateRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1097 | |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 1098 | return getCFSummaryGetRule(FD); |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1099 | } |
| 1100 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1101 | const RetainSummary * |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 1102 | RetainSummaryManager::getUnarySummary(const FunctionType* FT, |
| 1103 | UnaryFuncKind func) { |
| 1104 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1105 | // Sanity check that this is *really* a unary function. This can |
| 1106 | // happen if people do weird things. |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1107 | const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1108 | if (!FTP || FTP->getNumArgs() != 1) |
| 1109 | return getPersistentStopSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1110 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1111 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1112 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1113 | ArgEffect Effect; |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1114 | switch (func) { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1115 | case cfretain: Effect = IncRef; break; |
| 1116 | case cfrelease: Effect = DecRef; break; |
| 1117 | case cfmakecollectable: Effect = MakeCollectable; break; |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 1118 | } |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1119 | |
| 1120 | ScratchArgs = AF.add(ScratchArgs, 0, Effect); |
| 1121 | return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1122 | } |
| 1123 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1124 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1125 | RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1126 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1127 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1128 | return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1129 | } |
| 1130 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1131 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1132 | RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1133 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1134 | return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF), |
| 1135 | DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1136 | } |
| 1137 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1138 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1139 | // Summary creation for Selectors. |
| 1140 | //===----------------------------------------------------------------------===// |
| 1141 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1142 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1143 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1144 | const FunctionDecl *FD) { |
| 1145 | if (!FD) |
| 1146 | return; |
| 1147 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 1148 | RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1149 | |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1150 | // Effects on the parameters. |
| 1151 | unsigned parm_idx = 0; |
| 1152 | for (FunctionDecl::param_const_iterator pi = FD->param_begin(), |
John McCall | 98b8f16 | 2011-04-06 09:02:12 +0000 | [diff] [blame] | 1153 | pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1154 | const ParmVarDecl *pd = *pi; |
| 1155 | if (pd->getAttr<NSConsumedAttr>()) { |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1156 | if (!GCEnabled) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1157 | Template->addArg(AF, parm_idx, DecRef); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1158 | } |
| 1159 | } else if (pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1160 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1161 | } |
| 1162 | } |
| 1163 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1164 | QualType RetTy = FD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1165 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1166 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1167 | if (cocoa::isCocoaObjectRef(RetTy)) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1168 | if (FD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1169 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1170 | } |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1171 | else if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1172 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1173 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1174 | else if (FD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1175 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1176 | } |
| 1177 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1178 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1179 | } |
| 1180 | } else if (RetTy->getAs<PointerType>()) { |
| 1181 | if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1182 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1183 | } |
| 1184 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1185 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1186 | } |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1187 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1188 | } |
| 1189 | |
| 1190 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1191 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
| 1192 | const ObjCMethodDecl *MD) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1193 | if (!MD) |
| 1194 | return; |
| 1195 | |
Jordy Rose | ef94588 | 2012-03-18 01:26:10 +0000 | [diff] [blame] | 1196 | RetainSummaryTemplate Template(Summ, *getDefaultSummary(), *this); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1197 | bool isTrackedLoc = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1198 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1199 | // Effects on the receiver. |
| 1200 | if (MD->getAttr<NSConsumesSelfAttr>()) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1201 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1202 | Template->setReceiverEffect(DecRefMsg); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1203 | } |
| 1204 | |
| 1205 | // Effects on the parameters. |
| 1206 | unsigned parm_idx = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1207 | for (ObjCMethodDecl::param_const_iterator |
| 1208 | pi=MD->param_begin(), pe=MD->param_end(); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1209 | pi != pe; ++pi, ++parm_idx) { |
| 1210 | const ParmVarDecl *pd = *pi; |
| 1211 | if (pd->getAttr<NSConsumedAttr>()) { |
| 1212 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1213 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1214 | } |
| 1215 | else if(pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1216 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1217 | } |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1218 | } |
| 1219 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1220 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1221 | if (cocoa::isCocoaObjectRef(MD->getResultType())) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1222 | if (MD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1223 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1224 | return; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1225 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1226 | if (MD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1227 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1228 | return; |
| 1229 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1230 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1231 | isTrackedLoc = true; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1232 | } else { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1233 | isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1234 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1235 | |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1236 | if (isTrackedLoc) { |
| 1237 | if (MD->getAttr<CFReturnsRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1238 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1239 | else if (MD->getAttr<CFReturnsNotRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1240 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1241 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1242 | } |
| 1243 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1244 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1245 | RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD, |
| 1246 | Selector S, QualType RetTy) { |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1247 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1248 | if (MD) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1249 | // Scan the method decl for 'void*' arguments. These should be treated |
| 1250 | // as 'StopTracking' because they are often used with delegates. |
| 1251 | // Delegates are a frequent form of false positives with the retain |
| 1252 | // count checker. |
| 1253 | unsigned i = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1254 | for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(), |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1255 | E = MD->param_end(); I != E; ++I, ++i) |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1256 | if (const ParmVarDecl *PD = *I) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1257 | QualType Ty = Ctx.getCanonicalType(PD->getType()); |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 1258 | if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy) |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1259 | ScratchArgs = AF.add(ScratchArgs, i, StopTracking); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1260 | } |
| 1261 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1262 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1263 | // Any special effects? |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1264 | ArgEffect ReceiverEff = DoNothing; |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1265 | RetEffect ResultEff = RetEffect::MakeNoRet(); |
| 1266 | |
| 1267 | // Check the method family, and apply any default annotations. |
| 1268 | switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) { |
| 1269 | case OMF_None: |
| 1270 | case OMF_performSelector: |
| 1271 | // Assume all Objective-C methods follow Cocoa Memory Management rules. |
| 1272 | // FIXME: Does the non-threaded performSelector family really belong here? |
| 1273 | // The selector could be, say, @selector(copy). |
| 1274 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1275 | ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 1276 | else if (coreFoundation::isCFObjectRef(RetTy)) { |
| 1277 | // ObjCMethodDecl currently doesn't consider CF objects as valid return |
| 1278 | // values for alloc, new, copy, or mutableCopy, so we have to |
| 1279 | // double-check with the selector. This is ugly, but there aren't that |
| 1280 | // many Objective-C methods that return CF objects, right? |
| 1281 | if (MD) { |
| 1282 | switch (S.getMethodFamily()) { |
| 1283 | case OMF_alloc: |
| 1284 | case OMF_new: |
| 1285 | case OMF_copy: |
| 1286 | case OMF_mutableCopy: |
| 1287 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1288 | break; |
| 1289 | default: |
| 1290 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1291 | break; |
| 1292 | } |
| 1293 | } else { |
| 1294 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1295 | } |
| 1296 | } |
| 1297 | break; |
| 1298 | case OMF_init: |
| 1299 | ResultEff = ObjCInitRetE; |
| 1300 | ReceiverEff = DecRefMsg; |
| 1301 | break; |
| 1302 | case OMF_alloc: |
| 1303 | case OMF_new: |
| 1304 | case OMF_copy: |
| 1305 | case OMF_mutableCopy: |
| 1306 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1307 | ResultEff = ObjCAllocRetE; |
| 1308 | else if (coreFoundation::isCFObjectRef(RetTy)) |
| 1309 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1310 | break; |
| 1311 | case OMF_autorelease: |
| 1312 | ReceiverEff = Autorelease; |
| 1313 | break; |
| 1314 | case OMF_retain: |
| 1315 | ReceiverEff = IncRefMsg; |
| 1316 | break; |
| 1317 | case OMF_release: |
| 1318 | ReceiverEff = DecRefMsg; |
| 1319 | break; |
| 1320 | case OMF_dealloc: |
| 1321 | ReceiverEff = Dealloc; |
| 1322 | break; |
| 1323 | case OMF_self: |
| 1324 | // -self is handled specially by the ExprEngine to propagate the receiver. |
| 1325 | break; |
| 1326 | case OMF_retainCount: |
| 1327 | case OMF_finalize: |
| 1328 | // These methods don't return objects. |
| 1329 | break; |
| 1330 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1331 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1332 | // If one of the arguments in the selector has the keyword 'delegate' we |
| 1333 | // should stop tracking the reference count for the receiver. This is |
| 1334 | // because the reference count is quite possibly handled by a delegate |
| 1335 | // method. |
| 1336 | if (S.isKeywordSelector()) { |
| 1337 | const std::string &str = S.getAsString(); |
| 1338 | assert(!str.empty()); |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1339 | if (StrInStrNoCase(str, "delegate:") != StringRef::npos) |
| 1340 | ReceiverEff = StopTracking; |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1341 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1342 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1343 | if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing && |
| 1344 | ResultEff.getKind() == RetEffect::NoRet) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1345 | return getDefaultSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1346 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1347 | return getPersistentSummary(ResultEff, ReceiverEff, MayEscape); |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1348 | } |
| 1349 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1350 | const RetainSummary * |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1351 | RetainSummaryManager::getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1352 | ProgramStateRef state, |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1353 | const LocationContext *LC) { |
| 1354 | |
| 1355 | // We need the type-information of the tracked receiver object |
| 1356 | // Retrieve it from the state. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1357 | const Expr *Receiver = msg.getInstanceReceiver(); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1358 | const ObjCInterfaceDecl *ID = 0; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1359 | |
| 1360 | // FIXME: Is this really working as expected? There are cases where |
| 1361 | // we just use the 'ID' from the message expression. |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1362 | SVal receiverV; |
| 1363 | |
Ted Kremenek | 8f32675 | 2010-05-21 21:56:53 +0000 | [diff] [blame] | 1364 | if (Receiver) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1365 | receiverV = state->getSValAsScalarOrLoc(Receiver, LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1366 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1367 | // FIXME: Eventually replace the use of state->get<RefBindings> with |
| 1368 | // a generic API for reasoning about the Objective-C types of symbolic |
| 1369 | // objects. |
| 1370 | if (SymbolRef Sym = receiverV.getAsLocSymbol()) |
| 1371 | if (const RefVal *T = state->get<RefBindings>(Sym)) |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1372 | if (const ObjCObjectPointerType* PT = |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1373 | T->getType()->getAs<ObjCObjectPointerType>()) |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1374 | ID = PT->getInterfaceDecl(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1375 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1376 | // FIXME: this is a hack. This may or may not be the actual method |
| 1377 | // that is called. |
| 1378 | if (!ID) { |
| 1379 | if (const ObjCObjectPointerType *PT = |
| 1380 | Receiver->getType()->getAs<ObjCObjectPointerType>()) |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1381 | ID = PT->getInterfaceDecl(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1382 | } |
| 1383 | } else { |
| 1384 | // FIXME: Hack for 'super'. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1385 | ID = msg.getReceiverInterface(); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1386 | } |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1387 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1388 | // FIXME: The receiver could be a reference to a class, meaning that |
| 1389 | // we should use the class method. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1390 | return getInstanceMethodSummary(msg, ID); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1391 | } |
| 1392 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1393 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1394 | RetainSummaryManager::getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 1395 | const ObjCInterfaceDecl *ID, |
| 1396 | const ObjCMethodDecl *MD, QualType RetTy, |
| 1397 | ObjCMethodSummariesTy &CachedSummaries) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1398 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1399 | // Look up a summary in our summary cache. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1400 | const RetainSummary *Summ = CachedSummaries.find(ID, ClsName, S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1401 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1402 | if (!Summ) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1403 | Summ = getStandardMethodSummary(MD, S, RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1404 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1405 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1406 | updateSummaryFromAnnotations(Summ, MD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1407 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1408 | // Memoize the summary. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame] | 1409 | CachedSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1410 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1411 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1412 | return Summ; |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1413 | } |
| 1414 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1415 | void RetainSummaryManager::InitializeClassMethodSummaries() { |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1416 | assert(ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1417 | // Create the [NSAssertionHandler currentHander] summary. |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1418 | addClassMethSummary("NSAssertionHandler", "currentHandler", |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1419 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1420 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1421 | // Create the [NSAutoreleasePool addObject:] summary. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1422 | ScratchArgs = AF.add(ScratchArgs, 0, Autorelease); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1423 | addClassMethSummary("NSAutoreleasePool", "addObject", |
| 1424 | getPersistentSummary(RetEffect::MakeNoRet(), |
| 1425 | DoNothing, Autorelease)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1426 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1427 | // Create the summaries for [NSObject performSelector...]. We treat |
| 1428 | // these as 'stop tracking' for the arguments because they are often |
| 1429 | // used for delegates that can release the object. When we have better |
| 1430 | // inter-procedural analysis we can potentially do something better. This |
| 1431 | // workaround is to remove false positives. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1432 | const RetainSummary *Summ = |
Ted Kremenek | 012614e | 2011-08-17 21:04:19 +0000 | [diff] [blame] | 1433 | getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1434 | IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject"); |
| 1435 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1436 | "afterDelay", NULL); |
| 1437 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1438 | "afterDelay", "inModes", NULL); |
| 1439 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1440 | "withObject", "waitUntilDone", NULL); |
| 1441 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1442 | "withObject", "waitUntilDone", "modes", NULL); |
| 1443 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1444 | "withObject", "waitUntilDone", NULL); |
| 1445 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1446 | "withObject", "waitUntilDone", "modes", NULL); |
| 1447 | addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground", |
| 1448 | "withObject", NULL); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 1449 | } |
| 1450 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 1451 | void RetainSummaryManager::InitializeMethodSummaries() { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1452 | |
| 1453 | assert (ScratchArgs.isEmpty()); |
| 1454 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1455 | // Create the "init" selector. It just acts as a pass-through for the |
| 1456 | // receiver. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1457 | const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 1458 | addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm); |
| 1459 | |
| 1460 | // awakeAfterUsingCoder: behaves basically like an 'init' method. It |
| 1461 | // claims the receiver and returns a retained object. |
| 1462 | addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx), |
| 1463 | InitSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1464 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1465 | // The next methods are allocators. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1466 | const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE); |
| 1467 | const RetainSummary *CFAllocSumm = |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1468 | getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1469 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1470 | // Create the "retain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1471 | RetEffect NoRet = RetEffect::MakeNoRet(); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1472 | const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1473 | addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1474 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1475 | // Create the "release" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1476 | Summ = getPersistentSummary(NoRet, DecRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1477 | addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1478 | |
Ted Kremenek | 299e815 | 2008-05-07 21:17:39 +0000 | [diff] [blame] | 1479 | // Create the "drain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1480 | Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1481 | addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1482 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1483 | // Create the -dealloc summary. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1484 | Summ = getPersistentSummary(NoRet, Dealloc); |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1485 | addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1486 | |
| 1487 | // Create the "autorelease" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1488 | Summ = getPersistentSummary(NoRet, Autorelease); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1489 | addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1490 | |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1491 | // Specially handle NSAutoreleasePool. |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1492 | addInstMethSummary("NSAutoreleasePool", "init", |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1493 | getPersistentSummary(NoRet, NewAutoreleasePool)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1494 | |
| 1495 | // For NSWindow, allocated objects are (initially) self-owned. |
Ted Kremenek | 89e202d | 2009-02-23 02:51:29 +0000 | [diff] [blame] | 1496 | // FIXME: For now we opt for false negatives with NSWindow, as these objects |
| 1497 | // self-own themselves. However, they only do this once they are displayed. |
| 1498 | // Thus, we need to track an NSWindow's display status. |
| 1499 | // This is tracked in <rdar://problem/6062711>. |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1500 | // See also http://llvm.org/bugs/show_bug.cgi?id=3714. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1501 | const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(), |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1502 | StopTracking, |
| 1503 | StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1504 | |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1505 | addClassMethSummary("NSWindow", "alloc", NoTrackYet); |
| 1506 | |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1507 | #if 0 |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1508 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1509 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1510 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1511 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1512 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1513 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1514 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1515 | // For NSPanel (which subclasses NSWindow), allocated objects are not |
| 1516 | // self-owned. |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1517 | // FIXME: For now we don't track NSPanels. object for the same reason |
| 1518 | // as for NSWindow objects. |
| 1519 | addClassMethSummary("NSPanel", "alloc", NoTrackYet); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1520 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1521 | #if 0 |
| 1522 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1523 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1524 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1525 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1526 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1527 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1528 | |
Ted Kremenek | ba67f6a | 2009-05-18 23:14:34 +0000 | [diff] [blame] | 1529 | // Don't track allocated autorelease pools yet, as it is okay to prematurely |
| 1530 | // exit a method. |
| 1531 | addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 1532 | addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1533 | |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1534 | // Create summaries QCRenderer/QCView -createSnapShotImageOfType: |
| 1535 | addInstMethSummary("QCRenderer", AllocSumm, |
| 1536 | "createSnapshotImageOfType", NULL); |
| 1537 | addInstMethSummary("QCView", AllocSumm, |
| 1538 | "createSnapshotImageOfType", NULL); |
| 1539 | |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1540 | // Create summaries for CIContext, 'createCGImage' and |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1541 | // 'createCGLayerWithSize'. These objects are CF objects, and are not |
| 1542 | // automatically garbage collected. |
| 1543 | addInstMethSummary("CIContext", CFAllocSumm, |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1544 | "createCGImage", "fromRect", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1545 | addInstMethSummary("CIContext", CFAllocSumm, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1546 | "createCGImage", "fromRect", "format", "colorSpace", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1547 | addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1548 | "info", NULL); |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1549 | } |
| 1550 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1551 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1552 | // AutoreleaseBindings - State used to track objects in autorelease pools. |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1553 | //===----------------------------------------------------------------------===// |
| 1554 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1555 | typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts; |
| 1556 | typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents; |
| 1557 | typedef llvm::ImmutableList<SymbolRef> ARStack; |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1558 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1559 | static int AutoRCIndex = 0; |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1560 | static int AutoRBIndex = 0; |
| 1561 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1562 | namespace { class AutoreleasePoolContents {}; } |
| 1563 | namespace { class AutoreleaseStack {}; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1564 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1565 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 1566 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1567 | template<> struct ProgramStateTrait<AutoreleaseStack> |
| 1568 | : public ProgramStatePartialTrait<ARStack> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1569 | static inline void *GDMIndex() { return &AutoRBIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1570 | }; |
| 1571 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1572 | template<> struct ProgramStateTrait<AutoreleasePoolContents> |
| 1573 | : public ProgramStatePartialTrait<ARPoolContents> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1574 | static inline void *GDMIndex() { return &AutoRCIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1575 | }; |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 1576 | } // end GR namespace |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1577 | } // end clang namespace |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1578 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1579 | static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1580 | ARStack stack = state->get<AutoreleaseStack>(); |
| 1581 | return stack.isEmpty() ? SymbolRef() : stack.getHead(); |
| 1582 | } |
| 1583 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1584 | static ProgramStateRef |
| 1585 | SendAutorelease(ProgramStateRef state, |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1586 | ARCounts::Factory &F, |
| 1587 | SymbolRef sym) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1588 | SymbolRef pool = GetCurrentAutoreleasePool(state); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1589 | const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1590 | ARCounts newCnts(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1591 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1592 | if (cnts) { |
| 1593 | const unsigned *cnt = (*cnts).lookup(sym); |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1594 | newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1595 | } |
| 1596 | else |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1597 | newCnts = F.add(F.getEmptyMap(), sym, 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1598 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1599 | return state->set<AutoreleasePoolContents>(pool, newCnts); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1600 | } |
| 1601 | |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 1602 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1603 | // Error reporting. |
| 1604 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1605 | namespace { |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1606 | typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *> |
| 1607 | SummaryLogTy; |
| 1608 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1609 | //===-------------===// |
| 1610 | // Bug Descriptions. // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1611 | //===-------------===// |
| 1612 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1613 | class CFRefBug : public BugType { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1614 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1615 | CFRefBug(StringRef name) |
| 1616 | : BugType(name, "Memory (Core Foundation/Objective-C)") {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1617 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1618 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1619 | // FIXME: Eventually remove. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1620 | virtual const char *getDescription() const = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1621 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1622 | virtual bool isLeak() const { return false; } |
| 1623 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1624 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1625 | class UseAfterRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1626 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1627 | UseAfterRelease() : CFRefBug("Use-after-release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1628 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1629 | const char *getDescription() const { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1630 | return "Reference-counted object is used after it is released"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1631 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1632 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1633 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1634 | class BadRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1635 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1636 | BadRelease() : CFRefBug("Bad release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1637 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1638 | const char *getDescription() const { |
Ted Kremenek | bb206fd | 2009-10-01 17:31:50 +0000 | [diff] [blame] | 1639 | return "Incorrect decrement of the reference count of an object that is " |
| 1640 | "not owned at this point by the caller"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1641 | } |
| 1642 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1643 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1644 | class DeallocGC : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1645 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1646 | DeallocGC() |
| 1647 | : CFRefBug("-dealloc called while using garbage collection") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1648 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1649 | const char *getDescription() const { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1650 | return "-dealloc called while using garbage collection"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1651 | } |
| 1652 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1653 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1654 | class DeallocNotOwned : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1655 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1656 | DeallocNotOwned() |
| 1657 | : CFRefBug("-dealloc sent to non-exclusively owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1658 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1659 | const char *getDescription() const { |
| 1660 | return "-dealloc sent to object that may be referenced elsewhere"; |
| 1661 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1662 | }; |
| 1663 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1664 | class OverAutorelease : public CFRefBug { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1665 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1666 | OverAutorelease() |
| 1667 | : CFRefBug("Object sent -autorelease too many times") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1668 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1669 | const char *getDescription() const { |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1670 | return "Object sent -autorelease too many times"; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1671 | } |
| 1672 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1673 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1674 | class ReturnedNotOwnedForOwned : public CFRefBug { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1675 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1676 | ReturnedNotOwnedForOwned() |
| 1677 | : CFRefBug("Method should return an owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1678 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1679 | const char *getDescription() const { |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 1680 | return "Object with a +0 retain count returned to caller where a +1 " |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1681 | "(owning) retain count is expected"; |
| 1682 | } |
| 1683 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1684 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1685 | class Leak : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1686 | const bool isReturn; |
| 1687 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1688 | Leak(StringRef name, bool isRet) |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 1689 | : CFRefBug(name), isReturn(isRet) { |
| 1690 | // Leaks should not be reported if they are post-dominated by a sink. |
| 1691 | setSuppressOnSink(true); |
| 1692 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1693 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1694 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1695 | const char *getDescription() const { return ""; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1696 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1697 | bool isLeak() const { return true; } |
| 1698 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1699 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1700 | class LeakAtReturn : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1701 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1702 | LeakAtReturn(StringRef name) |
| 1703 | : Leak(name, true) {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1704 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1705 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1706 | class LeakWithinFunction : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1707 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1708 | LeakWithinFunction(StringRef name) |
| 1709 | : Leak(name, false) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1710 | }; |
| 1711 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1712 | //===---------===// |
| 1713 | // Bug Reports. // |
| 1714 | //===---------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1715 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1716 | class CFRefReportVisitor : public BugReporterVisitor { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1717 | protected: |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1718 | SymbolRef Sym; |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1719 | const SummaryLogTy &SummaryLog; |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1720 | bool GCEnabled; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1721 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1722 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1723 | CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log) |
| 1724 | : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {} |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1725 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1726 | virtual void Profile(llvm::FoldingSetNodeID &ID) const { |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1727 | static int x = 0; |
| 1728 | ID.AddPointer(&x); |
| 1729 | ID.AddPointer(Sym); |
| 1730 | } |
| 1731 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1732 | virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 1733 | const ExplodedNode *PrevN, |
| 1734 | BugReporterContext &BRC, |
| 1735 | BugReport &BR); |
| 1736 | |
| 1737 | virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1738 | const ExplodedNode *N, |
| 1739 | BugReport &BR); |
| 1740 | }; |
| 1741 | |
| 1742 | class CFRefLeakReportVisitor : public CFRefReportVisitor { |
| 1743 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1744 | CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled, |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1745 | const SummaryLogTy &log) |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1746 | : CFRefReportVisitor(sym, GCEnabled, log) {} |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1747 | |
| 1748 | PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1749 | const ExplodedNode *N, |
| 1750 | BugReport &BR); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1751 | }; |
| 1752 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1753 | class CFRefReport : public BugReport { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1754 | void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1755 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1756 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1757 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1758 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1759 | bool registerVisitor = true) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1760 | : BugReport(D, D.getDescription(), n) { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1761 | if (registerVisitor) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1762 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1763 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1764 | } |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1765 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1766 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1767 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1768 | StringRef endText) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1769 | : BugReport(D, D.getDescription(), endText, n) { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1770 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1771 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1772 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1773 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1774 | virtual std::pair<ranges_iterator, ranges_iterator> getRanges() { |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1775 | const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType()); |
| 1776 | if (!BugTy.isLeak()) |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1777 | return BugReport::getRanges(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1778 | else |
Argyrios Kyrtzidis | 640ccf0 | 2010-12-04 01:12:15 +0000 | [diff] [blame] | 1779 | return std::make_pair(ranges_iterator(), ranges_iterator()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1780 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1781 | }; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1782 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1783 | class CFRefLeakReport : public CFRefReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1784 | const MemRegion* AllocBinding; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1785 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1786 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1787 | CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1788 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 1789 | CheckerContext &Ctx); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1790 | |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 1791 | PathDiagnosticLocation getLocation(const SourceManager &SM) const { |
| 1792 | assert(Location.isValid()); |
| 1793 | return Location; |
| 1794 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1795 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1796 | } // end anonymous namespace |
| 1797 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1798 | void CFRefReport::addGCModeDescription(const LangOptions &LOpts, |
| 1799 | bool GCEnabled) { |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1800 | const char *GCModeDescription = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1801 | |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 1802 | switch (LOpts.getGC()) { |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1803 | case LangOptions::GCOnly: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1804 | assert(GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1805 | GCModeDescription = "Code is compiled to only use garbage collection"; |
| 1806 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1807 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1808 | case LangOptions::NonGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1809 | assert(!GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1810 | GCModeDescription = "Code is compiled to use reference counts"; |
| 1811 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1812 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1813 | case LangOptions::HybridGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1814 | if (GCEnabled) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1815 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1816 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1817 | "with GC enabled"; |
| 1818 | break; |
| 1819 | } else { |
| 1820 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1821 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1822 | "in non-GC mode"; |
| 1823 | break; |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1824 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1825 | } |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1826 | |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1827 | assert(GCModeDescription && "invalid/unknown GC mode"); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1828 | addExtraText(GCModeDescription); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1829 | } |
| 1830 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1831 | // FIXME: This should be a method on SmallVector. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1832 | static inline bool contains(const SmallVectorImpl<ArgEffect>& V, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1833 | ArgEffect X) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1834 | for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1835 | I!=E; ++I) |
| 1836 | if (*I == X) return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1837 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1838 | return false; |
| 1839 | } |
| 1840 | |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 1841 | static bool isPropertyAccess(const Stmt *S, ParentMap &PM) { |
| 1842 | unsigned maxDepth = 4; |
| 1843 | while (S && maxDepth) { |
| 1844 | if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) { |
| 1845 | if (!isa<ObjCMessageExpr>(PO->getSyntacticForm())) |
| 1846 | return true; |
| 1847 | return false; |
| 1848 | } |
| 1849 | S = PM.getParent(S); |
| 1850 | --maxDepth; |
| 1851 | } |
| 1852 | return false; |
| 1853 | } |
| 1854 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1855 | PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N, |
| 1856 | const ExplodedNode *PrevN, |
| 1857 | BugReporterContext &BRC, |
| 1858 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1859 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1860 | if (!isa<StmtPoint>(N->getLocation())) |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 1861 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1862 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 1863 | // Check if the type state has changed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1864 | ProgramStateRef PrevSt = PrevN->getState(); |
| 1865 | ProgramStateRef CurrSt = N->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1866 | const LocationContext *LCtx = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1867 | |
| 1868 | const RefVal* CurrT = CurrSt->get<RefBindings>(Sym); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1869 | if (!CurrT) return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1870 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1871 | const RefVal &CurrV = *CurrT; |
| 1872 | const RefVal *PrevT = PrevSt->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1873 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1874 | // Create a string buffer to constain all the useful things we want |
| 1875 | // to tell the user. |
| 1876 | std::string sbuf; |
| 1877 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1878 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1879 | // This is the allocation site since the previous node had no bindings |
| 1880 | // for this symbol. |
| 1881 | if (!PrevT) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1882 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1883 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1884 | if (isa<ObjCArrayLiteral>(S)) { |
| 1885 | os << "NSArray literal is an object with a +0 retain count"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1886 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1887 | else if (isa<ObjCDictionaryLiteral>(S)) { |
| 1888 | os << "NSDictionary literal is an object with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1889 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1890 | else { |
| 1891 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
| 1892 | // Get the name of the callee (if it is available). |
| 1893 | SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx); |
| 1894 | if (const FunctionDecl *FD = X.getAsFunctionDecl()) |
| 1895 | os << "Call to function '" << *FD << '\''; |
| 1896 | else |
| 1897 | os << "function call"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1898 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1899 | else { |
| 1900 | assert(isa<ObjCMessageExpr>(S)); |
| 1901 | // The message expression may have between written directly or as |
| 1902 | // a property access. Lazily determine which case we are looking at. |
| 1903 | os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method"); |
| 1904 | } |
| 1905 | |
| 1906 | if (CurrV.getObjKind() == RetEffect::CF) { |
| 1907 | os << " returns a Core Foundation object with a "; |
| 1908 | } |
| 1909 | else { |
| 1910 | assert (CurrV.getObjKind() == RetEffect::ObjC); |
| 1911 | os << " returns an Objective-C object with a "; |
| 1912 | } |
| 1913 | |
| 1914 | if (CurrV.isOwned()) { |
| 1915 | os << "+1 retain count"; |
| 1916 | |
| 1917 | if (GCEnabled) { |
| 1918 | assert(CurrV.getObjKind() == RetEffect::CF); |
| 1919 | os << ". " |
| 1920 | "Core Foundation objects are not automatically garbage collected."; |
| 1921 | } |
| 1922 | } |
| 1923 | else { |
| 1924 | assert (CurrV.isNotOwned()); |
| 1925 | os << "+0 retain count"; |
| 1926 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1927 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1928 | |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 1929 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 1930 | N->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1931 | return new PathDiagnosticEventPiece(Pos, os.str()); |
| 1932 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1933 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1934 | // Gather up the effects that were performed on the object at this |
| 1935 | // program point |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1936 | SmallVector<ArgEffect, 2> AEffects; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1937 | |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1938 | const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N); |
| 1939 | if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1940 | // We only have summaries attached to nodes after evaluating CallExpr and |
| 1941 | // ObjCMessageExprs. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1942 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1943 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1944 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1945 | // Iterate through the parameter expressions and see if the symbol |
| 1946 | // was ever passed as an argument. |
| 1947 | unsigned i = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1949 | for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1950 | AI!=AE; ++AI, ++i) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1951 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1952 | // Retrieve the value of the argument. Is it the symbol |
| 1953 | // we are interested in? |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1954 | if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1955 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1956 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1957 | // We have an argument. Get the effect! |
| 1958 | AEffects.push_back(Summ->getArg(i)); |
| 1959 | } |
| 1960 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1961 | else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1962 | if (const Expr *receiver = ME->getInstanceReceiver()) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1963 | if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx) |
| 1964 | .getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1965 | // The symbol we are tracking is the receiver. |
| 1966 | AEffects.push_back(Summ->getReceiverEffect()); |
| 1967 | } |
| 1968 | } |
| 1969 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1970 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1971 | do { |
| 1972 | // Get the previous type state. |
| 1973 | RefVal PrevV = *PrevT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1974 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1975 | // Specially handle -dealloc. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1976 | if (!GCEnabled && contains(AEffects, Dealloc)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1977 | // Determine if the object's reference count was pushed to zero. |
| 1978 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
| 1979 | // We may not have transitioned to 'release' if we hit an error. |
| 1980 | // This case is handled elsewhere. |
| 1981 | if (CurrV.getKind() == RefVal::Released) { |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 1982 | assert(CurrV.getCombinedCounts() == 0); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1983 | os << "Object released by directly sending the '-dealloc' message"; |
| 1984 | break; |
| 1985 | } |
| 1986 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1987 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1988 | // Specially handle CFMakeCollectable and friends. |
| 1989 | if (contains(AEffects, MakeCollectable)) { |
| 1990 | // Get the name of the function. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1991 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1992 | SVal X = |
| 1993 | CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1994 | const FunctionDecl *FD = X.getAsFunctionDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1995 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1996 | if (GCEnabled) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1997 | // Determine if the object's reference count was pushed to zero. |
| 1998 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1999 | |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 2000 | os << "In GC mode a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2001 | << "' decrements an object's retain count and registers the " |
| 2002 | "object with the garbage collector. "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2003 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2004 | if (CurrV.getKind() == RefVal::Released) { |
| 2005 | assert(CurrV.getCount() == 0); |
| 2006 | os << "Since it now has a 0 retain count the object can be " |
| 2007 | "automatically collected by the garbage collector."; |
| 2008 | } |
| 2009 | else |
| 2010 | os << "An object must have a 0 retain count to be garbage collected. " |
| 2011 | "After this call its retain count is +" << CurrV.getCount() |
| 2012 | << '.'; |
| 2013 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2014 | else |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 2015 | os << "When GC is not enabled a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2016 | << "' has no effect on its argument."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2017 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2018 | // Nothing more to say. |
| 2019 | break; |
| 2020 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2021 | |
| 2022 | // Determine if the typestate has changed. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2023 | if (!(PrevV == CurrV)) |
| 2024 | switch (CurrV.getKind()) { |
| 2025 | case RefVal::Owned: |
| 2026 | case RefVal::NotOwned: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2027 | |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2028 | if (PrevV.getCount() == CurrV.getCount()) { |
| 2029 | // Did an autorelease message get sent? |
| 2030 | if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount()) |
| 2031 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2032 | |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2033 | assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount()); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2034 | os << "Object sent -autorelease message"; |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2035 | break; |
| 2036 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2037 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2038 | if (PrevV.getCount() > CurrV.getCount()) |
| 2039 | os << "Reference count decremented."; |
| 2040 | else |
| 2041 | os << "Reference count incremented."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2042 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2043 | if (unsigned Count = CurrV.getCount()) |
| 2044 | os << " The object now has a +" << Count << " retain count."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2045 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2046 | if (PrevV.getKind() == RefVal::Released) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2047 | assert(GCEnabled && CurrV.getCount() > 0); |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2048 | os << " The object is not eligible for garbage collection until " |
| 2049 | "the retain count reaches 0 again."; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2050 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2051 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2052 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2053 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2054 | case RefVal::Released: |
| 2055 | os << "Object released."; |
| 2056 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2057 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2058 | case RefVal::ReturnedOwned: |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2059 | // Autoreleases can be applied after marking a node ReturnedOwned. |
| 2060 | if (CurrV.getAutoreleaseCount()) |
| 2061 | return NULL; |
| 2062 | |
| 2063 | os << "Object returned to caller as an owning reference (single " |
| 2064 | "retain count transferred to caller)"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2065 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2066 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2067 | case RefVal::ReturnedNotOwned: |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2068 | os << "Object returned to caller with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2069 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2070 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2071 | default: |
| 2072 | return NULL; |
| 2073 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2074 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2075 | // Emit any remaining diagnostics for the argument effects (if any). |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2076 | for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(), |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2077 | E=AEffects.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2078 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2079 | // A bunch of things have alternate behavior under GC. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2080 | if (GCEnabled) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2081 | switch (*I) { |
| 2082 | default: break; |
| 2083 | case Autorelease: |
| 2084 | os << "In GC mode an 'autorelease' has no effect."; |
| 2085 | continue; |
| 2086 | case IncRefMsg: |
| 2087 | os << "In GC mode the 'retain' message has no effect."; |
| 2088 | continue; |
| 2089 | case DecRefMsg: |
| 2090 | os << "In GC mode the 'release' message has no effect."; |
| 2091 | continue; |
| 2092 | } |
| 2093 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2094 | } while (0); |
| 2095 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2096 | if (os.str().empty()) |
| 2097 | return 0; // We have nothing to say! |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2098 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2099 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 2100 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 2101 | N->getLocationContext()); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2102 | PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2103 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2104 | // Add the range by scanning the children of the statement for any bindings |
| 2105 | // to Sym. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2106 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2107 | I!=E; ++I) |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2108 | if (const Expr *Exp = dyn_cast_or_null<Expr>(*I)) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2109 | if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2110 | P->addRange(Exp->getSourceRange()); |
| 2111 | break; |
| 2112 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2113 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2114 | return P; |
| 2115 | } |
| 2116 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2117 | // Find the first node in the current function context that referred to the |
| 2118 | // tracked symbol and the memory location that value was stored to. Note, the |
| 2119 | // value is only reported if the allocation occurred in the same function as |
| 2120 | // the leak. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2121 | static std::pair<const ExplodedNode*,const MemRegion*> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 2122 | GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2123 | SymbolRef Sym) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2124 | const ExplodedNode *Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2125 | const MemRegion* FirstBinding = 0; |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2126 | const LocationContext *LeakContext = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2127 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2128 | while (N) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2129 | ProgramStateRef St = N->getState(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2130 | RefBindings B = St->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2131 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2132 | if (!B.lookup(Sym)) |
| 2133 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2134 | |
Anna Zaks | 27b867e | 2012-03-21 19:45:01 +0000 | [diff] [blame] | 2135 | StoreManager::FindUniqueBinding FB(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2136 | StateMgr.iterBindings(St, FB); |
| 2137 | if (FB) FirstBinding = FB.getRegion(); |
| 2138 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2139 | // Allocation node, is the last node in the current context in which the |
| 2140 | // symbol was tracked. |
| 2141 | if (N->getLocationContext() == LeakContext) |
| 2142 | Last = N; |
| 2143 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2144 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2145 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2146 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2147 | // If allocation happened in a function different from the leak node context, |
| 2148 | // do not report the binding. |
| 2149 | if (N->getLocationContext() != LeakContext) { |
| 2150 | FirstBinding = 0; |
| 2151 | } |
| 2152 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2153 | return std::make_pair(Last, FirstBinding); |
| 2154 | } |
| 2155 | |
| 2156 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2157 | CFRefReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2158 | const ExplodedNode *EndN, |
| 2159 | BugReport &BR) { |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2160 | BR.markInteresting(Sym); |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2161 | return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2162 | } |
| 2163 | |
| 2164 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2165 | CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2166 | const ExplodedNode *EndN, |
| 2167 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2168 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2169 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2170 | // assigned to different variables, etc. |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2171 | BR.markInteresting(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2172 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2173 | // We are reporting a leak. Walk up the graph to get to the first node where |
| 2174 | // the symbol appeared, and also get the first VarDecl that tracked object |
| 2175 | // is stored to. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2176 | const ExplodedNode *AllocNode = 0; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2177 | const MemRegion* FirstBinding = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2178 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2179 | llvm::tie(AllocNode, FirstBinding) = |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2180 | GetAllocationSite(BRC.getStateManager(), EndN, Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2181 | |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2182 | SourceManager& SM = BRC.getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2183 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2184 | // Compute an actual location for the leak. Sometimes a leak doesn't |
| 2185 | // occur at an actual statement (e.g., transition between blocks; end |
| 2186 | // of function) so we need to walk the graph and compute a real location. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2187 | const ExplodedNode *LeakN = EndN; |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2188 | PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2189 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2190 | std::string sbuf; |
| 2191 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2192 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2193 | os << "Object leaked: "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2194 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2195 | if (FirstBinding) { |
| 2196 | os << "object allocated and stored into '" |
| 2197 | << FirstBinding->getString() << '\''; |
| 2198 | } |
| 2199 | else |
| 2200 | os << "allocated object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2201 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2202 | // Get the retain count. |
| 2203 | const RefVal* RV = EndN->getState()->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2204 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2205 | if (RV->getKind() == RefVal::ErrorLeakReturned) { |
| 2206 | // FIXME: Per comments in rdar://6320065, "create" only applies to CF |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2207 | // objects. Only "copy", "alloc", "retain" and "new" transfer ownership |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2208 | // to the caller for NS objects. |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2209 | const Decl *D = &EndN->getCodeDecl(); |
| 2210 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
| 2211 | os << " is returned from a method whose name ('" |
| 2212 | << MD->getSelector().getAsString() |
| 2213 | << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'." |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2214 | " This violates the naming convention rules" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2215 | " given in the Memory Management Guide for Cocoa"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2216 | } |
| 2217 | else { |
| 2218 | const FunctionDecl *FD = cast<FunctionDecl>(D); |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2219 | os << " is returned from a function whose name ('" |
Benjamin Kramer | a59d20b | 2012-02-07 11:57:57 +0000 | [diff] [blame] | 2220 | << *FD |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2221 | << "') does not contain 'Copy' or 'Create'. This violates the naming" |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2222 | " convention rules given in the Memory Management Guide for Core" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2223 | " Foundation"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2224 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2225 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2226 | else if (RV->getKind() == RefVal::ErrorGCLeakReturned) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2227 | ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2228 | os << " and returned from method '" << MD.getSelector().getAsString() |
Ted Kremenek | 82f2be5 | 2009-05-10 16:52:15 +0000 | [diff] [blame] | 2229 | << "' is potentially leaked when using garbage collection. Callers " |
| 2230 | "of this method do not expect a returned object with a +1 retain " |
| 2231 | "count since they expect the object to be managed by the garbage " |
| 2232 | "collector"; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2233 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2234 | else |
Ted Kremenek | abf517c | 2010-10-15 22:50:23 +0000 | [diff] [blame] | 2235 | os << " is not referenced later in this execution path and has a retain " |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2236 | "count of +" << RV->getCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2237 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2238 | return new PathDiagnosticEventPiece(L, os.str()); |
| 2239 | } |
| 2240 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2241 | CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, |
| 2242 | bool GCEnabled, const SummaryLogTy &Log, |
| 2243 | ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2244 | CheckerContext &Ctx) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2245 | : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2246 | |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 2247 | // Most bug reports are cached at the location where they occurred. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2248 | // With leaks, we want to unique them by the location where they were |
| 2249 | // allocated, and only report a single path. To do this, we need to find |
| 2250 | // the allocation site of a piece of tracked memory, which we do via a |
| 2251 | // call to GetAllocationSite. This will walk the ExplodedGraph backwards. |
| 2252 | // Note that this is *not* the trimmed graph; we are guaranteed, however, |
| 2253 | // that all ancestor nodes that represent the allocation site have the |
| 2254 | // same SourceLocation. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2255 | const ExplodedNode *AllocNode = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2256 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2257 | const SourceManager& SMgr = Ctx.getSourceManager(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2258 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2259 | llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding. |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2260 | GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2261 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2262 | // Get the SourceLocation for the allocation site. |
| 2263 | ProgramPoint P = AllocNode->getLocation(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2264 | const Stmt *AllocStmt = cast<PostStmt>(P).getStmt(); |
| 2265 | Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr, |
| 2266 | n->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2267 | // Fill in the description of the bug. |
| 2268 | Description.clear(); |
| 2269 | llvm::raw_string_ostream os(Description); |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2270 | os << "Potential leak "; |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2271 | if (GCEnabled) |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2272 | os << "(when using garbage collection) "; |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2273 | os << "of an object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2274 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2275 | // FIXME: AllocBinding doesn't get populated for RegionStore yet. |
| 2276 | if (AllocBinding) |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2277 | os << " stored into '" << AllocBinding->getString() << '\''; |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 2278 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2279 | addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log)); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2280 | } |
| 2281 | |
| 2282 | //===----------------------------------------------------------------------===// |
| 2283 | // Main checker logic. |
| 2284 | //===----------------------------------------------------------------------===// |
| 2285 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2286 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2287 | class RetainCountChecker |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2288 | : public Checker< check::Bind, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2289 | check::DeadSymbols, |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2290 | check::EndAnalysis, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2291 | check::EndPath, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2292 | check::PostStmt<BlockExpr>, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2293 | check::PostStmt<CastExpr>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2294 | check::PostStmt<CallExpr>, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2295 | check::PostStmt<CXXConstructExpr>, |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2296 | check::PostStmt<ObjCArrayLiteral>, |
| 2297 | check::PostStmt<ObjCDictionaryLiteral>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2298 | check::PostObjCMessage, |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2299 | check::PreStmt<ReturnStmt>, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2300 | check::RegionChanges, |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2301 | eval::Assume, |
| 2302 | eval::Call > { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2303 | mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned; |
| 2304 | mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned; |
| 2305 | mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned; |
| 2306 | mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn; |
| 2307 | mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2308 | |
| 2309 | typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap; |
| 2310 | |
| 2311 | // This map is only used to ensure proper deletion of any allocated tags. |
| 2312 | mutable SymbolTagMap DeadSymbolTags; |
| 2313 | |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2314 | mutable OwningPtr<RetainSummaryManager> Summaries; |
| 2315 | mutable OwningPtr<RetainSummaryManager> SummariesGC; |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2316 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2317 | mutable ARCounts::Factory ARCountFactory; |
| 2318 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2319 | mutable SummaryLogTy SummaryLog; |
| 2320 | mutable bool ShouldResetSummaryLog; |
| 2321 | |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2322 | public: |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2323 | RetainCountChecker() : ShouldResetSummaryLog(false) {} |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2324 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2325 | virtual ~RetainCountChecker() { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2326 | DeleteContainerSeconds(DeadSymbolTags); |
| 2327 | } |
| 2328 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2329 | void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR, |
| 2330 | ExprEngine &Eng) const { |
| 2331 | // FIXME: This is a hack to make sure the summary log gets cleared between |
| 2332 | // analyses of different code bodies. |
| 2333 | // |
| 2334 | // Why is this necessary? Because a checker's lifetime is tied to a |
| 2335 | // translation unit, but an ExplodedGraph's lifetime is just a code body. |
| 2336 | // Once in a blue moon, a new ExplodedNode will have the same address as an |
| 2337 | // old one with an associated summary, and the bug report visitor gets very |
| 2338 | // confused. (To make things worse, the summary lifetime is currently also |
| 2339 | // tied to a code body, so we get a crash instead of incorrect results.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2340 | // |
| 2341 | // Why is this a bad solution? Because if the lifetime of the ExplodedGraph |
| 2342 | // changes, things will start going wrong again. Really the lifetime of this |
| 2343 | // log needs to be tied to either the specific nodes in it or the entire |
| 2344 | // ExplodedGraph, not to a specific part of the code being analyzed. |
| 2345 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2346 | // (Also, having stateful local data means that the same checker can't be |
| 2347 | // used from multiple threads, but a lot of checkers have incorrect |
| 2348 | // assumptions about that anyway. So that wasn't a priority at the time of |
| 2349 | // this fix.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2350 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2351 | // This happens at the end of analysis, but bug reports are emitted /after/ |
| 2352 | // this point. So we can't just clear the summary log now. Instead, we mark |
| 2353 | // that the next time we access the summary log, it should be cleared. |
| 2354 | |
| 2355 | // If we never reset the summary log during /this/ code body analysis, |
| 2356 | // there were no new summaries. There might still have been summaries from |
| 2357 | // the /last/ analysis, so clear them out to make sure the bug report |
| 2358 | // visitors don't get confused. |
| 2359 | if (ShouldResetSummaryLog) |
| 2360 | SummaryLog.clear(); |
| 2361 | |
| 2362 | ShouldResetSummaryLog = !SummaryLog.empty(); |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2363 | } |
| 2364 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2365 | CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts, |
| 2366 | bool GCEnabled) const { |
| 2367 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2368 | if (!leakWithinFunctionGC) |
| 2369 | leakWithinFunctionGC.reset(new LeakWithinFunction("Leak of object when " |
| 2370 | "using garbage " |
| 2371 | "collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2372 | return leakWithinFunctionGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2373 | } else { |
| 2374 | if (!leakWithinFunction) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2375 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2376 | leakWithinFunction.reset(new LeakWithinFunction("Leak of object when " |
| 2377 | "not using garbage " |
| 2378 | "collection (GC) in " |
| 2379 | "dual GC/non-GC " |
| 2380 | "code")); |
| 2381 | } else { |
| 2382 | leakWithinFunction.reset(new LeakWithinFunction("Leak")); |
| 2383 | } |
| 2384 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2385 | return leakWithinFunction.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2386 | } |
| 2387 | } |
| 2388 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2389 | CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const { |
| 2390 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2391 | if (!leakAtReturnGC) |
| 2392 | leakAtReturnGC.reset(new LeakAtReturn("Leak of returned object when " |
| 2393 | "using garbage collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2394 | return leakAtReturnGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2395 | } else { |
| 2396 | if (!leakAtReturn) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2397 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2398 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object when " |
| 2399 | "not using garbage collection " |
| 2400 | "(GC) in dual GC/non-GC code")); |
| 2401 | } else { |
| 2402 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object")); |
| 2403 | } |
| 2404 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2405 | return leakAtReturn.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2406 | } |
| 2407 | } |
| 2408 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2409 | RetainSummaryManager &getSummaryManager(ASTContext &Ctx, |
| 2410 | bool GCEnabled) const { |
| 2411 | // FIXME: We don't support ARC being turned on and off during one analysis. |
| 2412 | // (nor, for that matter, do we support changing ASTContexts) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2413 | bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2414 | if (GCEnabled) { |
| 2415 | if (!SummariesGC) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2416 | SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2417 | else |
| 2418 | assert(SummariesGC->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2419 | return *SummariesGC; |
| 2420 | } else { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2421 | if (!Summaries) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2422 | Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2423 | else |
| 2424 | assert(Summaries->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2425 | return *Summaries; |
| 2426 | } |
| 2427 | } |
| 2428 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2429 | RetainSummaryManager &getSummaryManager(CheckerContext &C) const { |
| 2430 | return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled()); |
| 2431 | } |
| 2432 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2433 | void printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 2434 | const char *NL, const char *Sep) const; |
| 2435 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 2436 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2437 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
| 2438 | void checkPostStmt(const CastExpr *CE, CheckerContext &C) const; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2439 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2440 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2441 | void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2442 | void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const; |
| 2443 | void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2444 | void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2445 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2446 | void checkSummary(const RetainSummary &Summ, const CallOrObjCMessage &Call, |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2447 | CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2448 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2449 | bool evalCall(const CallExpr *CE, CheckerContext &C) const; |
| 2450 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2451 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2452 | bool Assumption) const; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2453 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2454 | ProgramStateRef |
| 2455 | checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2456 | const StoreManager::InvalidatedSymbols *invalidated, |
| 2457 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 2458 | ArrayRef<const MemRegion *> Regions, |
| 2459 | const CallOrObjCMessage *Call) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2460 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2461 | bool wantsRegionChangeUpdate(ProgramStateRef state) const { |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2462 | return true; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2463 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2464 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2465 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
| 2466 | void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, |
| 2467 | ExplodedNode *Pred, RetEffect RE, RefVal X, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2468 | SymbolRef Sym, ProgramStateRef state) const; |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2469 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2470 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 2471 | void checkEndPath(CheckerContext &C) const; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2472 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2473 | ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2474 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2475 | CheckerContext &C) const; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2476 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2477 | void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2478 | RefVal::Kind ErrorKind, SymbolRef Sym, |
| 2479 | CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2480 | |
| 2481 | void processObjCLiterals(CheckerContext &C, const Expr *Ex) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2482 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2483 | const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const; |
| 2484 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2485 | ProgramStateRef handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2486 | SymbolRef sid, RefVal V, |
| 2487 | SmallVectorImpl<SymbolRef> &Leaked) const; |
| 2488 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2489 | std::pair<ExplodedNode *, ProgramStateRef > |
| 2490 | handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2491 | GenericNodeBuilderRefCount Bd, ExplodedNode *Pred, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2492 | CheckerContext &Ctx, SymbolRef Sym, RefVal V) const; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2493 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2494 | ExplodedNode *processLeaks(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2495 | SmallVectorImpl<SymbolRef> &Leaked, |
| 2496 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2497 | CheckerContext &Ctx, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2498 | ExplodedNode *Pred = 0) const; |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2499 | }; |
| 2500 | } // end anonymous namespace |
| 2501 | |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2502 | namespace { |
| 2503 | class StopTrackingCallback : public SymbolVisitor { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2504 | ProgramStateRef state; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2505 | public: |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2506 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 2507 | ProgramStateRef getState() const { return state; } |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2508 | |
| 2509 | bool VisitSymbol(SymbolRef sym) { |
| 2510 | state = state->remove<RefBindings>(sym); |
| 2511 | return true; |
| 2512 | } |
| 2513 | }; |
| 2514 | } // end anonymous namespace |
| 2515 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2516 | //===----------------------------------------------------------------------===// |
| 2517 | // Handle statements that may have an effect on refcounts. |
| 2518 | //===----------------------------------------------------------------------===// |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2519 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2520 | void RetainCountChecker::checkPostStmt(const BlockExpr *BE, |
| 2521 | CheckerContext &C) const { |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2522 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2523 | // Scan the BlockDecRefExprs for any object the retain count checker |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2524 | // may be tracking. |
John McCall | 469a1eb | 2011-02-02 13:00:07 +0000 | [diff] [blame] | 2525 | if (!BE->getBlockDecl()->hasCaptures()) |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2526 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2527 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2528 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2529 | const BlockDataRegion *R = |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2530 | cast<BlockDataRegion>(state->getSVal(BE, |
| 2531 | C.getLocationContext()).getAsRegion()); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2532 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2533 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 2534 | E = R->referenced_vars_end(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2535 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2536 | if (I == E) |
| 2537 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2538 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2539 | // FIXME: For now we invalidate the tracking of all symbols passed to blocks |
| 2540 | // via captured variables, even though captured variables result in a copy |
| 2541 | // and in implicit increment/decrement of a retain count. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2542 | SmallVector<const MemRegion*, 10> Regions; |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2543 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2544 | MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2545 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2546 | for ( ; I != E; ++I) { |
| 2547 | const VarRegion *VR = *I; |
| 2548 | if (VR->getSuperRegion() == R) { |
| 2549 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 2550 | } |
| 2551 | Regions.push_back(VR); |
| 2552 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2553 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2554 | state = |
| 2555 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 2556 | Regions.data() + Regions.size()).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2557 | C.addTransition(state); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2558 | } |
| 2559 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2560 | void RetainCountChecker::checkPostStmt(const CastExpr *CE, |
| 2561 | CheckerContext &C) const { |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2562 | const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE); |
| 2563 | if (!BE) |
| 2564 | return; |
| 2565 | |
John McCall | 71c482c | 2011-06-17 06:50:50 +0000 | [diff] [blame] | 2566 | ArgEffect AE = IncRef; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2567 | |
| 2568 | switch (BE->getBridgeKind()) { |
| 2569 | case clang::OBC_Bridge: |
| 2570 | // Do nothing. |
| 2571 | return; |
| 2572 | case clang::OBC_BridgeRetained: |
| 2573 | AE = IncRef; |
| 2574 | break; |
| 2575 | case clang::OBC_BridgeTransfer: |
| 2576 | AE = DecRefBridgedTransfered; |
| 2577 | break; |
| 2578 | } |
| 2579 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2580 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2581 | SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol(); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2582 | if (!Sym) |
| 2583 | return; |
| 2584 | const RefVal* T = state->get<RefBindings>(Sym); |
| 2585 | if (!T) |
| 2586 | return; |
| 2587 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2588 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2589 | state = updateSymbol(state, Sym, *T, AE, hasErr, C); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2590 | |
| 2591 | if (hasErr) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2592 | // FIXME: If we get an error during a bridge cast, should we report it? |
| 2593 | // Should we assert that there is no error? |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2594 | return; |
| 2595 | } |
| 2596 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2597 | C.addTransition(state); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2598 | } |
| 2599 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2600 | void RetainCountChecker::checkPostStmt(const CallExpr *CE, |
| 2601 | CheckerContext &C) const { |
Ted Kremenek | 514f2c9 | 2012-03-23 06:26:56 +0000 | [diff] [blame^] | 2602 | if (C.wasInlined) |
| 2603 | return; |
| 2604 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2605 | // Get the callee. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2606 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2607 | const Expr *Callee = CE->getCallee(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2608 | SVal L = state->getSVal(Callee, C.getLocationContext()); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2609 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2610 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2611 | const RetainSummary *Summ = 0; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2612 | |
| 2613 | // FIXME: Better support for blocks. For now we stop tracking anything |
| 2614 | // that is passed to blocks. |
| 2615 | // FIXME: Need to handle variables that are "captured" by the block. |
| 2616 | if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) { |
| 2617 | Summ = Summaries.getPersistentStopSummary(); |
| 2618 | } else if (const FunctionDecl *FD = L.getAsFunctionDecl()) { |
| 2619 | Summ = Summaries.getSummary(FD); |
| 2620 | } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) { |
| 2621 | if (const CXXMethodDecl *MD = me->getMethodDecl()) |
| 2622 | Summ = Summaries.getSummary(MD); |
| 2623 | } |
| 2624 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2625 | if (!Summ) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2626 | Summ = Summaries.getDefaultSummary(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2627 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2628 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2629 | } |
| 2630 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2631 | void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE, |
| 2632 | CheckerContext &C) const { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2633 | const CXXConstructorDecl *Ctor = CE->getConstructor(); |
| 2634 | if (!Ctor) |
| 2635 | return; |
| 2636 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2637 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2638 | const RetainSummary *Summ = Summaries.getSummary(Ctor); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2639 | |
| 2640 | // If we didn't get a summary, this constructor doesn't affect retain counts. |
| 2641 | if (!Summ) |
| 2642 | return; |
| 2643 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2644 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2645 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2646 | } |
| 2647 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2648 | void RetainCountChecker::processObjCLiterals(CheckerContext &C, |
| 2649 | const Expr *Ex) const { |
| 2650 | ProgramStateRef state = C.getState(); |
| 2651 | const ExplodedNode *pred = C.getPredecessor(); |
| 2652 | for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ; |
| 2653 | it != et ; ++it) { |
| 2654 | const Stmt *child = *it; |
| 2655 | SVal V = state->getSVal(child, pred->getLocationContext()); |
| 2656 | if (SymbolRef sym = V.getAsSymbol()) |
| 2657 | if (const RefVal* T = state->get<RefBindings>(sym)) { |
| 2658 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2659 | state = updateSymbol(state, sym, *T, MayEscape, hasErr, C); |
| 2660 | if (hasErr) { |
| 2661 | processNonLeakError(state, child->getSourceRange(), hasErr, sym, C); |
| 2662 | return; |
| 2663 | } |
| 2664 | } |
| 2665 | } |
| 2666 | |
| 2667 | // Return the object as autoreleased. |
| 2668 | // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 2669 | if (SymbolRef sym = |
| 2670 | state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { |
| 2671 | QualType ResultTy = Ex->getType(); |
| 2672 | state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC, |
| 2673 | ResultTy)); |
| 2674 | } |
| 2675 | |
| 2676 | C.addTransition(state); |
| 2677 | } |
| 2678 | |
| 2679 | void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL, |
| 2680 | CheckerContext &C) const { |
| 2681 | // Apply the 'MayEscape' to all values. |
| 2682 | processObjCLiterals(C, AL); |
| 2683 | } |
| 2684 | |
| 2685 | void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL, |
| 2686 | CheckerContext &C) const { |
| 2687 | // Apply the 'MayEscape' to all keys and values. |
| 2688 | processObjCLiterals(C, DL); |
| 2689 | } |
| 2690 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2691 | void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg, |
| 2692 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2693 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2694 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2695 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2696 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2697 | const RetainSummary *Summ; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2698 | if (Msg.isInstanceMessage()) { |
Anna Zaks | a2a8603 | 2011-11-01 22:41:01 +0000 | [diff] [blame] | 2699 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2700 | Summ = Summaries.getInstanceMethodSummary(Msg, state, LC); |
| 2701 | } else { |
| 2702 | Summ = Summaries.getClassMethodSummary(Msg); |
| 2703 | } |
| 2704 | |
| 2705 | // If we didn't get a summary, this message doesn't affect retain counts. |
| 2706 | if (!Summ) |
| 2707 | return; |
| 2708 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2709 | checkSummary(*Summ, CallOrObjCMessage(Msg, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2710 | } |
| 2711 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2712 | /// GetReturnType - Used to get the return type of a message expression or |
| 2713 | /// function call with the intention of affixing that type to a tracked symbol. |
| 2714 | /// While the the return type can be queried directly from RetEx, when |
| 2715 | /// invoking class methods we augment to the return type to be that of |
| 2716 | /// a pointer to the class (as opposed it just being id). |
| 2717 | // FIXME: We may be able to do this with related result types instead. |
| 2718 | // This function is probably overestimating. |
| 2719 | static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) { |
| 2720 | QualType RetTy = RetE->getType(); |
| 2721 | // If RetE is not a message expression just return its type. |
| 2722 | // If RetE is a message expression, return its types if it is something |
| 2723 | /// more specific than id. |
| 2724 | if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE)) |
| 2725 | if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>()) |
| 2726 | if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() || |
| 2727 | PT->isObjCClassType()) { |
| 2728 | // At this point we know the return type of the message expression is |
| 2729 | // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this |
| 2730 | // is a call to a class method whose type we can resolve. In such |
| 2731 | // cases, promote the return type to XXX* (where XXX is the class). |
| 2732 | const ObjCInterfaceDecl *D = ME->getReceiverInterface(); |
| 2733 | return !D ? RetTy : |
| 2734 | Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D)); |
| 2735 | } |
| 2736 | |
| 2737 | return RetTy; |
| 2738 | } |
| 2739 | |
| 2740 | void RetainCountChecker::checkSummary(const RetainSummary &Summ, |
| 2741 | const CallOrObjCMessage &CallOrMsg, |
| 2742 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2743 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2744 | |
| 2745 | // Evaluate the effect of the arguments. |
| 2746 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2747 | SourceRange ErrorRange; |
| 2748 | SymbolRef ErrorSym = 0; |
| 2749 | |
| 2750 | for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2751 | SVal V = CallOrMsg.getArgSVal(idx); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2752 | |
| 2753 | if (SymbolRef Sym = V.getAsLocSymbol()) { |
| 2754 | if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2755 | state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2756 | if (hasErr) { |
| 2757 | ErrorRange = CallOrMsg.getArgSourceRange(idx); |
| 2758 | ErrorSym = Sym; |
| 2759 | break; |
| 2760 | } |
| 2761 | } |
| 2762 | } |
| 2763 | } |
| 2764 | |
| 2765 | // Evaluate the effect on the message receiver. |
| 2766 | bool ReceiverIsTracked = false; |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2767 | if (!hasErr && CallOrMsg.isObjCMessage()) { |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2768 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2769 | SVal Receiver = CallOrMsg.getInstanceMessageReceiver(LC); |
| 2770 | if (SymbolRef Sym = Receiver.getAsLocSymbol()) { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2771 | if (const RefVal *T = state->get<RefBindings>(Sym)) { |
| 2772 | ReceiverIsTracked = true; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2773 | state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(), |
| 2774 | hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2775 | if (hasErr) { |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2776 | ErrorRange = CallOrMsg.getReceiverSourceRange(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2777 | ErrorSym = Sym; |
| 2778 | } |
| 2779 | } |
| 2780 | } |
| 2781 | } |
| 2782 | |
| 2783 | // Process any errors. |
| 2784 | if (hasErr) { |
| 2785 | processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C); |
| 2786 | return; |
| 2787 | } |
| 2788 | |
| 2789 | // Consult the summary for the return value. |
| 2790 | RetEffect RE = Summ.getRetEffect(); |
| 2791 | |
| 2792 | if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2793 | if (ReceiverIsTracked) |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2794 | RE = getSummaryManager(C).getObjAllocRetEffect(); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2795 | else |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2796 | RE = RetEffect::MakeNoRet(); |
| 2797 | } |
| 2798 | |
| 2799 | switch (RE.getKind()) { |
| 2800 | default: |
David Blaikie | 7530c03 | 2012-01-17 06:56:22 +0000 | [diff] [blame] | 2801 | llvm_unreachable("Unhandled RetEffect."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2802 | |
| 2803 | case RetEffect::NoRet: |
| 2804 | // No work necessary. |
| 2805 | break; |
| 2806 | |
| 2807 | case RetEffect::OwnedAllocatedSymbol: |
| 2808 | case RetEffect::OwnedSymbol: { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2809 | SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(), |
| 2810 | C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2811 | if (!Sym) |
| 2812 | break; |
| 2813 | |
| 2814 | // Use the result type from callOrMsg as it automatically adjusts |
| 2815 | // for methods/functions that return references. |
| 2816 | QualType ResultTy = CallOrMsg.getResultType(C.getASTContext()); |
| 2817 | state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(), |
| 2818 | ResultTy)); |
| 2819 | |
| 2820 | // FIXME: Add a flag to the checker where allocations are assumed to |
| 2821 | // *not* fail. (The code below is out-of-date, though.) |
| 2822 | #if 0 |
| 2823 | if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) { |
| 2824 | bool isFeasible; |
| 2825 | state = state.assume(loc::SymbolVal(Sym), true, isFeasible); |
| 2826 | assert(isFeasible && "Cannot assume fresh symbol is non-null."); |
| 2827 | } |
| 2828 | #endif |
| 2829 | |
| 2830 | break; |
| 2831 | } |
| 2832 | |
| 2833 | case RetEffect::GCNotOwnedSymbol: |
| 2834 | case RetEffect::ARCNotOwnedSymbol: |
| 2835 | case RetEffect::NotOwnedSymbol: { |
| 2836 | const Expr *Ex = CallOrMsg.getOriginExpr(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2837 | SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2838 | if (!Sym) |
| 2839 | break; |
| 2840 | |
| 2841 | // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *. |
| 2842 | QualType ResultTy = GetReturnType(Ex, C.getASTContext()); |
| 2843 | state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(), |
| 2844 | ResultTy)); |
| 2845 | break; |
| 2846 | } |
| 2847 | } |
| 2848 | |
| 2849 | // This check is actually necessary; otherwise the statement builder thinks |
| 2850 | // we've hit a previously-found path. |
| 2851 | // Normally addTransition takes care of this, but we want the node pointer. |
| 2852 | ExplodedNode *NewNode; |
| 2853 | if (state == C.getState()) { |
| 2854 | NewNode = C.getPredecessor(); |
| 2855 | } else { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2856 | NewNode = C.addTransition(state); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2857 | } |
| 2858 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2859 | // Annotate the node with summary we used. |
| 2860 | if (NewNode) { |
| 2861 | // FIXME: This is ugly. See checkEndAnalysis for why it's necessary. |
| 2862 | if (ShouldResetSummaryLog) { |
| 2863 | SummaryLog.clear(); |
| 2864 | ShouldResetSummaryLog = false; |
| 2865 | } |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 2866 | SummaryLog[NewNode] = &Summ; |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2867 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2868 | } |
| 2869 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2870 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2871 | ProgramStateRef |
| 2872 | RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2873 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2874 | CheckerContext &C) const { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2875 | // In GC mode [... release] and [... retain] do nothing. |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2876 | // In ARC mode they shouldn't exist at all, but we just ignore them. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2877 | bool IgnoreRetainMsg = C.isObjCGCEnabled(); |
| 2878 | if (!IgnoreRetainMsg) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2879 | IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2880 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2881 | switch (E) { |
| 2882 | default: break; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2883 | case IncRefMsg: E = IgnoreRetainMsg ? DoNothing : IncRef; break; |
| 2884 | case DecRefMsg: E = IgnoreRetainMsg ? DoNothing : DecRef; break; |
| 2885 | case MakeCollectable: E = C.isObjCGCEnabled() ? DecRef : DoNothing; break; |
| 2886 | case NewAutoreleasePool: E = C.isObjCGCEnabled() ? DoNothing : |
| 2887 | NewAutoreleasePool; break; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2888 | } |
| 2889 | |
| 2890 | // Handle all use-after-releases. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2891 | if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2892 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 2893 | hasErr = V.getKind(); |
| 2894 | return state->set<RefBindings>(sym, V); |
| 2895 | } |
| 2896 | |
| 2897 | switch (E) { |
| 2898 | case DecRefMsg: |
| 2899 | case IncRefMsg: |
| 2900 | case MakeCollectable: |
| 2901 | llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted"); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2902 | |
| 2903 | case Dealloc: |
| 2904 | // Any use of -dealloc in GC is *bad*. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2905 | if (C.isObjCGCEnabled()) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2906 | V = V ^ RefVal::ErrorDeallocGC; |
| 2907 | hasErr = V.getKind(); |
| 2908 | break; |
| 2909 | } |
| 2910 | |
| 2911 | switch (V.getKind()) { |
| 2912 | default: |
| 2913 | llvm_unreachable("Invalid RefVal state for an explicit dealloc."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2914 | case RefVal::Owned: |
| 2915 | // The object immediately transitions to the released state. |
| 2916 | V = V ^ RefVal::Released; |
| 2917 | V.clearCounts(); |
| 2918 | return state->set<RefBindings>(sym, V); |
| 2919 | case RefVal::NotOwned: |
| 2920 | V = V ^ RefVal::ErrorDeallocNotOwned; |
| 2921 | hasErr = V.getKind(); |
| 2922 | break; |
| 2923 | } |
| 2924 | break; |
| 2925 | |
| 2926 | case NewAutoreleasePool: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2927 | assert(!C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2928 | return state->add<AutoreleaseStack>(sym); |
| 2929 | |
| 2930 | case MayEscape: |
| 2931 | if (V.getKind() == RefVal::Owned) { |
| 2932 | V = V ^ RefVal::NotOwned; |
| 2933 | break; |
| 2934 | } |
| 2935 | |
| 2936 | // Fall-through. |
| 2937 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2938 | case DoNothing: |
| 2939 | return state; |
| 2940 | |
| 2941 | case Autorelease: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2942 | if (C.isObjCGCEnabled()) |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2943 | return state; |
| 2944 | |
| 2945 | // Update the autorelease counts. |
| 2946 | state = SendAutorelease(state, ARCountFactory, sym); |
| 2947 | V = V.autorelease(); |
| 2948 | break; |
| 2949 | |
| 2950 | case StopTracking: |
| 2951 | return state->remove<RefBindings>(sym); |
| 2952 | |
| 2953 | case IncRef: |
| 2954 | switch (V.getKind()) { |
| 2955 | default: |
| 2956 | llvm_unreachable("Invalid RefVal state for a retain."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2957 | case RefVal::Owned: |
| 2958 | case RefVal::NotOwned: |
| 2959 | V = V + 1; |
| 2960 | break; |
| 2961 | case RefVal::Released: |
| 2962 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2963 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2964 | V = (V ^ RefVal::Owned) + 1; |
| 2965 | break; |
| 2966 | } |
| 2967 | break; |
| 2968 | |
| 2969 | case SelfOwn: |
| 2970 | V = V ^ RefVal::NotOwned; |
| 2971 | // Fall-through. |
| 2972 | case DecRef: |
| 2973 | case DecRefBridgedTransfered: |
| 2974 | switch (V.getKind()) { |
| 2975 | default: |
| 2976 | // case 'RefVal::Released' handled above. |
| 2977 | llvm_unreachable("Invalid RefVal state for a release."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2978 | |
| 2979 | case RefVal::Owned: |
| 2980 | assert(V.getCount() > 0); |
| 2981 | if (V.getCount() == 1) |
| 2982 | V = V ^ (E == DecRefBridgedTransfered ? |
| 2983 | RefVal::NotOwned : RefVal::Released); |
| 2984 | V = V - 1; |
| 2985 | break; |
| 2986 | |
| 2987 | case RefVal::NotOwned: |
| 2988 | if (V.getCount() > 0) |
| 2989 | V = V - 1; |
| 2990 | else { |
| 2991 | V = V ^ RefVal::ErrorReleaseNotOwned; |
| 2992 | hasErr = V.getKind(); |
| 2993 | } |
| 2994 | break; |
| 2995 | |
| 2996 | case RefVal::Released: |
| 2997 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2998 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2999 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3000 | hasErr = V.getKind(); |
| 3001 | break; |
| 3002 | } |
| 3003 | break; |
| 3004 | } |
| 3005 | return state->set<RefBindings>(sym, V); |
| 3006 | } |
| 3007 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3008 | void RetainCountChecker::processNonLeakError(ProgramStateRef St, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3009 | SourceRange ErrorRange, |
| 3010 | RefVal::Kind ErrorKind, |
| 3011 | SymbolRef Sym, |
| 3012 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3013 | ExplodedNode *N = C.generateSink(St); |
| 3014 | if (!N) |
| 3015 | return; |
| 3016 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3017 | CFRefBug *BT; |
| 3018 | switch (ErrorKind) { |
| 3019 | default: |
| 3020 | llvm_unreachable("Unhandled error."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3021 | case RefVal::ErrorUseAfterRelease: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3022 | if (!useAfterRelease) |
| 3023 | useAfterRelease.reset(new UseAfterRelease()); |
| 3024 | BT = &*useAfterRelease; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3025 | break; |
| 3026 | case RefVal::ErrorReleaseNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3027 | if (!releaseNotOwned) |
| 3028 | releaseNotOwned.reset(new BadRelease()); |
| 3029 | BT = &*releaseNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3030 | break; |
| 3031 | case RefVal::ErrorDeallocGC: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3032 | if (!deallocGC) |
| 3033 | deallocGC.reset(new DeallocGC()); |
| 3034 | BT = &*deallocGC; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3035 | break; |
| 3036 | case RefVal::ErrorDeallocNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3037 | if (!deallocNotOwned) |
| 3038 | deallocNotOwned.reset(new DeallocNotOwned()); |
| 3039 | BT = &*deallocNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3040 | break; |
| 3041 | } |
| 3042 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3043 | assert(BT); |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3044 | CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3045 | C.isObjCGCEnabled(), SummaryLog, |
| 3046 | N, Sym); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3047 | report->addRange(ErrorRange); |
| 3048 | C.EmitReport(report); |
| 3049 | } |
| 3050 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3051 | //===----------------------------------------------------------------------===// |
| 3052 | // Handle the return values of retain-count-related functions. |
| 3053 | //===----------------------------------------------------------------------===// |
| 3054 | |
| 3055 | bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3056 | // Get the callee. We're only interested in simple C functions. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3057 | ProgramStateRef state = C.getState(); |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3058 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3059 | if (!FD) |
| 3060 | return false; |
| 3061 | |
| 3062 | IdentifierInfo *II = FD->getIdentifier(); |
| 3063 | if (!II) |
| 3064 | return false; |
| 3065 | |
| 3066 | // For now, we're only handling the functions that return aliases of their |
| 3067 | // arguments: CFRetain and CFMakeCollectable (and their families). |
| 3068 | // Eventually we should add other functions we can model entirely, |
| 3069 | // such as CFRelease, which don't invalidate their arguments or globals. |
| 3070 | if (CE->getNumArgs() != 1) |
| 3071 | return false; |
| 3072 | |
| 3073 | // Get the name of the function. |
| 3074 | StringRef FName = II->getName(); |
| 3075 | FName = FName.substr(FName.find_first_not_of('_')); |
| 3076 | |
| 3077 | // See if it's one of the specific functions we know how to eval. |
| 3078 | bool canEval = false; |
| 3079 | |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3080 | QualType ResultTy = CE->getCallReturnType(); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3081 | if (ResultTy->isObjCIdType()) { |
| 3082 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 3083 | canEval = II->isStr("NSMakeCollectable"); |
| 3084 | } else if (ResultTy->isPointerType()) { |
| 3085 | // Handle: (CF|CG)Retain |
| 3086 | // CFMakeCollectable |
| 3087 | // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist). |
| 3088 | if (cocoa::isRefType(ResultTy, "CF", FName) || |
| 3089 | cocoa::isRefType(ResultTy, "CG", FName)) { |
| 3090 | canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName); |
| 3091 | } |
| 3092 | } |
| 3093 | |
| 3094 | if (!canEval) |
| 3095 | return false; |
| 3096 | |
| 3097 | // Bind the return value. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3098 | const LocationContext *LCtx = C.getLocationContext(); |
| 3099 | SVal RetVal = state->getSVal(CE->getArg(0), LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3100 | if (RetVal.isUnknown()) { |
| 3101 | // If the receiver is unknown, conjure a return value. |
| 3102 | SValBuilder &SVB = C.getSValBuilder(); |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3103 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3104 | SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3105 | } |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3106 | state = state->BindExpr(CE, LCtx, RetVal, false); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3107 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3108 | // FIXME: This should not be necessary, but otherwise the argument seems to be |
| 3109 | // considered alive during the next statement. |
| 3110 | if (const MemRegion *ArgRegion = RetVal.getAsRegion()) { |
| 3111 | // Save the refcount status of the argument. |
| 3112 | SymbolRef Sym = RetVal.getAsLocSymbol(); |
| 3113 | RefBindings::data_type *Binding = 0; |
| 3114 | if (Sym) |
| 3115 | Binding = state->get<RefBindings>(Sym); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3116 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3117 | // Invalidate the argument region. |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3118 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3119 | state = state->invalidateRegions(ArgRegion, CE, Count, LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3120 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3121 | // Restore the refcount status of the argument. |
| 3122 | if (Binding) |
| 3123 | state = state->set<RefBindings>(Sym, *Binding); |
| 3124 | } |
| 3125 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3126 | C.addTransition(state); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3127 | return true; |
| 3128 | } |
| 3129 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3130 | //===----------------------------------------------------------------------===// |
| 3131 | // Handle return statements. |
| 3132 | //===----------------------------------------------------------------------===// |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3133 | |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3134 | // Return true if the current LocationContext has no caller context. |
| 3135 | static bool inTopFrame(CheckerContext &C) { |
| 3136 | const LocationContext *LC = C.getLocationContext(); |
| 3137 | return LC->getParent() == 0; |
| 3138 | } |
| 3139 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3140 | void RetainCountChecker::checkPreStmt(const ReturnStmt *S, |
| 3141 | CheckerContext &C) const { |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3142 | |
| 3143 | // Only adjust the reference count if this is the top-level call frame, |
| 3144 | // and not the result of inlining. In the future, we should do |
| 3145 | // better checking even for inlined calls, and see if they match |
| 3146 | // with their expected semantics (e.g., the method should return a retained |
| 3147 | // object, etc.). |
| 3148 | if (!inTopFrame(C)) |
| 3149 | return; |
| 3150 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3151 | const Expr *RetE = S->getRetValue(); |
| 3152 | if (!RetE) |
| 3153 | return; |
| 3154 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3155 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3156 | SymbolRef Sym = |
| 3157 | state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3158 | if (!Sym) |
| 3159 | return; |
| 3160 | |
| 3161 | // Get the reference count binding (if any). |
| 3162 | const RefVal *T = state->get<RefBindings>(Sym); |
| 3163 | if (!T) |
| 3164 | return; |
| 3165 | |
| 3166 | // Change the reference count. |
| 3167 | RefVal X = *T; |
| 3168 | |
| 3169 | switch (X.getKind()) { |
| 3170 | case RefVal::Owned: { |
| 3171 | unsigned cnt = X.getCount(); |
| 3172 | assert(cnt > 0); |
| 3173 | X.setCount(cnt - 1); |
| 3174 | X = X ^ RefVal::ReturnedOwned; |
| 3175 | break; |
| 3176 | } |
| 3177 | |
| 3178 | case RefVal::NotOwned: { |
| 3179 | unsigned cnt = X.getCount(); |
| 3180 | if (cnt) { |
| 3181 | X.setCount(cnt - 1); |
| 3182 | X = X ^ RefVal::ReturnedOwned; |
| 3183 | } |
| 3184 | else { |
| 3185 | X = X ^ RefVal::ReturnedNotOwned; |
| 3186 | } |
| 3187 | break; |
| 3188 | } |
| 3189 | |
| 3190 | default: |
| 3191 | return; |
| 3192 | } |
| 3193 | |
| 3194 | // Update the binding. |
| 3195 | state = state->set<RefBindings>(Sym, X); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3196 | ExplodedNode *Pred = C.addTransition(state); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3197 | |
| 3198 | // At this point we have updated the state properly. |
| 3199 | // Everything after this is merely checking to see if the return value has |
| 3200 | // been over- or under-retained. |
| 3201 | |
| 3202 | // Did we cache out? |
| 3203 | if (!Pred) |
| 3204 | return; |
| 3205 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3206 | // Update the autorelease counts. |
| 3207 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3208 | AutoreleaseTag("RetainCountChecker : Autorelease"); |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3209 | GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3210 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3211 | |
| 3212 | // Did we cache out? |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3213 | if (!Pred) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3214 | return; |
| 3215 | |
| 3216 | // Get the updated binding. |
| 3217 | T = state->get<RefBindings>(Sym); |
| 3218 | assert(T); |
| 3219 | X = *T; |
| 3220 | |
| 3221 | // Consult the summary of the enclosing method. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3222 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3223 | const Decl *CD = &Pred->getCodeDecl(); |
| 3224 | |
| 3225 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) { |
| 3226 | // Unlike regular functions, /all/ ObjC methods are assumed to always |
| 3227 | // follow Cocoa retain-count conventions, not just those with special |
| 3228 | // names or attributes. |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3229 | const RetainSummary *Summ = Summaries.getMethodSummary(MD); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3230 | RetEffect RE = Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet(); |
| 3231 | checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state); |
| 3232 | } |
| 3233 | |
| 3234 | if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) { |
| 3235 | if (!isa<CXXMethodDecl>(FD)) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3236 | if (const RetainSummary *Summ = Summaries.getSummary(FD)) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3237 | checkReturnWithRetEffect(S, C, Pred, Summ->getRetEffect(), X, |
| 3238 | Sym, state); |
| 3239 | } |
| 3240 | } |
| 3241 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3242 | void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S, |
| 3243 | CheckerContext &C, |
| 3244 | ExplodedNode *Pred, |
| 3245 | RetEffect RE, RefVal X, |
| 3246 | SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3247 | ProgramStateRef state) const { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3248 | // Any leaks or other errors? |
| 3249 | if (X.isReturnedOwned() && X.getCount() == 0) { |
| 3250 | if (RE.getKind() != RetEffect::NoRet) { |
| 3251 | bool hasError = false; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3252 | if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3253 | // Things are more complicated with garbage collection. If the |
| 3254 | // returned object is suppose to be an Objective-C object, we have |
| 3255 | // a leak (as the caller expects a GC'ed object) because no |
| 3256 | // method should return ownership unless it returns a CF object. |
| 3257 | hasError = true; |
| 3258 | X = X ^ RefVal::ErrorGCLeakReturned; |
| 3259 | } |
| 3260 | else if (!RE.isOwned()) { |
| 3261 | // Either we are using GC and the returned object is a CF type |
| 3262 | // or we aren't using GC. In either case, we expect that the |
| 3263 | // enclosing method is expected to return ownership. |
| 3264 | hasError = true; |
| 3265 | X = X ^ RefVal::ErrorLeakReturned; |
| 3266 | } |
| 3267 | |
| 3268 | if (hasError) { |
| 3269 | // Generate an error node. |
| 3270 | state = state->set<RefBindings>(Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3271 | |
| 3272 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3273 | ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3274 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3275 | if (N) { |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3276 | const LangOptions &LOpts = C.getASTContext().getLangOpts(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3277 | bool GCEnabled = C.isObjCGCEnabled(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3278 | CFRefReport *report = |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3279 | new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled), |
| 3280 | LOpts, GCEnabled, SummaryLog, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3281 | N, Sym, C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3282 | C.EmitReport(report); |
| 3283 | } |
| 3284 | } |
| 3285 | } |
| 3286 | } else if (X.isReturnedNotOwned()) { |
| 3287 | if (RE.isOwned()) { |
| 3288 | // Trying to return a not owned object to a caller expecting an |
| 3289 | // owned object. |
| 3290 | state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3291 | |
| 3292 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3293 | ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3294 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3295 | if (N) { |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3296 | if (!returnNotOwnedForOwned) |
| 3297 | returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned()); |
| 3298 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3299 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3300 | new CFRefReport(*returnNotOwnedForOwned, |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3301 | C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3302 | C.isObjCGCEnabled(), SummaryLog, N, Sym); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3303 | C.EmitReport(report); |
| 3304 | } |
| 3305 | } |
| 3306 | } |
| 3307 | } |
| 3308 | |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3309 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3310 | // Check various ways a symbol can be invalidated. |
| 3311 | //===----------------------------------------------------------------------===// |
| 3312 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 3313 | void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3314 | CheckerContext &C) const { |
| 3315 | // Are we storing to something that causes the value to "escape"? |
| 3316 | bool escapes = true; |
| 3317 | |
| 3318 | // A value escapes in three possible cases (this may change): |
| 3319 | // |
| 3320 | // (1) we are binding to something that is not a memory region. |
| 3321 | // (2) we are binding to a memregion that does not have stack storage |
| 3322 | // (3) we are binding to a memregion with stack storage that the store |
| 3323 | // does not understand. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3324 | ProgramStateRef state = C.getState(); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3325 | |
| 3326 | if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { |
| 3327 | escapes = !regionLoc->getRegion()->hasStackStorage(); |
| 3328 | |
| 3329 | if (!escapes) { |
| 3330 | // To test (3), generate a new state with the binding added. If it is |
| 3331 | // the same state, then it escapes (since the store cannot represent |
| 3332 | // the binding). |
| 3333 | escapes = (state == (state->bindLoc(*regionLoc, val))); |
| 3334 | } |
| 3335 | } |
| 3336 | |
| 3337 | // If our store can represent the binding and we aren't storing to something |
| 3338 | // that doesn't have local storage then just return and have the simulation |
| 3339 | // state continue as is. |
| 3340 | if (!escapes) |
| 3341 | return; |
| 3342 | |
| 3343 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 3344 | // and stop tracking them. |
| 3345 | state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3346 | C.addTransition(state); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3347 | } |
| 3348 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3349 | ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3350 | SVal Cond, |
| 3351 | bool Assumption) const { |
| 3352 | |
| 3353 | // FIXME: We may add to the interface of evalAssume the list of symbols |
| 3354 | // whose assumptions have changed. For now we just iterate through the |
| 3355 | // bindings and check if any of the tracked symbols are NULL. This isn't |
| 3356 | // too bad since the number of symbols we will track in practice are |
| 3357 | // probably small and evalAssume is only called at branches and a few |
| 3358 | // other places. |
| 3359 | RefBindings B = state->get<RefBindings>(); |
| 3360 | |
| 3361 | if (B.isEmpty()) |
| 3362 | return state; |
| 3363 | |
| 3364 | bool changed = false; |
| 3365 | RefBindings::Factory &RefBFactory = state->get_context<RefBindings>(); |
| 3366 | |
| 3367 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3368 | // Check if the symbol is null (or equal to any constant). |
| 3369 | // If this is the case, stop tracking the symbol. |
| 3370 | if (state->getSymVal(I.getKey())) { |
| 3371 | changed = true; |
| 3372 | B = RefBFactory.remove(B, I.getKey()); |
| 3373 | } |
| 3374 | } |
| 3375 | |
| 3376 | if (changed) |
| 3377 | state = state->set<RefBindings>(B); |
| 3378 | |
| 3379 | return state; |
| 3380 | } |
| 3381 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3382 | ProgramStateRef |
| 3383 | RetainCountChecker::checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3384 | const StoreManager::InvalidatedSymbols *invalidated, |
| 3385 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 3386 | ArrayRef<const MemRegion *> Regions, |
| 3387 | const CallOrObjCMessage *Call) const { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3388 | if (!invalidated) |
| 3389 | return state; |
| 3390 | |
| 3391 | llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; |
| 3392 | for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), |
| 3393 | E = ExplicitRegions.end(); I != E; ++I) { |
| 3394 | if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>()) |
| 3395 | WhitelistedSymbols.insert(SR->getSymbol()); |
| 3396 | } |
| 3397 | |
| 3398 | for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), |
| 3399 | E = invalidated->end(); I!=E; ++I) { |
| 3400 | SymbolRef sym = *I; |
| 3401 | if (WhitelistedSymbols.count(sym)) |
| 3402 | continue; |
| 3403 | // Remove any existing reference-count binding. |
| 3404 | state = state->remove<RefBindings>(sym); |
| 3405 | } |
| 3406 | return state; |
| 3407 | } |
| 3408 | |
| 3409 | //===----------------------------------------------------------------------===// |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3410 | // Handle dead symbols and end-of-path. |
| 3411 | //===----------------------------------------------------------------------===// |
| 3412 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3413 | std::pair<ExplodedNode *, ProgramStateRef > |
| 3414 | RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3415 | GenericNodeBuilderRefCount Bd, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3416 | ExplodedNode *Pred, |
| 3417 | CheckerContext &Ctx, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3418 | SymbolRef Sym, RefVal V) const { |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3419 | unsigned ACnt = V.getAutoreleaseCount(); |
| 3420 | |
| 3421 | // No autorelease counts? Nothing to be done. |
| 3422 | if (!ACnt) |
| 3423 | return std::make_pair(Pred, state); |
| 3424 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3425 | assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?"); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3426 | unsigned Cnt = V.getCount(); |
| 3427 | |
| 3428 | // FIXME: Handle sending 'autorelease' to already released object. |
| 3429 | |
| 3430 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3431 | ++Cnt; |
| 3432 | |
| 3433 | if (ACnt <= Cnt) { |
| 3434 | if (ACnt == Cnt) { |
| 3435 | V.clearCounts(); |
| 3436 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3437 | V = V ^ RefVal::ReturnedNotOwned; |
| 3438 | else |
| 3439 | V = V ^ RefVal::NotOwned; |
| 3440 | } else { |
| 3441 | V.setCount(Cnt - ACnt); |
| 3442 | V.setAutoreleaseCount(0); |
| 3443 | } |
| 3444 | state = state->set<RefBindings>(Sym, V); |
| 3445 | ExplodedNode *N = Bd.MakeNode(state, Pred); |
| 3446 | if (N == 0) |
| 3447 | state = 0; |
| 3448 | return std::make_pair(N, state); |
| 3449 | } |
| 3450 | |
| 3451 | // Woah! More autorelease counts then retain counts left. |
| 3452 | // Emit hard error. |
| 3453 | V = V ^ RefVal::ErrorOverAutorelease; |
| 3454 | state = state->set<RefBindings>(Sym, V); |
| 3455 | |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 3456 | if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3457 | SmallString<128> sbuf; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3458 | llvm::raw_svector_ostream os(sbuf); |
| 3459 | os << "Object over-autoreleased: object was sent -autorelease "; |
| 3460 | if (V.getAutoreleaseCount() > 1) |
| 3461 | os << V.getAutoreleaseCount() << " times "; |
| 3462 | os << "but the object has a +" << V.getCount() << " retain count"; |
| 3463 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3464 | if (!overAutorelease) |
| 3465 | overAutorelease.reset(new OverAutorelease()); |
| 3466 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3467 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3468 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3469 | new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false, |
| 3470 | SummaryLog, N, Sym, os.str()); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3471 | Ctx.EmitReport(report); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3472 | } |
| 3473 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3474 | return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3475 | } |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3476 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3477 | ProgramStateRef |
| 3478 | RetainCountChecker::handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3479 | SymbolRef sid, RefVal V, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3480 | SmallVectorImpl<SymbolRef> &Leaked) const { |
Jordy Rose | 5337612 | 2011-08-24 04:48:19 +0000 | [diff] [blame] | 3481 | bool hasLeak = false; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3482 | if (V.isOwned()) |
| 3483 | hasLeak = true; |
| 3484 | else if (V.isNotOwned() || V.isReturnedOwned()) |
| 3485 | hasLeak = (V.getCount() > 0); |
| 3486 | |
| 3487 | if (!hasLeak) |
| 3488 | return state->remove<RefBindings>(sid); |
| 3489 | |
| 3490 | Leaked.push_back(sid); |
| 3491 | return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak); |
| 3492 | } |
| 3493 | |
| 3494 | ExplodedNode * |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3495 | RetainCountChecker::processLeaks(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3496 | SmallVectorImpl<SymbolRef> &Leaked, |
| 3497 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3498 | CheckerContext &Ctx, |
| 3499 | ExplodedNode *Pred) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3500 | if (Leaked.empty()) |
| 3501 | return Pred; |
| 3502 | |
| 3503 | // Generate an intermediate node representing the leak point. |
| 3504 | ExplodedNode *N = Builder.MakeNode(state, Pred); |
| 3505 | |
| 3506 | if (N) { |
| 3507 | for (SmallVectorImpl<SymbolRef>::iterator |
| 3508 | I = Leaked.begin(), E = Leaked.end(); I != E; ++I) { |
| 3509 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3510 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3511 | bool GCEnabled = Ctx.isObjCGCEnabled(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3512 | CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled) |
| 3513 | : getLeakAtReturnBug(LOpts, GCEnabled); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3514 | assert(BT && "BugType not initialized."); |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 3515 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3516 | CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3517 | SummaryLog, N, *I, Ctx); |
| 3518 | Ctx.EmitReport(report); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3519 | } |
| 3520 | } |
| 3521 | |
| 3522 | return N; |
| 3523 | } |
| 3524 | |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3525 | void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3526 | ProgramStateRef state = Ctx.getState(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3527 | GenericNodeBuilderRefCount Bd(Ctx); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3528 | RefBindings B = state->get<RefBindings>(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3529 | ExplodedNode *Pred = Ctx.getPredecessor(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3530 | |
| 3531 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3532 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3533 | I->first, I->second); |
| 3534 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3535 | return; |
| 3536 | } |
| 3537 | |
Ted Kremenek | 0cf3d47 | 2012-02-07 00:24:33 +0000 | [diff] [blame] | 3538 | // If the current LocationContext has a parent, don't check for leaks. |
| 3539 | // We will do that later. |
| 3540 | // FIXME: we should instead check for imblances of the retain/releases, |
| 3541 | // and suggest annotations. |
| 3542 | if (Ctx.getLocationContext()->getParent()) |
| 3543 | return; |
| 3544 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3545 | B = state->get<RefBindings>(); |
| 3546 | SmallVector<SymbolRef, 10> Leaked; |
| 3547 | |
| 3548 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3549 | state = handleSymbolDeath(state, I->first, I->second, Leaked); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3550 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3551 | processLeaks(state, Leaked, Bd, Ctx, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3552 | } |
| 3553 | |
| 3554 | const ProgramPointTag * |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3555 | RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3556 | const SimpleProgramPointTag *&tag = DeadSymbolTags[sym]; |
| 3557 | if (!tag) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3558 | SmallString<64> buf; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3559 | llvm::raw_svector_ostream out(buf); |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3560 | out << "RetainCountChecker : Dead Symbol : "; |
| 3561 | sym->dumpToStream(out); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3562 | tag = new SimpleProgramPointTag(out.str()); |
| 3563 | } |
| 3564 | return tag; |
| 3565 | } |
| 3566 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3567 | void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 3568 | CheckerContext &C) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3569 | ExplodedNode *Pred = C.getPredecessor(); |
| 3570 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3571 | ProgramStateRef state = C.getState(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3572 | RefBindings B = state->get<RefBindings>(); |
| 3573 | |
| 3574 | // Update counts from autorelease pools |
| 3575 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3576 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3577 | SymbolRef Sym = *I; |
| 3578 | if (const RefVal *T = B.lookup(Sym)){ |
| 3579 | // Use the symbol as the tag. |
| 3580 | // FIXME: This might not be as unique as we would like. |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3581 | GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym)); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3582 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3583 | Sym, *T); |
| 3584 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3585 | return; |
| 3586 | } |
| 3587 | } |
| 3588 | |
| 3589 | B = state->get<RefBindings>(); |
| 3590 | SmallVector<SymbolRef, 10> Leaked; |
| 3591 | |
| 3592 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3593 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3594 | if (const RefVal *T = B.lookup(*I)) |
| 3595 | state = handleSymbolDeath(state, *I, *T, Leaked); |
| 3596 | } |
| 3597 | |
| 3598 | { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3599 | GenericNodeBuilderRefCount Bd(C, this); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3600 | Pred = processLeaks(state, Leaked, Bd, C, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3601 | } |
| 3602 | |
| 3603 | // Did we cache out? |
| 3604 | if (!Pred) |
| 3605 | return; |
| 3606 | |
| 3607 | // Now generate a new node that nukes the old bindings. |
| 3608 | RefBindings::Factory &F = state->get_context<RefBindings>(); |
| 3609 | |
| 3610 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3611 | E = SymReaper.dead_end(); I != E; ++I) |
| 3612 | B = F.remove(B, *I); |
| 3613 | |
| 3614 | state = state->set<RefBindings>(B); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3615 | C.addTransition(state, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3616 | } |
| 3617 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3618 | //===----------------------------------------------------------------------===// |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3619 | // Debug printing of refcount bindings and autorelease pools. |
| 3620 | //===----------------------------------------------------------------------===// |
| 3621 | |
| 3622 | static void PrintPool(raw_ostream &Out, SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3623 | ProgramStateRef State) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3624 | Out << ' '; |
| 3625 | if (Sym) |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3626 | Sym->dumpToStream(Out); |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3627 | else |
| 3628 | Out << "<pool>"; |
| 3629 | Out << ":{"; |
| 3630 | |
| 3631 | // Get the contents of the pool. |
| 3632 | if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym)) |
| 3633 | for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I) |
| 3634 | Out << '(' << I.getKey() << ',' << I.getData() << ')'; |
| 3635 | |
| 3636 | Out << '}'; |
| 3637 | } |
| 3638 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3639 | static bool UsesAutorelease(ProgramStateRef state) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3640 | // A state uses autorelease if it allocated an autorelease pool or if it has |
| 3641 | // objects in the caller's autorelease pool. |
| 3642 | return !state->get<AutoreleaseStack>().isEmpty() || |
| 3643 | state->get<AutoreleasePoolContents>(SymbolRef()); |
| 3644 | } |
| 3645 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3646 | void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3647 | const char *NL, const char *Sep) const { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3648 | |
| 3649 | RefBindings B = State->get<RefBindings>(); |
| 3650 | |
| 3651 | if (!B.isEmpty()) |
| 3652 | Out << Sep << NL; |
| 3653 | |
| 3654 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3655 | Out << I->first << " : "; |
| 3656 | I->second.print(Out); |
| 3657 | Out << NL; |
| 3658 | } |
| 3659 | |
| 3660 | // Print the autorelease stack. |
| 3661 | if (UsesAutorelease(State)) { |
| 3662 | Out << Sep << NL << "AR pool stack:"; |
| 3663 | ARStack Stack = State->get<AutoreleaseStack>(); |
| 3664 | |
| 3665 | PrintPool(Out, SymbolRef(), State); // Print the caller's pool. |
| 3666 | for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I) |
| 3667 | PrintPool(Out, *I, State); |
| 3668 | |
| 3669 | Out << NL; |
| 3670 | } |
| 3671 | } |
| 3672 | |
| 3673 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3674 | // Checker registration. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3675 | //===----------------------------------------------------------------------===// |
| 3676 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3677 | void ento::registerRetainCountChecker(CheckerManager &Mgr) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3678 | Mgr.registerChecker<RetainCountChecker>(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3679 | } |
| 3680 | |