Chris Lattner | bda0b62 | 2008-03-15 23:59:48 +0000 | [diff] [blame] | 1 | // CFRefCount.cpp - Transfer functions for tracking simple values -*- C++ -*--// |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Gabor Greif | 843e934 | 2008-03-06 10:40:09 +0000 | [diff] [blame] | 10 | // This file defines the methods for CFRefCount, which implements |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 11 | // a reference count checker for Core Foundation (Mac OS X). |
| 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Ted Kremenek | 072192b | 2008-04-30 23:47:44 +0000 | [diff] [blame] | 15 | #include "clang/Basic/LangOptions.h" |
Ted Kremenek | c9fa2f7 | 2008-05-01 23:13:35 +0000 | [diff] [blame] | 16 | #include "clang/Basic/SourceManager.h" |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 17 | #include "clang/Analysis/PathSensitive/GRExprEngineBuilders.h" |
Ted Kremenek | b9d17f9 | 2008-08-17 03:20:02 +0000 | [diff] [blame] | 18 | #include "clang/Analysis/PathSensitive/GRStateTrait.h" |
Ted Kremenek | 4dc41cc | 2008-03-31 18:26:32 +0000 | [diff] [blame] | 19 | #include "clang/Analysis/PathDiagnostic.h" |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/LocalCheckers.h" |
Ted Kremenek | fa34b33 | 2008-04-09 01:10:13 +0000 | [diff] [blame] | 21 | #include "clang/Analysis/PathDiagnostic.h" |
| 22 | #include "clang/Analysis/PathSensitive/BugReporter.h" |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 23 | #include "clang/Analysis/PathSensitive/SymbolManager.h" |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 24 | #include "clang/Analysis/PathSensitive/GRTransferFuncs.h" |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 25 | #include "clang/Analysis/PathSensitive/CheckerVisitor.h" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 26 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 27 | #include "clang/AST/StmtVisitor.h" |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 28 | #include "llvm/ADT/DenseMap.h" |
| 29 | #include "llvm/ADT/FoldingSet.h" |
| 30 | #include "llvm/ADT/ImmutableMap.h" |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 31 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 900a2d7 | 2008-05-07 18:36:45 +0000 | [diff] [blame] | 32 | #include "llvm/ADT/StringExtras.h" |
Ted Kremenek | 6ed9afc | 2008-05-16 18:33:44 +0000 | [diff] [blame] | 33 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 9853045 | 2008-08-12 20:41:56 +0000 | [diff] [blame] | 34 | #include <stdarg.h> |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 35 | |
| 36 | using namespace clang; |
Ted Kremenek | 5c74d50 | 2008-10-24 21:18:08 +0000 | [diff] [blame] | 37 | |
| 38 | //===----------------------------------------------------------------------===// |
| 39 | // Utility functions. |
| 40 | //===----------------------------------------------------------------------===// |
| 41 | |
Ted Kremenek | 5c74d50 | 2008-10-24 21:18:08 +0000 | [diff] [blame] | 42 | // The "fundamental rule" for naming conventions of methods: |
| 43 | // (url broken into two lines) |
| 44 | // http://developer.apple.com/documentation/Cocoa/Conceptual/ |
| 45 | // MemoryMgmt/Tasks/MemoryManagementRules.html |
| 46 | // |
| 47 | // "You take ownership of an object if you create it using a method whose name |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 48 | // begins with "alloc" or "new" or contains "copy" (for example, alloc, |
Ted Kremenek | 5c74d50 | 2008-10-24 21:18:08 +0000 | [diff] [blame] | 49 | // newObject, or mutableCopy), or if you send it a retain message. You are |
| 50 | // responsible for relinquishing ownership of objects you own using release |
| 51 | // or autorelease. Any other time you receive an object, you must |
| 52 | // not release it." |
| 53 | // |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 54 | |
| 55 | using llvm::CStrInCStrNoCase; |
Ted Kremenek | 39868cd | 2009-02-21 18:26:02 +0000 | [diff] [blame] | 56 | using llvm::StringsEqualNoCase; |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 57 | |
| 58 | enum NamingConvention { NoConvention, CreateRule, InitRule }; |
| 59 | |
| 60 | static inline bool isWordEnd(char ch, char prev, char next) { |
| 61 | return ch == '\0' |
| 62 | || (islower(prev) && isupper(ch)) // xxxC |
| 63 | || (isupper(prev) && isupper(ch) && islower(next)) // XXCreate |
| 64 | || !isalpha(ch); |
| 65 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 66 | |
| 67 | static inline const char* parseWord(const char* s) { |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 68 | char ch = *s, prev = '\0'; |
| 69 | assert(ch != '\0'); |
| 70 | char next = *(s+1); |
| 71 | while (!isWordEnd(ch, prev, next)) { |
| 72 | prev = ch; |
| 73 | ch = next; |
| 74 | next = *((++s)+1); |
| 75 | } |
| 76 | return s; |
| 77 | } |
| 78 | |
Ted Kremenek | 7db1604 | 2009-05-15 15:49:00 +0000 | [diff] [blame] | 79 | static NamingConvention deriveNamingConvention(Selector S) { |
| 80 | IdentifierInfo *II = S.getIdentifierInfoForSlot(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 81 | |
Ted Kremenek | 7db1604 | 2009-05-15 15:49:00 +0000 | [diff] [blame] | 82 | if (!II) |
| 83 | return NoConvention; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 84 | |
Daniel Dunbar | 3c2292e | 2009-10-17 18:12:45 +0000 | [diff] [blame] | 85 | const char *s = II->getNameStart(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 86 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 87 | // A method/function name may contain a prefix. We don't know it is there, |
| 88 | // however, until we encounter the first '_'. |
| 89 | bool InPossiblePrefix = true; |
| 90 | bool AtBeginning = true; |
| 91 | NamingConvention C = NoConvention; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 92 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 93 | while (*s != '\0') { |
| 94 | // Skip '_'. |
| 95 | if (*s == '_') { |
| 96 | if (InPossiblePrefix) { |
Ted Kremenek | e973183 | 2009-10-20 00:13:00 +0000 | [diff] [blame] | 97 | // If we already have a convention, return it. Otherwise, skip |
| 98 | // the prefix as if it wasn't there. |
| 99 | if (C != NoConvention) |
| 100 | break; |
| 101 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 102 | InPossiblePrefix = false; |
| 103 | AtBeginning = true; |
Ted Kremenek | e973183 | 2009-10-20 00:13:00 +0000 | [diff] [blame] | 104 | assert(C == NoConvention); |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 105 | } |
| 106 | ++s; |
| 107 | continue; |
| 108 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 109 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 110 | // Skip numbers, ':', etc. |
| 111 | if (!isalpha(*s)) { |
| 112 | ++s; |
| 113 | continue; |
| 114 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 115 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 116 | const char *wordEnd = parseWord(s); |
| 117 | assert(wordEnd > s); |
| 118 | unsigned len = wordEnd - s; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 120 | switch (len) { |
| 121 | default: |
| 122 | break; |
| 123 | case 3: |
| 124 | // Methods starting with 'new' follow the create rule. |
Ted Kremenek | 39868cd | 2009-02-21 18:26:02 +0000 | [diff] [blame] | 125 | if (AtBeginning && StringsEqualNoCase("new", s, len)) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 126 | C = CreateRule; |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 127 | break; |
| 128 | case 4: |
| 129 | // Methods starting with 'alloc' or contain 'copy' follow the |
| 130 | // create rule |
Ted Kremenek | 8be2a67 | 2009-03-13 20:27:06 +0000 | [diff] [blame] | 131 | if (C == NoConvention && StringsEqualNoCase("copy", s, len)) |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 132 | C = CreateRule; |
| 133 | else // Methods starting with 'init' follow the init rule. |
Ted Kremenek | 39868cd | 2009-02-21 18:26:02 +0000 | [diff] [blame] | 134 | if (AtBeginning && StringsEqualNoCase("init", s, len)) |
Ted Kremenek | 8be2a67 | 2009-03-13 20:27:06 +0000 | [diff] [blame] | 135 | C = InitRule; |
| 136 | break; |
| 137 | case 5: |
| 138 | if (AtBeginning && StringsEqualNoCase("alloc", s, len)) |
| 139 | C = CreateRule; |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 140 | break; |
| 141 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 142 | |
Ted Kremenek | b80976c | 2009-02-21 05:13:43 +0000 | [diff] [blame] | 143 | // If we aren't in the prefix and have a derived convention then just |
| 144 | // return it now. |
| 145 | if (!InPossiblePrefix && C != NoConvention) |
| 146 | return C; |
| 147 | |
| 148 | AtBeginning = false; |
| 149 | s = wordEnd; |
| 150 | } |
| 151 | |
| 152 | // We will get here if there wasn't more than one word |
| 153 | // after the prefix. |
| 154 | return C; |
| 155 | } |
| 156 | |
Ted Kremenek | 7db1604 | 2009-05-15 15:49:00 +0000 | [diff] [blame] | 157 | static bool followsFundamentalRule(Selector S) { |
| 158 | return deriveNamingConvention(S) == CreateRule; |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 159 | } |
| 160 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 161 | static const ObjCMethodDecl* |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 162 | ResolveToInterfaceMethodDecl(const ObjCMethodDecl *MD) { |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 163 | ObjCInterfaceDecl *ID = |
| 164 | const_cast<ObjCInterfaceDecl*>(MD->getClassInterface()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 165 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 166 | return MD->isInstanceMethod() |
Argyrios Kyrtzidis | 17945a0 | 2009-06-30 02:36:12 +0000 | [diff] [blame] | 167 | ? ID->lookupInstanceMethod(MD->getSelector()) |
| 168 | : ID->lookupClassMethod(MD->getSelector()); |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 169 | } |
Ted Kremenek | 5c74d50 | 2008-10-24 21:18:08 +0000 | [diff] [blame] | 170 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 171 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 172 | class GenericNodeBuilder { |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 173 | GRStmtNodeBuilder *SNB; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 174 | Stmt *S; |
| 175 | const void *tag; |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 176 | GREndPathNodeBuilder *ENB; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 177 | public: |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 178 | GenericNodeBuilder(GRStmtNodeBuilder &snb, Stmt *s, |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 179 | const void *t) |
| 180 | : SNB(&snb), S(s), tag(t), ENB(0) {} |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 181 | |
| 182 | GenericNodeBuilder(GREndPathNodeBuilder &enb) |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 183 | : SNB(0), S(0), tag(0), ENB(&enb) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 184 | |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 185 | ExplodedNode *MakeNode(const GRState *state, ExplodedNode *Pred) { |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 186 | if (SNB) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 187 | return SNB->generateNode(PostStmt(S, Pred->getLocationContext(), tag), |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 188 | state, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 189 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 190 | assert(ENB); |
Ted Kremenek | 80c2418 | 2009-05-09 00:44:07 +0000 | [diff] [blame] | 191 | return ENB->generateNode(state, Pred); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 192 | } |
| 193 | }; |
| 194 | } // end anonymous namespace |
| 195 | |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 196 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 197 | // Type querying functions. |
| 198 | //===----------------------------------------------------------------------===// |
| 199 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 200 | static bool isRefType(QualType RetTy, const char* prefix, |
| 201 | ASTContext* Ctx = 0, const char* name = 0) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 202 | |
Ted Kremenek | 6738b73 | 2009-05-12 04:53:03 +0000 | [diff] [blame] | 203 | // Recursively walk the typedef stack, allowing typedefs of reference types. |
Daniel Dunbar | 8fff5f7 | 2009-10-17 18:12:53 +0000 | [diff] [blame] | 204 | while (TypedefType* TD = dyn_cast<TypedefType>(RetTy.getTypePtr())) { |
Daniel Dunbar | 01eb9b9 | 2009-10-18 21:17:35 +0000 | [diff] [blame] | 205 | llvm::StringRef TDName = TD->getDecl()->getIdentifier()->getName(); |
Daniel Dunbar | 8fff5f7 | 2009-10-17 18:12:53 +0000 | [diff] [blame] | 206 | if (TDName.startswith(prefix) && TDName.endswith("Ref")) |
| 207 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 208 | |
Daniel Dunbar | 8fff5f7 | 2009-10-17 18:12:53 +0000 | [diff] [blame] | 209 | RetTy = TD->getDecl()->getUnderlyingType(); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 210 | } |
| 211 | |
| 212 | if (!Ctx || !name) |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 213 | return false; |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 214 | |
| 215 | // Is the type void*? |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 216 | const PointerType* PT = RetTy->getAs<PointerType>(); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 217 | if (!(PT->getPointeeType().getUnqualifiedType() == Ctx->VoidTy)) |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 218 | return false; |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 219 | |
| 220 | // Does the name start with the prefix? |
Daniel Dunbar | 3c2292e | 2009-10-17 18:12:45 +0000 | [diff] [blame] | 221 | return llvm::StringRef(name).startswith(prefix); |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 222 | } |
| 223 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 224 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 225 | // Primitives used for constructing summaries for function/method calls. |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 226 | //===----------------------------------------------------------------------===// |
| 227 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 228 | /// ArgEffect is used to summarize a function/method call's effect on a |
| 229 | /// particular argument. |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 230 | enum ArgEffect { Autorelease, Dealloc, DecRef, DecRefMsg, DoNothing, |
| 231 | DoNothingByRef, IncRefMsg, IncRef, MakeCollectable, MayEscape, |
| 232 | NewAutoreleasePool, SelfOwn, StopTracking }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 234 | namespace llvm { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 235 | template <> struct FoldingSetTrait<ArgEffect> { |
| 236 | static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) { |
| 237 | ID.AddInteger((unsigned) X); |
| 238 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 239 | }; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 240 | } // end llvm namespace |
| 241 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 242 | /// ArgEffects summarizes the effects of a function/method call on all of |
| 243 | /// its arguments. |
| 244 | typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects; |
| 245 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 246 | namespace { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 247 | |
| 248 | /// RetEffect is used to summarize a function/method call's behavior with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 249 | /// respect to its return value. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 250 | class RetEffect { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 251 | public: |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 252 | enum Kind { NoRet, Alias, OwnedSymbol, OwnedAllocatedSymbol, |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 253 | NotOwnedSymbol, GCNotOwnedSymbol, ReceiverAlias, |
| 254 | OwnedWhenTrackedReceiver }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 255 | |
| 256 | enum ObjKind { CF, ObjC, AnyObj }; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 257 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 258 | private: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 259 | Kind K; |
| 260 | ObjKind O; |
| 261 | unsigned index; |
| 262 | |
| 263 | RetEffect(Kind k, unsigned idx = 0) : K(k), O(AnyObj), index(idx) {} |
| 264 | RetEffect(Kind k, ObjKind o) : K(k), O(o), index(0) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 265 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 266 | public: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 267 | Kind getKind() const { return K; } |
| 268 | |
| 269 | ObjKind getObjKind() const { return O; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 270 | |
| 271 | unsigned getIndex() const { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 272 | assert(getKind() == Alias); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 273 | return index; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 274 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 275 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 276 | bool isOwned() const { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 277 | return K == OwnedSymbol || K == OwnedAllocatedSymbol || |
| 278 | K == OwnedWhenTrackedReceiver; |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 279 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 280 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 281 | static RetEffect MakeOwnedWhenTrackedReceiver() { |
| 282 | return RetEffect(OwnedWhenTrackedReceiver, ObjC); |
| 283 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 284 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 285 | static RetEffect MakeAlias(unsigned Idx) { |
| 286 | return RetEffect(Alias, Idx); |
| 287 | } |
| 288 | static RetEffect MakeReceiverAlias() { |
| 289 | return RetEffect(ReceiverAlias); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 290 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 291 | static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) { |
| 292 | return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 293 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 294 | static RetEffect MakeNotOwned(ObjKind o) { |
| 295 | return RetEffect(NotOwnedSymbol, o); |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 296 | } |
| 297 | static RetEffect MakeGCNotOwned() { |
| 298 | return RetEffect(GCNotOwnedSymbol, ObjC); |
| 299 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 300 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 301 | static RetEffect MakeNoRet() { |
| 302 | return RetEffect(NoRet); |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 303 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 304 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 305 | void Profile(llvm::FoldingSetNodeID& ID) const { |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 306 | ID.AddInteger((unsigned)K); |
| 307 | ID.AddInteger((unsigned)O); |
| 308 | ID.AddInteger(index); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 309 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 310 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 311 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 312 | //===----------------------------------------------------------------------===// |
| 313 | // Reference-counting logic (typestate + counts). |
| 314 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 315 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 316 | class RefVal { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 317 | public: |
| 318 | enum Kind { |
| 319 | Owned = 0, // Owning reference. |
| 320 | NotOwned, // Reference is not owned by still valid (not freed). |
| 321 | Released, // Object has been released. |
| 322 | ReturnedOwned, // Returned object passes ownership to caller. |
| 323 | ReturnedNotOwned, // Return object does not pass ownership to caller. |
| 324 | ERROR_START, |
| 325 | ErrorDeallocNotOwned, // -dealloc called on non-owned object. |
| 326 | ErrorDeallocGC, // Calling -dealloc with GC enabled. |
| 327 | ErrorUseAfterRelease, // Object used after released. |
| 328 | ErrorReleaseNotOwned, // Release of an object that was not owned. |
| 329 | ERROR_LEAK_START, |
| 330 | ErrorLeak, // A memory leak due to excessive reference counts. |
| 331 | ErrorLeakReturned, // A memory leak due to the returning method not having |
| 332 | // the correct naming conventions. |
| 333 | ErrorGCLeakReturned, |
| 334 | ErrorOverAutorelease, |
| 335 | ErrorReturnedNotOwned |
| 336 | }; |
| 337 | |
| 338 | private: |
| 339 | Kind kind; |
| 340 | RetEffect::ObjKind okind; |
| 341 | unsigned Cnt; |
| 342 | unsigned ACnt; |
| 343 | QualType T; |
| 344 | |
| 345 | RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t) |
| 346 | : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {} |
| 347 | |
| 348 | RefVal(Kind k, unsigned cnt = 0) |
| 349 | : kind(k), okind(RetEffect::AnyObj), Cnt(cnt), ACnt(0) {} |
| 350 | |
| 351 | public: |
| 352 | Kind getKind() const { return kind; } |
| 353 | |
| 354 | RetEffect::ObjKind getObjKind() const { return okind; } |
| 355 | |
| 356 | unsigned getCount() const { return Cnt; } |
| 357 | unsigned getAutoreleaseCount() const { return ACnt; } |
| 358 | unsigned getCombinedCounts() const { return Cnt + ACnt; } |
| 359 | void clearCounts() { Cnt = 0; ACnt = 0; } |
| 360 | void setCount(unsigned i) { Cnt = i; } |
| 361 | void setAutoreleaseCount(unsigned i) { ACnt = i; } |
| 362 | |
| 363 | QualType getType() const { return T; } |
| 364 | |
| 365 | // Useful predicates. |
| 366 | |
| 367 | static bool isError(Kind k) { return k >= ERROR_START; } |
| 368 | |
| 369 | static bool isLeak(Kind k) { return k >= ERROR_LEAK_START; } |
| 370 | |
| 371 | bool isOwned() const { |
| 372 | return getKind() == Owned; |
| 373 | } |
| 374 | |
| 375 | bool isNotOwned() const { |
| 376 | return getKind() == NotOwned; |
| 377 | } |
| 378 | |
| 379 | bool isReturnedOwned() const { |
| 380 | return getKind() == ReturnedOwned; |
| 381 | } |
| 382 | |
| 383 | bool isReturnedNotOwned() const { |
| 384 | return getKind() == ReturnedNotOwned; |
| 385 | } |
| 386 | |
| 387 | bool isNonLeakError() const { |
| 388 | Kind k = getKind(); |
| 389 | return isError(k) && !isLeak(k); |
| 390 | } |
| 391 | |
| 392 | static RefVal makeOwned(RetEffect::ObjKind o, QualType t, |
| 393 | unsigned Count = 1) { |
| 394 | return RefVal(Owned, o, Count, 0, t); |
| 395 | } |
| 396 | |
| 397 | static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t, |
| 398 | unsigned Count = 0) { |
| 399 | return RefVal(NotOwned, o, Count, 0, t); |
| 400 | } |
| 401 | |
| 402 | // Comparison, profiling, and pretty-printing. |
| 403 | |
| 404 | bool operator==(const RefVal& X) const { |
| 405 | return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt; |
| 406 | } |
| 407 | |
| 408 | RefVal operator-(size_t i) const { |
| 409 | return RefVal(getKind(), getObjKind(), getCount() - i, |
| 410 | getAutoreleaseCount(), getType()); |
| 411 | } |
| 412 | |
| 413 | RefVal operator+(size_t i) const { |
| 414 | return RefVal(getKind(), getObjKind(), getCount() + i, |
| 415 | getAutoreleaseCount(), getType()); |
| 416 | } |
| 417 | |
| 418 | RefVal operator^(Kind k) const { |
| 419 | return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(), |
| 420 | getType()); |
| 421 | } |
| 422 | |
| 423 | RefVal autorelease() const { |
| 424 | return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1, |
| 425 | getType()); |
| 426 | } |
| 427 | |
| 428 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 429 | ID.AddInteger((unsigned) kind); |
| 430 | ID.AddInteger(Cnt); |
| 431 | ID.AddInteger(ACnt); |
| 432 | ID.Add(T); |
| 433 | } |
| 434 | |
| 435 | void print(llvm::raw_ostream& Out) const; |
| 436 | }; |
| 437 | |
| 438 | void RefVal::print(llvm::raw_ostream& Out) const { |
| 439 | if (!T.isNull()) |
| 440 | Out << "Tracked Type:" << T.getAsString() << '\n'; |
| 441 | |
| 442 | switch (getKind()) { |
| 443 | default: assert(false); |
| 444 | case Owned: { |
| 445 | Out << "Owned"; |
| 446 | unsigned cnt = getCount(); |
| 447 | if (cnt) Out << " (+ " << cnt << ")"; |
| 448 | break; |
| 449 | } |
| 450 | |
| 451 | case NotOwned: { |
| 452 | Out << "NotOwned"; |
| 453 | unsigned cnt = getCount(); |
| 454 | if (cnt) Out << " (+ " << cnt << ")"; |
| 455 | break; |
| 456 | } |
| 457 | |
| 458 | case ReturnedOwned: { |
| 459 | Out << "ReturnedOwned"; |
| 460 | unsigned cnt = getCount(); |
| 461 | if (cnt) Out << " (+ " << cnt << ")"; |
| 462 | break; |
| 463 | } |
| 464 | |
| 465 | case ReturnedNotOwned: { |
| 466 | Out << "ReturnedNotOwned"; |
| 467 | unsigned cnt = getCount(); |
| 468 | if (cnt) Out << " (+ " << cnt << ")"; |
| 469 | break; |
| 470 | } |
| 471 | |
| 472 | case Released: |
| 473 | Out << "Released"; |
| 474 | break; |
| 475 | |
| 476 | case ErrorDeallocGC: |
| 477 | Out << "-dealloc (GC)"; |
| 478 | break; |
| 479 | |
| 480 | case ErrorDeallocNotOwned: |
| 481 | Out << "-dealloc (not-owned)"; |
| 482 | break; |
| 483 | |
| 484 | case ErrorLeak: |
| 485 | Out << "Leaked"; |
| 486 | break; |
| 487 | |
| 488 | case ErrorLeakReturned: |
| 489 | Out << "Leaked (Bad naming)"; |
| 490 | break; |
| 491 | |
| 492 | case ErrorGCLeakReturned: |
| 493 | Out << "Leaked (GC-ed at return)"; |
| 494 | break; |
| 495 | |
| 496 | case ErrorUseAfterRelease: |
| 497 | Out << "Use-After-Release [ERROR]"; |
| 498 | break; |
| 499 | |
| 500 | case ErrorReleaseNotOwned: |
| 501 | Out << "Release of Not-Owned [ERROR]"; |
| 502 | break; |
| 503 | |
| 504 | case RefVal::ErrorOverAutorelease: |
| 505 | Out << "Over autoreleased"; |
| 506 | break; |
| 507 | |
| 508 | case RefVal::ErrorReturnedNotOwned: |
| 509 | Out << "Non-owned object returned instead of owned"; |
| 510 | break; |
| 511 | } |
| 512 | |
| 513 | if (ACnt) { |
| 514 | Out << " [ARC +" << ACnt << ']'; |
| 515 | } |
| 516 | } |
| 517 | } //end anonymous namespace |
| 518 | |
| 519 | //===----------------------------------------------------------------------===// |
| 520 | // RefBindings - State used to track object reference counts. |
| 521 | //===----------------------------------------------------------------------===// |
| 522 | |
| 523 | typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 524 | |
| 525 | namespace clang { |
| 526 | template<> |
| 527 | struct GRStateTrait<RefBindings> : public GRStatePartialTrait<RefBindings> { |
Ted Kremenek | f0d8fff | 2009-11-13 01:58:01 +0000 | [diff] [blame] | 528 | static void* GDMIndex() { |
| 529 | static int RefBIndex = 0; |
| 530 | return &RefBIndex; |
| 531 | } |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 532 | }; |
| 533 | } |
| 534 | |
| 535 | //===----------------------------------------------------------------------===// |
| 536 | // Summaries |
| 537 | //===----------------------------------------------------------------------===// |
| 538 | |
| 539 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 540 | class RetainSummary { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 541 | /// Args - an ordered vector of (index, ArgEffect) pairs, where index |
| 542 | /// specifies the argument (starting from 0). This can be sparsely |
| 543 | /// populated; arguments with no entry in Args use 'DefaultArgEffect'. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 544 | ArgEffects Args; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 545 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 546 | /// DefaultArgEffect - The default ArgEffect to apply to arguments that |
| 547 | /// do not have an entry in Args. |
| 548 | ArgEffect DefaultArgEffect; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 549 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 550 | /// Receiver - If this summary applies to an Objective-C message expression, |
| 551 | /// this is the effect applied to the state of the receiver. |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 552 | ArgEffect Receiver; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 553 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 554 | /// Ret - The effect on the return value. Used to indicate if the |
| 555 | /// function/method call returns a new tracked symbol, returns an |
| 556 | /// alias of one of the arguments in the call, and so on. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 557 | RetEffect Ret; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 558 | |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 559 | /// EndPath - Indicates that execution of this method/function should |
| 560 | /// terminate the simulation of a path. |
| 561 | bool EndPath; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 562 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 563 | public: |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 564 | RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff, |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 565 | ArgEffect ReceiverEff, bool endpath = false) |
| 566 | : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 567 | EndPath(endpath) {} |
| 568 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 569 | /// getArg - Return the argument effect on the argument specified by |
| 570 | /// idx (starting from 0). |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 571 | ArgEffect getArg(unsigned idx) const { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 572 | if (const ArgEffect *AE = Args.lookup(idx)) |
| 573 | return *AE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 574 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 575 | return DefaultArgEffect; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 576 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 577 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 578 | /// setDefaultArgEffect - Set the default argument effect. |
| 579 | void setDefaultArgEffect(ArgEffect E) { |
| 580 | DefaultArgEffect = E; |
| 581 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 582 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 583 | /// setArg - Set the argument effect on the argument specified by idx. |
| 584 | void setArgEffect(ArgEffects::Factory& AF, unsigned idx, ArgEffect E) { |
| 585 | Args = AF.Add(Args, idx, E); |
| 586 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 587 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 588 | /// getRetEffect - Returns the effect on the return value of the call. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 589 | RetEffect getRetEffect() const { return Ret; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 590 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 591 | /// setRetEffect - Set the effect of the return value of the call. |
| 592 | void setRetEffect(RetEffect E) { Ret = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 593 | |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 594 | /// isEndPath - Returns true if executing the given method/function should |
| 595 | /// terminate the path. |
| 596 | bool isEndPath() const { return EndPath; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 597 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 598 | /// getReceiverEffect - Returns the effect on the receiver of the call. |
| 599 | /// This is only meaningful if the summary applies to an ObjCMessageExpr*. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 600 | ArgEffect getReceiverEffect() const { return Receiver; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 601 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 602 | /// setReceiverEffect - Set the effect on the receiver of the call. |
| 603 | void setReceiverEffect(ArgEffect E) { Receiver = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 604 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 605 | typedef ArgEffects::iterator ExprIterator; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 606 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 607 | ExprIterator begin_args() const { return Args.begin(); } |
| 608 | ExprIterator end_args() const { return Args.end(); } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 609 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 610 | static void Profile(llvm::FoldingSetNodeID& ID, ArgEffects A, |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 611 | RetEffect RetEff, ArgEffect DefaultEff, |
Ted Kremenek | 2d1086c | 2008-07-18 17:39:56 +0000 | [diff] [blame] | 612 | ArgEffect ReceiverEff, bool EndPath) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 613 | ID.Add(A); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 614 | ID.Add(RetEff); |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 615 | ID.AddInteger((unsigned) DefaultEff); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 616 | ID.AddInteger((unsigned) ReceiverEff); |
Ted Kremenek | 2d1086c | 2008-07-18 17:39:56 +0000 | [diff] [blame] | 617 | ID.AddInteger((unsigned) EndPath); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 618 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 619 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 620 | void Profile(llvm::FoldingSetNodeID& ID) const { |
Ted Kremenek | 2d1086c | 2008-07-18 17:39:56 +0000 | [diff] [blame] | 621 | Profile(ID, Args, Ret, DefaultArgEffect, Receiver, EndPath); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 622 | } |
| 623 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 624 | } // end anonymous namespace |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 625 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 626 | //===----------------------------------------------------------------------===// |
| 627 | // Data structures for constructing summaries. |
| 628 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 53301ba | 2008-06-24 03:49:48 +0000 | [diff] [blame] | 629 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 630 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 631 | class ObjCSummaryKey { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 632 | IdentifierInfo* II; |
| 633 | Selector S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 634 | public: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 635 | ObjCSummaryKey(IdentifierInfo* ii, Selector s) |
| 636 | : II(ii), S(s) {} |
| 637 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 638 | ObjCSummaryKey(const ObjCInterfaceDecl* d, Selector s) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 639 | : II(d ? d->getIdentifier() : 0), S(s) {} |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 640 | |
| 641 | ObjCSummaryKey(const ObjCInterfaceDecl* d, IdentifierInfo *ii, Selector s) |
| 642 | : II(d ? d->getIdentifier() : ii), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 643 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 644 | ObjCSummaryKey(Selector s) |
| 645 | : II(0), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 646 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 647 | IdentifierInfo* getIdentifier() const { return II; } |
| 648 | Selector getSelector() const { return S; } |
| 649 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 650 | } |
| 651 | |
| 652 | namespace llvm { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 653 | template <> struct DenseMapInfo<ObjCSummaryKey> { |
| 654 | static inline ObjCSummaryKey getEmptyKey() { |
| 655 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(), |
| 656 | DenseMapInfo<Selector>::getEmptyKey()); |
| 657 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 658 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 659 | static inline ObjCSummaryKey getTombstoneKey() { |
| 660 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 661 | DenseMapInfo<Selector>::getTombstoneKey()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 662 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 663 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 664 | static unsigned getHashValue(const ObjCSummaryKey &V) { |
| 665 | return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier()) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 666 | & 0x88888888) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 667 | | (DenseMapInfo<Selector>::getHashValue(V.getSelector()) |
| 668 | & 0x55555555); |
| 669 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 670 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 671 | static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) { |
| 672 | return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(), |
| 673 | RHS.getIdentifier()) && |
| 674 | DenseMapInfo<Selector>::isEqual(LHS.getSelector(), |
| 675 | RHS.getSelector()); |
| 676 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 677 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 678 | static bool isPod() { |
| 679 | return DenseMapInfo<ObjCInterfaceDecl*>::isPod() && |
| 680 | DenseMapInfo<Selector>::isPod(); |
| 681 | } |
| 682 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 683 | } // end llvm namespace |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 684 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 685 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 686 | class ObjCSummaryCache { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 687 | typedef llvm::DenseMap<ObjCSummaryKey, RetainSummary*> MapTy; |
| 688 | MapTy M; |
| 689 | public: |
| 690 | ObjCSummaryCache() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 691 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 692 | RetainSummary* find(const ObjCInterfaceDecl* D, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 693 | Selector S) { |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 694 | // Lookup the method using the decl for the class @interface. If we |
| 695 | // have no decl, lookup using the class name. |
| 696 | return D ? find(D, S) : find(ClsName, S); |
| 697 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 698 | |
| 699 | RetainSummary* find(const ObjCInterfaceDecl* D, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 700 | // Do a lookup with the (D,S) pair. If we find a match return |
| 701 | // the iterator. |
| 702 | ObjCSummaryKey K(D, S); |
| 703 | MapTy::iterator I = M.find(K); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 704 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 705 | if (I != M.end() || !D) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 706 | return I->second; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 707 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 708 | // Walk the super chain. If we find a hit with a parent, we'll end |
| 709 | // up returning that summary. We actually allow that key (null,S), as |
| 710 | // we cache summaries for the null ObjCInterfaceDecl* to allow us to |
| 711 | // generate initial summaries without having to worry about NSObject |
| 712 | // being declared. |
| 713 | // FIXME: We may change this at some point. |
| 714 | for (ObjCInterfaceDecl* C=D->getSuperClass() ;; C=C->getSuperClass()) { |
| 715 | if ((I = M.find(ObjCSummaryKey(C, S))) != M.end()) |
| 716 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 717 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 718 | if (!C) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 719 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 720 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 721 | |
| 722 | // Cache the summary with original key to make the next lookup faster |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 723 | // and return the iterator. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 724 | RetainSummary *Summ = I->second; |
| 725 | M[K] = Summ; |
| 726 | return Summ; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 727 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 728 | |
Ted Kremenek | 9853045 | 2008-08-12 20:41:56 +0000 | [diff] [blame] | 729 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 730 | RetainSummary* find(Expr* Receiver, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 731 | return find(getReceiverDecl(Receiver), S); |
| 732 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 733 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 734 | RetainSummary* find(IdentifierInfo* II, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 735 | // FIXME: Class method lookup. Right now we dont' have a good way |
| 736 | // of going between IdentifierInfo* and the class hierarchy. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 737 | MapTy::iterator I = M.find(ObjCSummaryKey(II, S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 738 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 739 | if (I == M.end()) |
| 740 | I = M.find(ObjCSummaryKey(S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 741 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 742 | return I == M.end() ? NULL : I->second; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 743 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 744 | |
| 745 | const ObjCInterfaceDecl* getReceiverDecl(Expr* E) { |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 746 | if (const ObjCObjectPointerType* PT = |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 747 | E->getType()->getAs<ObjCObjectPointerType>()) |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 748 | return PT->getInterfaceDecl(); |
| 749 | |
| 750 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 751 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 752 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 753 | RetainSummary*& operator[](ObjCMessageExpr* ME) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 754 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 755 | Selector S = ME->getSelector(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 756 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 757 | if (Expr* Receiver = ME->getReceiver()) { |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 758 | const ObjCInterfaceDecl* OD = getReceiverDecl(Receiver); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 759 | return OD ? M[ObjCSummaryKey(OD->getIdentifier(), S)] : M[S]; |
| 760 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 761 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 762 | return M[ObjCSummaryKey(ME->getClassName(), S)]; |
| 763 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 764 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 765 | RetainSummary*& operator[](ObjCSummaryKey K) { |
| 766 | return M[K]; |
| 767 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 768 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 769 | RetainSummary*& operator[](Selector S) { |
| 770 | return M[ ObjCSummaryKey(S) ]; |
| 771 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 772 | }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 773 | } // end anonymous namespace |
| 774 | |
| 775 | //===----------------------------------------------------------------------===// |
| 776 | // Data structures for managing collections of summaries. |
| 777 | //===----------------------------------------------------------------------===// |
| 778 | |
| 779 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 780 | class RetainSummaryManager { |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 781 | |
| 782 | //==-----------------------------------------------------------------==// |
| 783 | // Typedefs. |
| 784 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 785 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 786 | typedef llvm::DenseMap<FunctionDecl*, RetainSummary*> |
| 787 | FuncSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 788 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 789 | typedef ObjCSummaryCache ObjCMethodSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 790 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 791 | //==-----------------------------------------------------------------==// |
| 792 | // Data. |
| 793 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 794 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 795 | /// Ctx - The ASTContext object for the analyzed ASTs. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 796 | ASTContext& Ctx; |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 797 | |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 798 | /// CFDictionaryCreateII - An IdentifierInfo* representing the indentifier |
| 799 | /// "CFDictionaryCreate". |
| 800 | IdentifierInfo* CFDictionaryCreateII; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 801 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 802 | /// GCEnabled - Records whether or not the analyzed code runs in GC mode. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 803 | const bool GCEnabled; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 804 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 805 | /// FuncSummaries - A map from FunctionDecls to summaries. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 806 | FuncSummariesTy FuncSummaries; |
| 807 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 808 | /// ObjCClassMethodSummaries - A map from selectors (for instance methods) |
| 809 | /// to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 810 | ObjCMethodSummariesTy ObjCClassMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 811 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 812 | /// ObjCMethodSummaries - A map from selectors to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 813 | ObjCMethodSummariesTy ObjCMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 814 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 815 | /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects, |
| 816 | /// and all other data used by the checker. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 817 | llvm::BumpPtrAllocator BPAlloc; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 818 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 819 | /// AF - A factory for ArgEffects objects. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 820 | ArgEffects::Factory AF; |
| 821 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 822 | /// ScratchArgs - A holding buffer for construct ArgEffects. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 823 | ArgEffects ScratchArgs; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 824 | |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 825 | /// ObjCAllocRetE - Default return effect for methods returning Objective-C |
| 826 | /// objects. |
| 827 | RetEffect ObjCAllocRetE; |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 828 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 829 | /// ObjCInitRetE - Default return effect for init methods returning |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 830 | /// Objective-C objects. |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 831 | RetEffect ObjCInitRetE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 832 | |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 833 | RetainSummary DefaultSummary; |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 834 | RetainSummary* StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 835 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 836 | //==-----------------------------------------------------------------==// |
| 837 | // Methods. |
| 838 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 839 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 840 | /// getArgEffects - Returns a persistent ArgEffects object based on the |
| 841 | /// data in ScratchArgs. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 842 | ArgEffects getArgEffects(); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 843 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 844 | enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable }; |
| 845 | |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 846 | public: |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 847 | RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; } |
| 848 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 849 | RetainSummary *getDefaultSummary() { |
| 850 | RetainSummary *Summ = (RetainSummary*) BPAlloc.Allocate<RetainSummary>(); |
| 851 | return new (Summ) RetainSummary(DefaultSummary); |
| 852 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 853 | |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 854 | RetainSummary* getUnarySummary(const FunctionType* FT, UnaryFuncKind func); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 855 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 856 | RetainSummary* getCFSummaryCreateRule(FunctionDecl* FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 857 | RetainSummary* getCFSummaryGetRule(FunctionDecl* FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 858 | RetainSummary* getCFCreateGetRuleSummary(FunctionDecl* FD, const char* FName); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 859 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 860 | RetainSummary* getPersistentSummary(ArgEffects AE, RetEffect RetEff, |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 861 | ArgEffect ReceiverEff = DoNothing, |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 862 | ArgEffect DefaultEff = MayEscape, |
| 863 | bool isEndPath = false); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 864 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 865 | RetainSummary* getPersistentSummary(RetEffect RE, |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 866 | ArgEffect ReceiverEff = DoNothing, |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 867 | ArgEffect DefaultEff = MayEscape) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 868 | return getPersistentSummary(getArgEffects(), RE, ReceiverEff, DefaultEff); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 869 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 870 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 871 | RetainSummary *getPersistentStopSummary() { |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 872 | if (StopSummary) |
| 873 | return StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 874 | |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 875 | StopSummary = getPersistentSummary(RetEffect::MakeNoRet(), |
| 876 | StopTracking, StopTracking); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 877 | |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 878 | return StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 879 | } |
Ted Kremenek | b309525 | 2008-05-06 04:20:12 +0000 | [diff] [blame] | 880 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 881 | RetainSummary *getInitMethodSummary(QualType RetTy); |
Ted Kremenek | 46e49ee | 2008-05-05 23:55:01 +0000 | [diff] [blame] | 882 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 883 | void InitializeClassMethodSummaries(); |
| 884 | void InitializeMethodSummaries(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 885 | |
Ted Kremenek | eff4b3c | 2009-05-03 04:42:10 +0000 | [diff] [blame] | 886 | bool isTrackedObjCObjectType(QualType T); |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 887 | bool isTrackedCFObjectType(QualType T); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 888 | |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 889 | private: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 890 | |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 891 | void addClsMethSummary(IdentifierInfo* ClsII, Selector S, |
| 892 | RetainSummary* Summ) { |
| 893 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 894 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 895 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 896 | void addNSObjectClsMethSummary(Selector S, RetainSummary *Summ) { |
| 897 | ObjCClassMethodSummaries[S] = Summ; |
| 898 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 899 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 900 | void addNSObjectMethSummary(Selector S, RetainSummary *Summ) { |
| 901 | ObjCMethodSummaries[S] = Summ; |
| 902 | } |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 903 | |
| 904 | void addClassMethSummary(const char* Cls, const char* nullaryName, |
| 905 | RetainSummary *Summ) { |
| 906 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 907 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 908 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 909 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 910 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 911 | void addInstMethSummary(const char* Cls, const char* nullaryName, |
| 912 | RetainSummary *Summ) { |
| 913 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 914 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 915 | ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 916 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 917 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 918 | Selector generateSelector(va_list argp) { |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 919 | llvm::SmallVector<IdentifierInfo*, 10> II; |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 920 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 921 | while (const char* s = va_arg(argp, const char*)) |
| 922 | II.push_back(&Ctx.Idents.get(s)); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 923 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 924 | return Ctx.Selectors.getSelector(II.size(), &II[0]); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 925 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 926 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 927 | void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries, |
| 928 | RetainSummary* Summ, va_list argp) { |
| 929 | Selector S = generateSelector(argp); |
| 930 | Summaries[ObjCSummaryKey(ClsII, S)] = Summ; |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 931 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 932 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 933 | void addInstMethSummary(const char* Cls, RetainSummary* Summ, ...) { |
| 934 | va_list argp; |
| 935 | va_start(argp, Summ); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 936 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 937 | va_end(argp); |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 938 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 939 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 940 | void addClsMethSummary(const char* Cls, RetainSummary* Summ, ...) { |
| 941 | va_list argp; |
| 942 | va_start(argp, Summ); |
| 943 | addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp); |
| 944 | va_end(argp); |
| 945 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 946 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 947 | void addClsMethSummary(IdentifierInfo *II, RetainSummary* Summ, ...) { |
| 948 | va_list argp; |
| 949 | va_start(argp, Summ); |
| 950 | addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp); |
| 951 | va_end(argp); |
| 952 | } |
| 953 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 954 | void addPanicSummary(const char* Cls, ...) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 955 | RetainSummary* Summ = getPersistentSummary(AF.GetEmptyMap(), |
| 956 | RetEffect::MakeNoRet(), |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 957 | DoNothing, DoNothing, true); |
| 958 | va_list argp; |
| 959 | va_start (argp, Cls); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 960 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 961 | va_end(argp); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 962 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 963 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 964 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 965 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 966 | RetainSummaryManager(ASTContext& ctx, bool gcenabled) |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 967 | : Ctx(ctx), |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 968 | CFDictionaryCreateII(&ctx.Idents.get("CFDictionaryCreate")), |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 969 | GCEnabled(gcenabled), AF(BPAlloc), ScratchArgs(AF.GetEmptyMap()), |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 970 | ObjCAllocRetE(gcenabled ? RetEffect::MakeGCNotOwned() |
| 971 | : RetEffect::MakeOwned(RetEffect::ObjC, true)), |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 972 | ObjCInitRetE(gcenabled ? RetEffect::MakeGCNotOwned() |
| 973 | : RetEffect::MakeOwnedWhenTrackedReceiver()), |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 974 | DefaultSummary(AF.GetEmptyMap() /* per-argument effects (none) */, |
| 975 | RetEffect::MakeNoRet() /* return effect */, |
Ted Kremenek | ebd5a2d | 2009-05-11 18:30:24 +0000 | [diff] [blame] | 976 | MayEscape, /* default argument effect */ |
| 977 | DoNothing /* receiver effect */), |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 978 | StopSummary(0) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 979 | |
| 980 | InitializeClassMethodSummaries(); |
| 981 | InitializeMethodSummaries(); |
| 982 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 983 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 984 | ~RetainSummaryManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 985 | |
| 986 | RetainSummary* getSummary(FunctionDecl* FD); |
| 987 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 988 | RetainSummary *getInstanceMethodSummary(const ObjCMessageExpr *ME, |
| 989 | const GRState *state, |
| 990 | const LocationContext *LC); |
| 991 | |
| 992 | RetainSummary* getInstanceMethodSummary(const ObjCMessageExpr* ME, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 993 | const ObjCInterfaceDecl* ID) { |
Ted Kremenek | ce8a41d | 2009-04-29 17:09:14 +0000 | [diff] [blame] | 994 | return getInstanceMethodSummary(ME->getSelector(), ME->getClassName(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 995 | ID, ME->getMethodDecl(), ME->getType()); |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 996 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 997 | |
Ted Kremenek | ce8a41d | 2009-04-29 17:09:14 +0000 | [diff] [blame] | 998 | RetainSummary* getInstanceMethodSummary(Selector S, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 999 | const ObjCInterfaceDecl* ID, |
| 1000 | const ObjCMethodDecl *MD, |
| 1001 | QualType RetTy); |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1002 | |
| 1003 | RetainSummary *getClassMethodSummary(Selector S, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1004 | const ObjCInterfaceDecl *ID, |
| 1005 | const ObjCMethodDecl *MD, |
| 1006 | QualType RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1007 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1008 | RetainSummary *getClassMethodSummary(const ObjCMessageExpr *ME) { |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1009 | return getClassMethodSummary(ME->getSelector(), ME->getClassName(), |
| 1010 | ME->getClassInfo().first, |
| 1011 | ME->getMethodDecl(), ME->getType()); |
| 1012 | } |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 1013 | |
| 1014 | /// getMethodSummary - This version of getMethodSummary is used to query |
| 1015 | /// the summary for the current method being analyzed. |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1016 | RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) { |
| 1017 | // FIXME: Eventually this should be unneeded. |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1018 | const ObjCInterfaceDecl *ID = MD->getClassInterface(); |
Ted Kremenek | 70a6576 | 2009-04-30 05:41:14 +0000 | [diff] [blame] | 1019 | Selector S = MD->getSelector(); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 1020 | IdentifierInfo *ClsName = ID->getIdentifier(); |
| 1021 | QualType ResultTy = MD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1022 | |
| 1023 | // Resolve the method decl last. |
Argyrios Kyrtzidis | 17945a0 | 2009-06-30 02:36:12 +0000 | [diff] [blame] | 1024 | if (const ObjCMethodDecl *InterfaceMD = ResolveToInterfaceMethodDecl(MD)) |
Ted Kremenek | 76a50e3 | 2009-04-30 05:47:23 +0000 | [diff] [blame] | 1025 | MD = InterfaceMD; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1026 | |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 1027 | if (MD->isInstanceMethod()) |
| 1028 | return getInstanceMethodSummary(S, ClsName, ID, MD, ResultTy); |
| 1029 | else |
| 1030 | return getClassMethodSummary(S, ClsName, ID, MD, ResultTy); |
| 1031 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1032 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1033 | RetainSummary* getCommonMethodSummary(const ObjCMethodDecl* MD, |
| 1034 | Selector S, QualType RetTy); |
| 1035 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1036 | void updateSummaryFromAnnotations(RetainSummary &Summ, |
| 1037 | const ObjCMethodDecl *MD); |
| 1038 | |
| 1039 | void updateSummaryFromAnnotations(RetainSummary &Summ, |
| 1040 | const FunctionDecl *FD); |
| 1041 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1042 | bool isGCEnabled() const { return GCEnabled; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1043 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 1044 | RetainSummary *copySummary(RetainSummary *OldSumm) { |
| 1045 | RetainSummary *Summ = (RetainSummary*) BPAlloc.Allocate<RetainSummary>(); |
| 1046 | new (Summ) RetainSummary(*OldSumm); |
| 1047 | return Summ; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1048 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1049 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1050 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1051 | } // end anonymous namespace |
| 1052 | |
| 1053 | //===----------------------------------------------------------------------===// |
| 1054 | // Implementation of checker data structures. |
| 1055 | //===----------------------------------------------------------------------===// |
| 1056 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1057 | RetainSummaryManager::~RetainSummaryManager() {} |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1058 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1059 | ArgEffects RetainSummaryManager::getArgEffects() { |
| 1060 | ArgEffects AE = ScratchArgs; |
| 1061 | ScratchArgs = AF.GetEmptyMap(); |
| 1062 | return AE; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1063 | } |
| 1064 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1065 | RetainSummary* |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1066 | RetainSummaryManager::getPersistentSummary(ArgEffects AE, RetEffect RetEff, |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1067 | ArgEffect ReceiverEff, |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 1068 | ArgEffect DefaultEff, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1069 | bool isEndPath) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 1070 | // Create the summary and return it. |
Ted Kremenek | 22fe248 | 2009-05-04 04:30:18 +0000 | [diff] [blame] | 1071 | RetainSummary *Summ = (RetainSummary*) BPAlloc.Allocate<RetainSummary>(); |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 1072 | new (Summ) RetainSummary(AE, RetEff, DefaultEff, ReceiverEff, isEndPath); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1073 | return Summ; |
| 1074 | } |
| 1075 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1076 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1077 | // Predicates. |
| 1078 | //===----------------------------------------------------------------------===// |
| 1079 | |
Ted Kremenek | eff4b3c | 2009-05-03 04:42:10 +0000 | [diff] [blame] | 1080 | bool RetainSummaryManager::isTrackedObjCObjectType(QualType Ty) { |
Steve Naroff | f495456 | 2009-07-16 15:41:00 +0000 | [diff] [blame] | 1081 | if (!Ty->isObjCObjectPointerType()) |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1082 | return false; |
| 1083 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 1084 | const ObjCObjectPointerType *PT = Ty->getAs<ObjCObjectPointerType>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1085 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 1086 | // Can be true for objects with the 'NSObject' attribute. |
| 1087 | if (!PT) |
Ted Kremenek | 97d095f | 2009-04-23 22:11:07 +0000 | [diff] [blame] | 1088 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1089 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 1090 | // We assume that id<..>, id, and "Class" all represent tracked objects. |
| 1091 | if (PT->isObjCIdType() || PT->isObjCQualifiedIdType() || |
| 1092 | PT->isObjCClassType()) |
| 1093 | return true; |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1094 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1095 | // Does the interface subclass NSObject? |
| 1096 | // FIXME: We can memoize here if this gets too expensive. |
| 1097 | const ObjCInterfaceDecl *ID = PT->getInterfaceDecl(); |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1098 | |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 1099 | // Assume that anything declared with a forward declaration and no |
| 1100 | // @interface subclasses NSObject. |
| 1101 | if (ID->isForwardDecl()) |
| 1102 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1103 | |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 1104 | IdentifierInfo* NSObjectII = &Ctx.Idents.get("NSObject"); |
| 1105 | |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1106 | for ( ; ID ; ID = ID->getSuperClass()) |
| 1107 | if (ID->getIdentifier() == NSObjectII) |
| 1108 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1109 | |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1110 | return false; |
| 1111 | } |
| 1112 | |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 1113 | bool RetainSummaryManager::isTrackedCFObjectType(QualType T) { |
| 1114 | return isRefType(T, "CF") || // Core Foundation. |
| 1115 | isRefType(T, "CG") || // Core Graphics. |
| 1116 | isRefType(T, "DADisk") || // Disk Arbitration API. |
| 1117 | isRefType(T, "DADissenter") || |
| 1118 | isRefType(T, "DASessionRef"); |
| 1119 | } |
| 1120 | |
Ted Kremenek | 234a4c2 | 2009-01-07 00:39:56 +0000 | [diff] [blame] | 1121 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1122 | // Summary creation for functions (largely uses of Core Foundation). |
| 1123 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1124 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1125 | static bool isRetain(FunctionDecl* FD, const char* FName) { |
| 1126 | const char* loc = strstr(FName, "Retain"); |
| 1127 | return loc && loc[sizeof("Retain")-1] == '\0'; |
| 1128 | } |
| 1129 | |
| 1130 | static bool isRelease(FunctionDecl* FD, const char* FName) { |
| 1131 | const char* loc = strstr(FName, "Release"); |
| 1132 | return loc && loc[sizeof("Release")-1] == '\0'; |
| 1133 | } |
| 1134 | |
Ted Kremenek | ab59227 | 2008-06-24 03:56:45 +0000 | [diff] [blame] | 1135 | RetainSummary* RetainSummaryManager::getSummary(FunctionDecl* FD) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 1136 | // Look up a summary in our cache of FunctionDecls -> Summaries. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1137 | FuncSummariesTy::iterator I = FuncSummaries.find(FD); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1138 | if (I != FuncSummaries.end()) |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 1139 | return I->second; |
| 1140 | |
Ted Kremenek | e401a0c | 2009-05-04 15:34:07 +0000 | [diff] [blame] | 1141 | // No summary? Generate one. |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1142 | RetainSummary *S = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1143 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1144 | do { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1145 | // We generate "stop" summaries for implicitly defined functions. |
| 1146 | if (FD->isImplicit()) { |
| 1147 | S = getPersistentStopSummary(); |
| 1148 | break; |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1149 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1150 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 1151 | // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the |
Ted Kremenek | 9989065 | 2009-01-16 18:40:33 +0000 | [diff] [blame] | 1152 | // function's type. |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 1153 | const FunctionType* FT = FD->getType()->getAs<FunctionType>(); |
Daniel Dunbar | e013d68 | 2009-10-18 20:26:12 +0000 | [diff] [blame] | 1154 | const char* FName = FD->getIdentifier()->getNameStart(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1155 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1156 | // Strip away preceding '_'. Doing this here will effect all the checks |
| 1157 | // down below. |
| 1158 | while (*FName == '_') ++FName; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1159 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1160 | // Inspect the result type. |
| 1161 | QualType RetTy = FT->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1162 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1163 | // FIXME: This should all be refactored into a chain of "summary lookup" |
| 1164 | // filters. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 1165 | assert(ScratchArgs.isEmpty()); |
| 1166 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1167 | switch (strlen(FName)) { |
| 1168 | default: break; |
Ted Kremenek | 6240cf1 | 2009-10-13 22:55:33 +0000 | [diff] [blame] | 1169 | case 14: |
| 1170 | if (!memcmp(FName, "pthread_create", 14)) { |
| 1171 | // Part of: <rdar://problem/7299394>. This will be addressed |
| 1172 | // better with IPA. |
| 1173 | S = getPersistentStopSummary(); |
| 1174 | } |
| 1175 | break; |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1176 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1177 | case 17: |
| 1178 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 1179 | if (!memcmp(FName, "NSMakeCollectable", 17)) { |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 1180 | S = (RetTy->isObjCIdType()) |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1181 | ? getUnarySummary(FT, cfmakecollectable) |
| 1182 | : getPersistentStopSummary(); |
| 1183 | } |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1184 | else if (!memcmp(FName, "IOBSDNameMatching", 17) || |
| 1185 | !memcmp(FName, "IOServiceMatching", 17)) { |
| 1186 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1187 | // This should be addressed using a API table. |
| 1188 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1189 | DoNothing, DoNothing); |
| 1190 | } |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1191 | break; |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1192 | |
| 1193 | case 21: |
| 1194 | if (!memcmp(FName, "IOServiceNameMatching", 21)) { |
| 1195 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1196 | // This should be addressed using a API table. |
| 1197 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1198 | DoNothing, DoNothing); |
| 1199 | } |
| 1200 | break; |
| 1201 | |
| 1202 | case 24: |
| 1203 | if (!memcmp(FName, "IOServiceAddNotification", 24)) { |
| 1204 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1205 | // This should be addressed using a API table. |
| 1206 | ScratchArgs = AF.Add(ScratchArgs, 2, DecRef); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1207 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing,DoNothing); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1208 | } |
| 1209 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1210 | |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1211 | case 25: |
| 1212 | if (!memcmp(FName, "IORegistryEntryIDMatching", 25)) { |
| 1213 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1214 | // This should be addressed using a API table. |
| 1215 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1216 | DoNothing, DoNothing); |
| 1217 | } |
| 1218 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1219 | |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1220 | case 26: |
| 1221 | if (!memcmp(FName, "IOOpenFirmwarePathMatching", 26)) { |
| 1222 | // Part of <rdar://problem/6961230>. (IOKit) |
| 1223 | // This should be addressed using a API table. |
| 1224 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1225 | DoNothing, DoNothing); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1226 | } |
| 1227 | break; |
| 1228 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1229 | case 27: |
| 1230 | if (!memcmp(FName, "IOServiceGetMatchingService", 27)) { |
| 1231 | // Part of <rdar://problem/6961230>. |
| 1232 | // This should be addressed using a API table. |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1233 | ScratchArgs = AF.Add(ScratchArgs, 1, DecRef); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1234 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1235 | } |
| 1236 | break; |
| 1237 | |
| 1238 | case 28: |
| 1239 | if (!memcmp(FName, "IOServiceGetMatchingServices", 28)) { |
| 1240 | // FIXES: <rdar://problem/6326900> |
| 1241 | // This should be addressed using a API table. This strcmp is also |
| 1242 | // a little gross, but there is no need to super optimize here. |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1243 | ScratchArgs = AF.Add(ScratchArgs, 1, DecRef); |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 1244 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, |
| 1245 | DoNothing); |
| 1246 | } |
| 1247 | else if (!memcmp(FName, "CVPixelBufferCreateWithBytes", 28)) { |
| 1248 | // FIXES: <rdar://problem/7283567> |
| 1249 | // Eventually this can be improved by recognizing that the pixel |
| 1250 | // buffer passed to CVPixelBufferCreateWithBytes is released via |
| 1251 | // a callback and doing full IPA to make sure this is done correctly. |
Ted Kremenek | 002174f | 2009-11-03 05:39:12 +0000 | [diff] [blame] | 1252 | // FIXME: This function has an out parameter that returns an |
| 1253 | // allocated object. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 1254 | ScratchArgs = AF.Add(ScratchArgs, 7, StopTracking); |
| 1255 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, |
| 1256 | DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1257 | } |
| 1258 | break; |
Ted Kremenek | 882a51e | 2009-11-03 05:34:07 +0000 | [diff] [blame] | 1259 | |
| 1260 | case 29: |
| 1261 | if (!memcmp(FName, "CGBitmapContextCreateWithData", 29)) { |
| 1262 | // FIXES: <rdar://problem/7358899> |
| 1263 | // Eventually this can be improved by recognizing that 'releaseInfo' |
| 1264 | // passed to CGBitmapContextCreateWithData is released via |
| 1265 | // a callback and doing full IPA to make sure this is done correctly. |
| 1266 | ScratchArgs = AF.Add(ScratchArgs, 8, StopTracking); |
Ted Kremenek | 002174f | 2009-11-03 05:39:12 +0000 | [diff] [blame] | 1267 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 1268 | DoNothing,DoNothing); |
Ted Kremenek | 882a51e | 2009-11-03 05:34:07 +0000 | [diff] [blame] | 1269 | } |
| 1270 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1271 | |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1272 | case 32: |
| 1273 | if (!memcmp(FName, "IOServiceAddMatchingNotification", 32)) { |
| 1274 | // Part of <rdar://problem/6961230>. |
| 1275 | // This should be addressed using a API table. |
| 1276 | ScratchArgs = AF.Add(ScratchArgs, 2, DecRef); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1277 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 1278 | } |
| 1279 | break; |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 1280 | |
| 1281 | case 34: |
| 1282 | if (!memcmp(FName, "CVPixelBufferCreateWithPlanarBytes", 34)) { |
| 1283 | // FIXES: <rdar://problem/7283567> |
| 1284 | // Eventually this can be improved by recognizing that the pixel |
| 1285 | // buffer passed to CVPixelBufferCreateWithPlanarBytes is released |
| 1286 | // via a callback and doing full IPA to make sure this is done |
| 1287 | // correctly. |
| 1288 | ScratchArgs = AF.Add(ScratchArgs, 12, StopTracking); |
| 1289 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, |
| 1290 | DoNothing); |
| 1291 | } |
| 1292 | break; |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1293 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1294 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1295 | // Did we get a summary? |
| 1296 | if (S) |
| 1297 | break; |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1298 | |
| 1299 | // Enable this code once the semantics of NSDeallocateObject are resolved |
| 1300 | // for GC. <rdar://problem/6619988> |
| 1301 | #if 0 |
| 1302 | // Handle: NSDeallocateObject(id anObject); |
| 1303 | // This method does allow 'nil' (although we don't check it now). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1304 | if (strcmp(FName, "NSDeallocateObject") == 0) { |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 1305 | return RetTy == Ctx.VoidTy |
| 1306 | ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc) |
| 1307 | : getPersistentStopSummary(); |
| 1308 | } |
| 1309 | #endif |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1310 | |
| 1311 | if (RetTy->isPointerType()) { |
| 1312 | // For CoreFoundation ('CF') types. |
| 1313 | if (isRefType(RetTy, "CF", &Ctx, FName)) { |
| 1314 | if (isRetain(FD, FName)) |
| 1315 | S = getUnarySummary(FT, cfretain); |
| 1316 | else if (strstr(FName, "MakeCollectable")) |
| 1317 | S = getUnarySummary(FT, cfmakecollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1318 | else |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1319 | S = getCFCreateGetRuleSummary(FD, FName); |
| 1320 | |
| 1321 | break; |
| 1322 | } |
| 1323 | |
| 1324 | // For CoreGraphics ('CG') types. |
| 1325 | if (isRefType(RetTy, "CG", &Ctx, FName)) { |
| 1326 | if (isRetain(FD, FName)) |
| 1327 | S = getUnarySummary(FT, cfretain); |
| 1328 | else |
| 1329 | S = getCFCreateGetRuleSummary(FD, FName); |
| 1330 | |
| 1331 | break; |
| 1332 | } |
| 1333 | |
| 1334 | // For the Disk Arbitration API (DiskArbitration/DADisk.h) |
| 1335 | if (isRefType(RetTy, "DADisk") || |
| 1336 | isRefType(RetTy, "DADissenter") || |
| 1337 | isRefType(RetTy, "DASessionRef")) { |
| 1338 | S = getCFCreateGetRuleSummary(FD, FName); |
| 1339 | break; |
| 1340 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1341 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1342 | break; |
| 1343 | } |
| 1344 | |
| 1345 | // Check for release functions, the only kind of functions that we care |
| 1346 | // about that don't return a pointer type. |
| 1347 | if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) { |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1348 | // Test for 'CGCF'. |
| 1349 | if (FName[1] == 'G' && FName[2] == 'C' && FName[3] == 'F') |
| 1350 | FName += 4; |
| 1351 | else |
| 1352 | FName += 2; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1353 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1354 | if (isRelease(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1355 | S = getUnarySummary(FT, cfrelease); |
| 1356 | else { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1357 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1358 | // Remaining CoreFoundation and CoreGraphics functions. |
| 1359 | // We use to assume that they all strictly followed the ownership idiom |
| 1360 | // and that ownership cannot be transferred. While this is technically |
| 1361 | // correct, many methods allow a tracked object to escape. For example: |
| 1362 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1363 | // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1364 | // CFDictionaryAddValue(y, key, x); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1365 | // CFRelease(x); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1366 | // ... it is okay to use 'x' since 'y' has a reference to it |
| 1367 | // |
| 1368 | // We handle this and similar cases with the follow heuristic. If the |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1369 | // function name contains "InsertValue", "SetValue", "AddValue", |
| 1370 | // "AppendValue", or "SetAttribute", then we assume that arguments may |
| 1371 | // "escape." This means that something else holds on to the object, |
| 1372 | // allowing it be used even after its local retain count drops to 0. |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1373 | ArgEffect E = (CStrInCStrNoCase(FName, "InsertValue") || |
| 1374 | CStrInCStrNoCase(FName, "AddValue") || |
Ted Kremenek | a92206e | 2009-02-05 22:34:53 +0000 | [diff] [blame] | 1375 | CStrInCStrNoCase(FName, "SetValue") || |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1376 | CStrInCStrNoCase(FName, "AppendValue") || |
| 1377 | CStrInCStrNoCase(FName, "SetAttribute")) |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1378 | ? MayEscape : DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1379 | |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1380 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1381 | } |
| 1382 | } |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1383 | } |
| 1384 | while (0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1385 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 1386 | if (!S) |
| 1387 | S = getDefaultSummary(); |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 1388 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1389 | // Annotations override defaults. |
| 1390 | assert(S); |
| 1391 | updateSummaryFromAnnotations(*S, FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1392 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1393 | FuncSummaries[FD] = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1394 | return S; |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 1395 | } |
| 1396 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1397 | RetainSummary* |
| 1398 | RetainSummaryManager::getCFCreateGetRuleSummary(FunctionDecl* FD, |
| 1399 | const char* FName) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1400 | |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1401 | if (strstr(FName, "Create") || strstr(FName, "Copy")) |
| 1402 | return getCFSummaryCreateRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1403 | |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1404 | if (strstr(FName, "Get")) |
| 1405 | return getCFSummaryGetRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1406 | |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 1407 | return getDefaultSummary(); |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1408 | } |
| 1409 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1410 | RetainSummary* |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 1411 | RetainSummaryManager::getUnarySummary(const FunctionType* FT, |
| 1412 | UnaryFuncKind func) { |
| 1413 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1414 | // Sanity check that this is *really* a unary function. This can |
| 1415 | // happen if people do weird things. |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1416 | const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1417 | if (!FTP || FTP->getNumArgs() != 1) |
| 1418 | return getPersistentStopSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1419 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1420 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1421 | |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1422 | switch (func) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1423 | case cfretain: { |
| 1424 | ScratchArgs = AF.Add(ScratchArgs, 0, IncRef); |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 1425 | return getPersistentSummary(RetEffect::MakeAlias(0), |
| 1426 | DoNothing, DoNothing); |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1427 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1428 | |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1429 | case cfrelease: { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1430 | ScratchArgs = AF.Add(ScratchArgs, 0, DecRef); |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 1431 | return getPersistentSummary(RetEffect::MakeNoRet(), |
| 1432 | DoNothing, DoNothing); |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1433 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1434 | |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1435 | case cfmakecollectable: { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1436 | ScratchArgs = AF.Add(ScratchArgs, 0, MakeCollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1437 | return getPersistentSummary(RetEffect::MakeAlias(0),DoNothing, DoNothing); |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1438 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1439 | |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1440 | default: |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1441 | assert (false && "Not a supported unary function."); |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 1442 | return getDefaultSummary(); |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 1443 | } |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1444 | } |
| 1445 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1446 | RetainSummary* RetainSummaryManager::getCFSummaryCreateRule(FunctionDecl* FD) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1447 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1448 | |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 1449 | if (FD->getIdentifier() == CFDictionaryCreateII) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1450 | ScratchArgs = AF.Add(ScratchArgs, 1, DoNothingByRef); |
| 1451 | ScratchArgs = AF.Add(ScratchArgs, 2, DoNothingByRef); |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 1452 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1453 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1454 | return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1455 | } |
| 1456 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1457 | RetainSummary* RetainSummaryManager::getCFSummaryGetRule(FunctionDecl* FD) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1458 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1459 | return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF), |
| 1460 | DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1461 | } |
| 1462 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1463 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1464 | // Summary creation for Selectors. |
| 1465 | //===----------------------------------------------------------------------===// |
| 1466 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1467 | RetainSummary* |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1468 | RetainSummaryManager::getInitMethodSummary(QualType RetTy) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1469 | assert(ScratchArgs.isEmpty()); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1470 | // 'init' methods conceptually return a newly allocated object and claim |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1471 | // the receiver. |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1472 | if (isTrackedObjCObjectType(RetTy) || isTrackedCFObjectType(RetTy)) |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 1473 | return getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1474 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1475 | return getDefaultSummary(); |
Ted Kremenek | 46e49ee | 2008-05-05 23:55:01 +0000 | [diff] [blame] | 1476 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1477 | |
| 1478 | void |
| 1479 | RetainSummaryManager::updateSummaryFromAnnotations(RetainSummary &Summ, |
| 1480 | const FunctionDecl *FD) { |
| 1481 | if (!FD) |
| 1482 | return; |
| 1483 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1484 | QualType RetTy = FD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1485 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1486 | // Determine if there is a special return effect for this method. |
Ted Kremenek | b9d8db8 | 2009-06-05 23:00:33 +0000 | [diff] [blame] | 1487 | if (isTrackedObjCObjectType(RetTy)) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1488 | if (FD->getAttr<NSReturnsRetainedAttr>()) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1489 | Summ.setRetEffect(ObjCAllocRetE); |
| 1490 | } |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1491 | else if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Ted Kremenek | b9d8db8 | 2009-06-05 23:00:33 +0000 | [diff] [blame] | 1492 | Summ.setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1493 | } |
| 1494 | } |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1495 | else if (RetTy->getAs<PointerType>()) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1496 | if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1497 | Summ.setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
| 1498 | } |
| 1499 | } |
| 1500 | } |
| 1501 | |
| 1502 | void |
| 1503 | RetainSummaryManager::updateSummaryFromAnnotations(RetainSummary &Summ, |
| 1504 | const ObjCMethodDecl *MD) { |
| 1505 | if (!MD) |
| 1506 | return; |
| 1507 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1508 | bool isTrackedLoc = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1509 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1510 | // Determine if there is a special return effect for this method. |
| 1511 | if (isTrackedObjCObjectType(MD->getResultType())) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1512 | if (MD->getAttr<NSReturnsRetainedAttr>()) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1513 | Summ.setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1514 | return; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1515 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1516 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1517 | isTrackedLoc = true; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1518 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1519 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1520 | if (!isTrackedLoc) |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1521 | isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1522 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1523 | if (isTrackedLoc && MD->getAttr<CFReturnsRetainedAttr>()) |
| 1524 | Summ.setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1525 | } |
| 1526 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1527 | RetainSummary* |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1528 | RetainSummaryManager::getCommonMethodSummary(const ObjCMethodDecl* MD, |
| 1529 | Selector S, QualType RetTy) { |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1530 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1531 | if (MD) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1532 | // Scan the method decl for 'void*' arguments. These should be treated |
| 1533 | // as 'StopTracking' because they are often used with delegates. |
| 1534 | // Delegates are a frequent form of false positives with the retain |
| 1535 | // count checker. |
| 1536 | unsigned i = 0; |
| 1537 | for (ObjCMethodDecl::param_iterator I = MD->param_begin(), |
| 1538 | E = MD->param_end(); I != E; ++I, ++i) |
| 1539 | if (ParmVarDecl *PD = *I) { |
| 1540 | QualType Ty = Ctx.getCanonicalType(PD->getType()); |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 1541 | if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy) |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1542 | ScratchArgs = AF.Add(ScratchArgs, i, StopTracking); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1543 | } |
| 1544 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1545 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1546 | // Any special effect for the receiver? |
| 1547 | ArgEffect ReceiverEff = DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1548 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1549 | // If one of the arguments in the selector has the keyword 'delegate' we |
| 1550 | // should stop tracking the reference count for the receiver. This is |
| 1551 | // because the reference count is quite possibly handled by a delegate |
| 1552 | // method. |
| 1553 | if (S.isKeywordSelector()) { |
| 1554 | const std::string &str = S.getAsString(); |
| 1555 | assert(!str.empty()); |
| 1556 | if (CStrInCStrNoCase(&str[0], "delegate:")) ReceiverEff = StopTracking; |
| 1557 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1558 | |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1559 | // Look for methods that return an owned object. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1560 | if (isTrackedObjCObjectType(RetTy)) { |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 1561 | // EXPERIMENTAL: Assume the Cocoa conventions for all objects returned |
| 1562 | // by instance methods. |
Ted Kremenek | 7db1604 | 2009-05-15 15:49:00 +0000 | [diff] [blame] | 1563 | RetEffect E = followsFundamentalRule(S) |
| 1564 | ? ObjCAllocRetE : RetEffect::MakeNotOwned(RetEffect::ObjC); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1565 | |
| 1566 | return getPersistentSummary(E, ReceiverEff, MayEscape); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1567 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1568 | |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 1569 | // Look for methods that return an owned core foundation object. |
| 1570 | if (isTrackedCFObjectType(RetTy)) { |
Ted Kremenek | 7db1604 | 2009-05-15 15:49:00 +0000 | [diff] [blame] | 1571 | RetEffect E = followsFundamentalRule(S) |
| 1572 | ? RetEffect::MakeOwned(RetEffect::CF, true) |
| 1573 | : RetEffect::MakeNotOwned(RetEffect::CF); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1574 | |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 1575 | return getPersistentSummary(E, ReceiverEff, MayEscape); |
| 1576 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1577 | |
Ted Kremenek | 9251143 | 2009-05-03 06:08:32 +0000 | [diff] [blame] | 1578 | if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing) |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 1579 | return getDefaultSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1580 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 1581 | return getPersistentSummary(RetEffect::MakeNoRet(), ReceiverEff, MayEscape); |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1582 | } |
| 1583 | |
| 1584 | RetainSummary* |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1585 | RetainSummaryManager::getInstanceMethodSummary(const ObjCMessageExpr *ME, |
| 1586 | const GRState *state, |
| 1587 | const LocationContext *LC) { |
| 1588 | |
| 1589 | // We need the type-information of the tracked receiver object |
| 1590 | // Retrieve it from the state. |
| 1591 | const Expr *Receiver = ME->getReceiver(); |
| 1592 | const ObjCInterfaceDecl* ID = 0; |
| 1593 | |
| 1594 | // FIXME: Is this really working as expected? There are cases where |
| 1595 | // we just use the 'ID' from the message expression. |
| 1596 | SVal receiverV = state->getSValAsScalarOrLoc(Receiver); |
| 1597 | |
| 1598 | // FIXME: Eventually replace the use of state->get<RefBindings> with |
| 1599 | // a generic API for reasoning about the Objective-C types of symbolic |
| 1600 | // objects. |
| 1601 | if (SymbolRef Sym = receiverV.getAsLocSymbol()) |
| 1602 | if (const RefVal *T = state->get<RefBindings>(Sym)) |
| 1603 | if (const ObjCObjectPointerType* PT = |
| 1604 | T->getType()->getAs<ObjCObjectPointerType>()) |
| 1605 | ID = PT->getInterfaceDecl(); |
| 1606 | |
| 1607 | // FIXME: this is a hack. This may or may not be the actual method |
| 1608 | // that is called. |
| 1609 | if (!ID) { |
| 1610 | if (const ObjCObjectPointerType *PT = |
| 1611 | Receiver->getType()->getAs<ObjCObjectPointerType>()) |
| 1612 | ID = PT->getInterfaceDecl(); |
| 1613 | } |
| 1614 | |
| 1615 | // FIXME: The receiver could be a reference to a class, meaning that |
| 1616 | // we should use the class method. |
| 1617 | RetainSummary *Summ = getInstanceMethodSummary(ME, ID); |
| 1618 | |
| 1619 | // Special-case: are we sending a mesage to "self"? |
| 1620 | // This is a hack. When we have full-IP this should be removed. |
| 1621 | if (isa<ObjCMethodDecl>(LC->getDecl())) { |
| 1622 | if (const loc::MemRegionVal *L = dyn_cast<loc::MemRegionVal>(&receiverV)) { |
| 1623 | // Get the region associated with 'self'. |
| 1624 | if (const ImplicitParamDecl *SelfDecl = LC->getSelfDecl()) { |
| 1625 | SVal SelfVal = state->getSVal(state->getRegion(SelfDecl, LC)); |
| 1626 | if (L->StripCasts() == SelfVal.getAsRegion()) { |
| 1627 | // Update the summary to make the default argument effect |
| 1628 | // 'StopTracking'. |
| 1629 | Summ = copySummary(Summ); |
| 1630 | Summ->setDefaultArgEffect(StopTracking); |
| 1631 | } |
| 1632 | } |
| 1633 | } |
| 1634 | } |
| 1635 | |
| 1636 | return Summ ? Summ : getDefaultSummary(); |
| 1637 | } |
| 1638 | |
| 1639 | RetainSummary* |
Ted Kremenek | ce8a41d | 2009-04-29 17:09:14 +0000 | [diff] [blame] | 1640 | RetainSummaryManager::getInstanceMethodSummary(Selector S, |
| 1641 | IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1642 | const ObjCInterfaceDecl* ID, |
| 1643 | const ObjCMethodDecl *MD, |
Ted Kremenek | ce8a41d | 2009-04-29 17:09:14 +0000 | [diff] [blame] | 1644 | QualType RetTy) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1645 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1646 | // Look up a summary in our summary cache. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1647 | RetainSummary *Summ = ObjCMethodSummaries.find(ID, ClsName, S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1648 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1649 | if (!Summ) { |
| 1650 | assert(ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1651 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1652 | // "initXXX": pass-through for receiver. |
| 1653 | if (deriveNamingConvention(S) == InitRule) |
| 1654 | Summ = getInitMethodSummary(RetTy); |
| 1655 | else |
| 1656 | Summ = getCommonMethodSummary(MD, S, RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1657 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1658 | // Annotations override defaults. |
| 1659 | updateSummaryFromAnnotations(*Summ, MD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1660 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1661 | // Memoize the summary. |
| 1662 | ObjCMethodSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ; |
| 1663 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1664 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1665 | return Summ; |
Ted Kremenek | 46e49ee | 2008-05-05 23:55:01 +0000 | [diff] [blame] | 1666 | } |
| 1667 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1668 | RetainSummary* |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1669 | RetainSummaryManager::getClassMethodSummary(Selector S, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 1670 | const ObjCInterfaceDecl *ID, |
| 1671 | const ObjCMethodDecl *MD, |
| 1672 | QualType RetTy) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1673 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1674 | assert(ClsName && "Class name must be specified."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1675 | RetainSummary *Summ = ObjCClassMethodSummaries.find(ID, ClsName, S); |
| 1676 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1677 | if (!Summ) { |
| 1678 | Summ = getCommonMethodSummary(MD, S, RetTy); |
| 1679 | // Annotations override defaults. |
| 1680 | updateSummaryFromAnnotations(*Summ, MD); |
| 1681 | // Memoize the summary. |
| 1682 | ObjCClassMethodSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ; |
| 1683 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1684 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1685 | return Summ; |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1686 | } |
| 1687 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1688 | void RetainSummaryManager::InitializeClassMethodSummaries() { |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1689 | assert(ScratchArgs.isEmpty()); |
| 1690 | RetainSummary* Summ = getPersistentSummary(ObjCAllocRetE); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1691 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1692 | // Create the summaries for "alloc", "new", and "allocWithZone:" for |
| 1693 | // NSObject and its derivatives. |
| 1694 | addNSObjectClsMethSummary(GetNullarySelector("alloc", Ctx), Summ); |
| 1695 | addNSObjectClsMethSummary(GetNullarySelector("new", Ctx), Summ); |
| 1696 | addNSObjectClsMethSummary(GetUnarySelector("allocWithZone", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1697 | |
| 1698 | // Create the [NSAssertionHandler currentHander] summary. |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1699 | addClassMethSummary("NSAssertionHandler", "currentHandler", |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1700 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1701 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1702 | // Create the [NSAutoreleasePool addObject:] summary. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1703 | ScratchArgs = AF.Add(ScratchArgs, 0, Autorelease); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1704 | addClassMethSummary("NSAutoreleasePool", "addObject", |
| 1705 | getPersistentSummary(RetEffect::MakeNoRet(), |
| 1706 | DoNothing, Autorelease)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1707 | |
Ted Kremenek | e622554 | 2009-10-15 22:26:21 +0000 | [diff] [blame] | 1708 | // Create a summary for [NSCursor dragCopyCursor]. |
| 1709 | addClassMethSummary("NSCursor", "dragCopyCursor", |
| 1710 | getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, |
| 1711 | DoNothing)); |
| 1712 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1713 | // Create the summaries for [NSObject performSelector...]. We treat |
| 1714 | // these as 'stop tracking' for the arguments because they are often |
| 1715 | // used for delegates that can release the object. When we have better |
| 1716 | // inter-procedural analysis we can potentially do something better. This |
| 1717 | // workaround is to remove false positives. |
| 1718 | Summ = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking); |
| 1719 | IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject"); |
| 1720 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1721 | "afterDelay", NULL); |
| 1722 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1723 | "afterDelay", "inModes", NULL); |
| 1724 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1725 | "withObject", "waitUntilDone", NULL); |
| 1726 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1727 | "withObject", "waitUntilDone", "modes", NULL); |
| 1728 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1729 | "withObject", "waitUntilDone", NULL); |
| 1730 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1731 | "withObject", "waitUntilDone", "modes", NULL); |
| 1732 | addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground", |
| 1733 | "withObject", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1734 | |
Ted Kremenek | 3043766 | 2009-05-14 21:29:16 +0000 | [diff] [blame] | 1735 | // Specially handle NSData. |
| 1736 | RetainSummary *dataWithBytesNoCopySumm = |
| 1737 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC), DoNothing, |
| 1738 | DoNothing); |
| 1739 | addClsMethSummary("NSData", dataWithBytesNoCopySumm, |
| 1740 | "dataWithBytesNoCopy", "length", NULL); |
| 1741 | addClsMethSummary("NSData", dataWithBytesNoCopySumm, |
| 1742 | "dataWithBytesNoCopy", "length", "freeWhenDone", NULL); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 1743 | } |
| 1744 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 1745 | void RetainSummaryManager::InitializeMethodSummaries() { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1746 | |
| 1747 | assert (ScratchArgs.isEmpty()); |
| 1748 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1749 | // Create the "init" selector. It just acts as a pass-through for the |
| 1750 | // receiver. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1751 | RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 1752 | addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm); |
| 1753 | |
| 1754 | // awakeAfterUsingCoder: behaves basically like an 'init' method. It |
| 1755 | // claims the receiver and returns a retained object. |
| 1756 | addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx), |
| 1757 | InitSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1758 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1759 | // The next methods are allocators. |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1760 | RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1761 | RetainSummary *CFAllocSumm = |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1762 | getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1763 | |
| 1764 | // Create the "copy" selector. |
| 1765 | addNSObjectMethSummary(GetNullarySelector("copy", Ctx), AllocSumm); |
Ted Kremenek | 9853045 | 2008-08-12 20:41:56 +0000 | [diff] [blame] | 1766 | |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1767 | // Create the "mutableCopy" selector. |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1768 | addNSObjectMethSummary(GetNullarySelector("mutableCopy", Ctx), AllocSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1769 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1770 | // Create the "retain" selector. |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1771 | RetEffect E = RetEffect::MakeReceiverAlias(); |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1772 | RetainSummary *Summ = getPersistentSummary(E, IncRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1773 | addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1774 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1775 | // Create the "release" selector. |
Ted Kremenek | 1c512f5 | 2009-02-18 18:54:33 +0000 | [diff] [blame] | 1776 | Summ = getPersistentSummary(E, DecRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1777 | addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1778 | |
Ted Kremenek | 299e815 | 2008-05-07 21:17:39 +0000 | [diff] [blame] | 1779 | // Create the "drain" selector. |
| 1780 | Summ = getPersistentSummary(E, isGCEnabled() ? DoNothing : DecRef); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1781 | addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1782 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1783 | // Create the -dealloc summary. |
| 1784 | Summ = getPersistentSummary(RetEffect::MakeNoRet(), Dealloc); |
| 1785 | addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1786 | |
| 1787 | // Create the "autorelease" selector. |
Ted Kremenek | abf4397 | 2009-01-28 21:44:40 +0000 | [diff] [blame] | 1788 | Summ = getPersistentSummary(E, Autorelease); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1789 | addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1790 | |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1791 | // Specially handle NSAutoreleasePool. |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1792 | addInstMethSummary("NSAutoreleasePool", "init", |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1793 | getPersistentSummary(RetEffect::MakeReceiverAlias(), |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1794 | NewAutoreleasePool)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1795 | |
| 1796 | // For NSWindow, allocated objects are (initially) self-owned. |
Ted Kremenek | 89e202d | 2009-02-23 02:51:29 +0000 | [diff] [blame] | 1797 | // FIXME: For now we opt for false negatives with NSWindow, as these objects |
| 1798 | // self-own themselves. However, they only do this once they are displayed. |
| 1799 | // Thus, we need to track an NSWindow's display status. |
| 1800 | // This is tracked in <rdar://problem/6062711>. |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1801 | // See also http://llvm.org/bugs/show_bug.cgi?id=3714. |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1802 | RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(), |
| 1803 | StopTracking, |
| 1804 | StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1805 | |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1806 | addClassMethSummary("NSWindow", "alloc", NoTrackYet); |
| 1807 | |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1808 | #if 0 |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1809 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1810 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1811 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1812 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1813 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1814 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1815 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1816 | // For NSPanel (which subclasses NSWindow), allocated objects are not |
| 1817 | // self-owned. |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1818 | // FIXME: For now we don't track NSPanels. object for the same reason |
| 1819 | // as for NSWindow objects. |
| 1820 | addClassMethSummary("NSPanel", "alloc", NoTrackYet); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1821 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1822 | #if 0 |
| 1823 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1824 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1825 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1826 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1827 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1828 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1829 | |
Ted Kremenek | ba67f6a | 2009-05-18 23:14:34 +0000 | [diff] [blame] | 1830 | // Don't track allocated autorelease pools yet, as it is okay to prematurely |
| 1831 | // exit a method. |
| 1832 | addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1833 | |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 1834 | // Create NSAssertionHandler summaries. |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 1835 | addPanicSummary("NSAssertionHandler", "handleFailureInFunction", "file", |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1836 | "lineNumber", "description", NULL); |
| 1837 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 1838 | addPanicSummary("NSAssertionHandler", "handleFailureInMethod", "object", |
| 1839 | "file", "lineNumber", "description", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1840 | |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1841 | // Create summaries QCRenderer/QCView -createSnapShotImageOfType: |
| 1842 | addInstMethSummary("QCRenderer", AllocSumm, |
| 1843 | "createSnapshotImageOfType", NULL); |
| 1844 | addInstMethSummary("QCView", AllocSumm, |
| 1845 | "createSnapshotImageOfType", NULL); |
| 1846 | |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1847 | // Create summaries for CIContext, 'createCGImage' and |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1848 | // 'createCGLayerWithSize'. These objects are CF objects, and are not |
| 1849 | // automatically garbage collected. |
| 1850 | addInstMethSummary("CIContext", CFAllocSumm, |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1851 | "createCGImage", "fromRect", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1852 | addInstMethSummary("CIContext", CFAllocSumm, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1853 | "createCGImage", "fromRect", "format", "colorSpace", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1854 | addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1855 | "info", NULL); |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1856 | } |
| 1857 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1858 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1859 | // AutoreleaseBindings - State used to track objects in autorelease pools. |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1860 | //===----------------------------------------------------------------------===// |
| 1861 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1862 | typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts; |
| 1863 | typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents; |
| 1864 | typedef llvm::ImmutableList<SymbolRef> ARStack; |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1865 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1866 | static int AutoRCIndex = 0; |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1867 | static int AutoRBIndex = 0; |
| 1868 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1869 | namespace { class AutoreleasePoolContents {}; } |
| 1870 | namespace { class AutoreleaseStack {}; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1871 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1872 | namespace clang { |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1873 | template<> struct GRStateTrait<AutoreleaseStack> |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1874 | : public GRStatePartialTrait<ARStack> { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1875 | static inline void* GDMIndex() { return &AutoRBIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1876 | }; |
| 1877 | |
| 1878 | template<> struct GRStateTrait<AutoreleasePoolContents> |
| 1879 | : public GRStatePartialTrait<ARPoolContents> { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1880 | static inline void* GDMIndex() { return &AutoRCIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1881 | }; |
| 1882 | } // end clang namespace |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1883 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1884 | static SymbolRef GetCurrentAutoreleasePool(const GRState* state) { |
| 1885 | ARStack stack = state->get<AutoreleaseStack>(); |
| 1886 | return stack.isEmpty() ? SymbolRef() : stack.getHead(); |
| 1887 | } |
| 1888 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1889 | static const GRState * SendAutorelease(const GRState *state, |
| 1890 | ARCounts::Factory &F, SymbolRef sym) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1891 | |
| 1892 | SymbolRef pool = GetCurrentAutoreleasePool(state); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1893 | const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1894 | ARCounts newCnts(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1895 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1896 | if (cnts) { |
| 1897 | const unsigned *cnt = (*cnts).lookup(sym); |
| 1898 | newCnts = F.Add(*cnts, sym, cnt ? *cnt + 1 : 1); |
| 1899 | } |
| 1900 | else |
| 1901 | newCnts = F.Add(F.GetEmptyMap(), sym, 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1902 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1903 | return state->set<AutoreleasePoolContents>(pool, newCnts); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1904 | } |
| 1905 | |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 1906 | //===----------------------------------------------------------------------===// |
| 1907 | // Transfer functions. |
| 1908 | //===----------------------------------------------------------------------===// |
| 1909 | |
Ted Kremenek | 72cd17f | 2008-08-14 21:16:54 +0000 | [diff] [blame] | 1910 | namespace { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1911 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1912 | class CFRefCount : public GRTransferFuncs { |
Ted Kremenek | 8dd5646 | 2008-04-18 03:39:05 +0000 | [diff] [blame] | 1913 | public: |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 1914 | class BindingsPrinter : public GRState::Printer { |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 1915 | public: |
Ted Kremenek | 53ba0b6 | 2009-06-24 23:06:47 +0000 | [diff] [blame] | 1916 | virtual void Print(llvm::raw_ostream& Out, const GRState* state, |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 1917 | const char* nl, const char* sep); |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 1918 | }; |
Ted Kremenek | 8dd5646 | 2008-04-18 03:39:05 +0000 | [diff] [blame] | 1919 | |
| 1920 | private: |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1921 | typedef llvm::DenseMap<const ExplodedNode*, const RetainSummary*> |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1922 | SummaryLogTy; |
Ted Kremenek | fe9e543 | 2009-02-18 03:48:14 +0000 | [diff] [blame] | 1923 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1924 | RetainSummaryManager Summaries; |
Ted Kremenek | fe9e543 | 2009-02-18 03:48:14 +0000 | [diff] [blame] | 1925 | SummaryLogTy SummaryLog; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1926 | const LangOptions& LOpts; |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1927 | ARCounts::Factory ARCountFactory; |
Ted Kremenek | b9d17f9 | 2008-08-17 03:20:02 +0000 | [diff] [blame] | 1928 | |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 1929 | BugType *useAfterRelease, *releaseNotOwned; |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1930 | BugType *deallocGC, *deallocNotOwned; |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 1931 | BugType *leakWithinFunction, *leakAtReturn; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1932 | BugType *overAutorelease; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1933 | BugType *returnNotOwnedForOwned; |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 1934 | BugReporter *BR; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1935 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1936 | const GRState * Update(const GRState * state, SymbolRef sym, RefVal V, ArgEffect E, |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1937 | RefVal::Kind& hasErr); |
| 1938 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1939 | void ProcessNonLeakError(ExplodedNodeSet& Dst, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1940 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 1941 | Expr* NodeExpr, Expr* ErrorExpr, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1942 | ExplodedNode* Pred, |
Ted Kremenek | 4adc81e | 2008-08-13 04:27:00 +0000 | [diff] [blame] | 1943 | const GRState* St, |
Ted Kremenek | 2dabd43 | 2008-12-05 02:27:51 +0000 | [diff] [blame] | 1944 | RefVal::Kind hasErr, SymbolRef Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1945 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1946 | const GRState * HandleSymbolDeath(const GRState * state, SymbolRef sid, RefVal V, |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 1947 | llvm::SmallVectorImpl<SymbolRef> &Leaked); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1949 | ExplodedNode* ProcessLeaks(const GRState * state, |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 1950 | llvm::SmallVectorImpl<SymbolRef> &Leaked, |
| 1951 | GenericNodeBuilder &Builder, |
| 1952 | GRExprEngine &Eng, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1953 | ExplodedNode *Pred = 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1954 | |
| 1955 | public: |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 1956 | CFRefCount(ASTContext& Ctx, bool gcenabled, const LangOptions& lopts) |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1957 | : Summaries(Ctx, gcenabled), |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1958 | LOpts(lopts), useAfterRelease(0), releaseNotOwned(0), |
| 1959 | deallocGC(0), deallocNotOwned(0), |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1960 | leakWithinFunction(0), leakAtReturn(0), overAutorelease(0), |
| 1961 | returnNotOwnedForOwned(0), BR(0) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1962 | |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 1963 | virtual ~CFRefCount() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1964 | |
Ted Kremenek | 1fb7d0c | 2009-11-03 23:30:34 +0000 | [diff] [blame] | 1965 | void RegisterChecks(GRExprEngine &Eng); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1966 | |
Ted Kremenek | 1c72ef0 | 2008-08-16 00:49:49 +0000 | [diff] [blame] | 1967 | virtual void RegisterPrinters(std::vector<GRState::Printer*>& Printers) { |
| 1968 | Printers.push_back(new BindingsPrinter()); |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 1969 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1970 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1971 | bool isGCEnabled() const { return Summaries.isGCEnabled(); } |
Ted Kremenek | 072192b | 2008-04-30 23:47:44 +0000 | [diff] [blame] | 1972 | const LangOptions& getLangOptions() const { return LOpts; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1973 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1974 | const RetainSummary *getSummaryOfNode(const ExplodedNode *N) const { |
Ted Kremenek | fe9e543 | 2009-02-18 03:48:14 +0000 | [diff] [blame] | 1975 | SummaryLogTy::const_iterator I = SummaryLog.find(N); |
| 1976 | return I == SummaryLog.end() ? 0 : I->second; |
| 1977 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1978 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1979 | // Calls. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1980 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1981 | void EvalSummary(ExplodedNodeSet& Dst, |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1982 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1983 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1984 | Expr* Ex, |
| 1985 | Expr* Receiver, |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 1986 | const RetainSummary& Summ, |
Ted Kremenek | 2ffbfd9 | 2009-12-03 08:25:47 +0000 | [diff] [blame] | 1987 | const MemRegion *Callee, |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 1988 | ExprIterator arg_beg, ExprIterator arg_end, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 1989 | ExplodedNode* Pred, const GRState *state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1990 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1991 | virtual void EvalCall(ExplodedNodeSet& Dst, |
Ted Kremenek | 199e1a0 | 2008-03-12 21:06:49 +0000 | [diff] [blame] | 1992 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 1993 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 1994 | CallExpr* CE, SVal L, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1995 | ExplodedNode* Pred); |
| 1996 | |
| 1997 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 1998 | virtual void EvalObjCMessageExpr(ExplodedNodeSet& Dst, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 1999 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2000 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 2001 | ObjCMessageExpr* ME, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2002 | ExplodedNode* Pred, |
| 2003 | const GRState *state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2004 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2005 | bool EvalObjCMessageExprAux(ExplodedNodeSet& Dst, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 2006 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2007 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 2008 | ObjCMessageExpr* ME, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2009 | ExplodedNode* Pred); |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 2010 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2011 | // Stores. |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 2012 | virtual void EvalBind(GRStmtNodeBuilderRef& B, SVal location, SVal val); |
| 2013 | |
Ted Kremenek | e7bd9c2 | 2008-04-11 22:25:11 +0000 | [diff] [blame] | 2014 | // End-of-path. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2015 | |
Ted Kremenek | e7bd9c2 | 2008-04-11 22:25:11 +0000 | [diff] [blame] | 2016 | virtual void EvalEndPath(GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2017 | GREndPathNodeBuilder& Builder); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2018 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2019 | virtual void EvalDeadSymbols(ExplodedNodeSet& Dst, |
Ted Kremenek | 652adc6 | 2008-04-24 23:57:27 +0000 | [diff] [blame] | 2020 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2021 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2022 | ExplodedNode* Pred, |
Ted Kremenek | 241677a | 2009-01-21 22:26:05 +0000 | [diff] [blame] | 2023 | Stmt* S, const GRState* state, |
| 2024 | SymbolReaper& SymReaper); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2025 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2026 | std::pair<ExplodedNode*, const GRState *> |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2027 | HandleAutoreleaseCounts(const GRState * state, GenericNodeBuilder Bd, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2028 | ExplodedNode* Pred, GRExprEngine &Eng, |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2029 | SymbolRef Sym, RefVal V, bool &stop); |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 2030 | // Return statements. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2031 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2032 | virtual void EvalReturn(ExplodedNodeSet& Dst, |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 2033 | GRExprEngine& Engine, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2034 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 2035 | ReturnStmt* S, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2036 | ExplodedNode* Pred); |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 2037 | |
| 2038 | // Assumptions. |
| 2039 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 2040 | virtual const GRState *EvalAssume(const GRState* state, SVal condition, |
| 2041 | bool assumption); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 2042 | }; |
| 2043 | |
| 2044 | } // end anonymous namespace |
| 2045 | |
Ted Kremenek | 53ba0b6 | 2009-06-24 23:06:47 +0000 | [diff] [blame] | 2046 | static void PrintPool(llvm::raw_ostream &Out, SymbolRef Sym, |
| 2047 | const GRState *state) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2048 | Out << ' '; |
Ted Kremenek | e0e4ebf | 2009-03-26 03:35:11 +0000 | [diff] [blame] | 2049 | if (Sym) |
| 2050 | Out << Sym->getSymbolID(); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2051 | else |
| 2052 | Out << "<pool>"; |
| 2053 | Out << ":{"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2054 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2055 | // Get the contents of the pool. |
| 2056 | if (const ARCounts *cnts = state->get<AutoreleasePoolContents>(Sym)) |
| 2057 | for (ARCounts::iterator J=cnts->begin(), EJ=cnts->end(); J != EJ; ++J) |
| 2058 | Out << '(' << J.getKey() << ',' << J.getData() << ')'; |
| 2059 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2060 | Out << '}'; |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2061 | } |
Ted Kremenek | 8dd5646 | 2008-04-18 03:39:05 +0000 | [diff] [blame] | 2062 | |
Ted Kremenek | 53ba0b6 | 2009-06-24 23:06:47 +0000 | [diff] [blame] | 2063 | void CFRefCount::BindingsPrinter::Print(llvm::raw_ostream& Out, |
| 2064 | const GRState* state, |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 2065 | const char* nl, const char* sep) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2066 | |
Ted Kremenek | 72cd17f | 2008-08-14 21:16:54 +0000 | [diff] [blame] | 2067 | RefBindings B = state->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2068 | |
Ted Kremenek | ae6814e | 2008-08-13 21:24:49 +0000 | [diff] [blame] | 2069 | if (!B.isEmpty()) |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 2070 | Out << sep << nl; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2071 | |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 2072 | for (RefBindings::iterator I=B.begin(), E=B.end(); I!=E; ++I) { |
| 2073 | Out << (*I).first << " : "; |
| 2074 | (*I).second.print(Out); |
| 2075 | Out << nl; |
| 2076 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2077 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 2078 | // Print the autorelease stack. |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2079 | Out << sep << nl << "AR pool stack:"; |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 2080 | ARStack stack = state->get<AutoreleaseStack>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2081 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 2082 | PrintPool(Out, SymbolRef(), state); // Print the caller's pool. |
| 2083 | for (ARStack::iterator I=stack.begin(), E=stack.end(); I!=E; ++I) |
| 2084 | PrintPool(Out, *I, state); |
| 2085 | |
| 2086 | Out << nl; |
Ted Kremenek | f394804 | 2008-03-11 19:44:10 +0000 | [diff] [blame] | 2087 | } |
| 2088 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2089 | //===----------------------------------------------------------------------===// |
| 2090 | // Error reporting. |
| 2091 | //===----------------------------------------------------------------------===// |
| 2092 | |
| 2093 | namespace { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2094 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2095 | //===-------------===// |
| 2096 | // Bug Descriptions. // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2097 | //===-------------===// |
| 2098 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2099 | class CFRefBug : public BugType { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2100 | protected: |
| 2101 | CFRefCount& TF; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2102 | |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 2103 | CFRefBug(CFRefCount* tf, llvm::StringRef name) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2104 | : BugType(name, "Memory (Core Foundation/Objective-C)"), TF(*tf) {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2105 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2106 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2107 | CFRefCount& getTF() { return TF; } |
| 2108 | const CFRefCount& getTF() const { return TF; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2109 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2110 | // FIXME: Eventually remove. |
| 2111 | virtual const char* getDescription() const = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2112 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2113 | virtual bool isLeak() const { return false; } |
| 2114 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2115 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2116 | class UseAfterRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2117 | public: |
| 2118 | UseAfterRelease(CFRefCount* tf) |
| 2119 | : CFRefBug(tf, "Use-after-release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2120 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2121 | const char* getDescription() const { |
| 2122 | return "Reference-counted object is used after it is released"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2123 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2124 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2125 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2126 | class BadRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2127 | public: |
| 2128 | BadRelease(CFRefCount* tf) : CFRefBug(tf, "Bad release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2129 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2130 | const char* getDescription() const { |
Ted Kremenek | bb206fd | 2009-10-01 17:31:50 +0000 | [diff] [blame] | 2131 | return "Incorrect decrement of the reference count of an object that is " |
| 2132 | "not owned at this point by the caller"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2133 | } |
| 2134 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2135 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2136 | class DeallocGC : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2137 | public: |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2138 | DeallocGC(CFRefCount *tf) |
| 2139 | : CFRefBug(tf, "-dealloc called while using garbage collection") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2140 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2141 | const char *getDescription() const { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2142 | return "-dealloc called while using garbage collection"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2143 | } |
| 2144 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2145 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2146 | class DeallocNotOwned : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2147 | public: |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2148 | DeallocNotOwned(CFRefCount *tf) |
| 2149 | : CFRefBug(tf, "-dealloc sent to non-exclusively owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2150 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2151 | const char *getDescription() const { |
| 2152 | return "-dealloc sent to object that may be referenced elsewhere"; |
| 2153 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2154 | }; |
| 2155 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2156 | class OverAutorelease : public CFRefBug { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2157 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2158 | OverAutorelease(CFRefCount *tf) : |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2159 | CFRefBug(tf, "Object sent -autorelease too many times") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2160 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2161 | const char *getDescription() const { |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2162 | return "Object sent -autorelease too many times"; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 2163 | } |
| 2164 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2165 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2166 | class ReturnedNotOwnedForOwned : public CFRefBug { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2167 | public: |
| 2168 | ReturnedNotOwnedForOwned(CFRefCount *tf) : |
| 2169 | CFRefBug(tf, "Method should return an owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2170 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2171 | const char *getDescription() const { |
| 2172 | return "Object with +0 retain counts returned to caller where a +1 " |
| 2173 | "(owning) retain count is expected"; |
| 2174 | } |
| 2175 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2176 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2177 | class Leak : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2178 | const bool isReturn; |
| 2179 | protected: |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 2180 | Leak(CFRefCount* tf, llvm::StringRef name, bool isRet) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2181 | : CFRefBug(tf, name), isReturn(isRet) {} |
| 2182 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2183 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2184 | const char* getDescription() const { return ""; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2185 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2186 | bool isLeak() const { return true; } |
| 2187 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2188 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2189 | class LeakAtReturn : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2190 | public: |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 2191 | LeakAtReturn(CFRefCount* tf, llvm::StringRef name) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2192 | : Leak(tf, name, true) {} |
| 2193 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2194 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2195 | class LeakWithinFunction : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2196 | public: |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 2197 | LeakWithinFunction(CFRefCount* tf, llvm::StringRef name) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2198 | : Leak(tf, name, false) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2199 | }; |
| 2200 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2201 | //===---------===// |
| 2202 | // Bug Reports. // |
| 2203 | //===---------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2204 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2205 | class CFRefReport : public RangedBugReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2206 | protected: |
| 2207 | SymbolRef Sym; |
| 2208 | const CFRefCount &TF; |
| 2209 | public: |
| 2210 | CFRefReport(CFRefBug& D, const CFRefCount &tf, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2211 | ExplodedNode *n, SymbolRef sym) |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2212 | : RangedBugReport(D, D.getDescription(), n), Sym(sym), TF(tf) {} |
| 2213 | |
| 2214 | CFRefReport(CFRefBug& D, const CFRefCount &tf, |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 2215 | ExplodedNode *n, SymbolRef sym, llvm::StringRef endText) |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2216 | : RangedBugReport(D, D.getDescription(), endText, n), Sym(sym), TF(tf) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2217 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2218 | virtual ~CFRefReport() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2219 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2220 | CFRefBug& getBugType() { |
| 2221 | return (CFRefBug&) RangedBugReport::getBugType(); |
| 2222 | } |
| 2223 | const CFRefBug& getBugType() const { |
| 2224 | return (const CFRefBug&) RangedBugReport::getBugType(); |
| 2225 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2226 | |
Zhongxing Xu | 292a5c0 | 2009-08-18 08:58:41 +0000 | [diff] [blame] | 2227 | virtual void getRanges(const SourceRange*& beg, const SourceRange*& end) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2228 | if (!getBugType().isLeak()) |
Zhongxing Xu | 292a5c0 | 2009-08-18 08:58:41 +0000 | [diff] [blame] | 2229 | RangedBugReport::getRanges(beg, end); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2230 | else |
| 2231 | beg = end = 0; |
| 2232 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2233 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2234 | SymbolRef getSymbol() const { return Sym; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2235 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2236 | PathDiagnosticPiece* getEndPath(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2237 | const ExplodedNode* N); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2238 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2239 | std::pair<const char**,const char**> getExtraDescriptiveText(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2240 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2241 | PathDiagnosticPiece* VisitNode(const ExplodedNode* N, |
| 2242 | const ExplodedNode* PrevN, |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2243 | BugReporterContext& BRC); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2244 | }; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2245 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2246 | class CFRefLeakReport : public CFRefReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2247 | SourceLocation AllocSite; |
| 2248 | const MemRegion* AllocBinding; |
| 2249 | public: |
| 2250 | CFRefLeakReport(CFRefBug& D, const CFRefCount &tf, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2251 | ExplodedNode *n, SymbolRef sym, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2252 | GRExprEngine& Eng); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2253 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2254 | PathDiagnosticPiece* getEndPath(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2255 | const ExplodedNode* N); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2256 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2257 | SourceLocation getLocation() const { return AllocSite; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2258 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2259 | } // end anonymous namespace |
| 2260 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2261 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2262 | |
| 2263 | static const char* Msgs[] = { |
| 2264 | // GC only |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2265 | "Code is compiled to only use garbage collection", |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2266 | // No GC. |
| 2267 | "Code is compiled to use reference counts", |
| 2268 | // Hybrid, with GC. |
| 2269 | "Code is compiled to use either garbage collection (GC) or reference counts" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2270 | " (non-GC). The bug occurs with GC enabled", |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2271 | // Hybrid, without GC |
| 2272 | "Code is compiled to use either garbage collection (GC) or reference counts" |
| 2273 | " (non-GC). The bug occurs in non-GC mode" |
| 2274 | }; |
| 2275 | |
| 2276 | std::pair<const char**,const char**> CFRefReport::getExtraDescriptiveText() { |
| 2277 | CFRefCount& TF = static_cast<CFRefBug&>(getBugType()).getTF(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2278 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2279 | switch (TF.getLangOptions().getGCMode()) { |
| 2280 | default: |
| 2281 | assert(false); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2282 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2283 | case LangOptions::GCOnly: |
| 2284 | assert (TF.isGCEnabled()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2285 | return std::make_pair(&Msgs[0], &Msgs[0]+1); |
| 2286 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2287 | case LangOptions::NonGC: |
| 2288 | assert (!TF.isGCEnabled()); |
| 2289 | return std::make_pair(&Msgs[1], &Msgs[1]+1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2290 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2291 | case LangOptions::HybridGC: |
| 2292 | if (TF.isGCEnabled()) |
| 2293 | return std::make_pair(&Msgs[2], &Msgs[2]+1); |
| 2294 | else |
| 2295 | return std::make_pair(&Msgs[3], &Msgs[3]+1); |
| 2296 | } |
| 2297 | } |
| 2298 | |
| 2299 | static inline bool contains(const llvm::SmallVectorImpl<ArgEffect>& V, |
| 2300 | ArgEffect X) { |
| 2301 | for (llvm::SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end(); |
| 2302 | I!=E; ++I) |
| 2303 | if (*I == X) return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2304 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2305 | return false; |
| 2306 | } |
| 2307 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2308 | PathDiagnosticPiece* CFRefReport::VisitNode(const ExplodedNode* N, |
| 2309 | const ExplodedNode* PrevN, |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2310 | BugReporterContext& BRC) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2311 | |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2312 | if (!isa<PostStmt>(N->getLocation())) |
| 2313 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2314 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2315 | // Check if the type state has changed. |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2316 | const GRState *PrevSt = PrevN->getState(); |
| 2317 | const GRState *CurrSt = N->getState(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2318 | |
| 2319 | const RefVal* CurrT = CurrSt->get<RefBindings>(Sym); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2320 | if (!CurrT) return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2321 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2322 | const RefVal &CurrV = *CurrT; |
| 2323 | const RefVal *PrevT = PrevSt->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2324 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2325 | // Create a string buffer to constain all the useful things we want |
| 2326 | // to tell the user. |
| 2327 | std::string sbuf; |
| 2328 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2329 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2330 | // This is the allocation site since the previous node had no bindings |
| 2331 | // for this symbol. |
| 2332 | if (!PrevT) { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2333 | const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2334 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2335 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2336 | // Get the name of the callee (if it is available). |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2337 | SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2338 | if (const FunctionDecl* FD = X.getAsFunctionDecl()) |
| 2339 | os << "Call to function '" << FD->getNameAsString() <<'\''; |
| 2340 | else |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2341 | os << "function call"; |
| 2342 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2343 | else { |
| 2344 | assert (isa<ObjCMessageExpr>(S)); |
| 2345 | os << "Method"; |
| 2346 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2347 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2348 | if (CurrV.getObjKind() == RetEffect::CF) { |
| 2349 | os << " returns a Core Foundation object with a "; |
| 2350 | } |
| 2351 | else { |
| 2352 | assert (CurrV.getObjKind() == RetEffect::ObjC); |
| 2353 | os << " returns an Objective-C object with a "; |
| 2354 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2355 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2356 | if (CurrV.isOwned()) { |
| 2357 | os << "+1 retain count (owning reference)."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2358 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2359 | if (static_cast<CFRefBug&>(getBugType()).getTF().isGCEnabled()) { |
| 2360 | assert(CurrV.getObjKind() == RetEffect::CF); |
| 2361 | os << " " |
| 2362 | "Core Foundation objects are not automatically garbage collected."; |
| 2363 | } |
| 2364 | } |
| 2365 | else { |
| 2366 | assert (CurrV.isNotOwned()); |
| 2367 | os << "+0 retain count (non-owning reference)."; |
| 2368 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2369 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2370 | PathDiagnosticLocation Pos(S, BRC.getSourceManager()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2371 | return new PathDiagnosticEventPiece(Pos, os.str()); |
| 2372 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2373 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2374 | // Gather up the effects that were performed on the object at this |
| 2375 | // program point |
| 2376 | llvm::SmallVector<ArgEffect, 2> AEffects; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2377 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2378 | if (const RetainSummary *Summ = |
| 2379 | TF.getSummaryOfNode(BRC.getNodeResolver().getOriginalNode(N))) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2380 | // We only have summaries attached to nodes after evaluating CallExpr and |
| 2381 | // ObjCMessageExprs. |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2382 | const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2383 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2384 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2385 | // Iterate through the parameter expressions and see if the symbol |
| 2386 | // was ever passed as an argument. |
| 2387 | unsigned i = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2388 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2389 | for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2390 | AI!=AE; ++AI, ++i) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2391 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2392 | // Retrieve the value of the argument. Is it the symbol |
| 2393 | // we are interested in? |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2394 | if (CurrSt->getSValAsScalarOrLoc(*AI).getAsLocSymbol() != Sym) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2395 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2396 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2397 | // We have an argument. Get the effect! |
| 2398 | AEffects.push_back(Summ->getArg(i)); |
| 2399 | } |
| 2400 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2401 | else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2402 | if (const Expr *receiver = ME->getReceiver()) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2403 | if (CurrSt->getSValAsScalarOrLoc(receiver).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2404 | // The symbol we are tracking is the receiver. |
| 2405 | AEffects.push_back(Summ->getReceiverEffect()); |
| 2406 | } |
| 2407 | } |
| 2408 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2409 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2410 | do { |
| 2411 | // Get the previous type state. |
| 2412 | RefVal PrevV = *PrevT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2413 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2414 | // Specially handle -dealloc. |
| 2415 | if (!TF.isGCEnabled() && contains(AEffects, Dealloc)) { |
| 2416 | // Determine if the object's reference count was pushed to zero. |
| 2417 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
| 2418 | // We may not have transitioned to 'release' if we hit an error. |
| 2419 | // This case is handled elsewhere. |
| 2420 | if (CurrV.getKind() == RefVal::Released) { |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2421 | assert(CurrV.getCombinedCounts() == 0); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2422 | os << "Object released by directly sending the '-dealloc' message"; |
| 2423 | break; |
| 2424 | } |
| 2425 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2426 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2427 | // Specially handle CFMakeCollectable and friends. |
| 2428 | if (contains(AEffects, MakeCollectable)) { |
| 2429 | // Get the name of the function. |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2430 | const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2431 | SVal X = CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2432 | const FunctionDecl* FD = X.getAsFunctionDecl(); |
| 2433 | const std::string& FName = FD->getNameAsString(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2434 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2435 | if (TF.isGCEnabled()) { |
| 2436 | // Determine if the object's reference count was pushed to zero. |
| 2437 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2438 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2439 | os << "In GC mode a call to '" << FName |
| 2440 | << "' decrements an object's retain count and registers the " |
| 2441 | "object with the garbage collector. "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2442 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2443 | if (CurrV.getKind() == RefVal::Released) { |
| 2444 | assert(CurrV.getCount() == 0); |
| 2445 | os << "Since it now has a 0 retain count the object can be " |
| 2446 | "automatically collected by the garbage collector."; |
| 2447 | } |
| 2448 | else |
| 2449 | os << "An object must have a 0 retain count to be garbage collected. " |
| 2450 | "After this call its retain count is +" << CurrV.getCount() |
| 2451 | << '.'; |
| 2452 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2453 | else |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2454 | os << "When GC is not enabled a call to '" << FName |
| 2455 | << "' has no effect on its argument."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2456 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2457 | // Nothing more to say. |
| 2458 | break; |
| 2459 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2460 | |
| 2461 | // Determine if the typestate has changed. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2462 | if (!(PrevV == CurrV)) |
| 2463 | switch (CurrV.getKind()) { |
| 2464 | case RefVal::Owned: |
| 2465 | case RefVal::NotOwned: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2466 | |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2467 | if (PrevV.getCount() == CurrV.getCount()) { |
| 2468 | // Did an autorelease message get sent? |
| 2469 | if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount()) |
| 2470 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2471 | |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2472 | assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount()); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2473 | os << "Object sent -autorelease message"; |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2474 | break; |
| 2475 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2476 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2477 | if (PrevV.getCount() > CurrV.getCount()) |
| 2478 | os << "Reference count decremented."; |
| 2479 | else |
| 2480 | os << "Reference count incremented."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2481 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2482 | if (unsigned Count = CurrV.getCount()) |
| 2483 | os << " The object now has a +" << Count << " retain count."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2484 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2485 | if (PrevV.getKind() == RefVal::Released) { |
| 2486 | assert(TF.isGCEnabled() && CurrV.getCount() > 0); |
| 2487 | os << " The object is not eligible for garbage collection until the " |
| 2488 | "retain count reaches 0 again."; |
| 2489 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2490 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2491 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2492 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2493 | case RefVal::Released: |
| 2494 | os << "Object released."; |
| 2495 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2496 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2497 | case RefVal::ReturnedOwned: |
| 2498 | os << "Object returned to caller as an owning reference (single retain " |
| 2499 | "count transferred to caller)."; |
| 2500 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2501 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2502 | case RefVal::ReturnedNotOwned: |
| 2503 | os << "Object returned to caller with a +0 (non-owning) retain count."; |
| 2504 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2505 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2506 | default: |
| 2507 | return NULL; |
| 2508 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2509 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2510 | // Emit any remaining diagnostics for the argument effects (if any). |
| 2511 | for (llvm::SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(), |
| 2512 | E=AEffects.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2513 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2514 | // A bunch of things have alternate behavior under GC. |
| 2515 | if (TF.isGCEnabled()) |
| 2516 | switch (*I) { |
| 2517 | default: break; |
| 2518 | case Autorelease: |
| 2519 | os << "In GC mode an 'autorelease' has no effect."; |
| 2520 | continue; |
| 2521 | case IncRefMsg: |
| 2522 | os << "In GC mode the 'retain' message has no effect."; |
| 2523 | continue; |
| 2524 | case DecRefMsg: |
| 2525 | os << "In GC mode the 'release' message has no effect."; |
| 2526 | continue; |
| 2527 | } |
| 2528 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2529 | } while (0); |
| 2530 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2531 | if (os.str().empty()) |
| 2532 | return 0; // We have nothing to say! |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2533 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2534 | const Stmt* S = cast<PostStmt>(N->getLocation()).getStmt(); |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2535 | PathDiagnosticLocation Pos(S, BRC.getSourceManager()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2536 | PathDiagnosticPiece* P = new PathDiagnosticEventPiece(Pos, os.str()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2537 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2538 | // Add the range by scanning the children of the statement for any bindings |
| 2539 | // to Sym. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2540 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2541 | I!=E; ++I) |
| 2542 | if (const Expr* Exp = dyn_cast_or_null<Expr>(*I)) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2543 | if (CurrSt->getSValAsScalarOrLoc(Exp).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2544 | P->addRange(Exp->getSourceRange()); |
| 2545 | break; |
| 2546 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2547 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2548 | return P; |
| 2549 | } |
| 2550 | |
| 2551 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2552 | class FindUniqueBinding : |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2553 | public StoreManager::BindingsHandler { |
| 2554 | SymbolRef Sym; |
| 2555 | const MemRegion* Binding; |
| 2556 | bool First; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2557 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2558 | public: |
| 2559 | FindUniqueBinding(SymbolRef sym) : Sym(sym), Binding(0), First(true) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2560 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2561 | bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R, |
| 2562 | SVal val) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2563 | |
| 2564 | SymbolRef SymV = val.getAsSymbol(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2565 | if (!SymV || SymV != Sym) |
| 2566 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2567 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2568 | if (Binding) { |
| 2569 | First = false; |
| 2570 | return false; |
| 2571 | } |
| 2572 | else |
| 2573 | Binding = R; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2574 | |
| 2575 | return true; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2576 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2577 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2578 | operator bool() { return First && Binding; } |
| 2579 | const MemRegion* getRegion() { return Binding; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2580 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2581 | } |
| 2582 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2583 | static std::pair<const ExplodedNode*,const MemRegion*> |
| 2584 | GetAllocationSite(GRStateManager& StateMgr, const ExplodedNode* N, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2585 | SymbolRef Sym) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2586 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2587 | // Find both first node that referred to the tracked symbol and the |
| 2588 | // memory location that value was store to. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2589 | const ExplodedNode* Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2590 | const MemRegion* FirstBinding = 0; |
| 2591 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2592 | while (N) { |
| 2593 | const GRState* St = N->getState(); |
| 2594 | RefBindings B = St->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2595 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2596 | if (!B.lookup(Sym)) |
| 2597 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2598 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2599 | FindUniqueBinding FB(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2600 | StateMgr.iterBindings(St, FB); |
| 2601 | if (FB) FirstBinding = FB.getRegion(); |
| 2602 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2603 | Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2604 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2605 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2606 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2607 | return std::make_pair(Last, FirstBinding); |
| 2608 | } |
| 2609 | |
| 2610 | PathDiagnosticPiece* |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2611 | CFRefReport::getEndPath(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2612 | const ExplodedNode* EndN) { |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2613 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2614 | // assigned to different variables, etc. |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2615 | BRC.addNotableSymbol(Sym); |
| 2616 | return RangedBugReport::getEndPath(BRC, EndN); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2617 | } |
| 2618 | |
| 2619 | PathDiagnosticPiece* |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2620 | CFRefLeakReport::getEndPath(BugReporterContext& BRC, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2621 | const ExplodedNode* EndN){ |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2622 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2623 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2624 | // assigned to different variables, etc. |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2625 | BRC.addNotableSymbol(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2626 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2627 | // We are reporting a leak. Walk up the graph to get to the first node where |
| 2628 | // the symbol appeared, and also get the first VarDecl that tracked object |
| 2629 | // is stored to. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2630 | const ExplodedNode* AllocNode = 0; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2631 | const MemRegion* FirstBinding = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2632 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2633 | llvm::tie(AllocNode, FirstBinding) = |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2634 | GetAllocationSite(BRC.getStateManager(), EndN, Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2635 | |
| 2636 | // Get the allocate site. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2637 | assert(AllocNode); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2638 | const Stmt* FirstStmt = cast<PostStmt>(AllocNode->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2639 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2640 | SourceManager& SMgr = BRC.getSourceManager(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2641 | unsigned AllocLine =SMgr.getInstantiationLineNumber(FirstStmt->getLocStart()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2642 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2643 | // Compute an actual location for the leak. Sometimes a leak doesn't |
| 2644 | // occur at an actual statement (e.g., transition between blocks; end |
| 2645 | // of function) so we need to walk the graph and compute a real location. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2646 | const ExplodedNode* LeakN = EndN; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2647 | PathDiagnosticLocation L; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2648 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2649 | while (LeakN) { |
| 2650 | ProgramPoint P = LeakN->getLocation(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2651 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2652 | if (const PostStmt *PS = dyn_cast<PostStmt>(&P)) { |
| 2653 | L = PathDiagnosticLocation(PS->getStmt()->getLocStart(), SMgr); |
| 2654 | break; |
| 2655 | } |
| 2656 | else if (const BlockEdge *BE = dyn_cast<BlockEdge>(&P)) { |
| 2657 | if (const Stmt* Term = BE->getSrc()->getTerminator()) { |
| 2658 | L = PathDiagnosticLocation(Term->getLocStart(), SMgr); |
| 2659 | break; |
| 2660 | } |
| 2661 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2662 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2663 | LeakN = LeakN->succ_empty() ? 0 : *(LeakN->succ_begin()); |
| 2664 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2665 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2666 | if (!L.isValid()) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 2667 | const Decl &D = EndN->getCodeDecl(); |
Argyrios Kyrtzidis | 6fb0aee | 2009-06-30 02:35:26 +0000 | [diff] [blame] | 2668 | L = PathDiagnosticLocation(D.getBodyRBrace(), SMgr); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2669 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2670 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2671 | std::string sbuf; |
| 2672 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2673 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2674 | os << "Object allocated on line " << AllocLine; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2675 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2676 | if (FirstBinding) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2677 | os << " and stored into '" << FirstBinding->getString() << '\''; |
| 2678 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2679 | // Get the retain count. |
| 2680 | const RefVal* RV = EndN->getState()->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2681 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2682 | if (RV->getKind() == RefVal::ErrorLeakReturned) { |
| 2683 | // FIXME: Per comments in rdar://6320065, "create" only applies to CF |
| 2684 | // ojbects. Only "copy", "alloc", "retain" and "new" transfer ownership |
| 2685 | // to the caller for NS objects. |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 2686 | ObjCMethodDecl& MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2687 | os << " is returned from a method whose name ('" |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 2688 | << MD.getSelector().getAsString() |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2689 | << "') does not contain 'copy' or otherwise starts with" |
| 2690 | " 'new' or 'alloc'. This violates the naming convention rules given" |
Ted Kremenek | 8987a02 | 2009-04-29 22:25:52 +0000 | [diff] [blame] | 2691 | " in the Memory Management Guide for Cocoa (object leaked)"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2692 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2693 | else if (RV->getKind() == RefVal::ErrorGCLeakReturned) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 2694 | ObjCMethodDecl& MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2695 | os << " and returned from method '" << MD.getSelector().getAsString() |
Ted Kremenek | 82f2be5 | 2009-05-10 16:52:15 +0000 | [diff] [blame] | 2696 | << "' is potentially leaked when using garbage collection. Callers " |
| 2697 | "of this method do not expect a returned object with a +1 retain " |
| 2698 | "count since they expect the object to be managed by the garbage " |
| 2699 | "collector"; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2700 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2701 | else |
| 2702 | os << " is no longer referenced after this point and has a retain count of" |
Ted Kremenek | 8987a02 | 2009-04-29 22:25:52 +0000 | [diff] [blame] | 2703 | " +" << RV->getCount() << " (object leaked)"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2704 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2705 | return new PathDiagnosticEventPiece(L, os.str()); |
| 2706 | } |
| 2707 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2708 | CFRefLeakReport::CFRefLeakReport(CFRefBug& D, const CFRefCount &tf, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2709 | ExplodedNode *n, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2710 | SymbolRef sym, GRExprEngine& Eng) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2711 | : CFRefReport(D, tf, n, sym) { |
| 2712 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2713 | // Most bug reports are cached at the location where they occured. |
| 2714 | // With leaks, we want to unique them by the location where they were |
| 2715 | // allocated, and only report a single path. To do this, we need to find |
| 2716 | // the allocation site of a piece of tracked memory, which we do via a |
| 2717 | // call to GetAllocationSite. This will walk the ExplodedGraph backwards. |
| 2718 | // Note that this is *not* the trimmed graph; we are guaranteed, however, |
| 2719 | // that all ancestor nodes that represent the allocation site have the |
| 2720 | // same SourceLocation. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2721 | const ExplodedNode* AllocNode = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2722 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2723 | llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding. |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2724 | GetAllocationSite(Eng.getStateManager(), getEndNode(), getSymbol()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2725 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2726 | // Get the SourceLocation for the allocation site. |
| 2727 | ProgramPoint P = AllocNode->getLocation(); |
| 2728 | AllocSite = cast<PostStmt>(P).getStmt()->getLocStart(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2729 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2730 | // Fill in the description of the bug. |
| 2731 | Description.clear(); |
| 2732 | llvm::raw_string_ostream os(Description); |
| 2733 | SourceManager& SMgr = Eng.getContext().getSourceManager(); |
| 2734 | unsigned AllocLine = SMgr.getInstantiationLineNumber(AllocSite); |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2735 | os << "Potential leak "; |
| 2736 | if (tf.isGCEnabled()) { |
| 2737 | os << "(when using garbage collection) "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2738 | } |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2739 | os << "of an object allocated on line " << AllocLine; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2740 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2741 | // FIXME: AllocBinding doesn't get populated for RegionStore yet. |
| 2742 | if (AllocBinding) |
| 2743 | os << " and stored into '" << AllocBinding->getString() << '\''; |
| 2744 | } |
| 2745 | |
| 2746 | //===----------------------------------------------------------------------===// |
| 2747 | // Main checker logic. |
| 2748 | //===----------------------------------------------------------------------===// |
| 2749 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 2750 | /// GetReturnType - Used to get the return type of a message expression or |
| 2751 | /// function call with the intention of affixing that type to a tracked symbol. |
| 2752 | /// While the the return type can be queried directly from RetEx, when |
| 2753 | /// invoking class methods we augment to the return type to be that of |
| 2754 | /// a pointer to the class (as opposed it just being id). |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2755 | static QualType GetReturnType(const Expr* RetE, ASTContext& Ctx) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 2756 | QualType RetTy = RetE->getType(); |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2757 | // If RetE is not a message expression just return its type. |
| 2758 | // If RetE is a message expression, return its types if it is something |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 2759 | /// more specific than id. |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2760 | if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE)) |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 2761 | if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>()) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2762 | if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() || |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2763 | PT->isObjCClassType()) { |
| 2764 | // At this point we know the return type of the message expression is |
| 2765 | // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this |
| 2766 | // is a call to a class method whose type we can resolve. In such |
| 2767 | // cases, promote the return type to XXX* (where XXX is the class). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2768 | const ObjCInterfaceDecl *D = ME->getClassInfo().first; |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2769 | return !D ? RetTy : Ctx.getPointerType(Ctx.getObjCInterfaceType(D)); |
| 2770 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2771 | |
Steve Naroff | 14108da | 2009-07-10 23:34:53 +0000 | [diff] [blame] | 2772 | return RetTy; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 2773 | } |
| 2774 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2775 | void CFRefCount::EvalSummary(ExplodedNodeSet& Dst, |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 2776 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 2777 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 2778 | Expr* Ex, |
| 2779 | Expr* Receiver, |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 2780 | const RetainSummary& Summ, |
Ted Kremenek | 2ffbfd9 | 2009-12-03 08:25:47 +0000 | [diff] [blame] | 2781 | const MemRegion *Callee, |
Zhongxing Xu | 369f447 | 2009-04-20 05:24:46 +0000 | [diff] [blame] | 2782 | ExprIterator arg_beg, ExprIterator arg_end, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 2783 | ExplodedNode* Pred, const GRState *state) { |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2784 | |
| 2785 | // Evaluate the effect of the arguments. |
Ted Kremenek | 9ed18e6 | 2008-04-16 04:28:53 +0000 | [diff] [blame] | 2786 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2787 | unsigned idx = 0; |
Ted Kremenek | bcf50ad | 2008-04-11 18:40:51 +0000 | [diff] [blame] | 2788 | Expr* ErrorExpr = NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2789 | SymbolRef ErrorSym = 0; |
| 2790 | |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 2791 | llvm::SmallVector<const MemRegion*, 10> RegionsToInvalidate; |
| 2792 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2793 | for (ExprIterator I = arg_beg; I != arg_end; ++I, ++idx) { |
| 2794 | SVal V = state->getSValAsScalarOrLoc(*I); |
Ted Kremenek | 94c9698 | 2009-03-03 22:06:47 +0000 | [diff] [blame] | 2795 | SymbolRef Sym = V.getAsLocSymbol(); |
Ted Kremenek | 3f4d5ab | 2009-03-04 00:13:50 +0000 | [diff] [blame] | 2796 | |
Ted Kremenek | e0e4ebf | 2009-03-26 03:35:11 +0000 | [diff] [blame] | 2797 | if (Sym) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2798 | if (RefBindings::data_type* T = state->get<RefBindings>(Sym)) { |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 2799 | state = Update(state, Sym, *T, Summ.getArg(idx), hasErr); |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 2800 | if (hasErr) { |
Ted Kremenek | bcf50ad | 2008-04-11 18:40:51 +0000 | [diff] [blame] | 2801 | ErrorExpr = *I; |
Ted Kremenek | e8fdc83 | 2008-07-07 16:21:19 +0000 | [diff] [blame] | 2802 | ErrorSym = Sym; |
Ted Kremenek | bcf50ad | 2008-04-11 18:40:51 +0000 | [diff] [blame] | 2803 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2804 | } |
Ted Kremenek | 94c9698 | 2009-03-03 22:06:47 +0000 | [diff] [blame] | 2805 | continue; |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 2806 | } |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 2807 | |
Ted Kremenek | cc969fd | 2009-09-22 04:48:39 +0000 | [diff] [blame] | 2808 | tryAgain: |
Ted Kremenek | 94c9698 | 2009-03-03 22:06:47 +0000 | [diff] [blame] | 2809 | if (isa<Loc>(V)) { |
| 2810 | if (loc::MemRegionVal* MR = dyn_cast<loc::MemRegionVal>(&V)) { |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 2811 | if (Summ.getArg(idx) == DoNothingByRef) |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 2812 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2813 | |
| 2814 | // Invalidate the value of the variable passed by reference. |
Zhongxing Xu | 313b6da | 2009-07-06 06:01:24 +0000 | [diff] [blame] | 2815 | const MemRegion *R = MR->getRegion(); |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 2816 | |
Zhongxing Xu | 313b6da | 2009-07-06 06:01:24 +0000 | [diff] [blame] | 2817 | // Are we dealing with an ElementRegion? If the element type is |
| 2818 | // a basic integer type (e.g., char, int) and the underying region |
| 2819 | // is a variable region then strip off the ElementRegion. |
| 2820 | // FIXME: We really need to think about this for the general case |
| 2821 | // as sometimes we are reasoning about arrays and other times |
| 2822 | // about (char*), etc., is just a form of passing raw bytes. |
| 2823 | // e.g., void *p = alloca(); foo((char*)p); |
| 2824 | if (const ElementRegion *ER = dyn_cast<ElementRegion>(R)) { |
| 2825 | // Checking for 'integral type' is probably too promiscuous, but |
| 2826 | // we'll leave it in for now until we have a systematic way of |
| 2827 | // handling all of these cases. Eventually we need to come up |
| 2828 | // with an interface to StoreManager so that this logic can be |
| 2829 | // approriately delegated to the respective StoreManagers while |
| 2830 | // still allowing us to do checker-specific logic (e.g., |
| 2831 | // invalidating reference counts), probably via callbacks. |
| 2832 | if (ER->getElementType()->isIntegralType()) { |
| 2833 | const MemRegion *superReg = ER->getSuperRegion(); |
| 2834 | if (isa<VarRegion>(superReg) || isa<FieldRegion>(superReg) || |
| 2835 | isa<ObjCIvarRegion>(superReg)) |
| 2836 | R = cast<TypedRegion>(superReg); |
Ted Kremenek | 4253051 | 2009-05-06 18:19:24 +0000 | [diff] [blame] | 2837 | } |
Zhongxing Xu | 313b6da | 2009-07-06 06:01:24 +0000 | [diff] [blame] | 2838 | // FIXME: What about layers of ElementRegions? |
| 2839 | } |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 2840 | |
| 2841 | // Mark this region for invalidation. We batch invalidate regions |
| 2842 | // below for efficiency. |
| 2843 | RegionsToInvalidate.push_back(R); |
| 2844 | continue; |
Ted Kremenek | 8c5633e | 2008-07-03 23:26:32 +0000 | [diff] [blame] | 2845 | } |
| 2846 | else { |
| 2847 | // Nuke all other arguments passed by reference. |
Ted Kremenek | cc969fd | 2009-09-22 04:48:39 +0000 | [diff] [blame] | 2848 | // FIXME: is this necessary or correct? This handles the non-Region |
| 2849 | // cases. Is it ever valid to store to these? |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2850 | state = state->unbindLoc(cast<Loc>(V)); |
Ted Kremenek | 8c5633e | 2008-07-03 23:26:32 +0000 | [diff] [blame] | 2851 | } |
Ted Kremenek | b887355 | 2008-04-11 20:51:02 +0000 | [diff] [blame] | 2852 | } |
Ted Kremenek | cc969fd | 2009-09-22 04:48:39 +0000 | [diff] [blame] | 2853 | else if (isa<nonloc::LocAsInteger>(V)) { |
| 2854 | // If we are passing a location wrapped as an integer, unwrap it and |
| 2855 | // invalidate the values referred by the location. |
| 2856 | V = cast<nonloc::LocAsInteger>(V).getLoc(); |
| 2857 | goto tryAgain; |
| 2858 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2859 | } |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 2860 | |
Ted Kremenek | 2ffbfd9 | 2009-12-03 08:25:47 +0000 | [diff] [blame] | 2861 | // Block calls result in all captured values passed-via-reference to be |
| 2862 | // invalidated. |
| 2863 | if (const BlockDataRegion *BR = dyn_cast_or_null<BlockDataRegion>(Callee)) { |
| 2864 | RegionsToInvalidate.push_back(BR); |
| 2865 | } |
| 2866 | |
Ted Kremenek | 81a9583 | 2009-12-03 03:27:11 +0000 | [diff] [blame] | 2867 | // Invalidate regions we designed for invalidation use the batch invalidation |
| 2868 | // API. |
| 2869 | if (!RegionsToInvalidate.empty()) { |
| 2870 | // FIXME: We can have collisions on the conjured symbol if the |
| 2871 | // expression *I also creates conjured symbols. We probably want |
| 2872 | // to identify conjured symbols by an expression pair: the enclosing |
| 2873 | // expression (the context) and the expression itself. This should |
| 2874 | // disambiguate conjured symbols. |
| 2875 | unsigned Count = Builder.getCurrentBlockCount(); |
| 2876 | StoreManager& StoreMgr = Eng.getStateManager().getStoreManager(); |
| 2877 | |
| 2878 | |
| 2879 | StoreManager::InvalidatedSymbols IS; |
| 2880 | state = StoreMgr.InvalidateRegions(state, RegionsToInvalidate.data(), |
| 2881 | RegionsToInvalidate.data() + |
| 2882 | RegionsToInvalidate.size(), |
| 2883 | Ex, Count, &IS); |
| 2884 | for (StoreManager::InvalidatedSymbols::iterator I = IS.begin(), |
| 2885 | E = IS.end(); I!=E; ++I) { |
| 2886 | // Remove any existing reference-count binding. |
| 2887 | state = state->remove<RefBindings>(*I); |
| 2888 | } |
| 2889 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2890 | |
| 2891 | // Evaluate the effect on the message receiver. |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2892 | if (!ErrorExpr && Receiver) { |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2893 | SymbolRef Sym = state->getSValAsScalarOrLoc(Receiver).getAsLocSymbol(); |
Ted Kremenek | e0e4ebf | 2009-03-26 03:35:11 +0000 | [diff] [blame] | 2894 | if (Sym) { |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2895 | if (const RefVal* T = state->get<RefBindings>(Sym)) { |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 2896 | state = Update(state, Sym, *T, Summ.getReceiverEffect(), hasErr); |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 2897 | if (hasErr) { |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2898 | ErrorExpr = Receiver; |
Ted Kremenek | e8fdc83 | 2008-07-07 16:21:19 +0000 | [diff] [blame] | 2899 | ErrorSym = Sym; |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2900 | } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 2901 | } |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2902 | } |
| 2903 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2904 | |
| 2905 | // Process any errors. |
Ted Kremenek | 9ed18e6 | 2008-04-16 04:28:53 +0000 | [diff] [blame] | 2906 | if (hasErr) { |
Ted Kremenek | 72cd17f | 2008-08-14 21:16:54 +0000 | [diff] [blame] | 2907 | ProcessNonLeakError(Dst, Builder, Ex, ErrorExpr, Pred, state, |
Ted Kremenek | 8dd5646 | 2008-04-18 03:39:05 +0000 | [diff] [blame] | 2908 | hasErr, ErrorSym); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2909 | return; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 2910 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2911 | |
| 2912 | // Consult the summary for the return value. |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 2913 | RetEffect RE = Summ.getRetEffect(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2914 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 2915 | if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { |
| 2916 | assert(Receiver); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2917 | SVal V = state->getSValAsScalarOrLoc(Receiver); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 2918 | bool found = false; |
| 2919 | if (SymbolRef Sym = V.getAsLocSymbol()) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2920 | if (state->get<RefBindings>(Sym)) { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 2921 | found = true; |
| 2922 | RE = Summaries.getObjAllocRetEffect(); |
| 2923 | } |
| 2924 | |
| 2925 | if (!found) |
| 2926 | RE = RetEffect::MakeNoRet(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2927 | } |
| 2928 | |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2929 | switch (RE.getKind()) { |
| 2930 | default: |
| 2931 | assert (false && "Unhandled RetEffect."); break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2932 | |
| 2933 | case RetEffect::NoRet: { |
Ted Kremenek | f9561e5 | 2008-04-11 20:23:24 +0000 | [diff] [blame] | 2934 | // Make up a symbol for the return value (not reference counted). |
Ted Kremenek | 6c07bdb | 2009-06-26 00:05:51 +0000 | [diff] [blame] | 2935 | // FIXME: Most of this logic is not specific to the retain/release |
| 2936 | // checker. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2937 | |
Ted Kremenek | fd30194 | 2008-10-17 22:23:12 +0000 | [diff] [blame] | 2938 | // FIXME: We eventually should handle structs and other compound types |
| 2939 | // that are returned by value. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2940 | |
Ted Kremenek | fd30194 | 2008-10-17 22:23:12 +0000 | [diff] [blame] | 2941 | QualType T = Ex->getType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2942 | |
Ted Kremenek | 062e2f9 | 2008-11-13 06:10:40 +0000 | [diff] [blame] | 2943 | if (Loc::IsLocType(T) || (T->isIntegerType() && T->isScalarType())) { |
Ted Kremenek | f9561e5 | 2008-04-11 20:23:24 +0000 | [diff] [blame] | 2944 | unsigned Count = Builder.getCurrentBlockCount(); |
Ted Kremenek | 8d7f548 | 2009-04-09 22:22:44 +0000 | [diff] [blame] | 2945 | ValueManager &ValMgr = Eng.getValueManager(); |
Ted Kremenek | 8780679 | 2009-09-27 20:45:21 +0000 | [diff] [blame] | 2946 | SVal X = ValMgr.getConjuredSymbolVal(NULL, Ex, T, Count); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2947 | state = state->BindExpr(Ex, X, false); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2948 | } |
| 2949 | |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 2950 | break; |
Ted Kremenek | fd30194 | 2008-10-17 22:23:12 +0000 | [diff] [blame] | 2951 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2952 | |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2953 | case RetEffect::Alias: { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 2954 | unsigned idx = RE.getIndex(); |
Ted Kremenek | 5549976 | 2008-06-17 02:43:46 +0000 | [diff] [blame] | 2955 | assert (arg_end >= arg_beg); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 2956 | assert (idx < (unsigned) (arg_end - arg_beg)); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2957 | SVal V = state->getSValAsScalarOrLoc(*(arg_beg+idx)); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2958 | state = state->BindExpr(Ex, V, false); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2959 | break; |
| 2960 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2961 | |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2962 | case RetEffect::ReceiverAlias: { |
| 2963 | assert (Receiver); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2964 | SVal V = state->getSValAsScalarOrLoc(Receiver); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2965 | state = state->BindExpr(Ex, V, false); |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 2966 | break; |
| 2967 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2968 | |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 2969 | case RetEffect::OwnedAllocatedSymbol: |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2970 | case RetEffect::OwnedSymbol: { |
| 2971 | unsigned Count = Builder.getCurrentBlockCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2972 | ValueManager &ValMgr = Eng.getValueManager(); |
Ted Kremenek | 044b6f0 | 2009-04-09 16:13:17 +0000 | [diff] [blame] | 2973 | SymbolRef Sym = ValMgr.getConjuredSymbol(Ex, Count); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2974 | QualType RetT = GetReturnType(Ex, ValMgr.getContext()); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2975 | state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(), |
Ted Kremenek | 044b6f0 | 2009-04-09 16:13:17 +0000 | [diff] [blame] | 2976 | RetT)); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 2977 | state = state->BindExpr(Ex, ValMgr.makeLoc(Sym), false); |
Ted Kremenek | 25d01ba | 2009-03-09 22:46:49 +0000 | [diff] [blame] | 2978 | |
| 2979 | // FIXME: Add a flag to the checker where allocations are assumed to |
| 2980 | // *not fail. |
| 2981 | #if 0 |
Ted Kremenek | b2bf7cd | 2009-01-28 22:27:59 +0000 | [diff] [blame] | 2982 | if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) { |
| 2983 | bool isFeasible; |
| 2984 | state = state.Assume(loc::SymbolVal(Sym), true, isFeasible); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2985 | assert(isFeasible && "Cannot assume fresh symbol is non-null."); |
Ted Kremenek | b2bf7cd | 2009-01-28 22:27:59 +0000 | [diff] [blame] | 2986 | } |
Ted Kremenek | 25d01ba | 2009-03-09 22:46:49 +0000 | [diff] [blame] | 2987 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2988 | |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2989 | break; |
| 2990 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2991 | |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 2992 | case RetEffect::GCNotOwnedSymbol: |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 2993 | case RetEffect::NotOwnedSymbol: { |
| 2994 | unsigned Count = Builder.getCurrentBlockCount(); |
Ted Kremenek | 044b6f0 | 2009-04-09 16:13:17 +0000 | [diff] [blame] | 2995 | ValueManager &ValMgr = Eng.getValueManager(); |
| 2996 | SymbolRef Sym = ValMgr.getConjuredSymbol(Ex, Count); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2997 | QualType RetT = GetReturnType(Ex, ValMgr.getContext()); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 2998 | state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(), |
Ted Kremenek | 044b6f0 | 2009-04-09 16:13:17 +0000 | [diff] [blame] | 2999 | RetT)); |
Ted Kremenek | 8e02934 | 2009-08-27 22:17:37 +0000 | [diff] [blame] | 3000 | state = state->BindExpr(Ex, ValMgr.makeLoc(Sym), false); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 3001 | break; |
| 3002 | } |
| 3003 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3004 | |
Ted Kremenek | f5b34b1 | 2009-02-18 02:00:25 +0000 | [diff] [blame] | 3005 | // Generate a sink node if we are at the end of a path. |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3006 | ExplodedNode *NewNode = |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 3007 | Summ.isEndPath() ? Builder.MakeSinkNode(Dst, Ex, Pred, state) |
| 3008 | : Builder.MakeNode(Dst, Ex, Pred, state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3009 | |
Ted Kremenek | f5b34b1 | 2009-02-18 02:00:25 +0000 | [diff] [blame] | 3010 | // Annotate the edge with summary we used. |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 3011 | if (NewNode) SummaryLog[NewNode] = &Summ; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 3012 | } |
| 3013 | |
| 3014 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3015 | void CFRefCount::EvalCall(ExplodedNodeSet& Dst, |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 3016 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3017 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | 1c96b24 | 2008-10-17 05:57:07 +0000 | [diff] [blame] | 3018 | CallExpr* CE, SVal L, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3019 | ExplodedNode* Pred) { |
Ted Kremenek | 772250c | 2009-11-25 01:35:18 +0000 | [diff] [blame] | 3020 | |
| 3021 | RetainSummary *Summ = 0; |
| 3022 | |
| 3023 | // FIXME: Better support for blocks. For now we stop tracking anything |
| 3024 | // that is passed to blocks. |
| 3025 | // FIXME: Need to handle variables that are "captured" by the block. |
Ted Kremenek | 0a8112a | 2009-11-25 23:53:07 +0000 | [diff] [blame] | 3026 | if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) { |
Ted Kremenek | 772250c | 2009-11-25 01:35:18 +0000 | [diff] [blame] | 3027 | Summ = Summaries.getPersistentStopSummary(); |
| 3028 | } |
| 3029 | else { |
| 3030 | const FunctionDecl* FD = L.getAsFunctionDecl(); |
| 3031 | Summ = !FD ? Summaries.getDefaultSummary() : |
| 3032 | Summaries.getSummary(const_cast<FunctionDecl*>(FD)); |
| 3033 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3034 | |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 3035 | assert(Summ); |
Ted Kremenek | 2ffbfd9 | 2009-12-03 08:25:47 +0000 | [diff] [blame] | 3036 | EvalSummary(Dst, Eng, Builder, CE, 0, *Summ, L.getAsRegion(), |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 3037 | CE->arg_begin(), CE->arg_end(), Pred, Builder.GetState(Pred)); |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 3038 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3039 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3040 | void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet& Dst, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 3041 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3042 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 3043 | ObjCMessageExpr* ME, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 3044 | ExplodedNode* Pred, |
| 3045 | const GRState *state) { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 3046 | RetainSummary *Summ = |
| 3047 | ME->getReceiver() |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 3048 | ? Summaries.getInstanceMethodSummary(ME, state,Pred->getLocationContext()) |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 3049 | : Summaries.getClassMethodSummary(ME); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3050 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 3051 | assert(Summ && "RetainSummary is null"); |
Ted Kremenek | 2ffbfd9 | 2009-12-03 08:25:47 +0000 | [diff] [blame] | 3052 | EvalSummary(Dst, Eng, Builder, ME, ME->getReceiver(), *Summ, NULL, |
Zhongxing Xu | a46e4d9 | 2009-12-02 05:49:12 +0000 | [diff] [blame] | 3053 | ME->arg_begin(), ME->arg_end(), Pred, state); |
Ted Kremenek | 8534820 | 2008-04-15 23:44:31 +0000 | [diff] [blame] | 3054 | } |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3055 | |
| 3056 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 3057 | class StopTrackingCallback : public SymbolVisitor { |
Ted Kremenek | 3a77203 | 2009-06-18 00:49:02 +0000 | [diff] [blame] | 3058 | const GRState *state; |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3059 | public: |
Ted Kremenek | 3a77203 | 2009-06-18 00:49:02 +0000 | [diff] [blame] | 3060 | StopTrackingCallback(const GRState *st) : state(st) {} |
| 3061 | const GRState *getState() const { return state; } |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3062 | |
| 3063 | bool VisitSymbol(SymbolRef sym) { |
Ted Kremenek | 3a77203 | 2009-06-18 00:49:02 +0000 | [diff] [blame] | 3064 | state = state->remove<RefBindings>(sym); |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3065 | return true; |
| 3066 | } |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3067 | }; |
| 3068 | } // end anonymous namespace |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3069 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3070 | |
| 3071 | void CFRefCount::EvalBind(GRStmtNodeBuilderRef& B, SVal location, SVal val) { |
| 3072 | // Are we storing to something that causes the value to "escape"? |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 3073 | bool escapes = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3074 | |
Ted Kremenek | a496d16 | 2008-10-18 03:49:51 +0000 | [diff] [blame] | 3075 | // A value escapes in three possible cases (this may change): |
| 3076 | // |
| 3077 | // (1) we are binding to something that is not a memory region. |
| 3078 | // (2) we are binding to a memregion that does not have stack storage |
| 3079 | // (3) we are binding to a memregion with stack storage that the store |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3080 | // does not understand. |
Ted Kremenek | 3a77203 | 2009-06-18 00:49:02 +0000 | [diff] [blame] | 3081 | const GRState *state = B.getState(); |
Ted Kremenek | a496d16 | 2008-10-18 03:49:51 +0000 | [diff] [blame] | 3082 | |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 3083 | if (!isa<loc::MemRegionVal>(location)) |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 3084 | escapes = true; |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 3085 | else { |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 3086 | const MemRegion* R = cast<loc::MemRegionVal>(location).getRegion(); |
Ted Kremenek | ea20cd7 | 2009-06-23 18:05:21 +0000 | [diff] [blame] | 3087 | escapes = !R->hasStackStorage(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3088 | |
Ted Kremenek | a496d16 | 2008-10-18 03:49:51 +0000 | [diff] [blame] | 3089 | if (!escapes) { |
| 3090 | // To test (3), generate a new state with the binding removed. If it is |
| 3091 | // the same state, then it escapes (since the store cannot represent |
| 3092 | // the binding). |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3093 | escapes = (state == (state->bindLoc(cast<Loc>(location), UnknownVal()))); |
Ted Kremenek | a496d16 | 2008-10-18 03:49:51 +0000 | [diff] [blame] | 3094 | } |
Ted Kremenek | 9e24049 | 2008-10-04 05:50:14 +0000 | [diff] [blame] | 3095 | } |
Ted Kremenek | 41573eb | 2009-02-14 01:43:44 +0000 | [diff] [blame] | 3096 | |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3097 | // If our store can represent the binding and we aren't storing to something |
| 3098 | // that doesn't have local storage then just return and have the simulation |
| 3099 | // state continue as is. |
| 3100 | if (!escapes) |
| 3101 | return; |
Ted Kremenek | a496d16 | 2008-10-18 03:49:51 +0000 | [diff] [blame] | 3102 | |
Ted Kremenek | 5216ad7 | 2009-02-14 03:16:10 +0000 | [diff] [blame] | 3103 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 3104 | // and stop tracking them. |
Ted Kremenek | 3a77203 | 2009-06-18 00:49:02 +0000 | [diff] [blame] | 3105 | B.MakeNode(state->scanReachableSymbols<StopTrackingCallback>(val).getState()); |
Ted Kremenek | db86371 | 2008-04-16 22:32:20 +0000 | [diff] [blame] | 3106 | } |
| 3107 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3108 | // Return statements. |
| 3109 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3110 | void CFRefCount::EvalReturn(ExplodedNodeSet& Dst, |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3111 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3112 | GRStmtNodeBuilder& Builder, |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3113 | ReturnStmt* S, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3114 | ExplodedNode* Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3115 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3116 | Expr* RetE = S->getRetValue(); |
Ted Kremenek | 94c9698 | 2009-03-03 22:06:47 +0000 | [diff] [blame] | 3117 | if (!RetE) |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3118 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3119 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3120 | const GRState *state = Builder.GetState(Pred); |
| 3121 | SymbolRef Sym = state->getSValAsScalarOrLoc(RetE).getAsLocSymbol(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3122 | |
Ted Kremenek | e0e4ebf | 2009-03-26 03:35:11 +0000 | [diff] [blame] | 3123 | if (!Sym) |
Ted Kremenek | 94c9698 | 2009-03-03 22:06:47 +0000 | [diff] [blame] | 3124 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3125 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3126 | // Get the reference count binding (if any). |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3127 | const RefVal* T = state->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3128 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3129 | if (!T) |
| 3130 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3131 | |
| 3132 | // Change the reference count. |
| 3133 | RefVal X = *T; |
| 3134 | |
| 3135 | switch (X.getKind()) { |
| 3136 | case RefVal::Owned: { |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3137 | unsigned cnt = X.getCount(); |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 3138 | assert (cnt > 0); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3139 | X.setCount(cnt - 1); |
| 3140 | X = X ^ RefVal::ReturnedOwned; |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3141 | break; |
| 3142 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3143 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3144 | case RefVal::NotOwned: { |
| 3145 | unsigned cnt = X.getCount(); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3146 | if (cnt) { |
| 3147 | X.setCount(cnt - 1); |
| 3148 | X = X ^ RefVal::ReturnedOwned; |
| 3149 | } |
| 3150 | else { |
| 3151 | X = X ^ RefVal::ReturnedNotOwned; |
| 3152 | } |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3153 | break; |
| 3154 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3155 | |
| 3156 | default: |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3157 | return; |
| 3158 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3159 | |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3160 | // Update the binding. |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3161 | state = state->set<RefBindings>(Sym, X); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 3162 | Pred = Builder.MakeNode(Dst, S, Pred, state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3163 | |
Ted Kremenek | 9f246b6 | 2009-04-30 05:51:50 +0000 | [diff] [blame] | 3164 | // Did we cache out? |
| 3165 | if (!Pred) |
| 3166 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3167 | |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3168 | // Update the autorelease counts. |
| 3169 | static unsigned autoreleasetag = 0; |
| 3170 | GenericNodeBuilder Bd(Builder, S, &autoreleasetag); |
| 3171 | bool stop = false; |
| 3172 | llvm::tie(Pred, state) = HandleAutoreleaseCounts(state , Bd, Pred, Eng, Sym, |
| 3173 | X, stop); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3174 | |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3175 | // Did we cache out? |
| 3176 | if (!Pred || stop) |
| 3177 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3178 | |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3179 | // Get the updated binding. |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3180 | T = state->get<RefBindings>(Sym); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3181 | assert(T); |
| 3182 | X = *T; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3183 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 3184 | // Any leaks or other errors? |
| 3185 | if (X.isReturnedOwned() && X.getCount() == 0) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 3186 | Decl const *CD = &Pred->getCodeDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3187 | if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(CD)) { |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 3188 | const RetainSummary &Summ = *Summaries.getMethodSummary(MD); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3189 | RetEffect RE = Summ.getRetEffect(); |
| 3190 | bool hasError = false; |
| 3191 | |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 3192 | if (RE.getKind() != RetEffect::NoRet) { |
| 3193 | if (isGCEnabled() && RE.getObjKind() == RetEffect::ObjC) { |
| 3194 | // Things are more complicated with garbage collection. If the |
| 3195 | // returned object is suppose to be an Objective-C object, we have |
| 3196 | // a leak (as the caller expects a GC'ed object) because no |
| 3197 | // method should return ownership unless it returns a CF object. |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 3198 | hasError = true; |
Ted Kremenek | 3bc4ffd | 2009-10-14 23:58:34 +0000 | [diff] [blame] | 3199 | X = X ^ RefVal::ErrorGCLeakReturned; |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 3200 | } |
| 3201 | else if (!RE.isOwned()) { |
| 3202 | // Either we are using GC and the returned object is a CF type |
| 3203 | // or we aren't using GC. In either case, we expect that the |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3204 | // enclosing method is expected to return ownership. |
Ted Kremenek | fae664a | 2009-05-16 01:38:01 +0000 | [diff] [blame] | 3205 | hasError = true; |
| 3206 | X = X ^ RefVal::ErrorLeakReturned; |
| 3207 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3208 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3209 | |
| 3210 | if (hasError) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 3211 | // Generate an error node. |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3212 | static int ReturnOwnLeakTag = 0; |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3213 | state = state->set<RefBindings>(Sym, X); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3214 | ExplodedNode *N = |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 3215 | Builder.generateNode(PostStmt(S, Pred->getLocationContext(), |
| 3216 | &ReturnOwnLeakTag), state, Pred); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3217 | if (N) { |
| 3218 | CFRefReport *report = |
Ted Kremenek | 9f246b6 | 2009-04-30 05:51:50 +0000 | [diff] [blame] | 3219 | new CFRefLeakReport(*static_cast<CFRefBug*>(leakAtReturn), *this, |
| 3220 | N, Sym, Eng); |
| 3221 | BR->EmitReport(report); |
| 3222 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 3223 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3224 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3225 | } |
| 3226 | else if (X.isReturnedNotOwned()) { |
Zhongxing Xu | b317f8f | 2009-09-10 05:44:00 +0000 | [diff] [blame] | 3227 | Decl const *CD = &Pred->getCodeDecl(); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3228 | if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(CD)) { |
| 3229 | const RetainSummary &Summ = *Summaries.getMethodSummary(MD); |
| 3230 | if (Summ.getRetEffect().isOwned()) { |
| 3231 | // Trying to return a not owned object to a caller expecting an |
| 3232 | // owned object. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3233 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3234 | static int ReturnNotOwnedForOwnedTag = 0; |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3235 | state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3236 | if (ExplodedNode *N = |
Zhongxing Xu | 25e695b | 2009-08-15 03:17:38 +0000 | [diff] [blame] | 3237 | Builder.generateNode(PostStmt(S, Pred->getLocationContext(), |
| 3238 | &ReturnNotOwnedForOwnedTag), |
| 3239 | state, Pred)) { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 3240 | CFRefReport *report = |
| 3241 | new CFRefReport(*static_cast<CFRefBug*>(returnNotOwnedForOwned), |
| 3242 | *this, N, Sym); |
| 3243 | BR->EmitReport(report); |
| 3244 | } |
| 3245 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 3246 | } |
| 3247 | } |
Ted Kremenek | 4fd8897 | 2008-04-17 18:12:53 +0000 | [diff] [blame] | 3248 | } |
| 3249 | |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3250 | // Assumptions. |
| 3251 | |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 3252 | const GRState* CFRefCount::EvalAssume(const GRState *state, |
| 3253 | SVal Cond, bool Assumption) { |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3254 | |
| 3255 | // FIXME: We may add to the interface of EvalAssume the list of symbols |
| 3256 | // whose assumptions have changed. For now we just iterate through the |
| 3257 | // bindings and check if any of the tracked symbols are NULL. This isn't |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3258 | // too bad since the number of symbols we will track in practice are |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3259 | // probably small and EvalAssume is only called at branches and a few |
| 3260 | // other places. |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3261 | RefBindings B = state->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3262 | |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3263 | if (B.isEmpty()) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3264 | return state; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3265 | |
| 3266 | bool changed = false; |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3267 | RefBindings::Factory& RefBFactory = state->get_context<RefBindings>(); |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3268 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3269 | for (RefBindings::iterator I=B.begin(), E=B.end(); I!=E; ++I) { |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3270 | // Check if the symbol is null (or equal to any constant). |
| 3271 | // If this is the case, stop tracking the symbol. |
Ted Kremenek | a591bc0 | 2009-06-18 22:57:13 +0000 | [diff] [blame] | 3272 | if (state->getSymVal(I.getKey())) { |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3273 | changed = true; |
| 3274 | B = RefBFactory.Remove(B, I.getKey()); |
| 3275 | } |
| 3276 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3277 | |
Ted Kremenek | b9d17f9 | 2008-08-17 03:20:02 +0000 | [diff] [blame] | 3278 | if (changed) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3279 | state = state->set<RefBindings>(B); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3280 | |
Ted Kremenek | 72cd17f | 2008-08-14 21:16:54 +0000 | [diff] [blame] | 3281 | return state; |
Ted Kremenek | cb61292 | 2008-04-18 19:23:43 +0000 | [diff] [blame] | 3282 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3283 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3284 | const GRState * CFRefCount::Update(const GRState * state, SymbolRef sym, |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 3285 | RefVal V, ArgEffect E, |
| 3286 | RefVal::Kind& hasErr) { |
Ted Kremenek | 1c512f5 | 2009-02-18 18:54:33 +0000 | [diff] [blame] | 3287 | |
| 3288 | // In GC mode [... release] and [... retain] do nothing. |
| 3289 | switch (E) { |
| 3290 | default: break; |
| 3291 | case IncRefMsg: E = isGCEnabled() ? DoNothing : IncRef; break; |
| 3292 | case DecRefMsg: E = isGCEnabled() ? DoNothing : DecRef; break; |
Ted Kremenek | 2701900 | 2009-02-18 21:57:45 +0000 | [diff] [blame] | 3293 | case MakeCollectable: E = isGCEnabled() ? DecRef : DoNothing; break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3294 | case NewAutoreleasePool: E = isGCEnabled() ? DoNothing : |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 3295 | NewAutoreleasePool; break; |
Ted Kremenek | 1c512f5 | 2009-02-18 18:54:33 +0000 | [diff] [blame] | 3296 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3297 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3298 | // Handle all use-after-releases. |
| 3299 | if (!isGCEnabled() && V.getKind() == RefVal::Released) { |
| 3300 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3301 | hasErr = V.getKind(); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3302 | return state->set<RefBindings>(sym, V); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3303 | } |
| 3304 | |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3305 | switch (E) { |
| 3306 | default: |
| 3307 | assert (false && "Unhandled CFRef transition."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3308 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3309 | case Dealloc: |
| 3310 | // Any use of -dealloc in GC is *bad*. |
| 3311 | if (isGCEnabled()) { |
| 3312 | V = V ^ RefVal::ErrorDeallocGC; |
| 3313 | hasErr = V.getKind(); |
| 3314 | break; |
| 3315 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3316 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3317 | switch (V.getKind()) { |
| 3318 | default: |
| 3319 | assert(false && "Invalid case."); |
| 3320 | case RefVal::Owned: |
| 3321 | // The object immediately transitions to the released state. |
| 3322 | V = V ^ RefVal::Released; |
| 3323 | V.clearCounts(); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3324 | return state->set<RefBindings>(sym, V); |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3325 | case RefVal::NotOwned: |
| 3326 | V = V ^ RefVal::ErrorDeallocNotOwned; |
| 3327 | hasErr = V.getKind(); |
| 3328 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3329 | } |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3330 | break; |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 3331 | |
Ted Kremenek | 3579073 | 2009-02-25 23:11:49 +0000 | [diff] [blame] | 3332 | case NewAutoreleasePool: |
| 3333 | assert(!isGCEnabled()); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3334 | return state->add<AutoreleaseStack>(sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3335 | |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 3336 | case MayEscape: |
| 3337 | if (V.getKind() == RefVal::Owned) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3338 | V = V ^ RefVal::NotOwned; |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 3339 | break; |
| 3340 | } |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3341 | |
Ted Kremenek | 3eabf1c | 2008-05-22 17:31:13 +0000 | [diff] [blame] | 3342 | // Fall-through. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3343 | |
Ted Kremenek | 070a825 | 2008-07-09 18:11:16 +0000 | [diff] [blame] | 3344 | case DoNothingByRef: |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3345 | case DoNothing: |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 3346 | return state; |
Ted Kremenek | e19f449 | 2008-06-30 16:57:41 +0000 | [diff] [blame] | 3347 | |
Ted Kremenek | abf4397 | 2009-01-28 21:44:40 +0000 | [diff] [blame] | 3348 | case Autorelease: |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3349 | if (isGCEnabled()) |
| 3350 | return state; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3351 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 3352 | // Update the autorelease counts. |
| 3353 | state = SendAutorelease(state, ARCountFactory, sym); |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 3354 | V = V.autorelease(); |
Ted Kremenek | 6b62ec9 | 2009-05-09 01:50:57 +0000 | [diff] [blame] | 3355 | break; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3356 | |
Ted Kremenek | 1499389 | 2008-05-06 02:41:27 +0000 | [diff] [blame] | 3357 | case StopTracking: |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3358 | return state->remove<RefBindings>(sym); |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 3359 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3360 | case IncRef: |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3361 | switch (V.getKind()) { |
| 3362 | default: |
| 3363 | assert(false); |
| 3364 | |
| 3365 | case RefVal::Owned: |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3366 | case RefVal::NotOwned: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3367 | V = V + 1; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3368 | break; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3369 | case RefVal::Released: |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3370 | // Non-GC cases are handled above. |
| 3371 | assert(isGCEnabled()); |
| 3372 | V = (V ^ RefVal::Owned) + 1; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3373 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3374 | } |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 3375 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3376 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3377 | case SelfOwn: |
| 3378 | V = V ^ RefVal::NotOwned; |
Ted Kremenek | 1c512f5 | 2009-02-18 18:54:33 +0000 | [diff] [blame] | 3379 | // Fall-through. |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3380 | case DecRef: |
| 3381 | switch (V.getKind()) { |
| 3382 | default: |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3383 | // case 'RefVal::Released' handled above. |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3384 | assert (false); |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 3385 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3386 | case RefVal::Owned: |
Ted Kremenek | bb8c5aa | 2009-02-18 22:57:22 +0000 | [diff] [blame] | 3387 | assert(V.getCount() > 0); |
| 3388 | if (V.getCount() == 1) V = V ^ RefVal::Released; |
| 3389 | V = V - 1; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3390 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3391 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3392 | case RefVal::NotOwned: |
| 3393 | if (V.getCount() > 0) |
| 3394 | V = V - 1; |
Ted Kremenek | 61b9f87 | 2008-04-10 23:09:18 +0000 | [diff] [blame] | 3395 | else { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3396 | V = V ^ RefVal::ErrorReleaseNotOwned; |
Ted Kremenek | 9ed18e6 | 2008-04-16 04:28:53 +0000 | [diff] [blame] | 3397 | hasErr = V.getKind(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3398 | } |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3399 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3400 | |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3401 | case RefVal::Released: |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3402 | // Non-GC cases are handled above. |
| 3403 | assert(isGCEnabled()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 3404 | V = V ^ RefVal::ErrorUseAfterRelease; |
Ted Kremenek | 9ed18e6 | 2008-04-16 04:28:53 +0000 | [diff] [blame] | 3405 | hasErr = V.getKind(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3406 | break; |
| 3407 | } |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 3408 | break; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 3409 | } |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3410 | return state->set<RefBindings>(sym, V); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3411 | } |
| 3412 | |
Ted Kremenek | fa34b33 | 2008-04-09 01:10:13 +0000 | [diff] [blame] | 3413 | //===----------------------------------------------------------------------===// |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3414 | // Handle dead symbols and end-of-path. |
| 3415 | //===----------------------------------------------------------------------===// |
| 3416 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3417 | std::pair<ExplodedNode*, const GRState *> |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3418 | CFRefCount::HandleAutoreleaseCounts(const GRState * state, GenericNodeBuilder Bd, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3419 | ExplodedNode* Pred, |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3420 | GRExprEngine &Eng, |
| 3421 | SymbolRef Sym, RefVal V, bool &stop) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3422 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3423 | unsigned ACnt = V.getAutoreleaseCount(); |
| 3424 | stop = false; |
| 3425 | |
| 3426 | // No autorelease counts? Nothing to be done. |
| 3427 | if (!ACnt) |
| 3428 | return std::make_pair(Pred, state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3429 | |
| 3430 | assert(!isGCEnabled() && "Autorelease counts in GC mode?"); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3431 | unsigned Cnt = V.getCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3432 | |
Ted Kremenek | 95d3b90 | 2009-05-11 15:26:06 +0000 | [diff] [blame] | 3433 | // FIXME: Handle sending 'autorelease' to already released object. |
| 3434 | |
| 3435 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3436 | ++Cnt; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3437 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3438 | if (ACnt <= Cnt) { |
Ted Kremenek | 80c2418 | 2009-05-09 00:44:07 +0000 | [diff] [blame] | 3439 | if (ACnt == Cnt) { |
| 3440 | V.clearCounts(); |
Ted Kremenek | 95d3b90 | 2009-05-11 15:26:06 +0000 | [diff] [blame] | 3441 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3442 | V = V ^ RefVal::ReturnedNotOwned; |
| 3443 | else |
| 3444 | V = V ^ RefVal::NotOwned; |
Ted Kremenek | 80c2418 | 2009-05-09 00:44:07 +0000 | [diff] [blame] | 3445 | } |
Ted Kremenek | 95d3b90 | 2009-05-11 15:26:06 +0000 | [diff] [blame] | 3446 | else { |
Ted Kremenek | 80c2418 | 2009-05-09 00:44:07 +0000 | [diff] [blame] | 3447 | V.setCount(Cnt - ACnt); |
| 3448 | V.setAutoreleaseCount(0); |
| 3449 | } |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3450 | state = state->set<RefBindings>(Sym, V); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3451 | ExplodedNode *N = Bd.MakeNode(state, Pred); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3452 | stop = (N == 0); |
| 3453 | return std::make_pair(N, state); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3454 | } |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3455 | |
| 3456 | // Woah! More autorelease counts then retain counts left. |
| 3457 | // Emit hard error. |
| 3458 | stop = true; |
| 3459 | V = V ^ RefVal::ErrorOverAutorelease; |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3460 | state = state->set<RefBindings>(Sym, V); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3461 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3462 | if (ExplodedNode *N = Bd.MakeNode(state, Pred)) { |
Ted Kremenek | 80c2418 | 2009-05-09 00:44:07 +0000 | [diff] [blame] | 3463 | N->markAsSink(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3464 | |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3465 | std::string sbuf; |
| 3466 | llvm::raw_string_ostream os(sbuf); |
Ted Kremenek | daec145 | 2009-05-15 06:02:08 +0000 | [diff] [blame] | 3467 | os << "Object over-autoreleased: object was sent -autorelease"; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 3468 | if (V.getAutoreleaseCount() > 1) |
| 3469 | os << V.getAutoreleaseCount() << " times"; |
| 3470 | os << " but the object has "; |
| 3471 | if (V.getCount() == 0) |
| 3472 | os << "zero (locally visible)"; |
| 3473 | else |
| 3474 | os << "+" << V.getCount(); |
| 3475 | os << " retain counts"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3476 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3477 | CFRefReport *report = |
| 3478 | new CFRefReport(*static_cast<CFRefBug*>(overAutorelease), |
Benjamin Kramer | f017173 | 2009-11-29 18:27:55 +0000 | [diff] [blame] | 3479 | *this, N, Sym, os.str()); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3480 | BR->EmitReport(report); |
| 3481 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3482 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3483 | return std::make_pair((ExplodedNode*)0, state); |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3484 | } |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3485 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3486 | const GRState * |
| 3487 | CFRefCount::HandleSymbolDeath(const GRState * state, SymbolRef sid, RefVal V, |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3488 | llvm::SmallVectorImpl<SymbolRef> &Leaked) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3489 | |
| 3490 | bool hasLeak = V.isOwned() || |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3491 | ((V.isNotOwned() || V.isReturnedOwned()) && V.getCount() > 0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3492 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3493 | if (!hasLeak) |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3494 | return state->remove<RefBindings>(sid); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3495 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3496 | Leaked.push_back(sid); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3497 | return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3498 | } |
| 3499 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3500 | ExplodedNode* |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3501 | CFRefCount::ProcessLeaks(const GRState * state, |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3502 | llvm::SmallVectorImpl<SymbolRef> &Leaked, |
| 3503 | GenericNodeBuilder &Builder, |
| 3504 | GRExprEngine& Eng, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3505 | ExplodedNode *Pred) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3506 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3507 | if (Leaked.empty()) |
| 3508 | return Pred; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3509 | |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3510 | // Generate an intermediate node representing the leak point. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3511 | ExplodedNode *N = Builder.MakeNode(state, Pred); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3512 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3513 | if (N) { |
| 3514 | for (llvm::SmallVectorImpl<SymbolRef>::iterator |
| 3515 | I = Leaked.begin(), E = Leaked.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3516 | |
| 3517 | CFRefBug *BT = static_cast<CFRefBug*>(Pred ? leakWithinFunction |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3518 | : leakAtReturn); |
| 3519 | assert(BT && "BugType not initialized."); |
| 3520 | CFRefLeakReport* report = new CFRefLeakReport(*BT, *this, N, *I, Eng); |
| 3521 | BR->EmitReport(report); |
| 3522 | } |
| 3523 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3524 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3525 | return N; |
| 3526 | } |
| 3527 | |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3528 | void CFRefCount::EvalEndPath(GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3529 | GREndPathNodeBuilder& Builder) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3530 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3531 | const GRState *state = Builder.getState(); |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3532 | GenericNodeBuilder Bd(Builder); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3533 | RefBindings B = state->get<RefBindings>(); |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3534 | ExplodedNode *Pred = 0; |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3535 | |
| 3536 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3537 | bool stop = false; |
| 3538 | llvm::tie(Pred, state) = HandleAutoreleaseCounts(state, Bd, Pred, Eng, |
| 3539 | (*I).first, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3540 | (*I).second, stop); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3541 | |
| 3542 | if (stop) |
| 3543 | return; |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3544 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3545 | |
| 3546 | B = state->get<RefBindings>(); |
| 3547 | llvm::SmallVector<SymbolRef, 10> Leaked; |
| 3548 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3549 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) |
| 3550 | state = HandleSymbolDeath(state, (*I).first, (*I).second, Leaked); |
| 3551 | |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3552 | ProcessLeaks(state, Leaked, Bd, Eng, Pred); |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3553 | } |
| 3554 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3555 | void CFRefCount::EvalDeadSymbols(ExplodedNodeSet& Dst, |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3556 | GRExprEngine& Eng, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3557 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3558 | ExplodedNode* Pred, |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3559 | Stmt* S, |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3560 | const GRState* state, |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3561 | SymbolReaper& SymReaper) { |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3562 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3563 | RefBindings B = state->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3564 | |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3565 | // Update counts from autorelease pools |
| 3566 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3567 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3568 | SymbolRef Sym = *I; |
| 3569 | if (const RefVal* T = B.lookup(Sym)){ |
| 3570 | // Use the symbol as the tag. |
| 3571 | // FIXME: This might not be as unique as we would like. |
| 3572 | GenericNodeBuilder Bd(Builder, S, Sym); |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 3573 | bool stop = false; |
| 3574 | llvm::tie(Pred, state) = HandleAutoreleaseCounts(state, Bd, Pred, Eng, |
| 3575 | Sym, *T, stop); |
| 3576 | if (stop) |
| 3577 | return; |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3578 | } |
| 3579 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3580 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3581 | B = state->get<RefBindings>(); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3582 | llvm::SmallVector<SymbolRef, 10> Leaked; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3583 | |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3584 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3585 | E = SymReaper.dead_end(); I != E; ++I) { |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3586 | if (const RefVal* T = B.lookup(*I)) |
| 3587 | state = HandleSymbolDeath(state, *I, *T, Leaked); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3588 | } |
| 3589 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3590 | static unsigned LeakPPTag = 0; |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 3591 | { |
| 3592 | GenericNodeBuilder Bd(Builder, S, &LeakPPTag); |
| 3593 | Pred = ProcessLeaks(state, Leaked, Bd, Eng, Pred); |
| 3594 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3595 | |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3596 | // Did we cache out? |
| 3597 | if (!Pred) |
| 3598 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3599 | |
Ted Kremenek | 33b6f63 | 2009-02-19 23:47:02 +0000 | [diff] [blame] | 3600 | // Now generate a new node that nukes the old bindings. |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3601 | RefBindings::Factory& F = state->get_context<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3602 | |
Ted Kremenek | 33b6f63 | 2009-02-19 23:47:02 +0000 | [diff] [blame] | 3603 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 3604 | E = SymReaper.dead_end(); I!=E; ++I) B = F.Remove(B, *I); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3605 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 3606 | state = state->set<RefBindings>(B); |
Ted Kremenek | 33b6f63 | 2009-02-19 23:47:02 +0000 | [diff] [blame] | 3607 | Builder.MakeNode(Dst, S, Pred, state); |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3608 | } |
| 3609 | |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3610 | void CFRefCount::ProcessNonLeakError(ExplodedNodeSet& Dst, |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3611 | GRStmtNodeBuilder& Builder, |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 3612 | Expr* NodeExpr, Expr* ErrorExpr, |
| 3613 | ExplodedNode* Pred, |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3614 | const GRState* St, |
| 3615 | RefVal::Kind hasErr, SymbolRef Sym) { |
| 3616 | Builder.BuildSinks = true; |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 3617 | ExplodedNode *N = Builder.MakeNode(Dst, NodeExpr, Pred, St); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3618 | |
Ted Kremenek | 6b62ec9 | 2009-05-09 01:50:57 +0000 | [diff] [blame] | 3619 | if (!N) |
| 3620 | return; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3621 | |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3622 | CFRefBug *BT = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3623 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3624 | switch (hasErr) { |
| 3625 | default: |
| 3626 | assert(false && "Unhandled error."); |
| 3627 | return; |
| 3628 | case RefVal::ErrorUseAfterRelease: |
| 3629 | BT = static_cast<CFRefBug*>(useAfterRelease); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3630 | break; |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 3631 | case RefVal::ErrorReleaseNotOwned: |
| 3632 | BT = static_cast<CFRefBug*>(releaseNotOwned); |
| 3633 | break; |
| 3634 | case RefVal::ErrorDeallocGC: |
| 3635 | BT = static_cast<CFRefBug*>(deallocGC); |
| 3636 | break; |
| 3637 | case RefVal::ErrorDeallocNotOwned: |
| 3638 | BT = static_cast<CFRefBug*>(deallocNotOwned); |
| 3639 | break; |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3640 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3641 | |
Ted Kremenek | fe9e543 | 2009-02-18 03:48:14 +0000 | [diff] [blame] | 3642 | CFRefReport *report = new CFRefReport(*BT, *this, N, Sym); |
Ted Kremenek | cf70177 | 2009-02-05 06:50:21 +0000 | [diff] [blame] | 3643 | report->addRange(ErrorExpr->getSourceRange()); |
| 3644 | BR->EmitReport(report); |
| 3645 | } |
| 3646 | |
| 3647 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3648 | // Pieces of the retain/release checker implemented using a CheckerVisitor. |
| 3649 | // More pieces of the retain/release checker will be migrated to this interface |
| 3650 | // (ideally, all of it some day). |
| 3651 | //===----------------------------------------------------------------------===// |
| 3652 | |
| 3653 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 3654 | class RetainReleaseChecker |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3655 | : public CheckerVisitor<RetainReleaseChecker> { |
| 3656 | CFRefCount *TF; |
| 3657 | public: |
| 3658 | RetainReleaseChecker(CFRefCount *tf) : TF(tf) {} |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 3659 | static void* getTag() { static int x = 0; return &x; } |
| 3660 | |
| 3661 | void PostVisitBlockExpr(CheckerContext &C, const BlockExpr *BE); |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3662 | }; |
| 3663 | } // end anonymous namespace |
| 3664 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 3665 | |
| 3666 | void RetainReleaseChecker::PostVisitBlockExpr(CheckerContext &C, |
| 3667 | const BlockExpr *BE) { |
| 3668 | |
| 3669 | // Scan the BlockDecRefExprs for any object the retain/release checker |
| 3670 | // may be tracking. |
| 3671 | if (!BE->hasBlockDeclRefExprs()) |
| 3672 | return; |
| 3673 | |
| 3674 | const GRState *state = C.getState(); |
| 3675 | const BlockDataRegion *R = |
| 3676 | cast<BlockDataRegion>(state->getSVal(BE).getAsRegion()); |
| 3677 | |
| 3678 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 3679 | E = R->referenced_vars_end(); |
| 3680 | |
| 3681 | if (I == E) |
| 3682 | return; |
| 3683 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 3684 | // FIXME: For now we invalidate the tracking of all symbols passed to blocks |
| 3685 | // via captured variables, even though captured variables result in a copy |
| 3686 | // and in implicit increment/decrement of a retain count. |
| 3687 | llvm::SmallVector<const MemRegion*, 10> Regions; |
| 3688 | const LocationContext *LC = C.getPredecessor()->getLocationContext(); |
| 3689 | MemRegionManager &MemMgr = C.getValueManager().getRegionManager(); |
| 3690 | |
| 3691 | for ( ; I != E; ++I) { |
| 3692 | const VarRegion *VR = *I; |
| 3693 | if (VR->getSuperRegion() == R) { |
| 3694 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 3695 | } |
| 3696 | Regions.push_back(VR); |
| 3697 | } |
| 3698 | |
| 3699 | state = |
| 3700 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 3701 | Regions.data() + Regions.size()).getState(); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 3702 | C.addTransition(state); |
| 3703 | } |
| 3704 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3705 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d71ed26 | 2008-04-10 22:16:52 +0000 | [diff] [blame] | 3706 | // Transfer function creation for external clients. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3707 | //===----------------------------------------------------------------------===// |
| 3708 | |
Ted Kremenek | d295bae | 2009-11-25 22:08:49 +0000 | [diff] [blame] | 3709 | void CFRefCount::RegisterChecks(GRExprEngine& Eng) { |
| 3710 | BugReporter &BR = Eng.getBugReporter(); |
| 3711 | |
| 3712 | useAfterRelease = new UseAfterRelease(this); |
| 3713 | BR.Register(useAfterRelease); |
| 3714 | |
| 3715 | releaseNotOwned = new BadRelease(this); |
| 3716 | BR.Register(releaseNotOwned); |
| 3717 | |
| 3718 | deallocGC = new DeallocGC(this); |
| 3719 | BR.Register(deallocGC); |
| 3720 | |
| 3721 | deallocNotOwned = new DeallocNotOwned(this); |
| 3722 | BR.Register(deallocNotOwned); |
| 3723 | |
| 3724 | overAutorelease = new OverAutorelease(this); |
| 3725 | BR.Register(overAutorelease); |
| 3726 | |
| 3727 | returnNotOwnedForOwned = new ReturnedNotOwnedForOwned(this); |
| 3728 | BR.Register(returnNotOwnedForOwned); |
| 3729 | |
| 3730 | // First register "return" leaks. |
| 3731 | const char* name = 0; |
| 3732 | |
| 3733 | if (isGCEnabled()) |
| 3734 | name = "Leak of returned object when using garbage collection"; |
| 3735 | else if (getLangOptions().getGCMode() == LangOptions::HybridGC) |
| 3736 | name = "Leak of returned object when not using garbage collection (GC) in " |
| 3737 | "dual GC/non-GC code"; |
| 3738 | else { |
| 3739 | assert(getLangOptions().getGCMode() == LangOptions::NonGC); |
| 3740 | name = "Leak of returned object"; |
| 3741 | } |
| 3742 | |
| 3743 | // Leaks should not be reported if they are post-dominated by a sink. |
| 3744 | leakAtReturn = new LeakAtReturn(this, name); |
| 3745 | leakAtReturn->setSuppressOnSink(true); |
| 3746 | BR.Register(leakAtReturn); |
| 3747 | |
| 3748 | // Second, register leaks within a function/method. |
| 3749 | if (isGCEnabled()) |
| 3750 | name = "Leak of object when using garbage collection"; |
| 3751 | else if (getLangOptions().getGCMode() == LangOptions::HybridGC) |
| 3752 | name = "Leak of object when not using garbage collection (GC) in " |
| 3753 | "dual GC/non-GC code"; |
| 3754 | else { |
| 3755 | assert(getLangOptions().getGCMode() == LangOptions::NonGC); |
| 3756 | name = "Leak"; |
| 3757 | } |
| 3758 | |
| 3759 | // Leaks should not be reported if they are post-dominated by sinks. |
| 3760 | leakWithinFunction = new LeakWithinFunction(this, name); |
| 3761 | leakWithinFunction->setSuppressOnSink(true); |
| 3762 | BR.Register(leakWithinFunction); |
| 3763 | |
| 3764 | // Save the reference to the BugReporter. |
| 3765 | this->BR = &BR; |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3766 | |
| 3767 | // Register the RetainReleaseChecker with the GRExprEngine object. |
| 3768 | // Functionality in CFRefCount will be migrated to RetainReleaseChecker |
| 3769 | // over time. |
| 3770 | Eng.registerCheck(new RetainReleaseChecker(this)); |
Ted Kremenek | d295bae | 2009-11-25 22:08:49 +0000 | [diff] [blame] | 3771 | } |
| 3772 | |
Ted Kremenek | 072192b | 2008-04-30 23:47:44 +0000 | [diff] [blame] | 3773 | GRTransferFuncs* clang::MakeCFRefCountTF(ASTContext& Ctx, bool GCEnabled, |
| 3774 | const LangOptions& lopts) { |
Ted Kremenek | 78d4624 | 2008-07-22 16:21:24 +0000 | [diff] [blame] | 3775 | return new CFRefCount(Ctx, GCEnabled, lopts); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 3776 | } |