Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1 | //==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--// |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 2 | // |
| 3 | // The LLVM Compiler Infrastructure |
| 4 | // |
| 5 | // This file is distributed under the University of Illinois Open Source |
| 6 | // License. See LICENSE.TXT for details. |
| 7 | // |
| 8 | //===----------------------------------------------------------------------===// |
| 9 | // |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 10 | // This file defines the methods for RetainCountChecker, which implements |
| 11 | // a reference count checker for Core Foundation and Cocoa on (Mac OS X). |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 12 | // |
| 13 | //===----------------------------------------------------------------------===// |
| 14 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 15 | #include "ClangSACheckers.h" |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 16 | #include "clang/AST/DeclObjC.h" |
Ted Kremenek | b277159 | 2011-03-30 17:41:19 +0000 | [diff] [blame] | 17 | #include "clang/AST/DeclCXX.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 18 | #include "clang/Basic/LangOptions.h" |
| 19 | #include "clang/Basic/SourceManager.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 20 | #include "clang/Analysis/DomainSpecific/CocoaConventions.h" |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 21 | #include "clang/AST/ParentMap.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 22 | #include "clang/StaticAnalyzer/Core/Checker.h" |
| 23 | #include "clang/StaticAnalyzer/Core/CheckerManager.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 24 | #include "clang/StaticAnalyzer/Core/BugReporter/BugType.h" |
| 25 | #include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h" |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 26 | #include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h" |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 27 | #include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h" |
Ted Kremenek | 9b66371 | 2011-02-10 01:03:03 +0000 | [diff] [blame] | 28 | #include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h" |
Jordy Rose | d1e5a89 | 2011-09-02 08:02:59 +0000 | [diff] [blame] | 29 | #include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h" |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 30 | #include "llvm/ADT/DenseMap.h" |
| 31 | #include "llvm/ADT/FoldingSet.h" |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 32 | #include "llvm/ADT/ImmutableList.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 33 | #include "llvm/ADT/ImmutableMap.h" |
Benjamin Kramer | 8fe83e1 | 2012-02-04 13:45:25 +0000 | [diff] [blame] | 34 | #include "llvm/ADT/SmallString.h" |
Ted Kremenek | 6ed9afc | 2008-05-16 18:33:44 +0000 | [diff] [blame] | 35 | #include "llvm/ADT/STLExtras.h" |
Ted Kremenek | 0b526b4 | 2010-02-18 00:05:58 +0000 | [diff] [blame] | 36 | #include "llvm/ADT/StringExtras.h" |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 37 | #include <cstdarg> |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 38 | |
| 39 | using namespace clang; |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 40 | using namespace ento; |
Ted Kremenek | a64e89b | 2010-01-27 06:13:48 +0000 | [diff] [blame] | 41 | using llvm::StrInStrNoCase; |
Ted Kremenek | 4c79e55 | 2008-11-05 16:54:44 +0000 | [diff] [blame] | 42 | |
Ted Kremenek | d775c66 | 2010-05-21 21:57:00 +0000 | [diff] [blame] | 43 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 44 | /// Wrapper around different kinds of node builder, so that helper functions |
| 45 | /// can have a common interface. |
Francois Pichet | ea09785 | 2011-01-11 10:41:37 +0000 | [diff] [blame] | 46 | class GenericNodeBuilderRefCount { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 47 | CheckerContext *C; |
Ted Kremenek | ca80453 | 2011-08-12 23:04:46 +0000 | [diff] [blame] | 48 | const ProgramPointTag *tag; |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 49 | public: |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 50 | GenericNodeBuilderRefCount(CheckerContext &c, |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 51 | const ProgramPointTag *t = 0) |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 52 | : C(&c), tag(t){} |
Zhongxing Xu | 031ccc0 | 2009-08-06 12:48:26 +0000 | [diff] [blame] | 53 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 54 | ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred, |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 55 | bool MarkAsSink = false) { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 56 | return C->addTransition(state, Pred, tag, MarkAsSink); |
Ted Kremenek | 9d9d3a6 | 2009-05-08 23:09:42 +0000 | [diff] [blame] | 57 | } |
| 58 | }; |
| 59 | } // end anonymous namespace |
| 60 | |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 61 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 62 | // Primitives used for constructing summaries for function/method calls. |
Ted Kremenek | 05cbe1a | 2008-04-09 23:49:11 +0000 | [diff] [blame] | 63 | //===----------------------------------------------------------------------===// |
| 64 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 65 | /// ArgEffect is used to summarize a function/method call's effect on a |
| 66 | /// particular argument. |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 67 | enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 68 | DecRefBridgedTransfered, |
Jordy Rose | bd85b13 | 2011-08-24 19:10:50 +0000 | [diff] [blame] | 69 | IncRefMsg, IncRef, MakeCollectable, MayEscape, |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 70 | NewAutoreleasePool, SelfOwn, StopTracking }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 71 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 72 | namespace llvm { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 73 | template <> struct FoldingSetTrait<ArgEffect> { |
| 74 | static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) { |
| 75 | ID.AddInteger((unsigned) X); |
| 76 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 77 | }; |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 78 | } // end llvm namespace |
| 79 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 80 | /// ArgEffects summarizes the effects of a function/method call on all of |
| 81 | /// its arguments. |
| 82 | typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects; |
| 83 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 84 | namespace { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 85 | |
| 86 | /// RetEffect is used to summarize a function/method call's behavior with |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 87 | /// respect to its return value. |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 88 | class RetEffect { |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 89 | public: |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 90 | enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 91 | NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol, |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 92 | OwnedWhenTrackedReceiver }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 93 | |
| 94 | enum ObjKind { CF, ObjC, AnyObj }; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 95 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 96 | private: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 97 | Kind K; |
| 98 | ObjKind O; |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 99 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 100 | RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 101 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 102 | public: |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 103 | Kind getKind() const { return K; } |
| 104 | |
| 105 | ObjKind getObjKind() const { return O; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 106 | |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 107 | bool isOwned() const { |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 108 | return K == OwnedSymbol || K == OwnedAllocatedSymbol || |
| 109 | K == OwnedWhenTrackedReceiver; |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 110 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 111 | |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 112 | bool operator==(const RetEffect &Other) const { |
| 113 | return K == Other.K && O == Other.O; |
| 114 | } |
| 115 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 116 | static RetEffect MakeOwnedWhenTrackedReceiver() { |
| 117 | return RetEffect(OwnedWhenTrackedReceiver, ObjC); |
| 118 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 119 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 120 | static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) { |
| 121 | return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 122 | } |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 123 | static RetEffect MakeNotOwned(ObjKind o) { |
| 124 | return RetEffect(NotOwnedSymbol, o); |
Ted Kremenek | e798e7c | 2009-04-27 19:14:45 +0000 | [diff] [blame] | 125 | } |
| 126 | static RetEffect MakeGCNotOwned() { |
| 127 | return RetEffect(GCNotOwnedSymbol, ObjC); |
| 128 | } |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 129 | static RetEffect MakeARCNotOwned() { |
| 130 | return RetEffect(ARCNotOwnedSymbol, ObjC); |
| 131 | } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 132 | static RetEffect MakeNoRet() { |
| 133 | return RetEffect(NoRet); |
Ted Kremenek | a734470 | 2008-06-23 18:02:52 +0000 | [diff] [blame] | 134 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 135 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 136 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 137 | //===----------------------------------------------------------------------===// |
| 138 | // Reference-counting logic (typestate + counts). |
| 139 | //===----------------------------------------------------------------------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 140 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 141 | class RefVal { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 142 | public: |
| 143 | enum Kind { |
| 144 | Owned = 0, // Owning reference. |
| 145 | NotOwned, // Reference is not owned by still valid (not freed). |
| 146 | Released, // Object has been released. |
| 147 | ReturnedOwned, // Returned object passes ownership to caller. |
| 148 | ReturnedNotOwned, // Return object does not pass ownership to caller. |
| 149 | ERROR_START, |
| 150 | ErrorDeallocNotOwned, // -dealloc called on non-owned object. |
| 151 | ErrorDeallocGC, // Calling -dealloc with GC enabled. |
| 152 | ErrorUseAfterRelease, // Object used after released. |
| 153 | ErrorReleaseNotOwned, // Release of an object that was not owned. |
| 154 | ERROR_LEAK_START, |
| 155 | ErrorLeak, // A memory leak due to excessive reference counts. |
| 156 | ErrorLeakReturned, // A memory leak due to the returning method not having |
| 157 | // the correct naming conventions. |
| 158 | ErrorGCLeakReturned, |
| 159 | ErrorOverAutorelease, |
| 160 | ErrorReturnedNotOwned |
| 161 | }; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 162 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 163 | private: |
| 164 | Kind kind; |
| 165 | RetEffect::ObjKind okind; |
| 166 | unsigned Cnt; |
| 167 | unsigned ACnt; |
| 168 | QualType T; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 169 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 170 | RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t) |
| 171 | : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {} |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 172 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 173 | public: |
| 174 | Kind getKind() const { return kind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 175 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 176 | RetEffect::ObjKind getObjKind() const { return okind; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 177 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 178 | unsigned getCount() const { return Cnt; } |
| 179 | unsigned getAutoreleaseCount() const { return ACnt; } |
| 180 | unsigned getCombinedCounts() const { return Cnt + ACnt; } |
| 181 | void clearCounts() { Cnt = 0; ACnt = 0; } |
| 182 | void setCount(unsigned i) { Cnt = i; } |
| 183 | void setAutoreleaseCount(unsigned i) { ACnt = i; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 184 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 185 | QualType getType() const { return T; } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 186 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 187 | bool isOwned() const { |
| 188 | return getKind() == Owned; |
| 189 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 190 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 191 | bool isNotOwned() const { |
| 192 | return getKind() == NotOwned; |
| 193 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 194 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 195 | bool isReturnedOwned() const { |
| 196 | return getKind() == ReturnedOwned; |
| 197 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 198 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 199 | bool isReturnedNotOwned() const { |
| 200 | return getKind() == ReturnedNotOwned; |
| 201 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 202 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 203 | static RefVal makeOwned(RetEffect::ObjKind o, QualType t, |
| 204 | unsigned Count = 1) { |
| 205 | return RefVal(Owned, o, Count, 0, t); |
| 206 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 207 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 208 | static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t, |
| 209 | unsigned Count = 0) { |
| 210 | return RefVal(NotOwned, o, Count, 0, t); |
| 211 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 212 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 213 | // Comparison, profiling, and pretty-printing. |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 214 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 215 | bool operator==(const RefVal& X) const { |
| 216 | return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt; |
| 217 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 218 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 219 | RefVal operator-(size_t i) const { |
| 220 | return RefVal(getKind(), getObjKind(), getCount() - i, |
| 221 | getAutoreleaseCount(), getType()); |
| 222 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 223 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 224 | RefVal operator+(size_t i) const { |
| 225 | return RefVal(getKind(), getObjKind(), getCount() + i, |
| 226 | getAutoreleaseCount(), getType()); |
| 227 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 228 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 229 | RefVal operator^(Kind k) const { |
| 230 | return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(), |
| 231 | getType()); |
| 232 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 233 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 234 | RefVal autorelease() const { |
| 235 | return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1, |
| 236 | getType()); |
| 237 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 238 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 239 | void Profile(llvm::FoldingSetNodeID& ID) const { |
| 240 | ID.AddInteger((unsigned) kind); |
| 241 | ID.AddInteger(Cnt); |
| 242 | ID.AddInteger(ACnt); |
| 243 | ID.Add(T); |
| 244 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 245 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 246 | void print(raw_ostream &Out) const; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 247 | }; |
| 248 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 249 | void RefVal::print(raw_ostream &Out) const { |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 250 | if (!T.isNull()) |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 251 | Out << "Tracked " << T.getAsString() << '/'; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 252 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 253 | switch (getKind()) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 254 | default: llvm_unreachable("Invalid RefVal kind"); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 255 | case Owned: { |
| 256 | Out << "Owned"; |
| 257 | unsigned cnt = getCount(); |
| 258 | if (cnt) Out << " (+ " << cnt << ")"; |
| 259 | break; |
| 260 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 261 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 262 | case NotOwned: { |
| 263 | Out << "NotOwned"; |
| 264 | unsigned cnt = getCount(); |
| 265 | if (cnt) Out << " (+ " << cnt << ")"; |
| 266 | break; |
| 267 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 268 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 269 | case ReturnedOwned: { |
| 270 | Out << "ReturnedOwned"; |
| 271 | unsigned cnt = getCount(); |
| 272 | if (cnt) Out << " (+ " << cnt << ")"; |
| 273 | break; |
| 274 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 275 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 276 | case ReturnedNotOwned: { |
| 277 | Out << "ReturnedNotOwned"; |
| 278 | unsigned cnt = getCount(); |
| 279 | if (cnt) Out << " (+ " << cnt << ")"; |
| 280 | break; |
| 281 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 282 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 283 | case Released: |
| 284 | Out << "Released"; |
| 285 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 286 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 287 | case ErrorDeallocGC: |
| 288 | Out << "-dealloc (GC)"; |
| 289 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 290 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 291 | case ErrorDeallocNotOwned: |
| 292 | Out << "-dealloc (not-owned)"; |
| 293 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 294 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 295 | case ErrorLeak: |
| 296 | Out << "Leaked"; |
| 297 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 298 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 299 | case ErrorLeakReturned: |
| 300 | Out << "Leaked (Bad naming)"; |
| 301 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 302 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 303 | case ErrorGCLeakReturned: |
| 304 | Out << "Leaked (GC-ed at return)"; |
| 305 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 306 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 307 | case ErrorUseAfterRelease: |
| 308 | Out << "Use-After-Release [ERROR]"; |
| 309 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 310 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 311 | case ErrorReleaseNotOwned: |
| 312 | Out << "Release of Not-Owned [ERROR]"; |
| 313 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 314 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 315 | case RefVal::ErrorOverAutorelease: |
| 316 | Out << "Over autoreleased"; |
| 317 | break; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 318 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 319 | case RefVal::ErrorReturnedNotOwned: |
| 320 | Out << "Non-owned object returned instead of owned"; |
| 321 | break; |
| 322 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 323 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 324 | if (ACnt) { |
| 325 | Out << " [ARC +" << ACnt << ']'; |
| 326 | } |
| 327 | } |
| 328 | } //end anonymous namespace |
| 329 | |
| 330 | //===----------------------------------------------------------------------===// |
| 331 | // RefBindings - State used to track object reference counts. |
| 332 | //===----------------------------------------------------------------------===// |
| 333 | |
| 334 | typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 335 | |
| 336 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 337 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 338 | template<> |
| 339 | struct ProgramStateTrait<RefBindings> |
| 340 | : public ProgramStatePartialTrait<RefBindings> { |
| 341 | static void *GDMIndex() { |
| 342 | static int RefBIndex = 0; |
| 343 | return &RefBIndex; |
| 344 | } |
| 345 | }; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 346 | } |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 347 | } |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 348 | |
| 349 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 350 | // Function/Method behavior summaries. |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 351 | //===----------------------------------------------------------------------===// |
| 352 | |
| 353 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 354 | class RetainSummary { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 355 | /// Args - an ordered vector of (index, ArgEffect) pairs, where index |
| 356 | /// specifies the argument (starting from 0). This can be sparsely |
| 357 | /// populated; arguments with no entry in Args use 'DefaultArgEffect'. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 358 | ArgEffects Args; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 359 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 360 | /// DefaultArgEffect - The default ArgEffect to apply to arguments that |
| 361 | /// do not have an entry in Args. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 362 | ArgEffect DefaultArgEffect; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 363 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 364 | /// Receiver - If this summary applies to an Objective-C message expression, |
| 365 | /// this is the effect applied to the state of the receiver. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 366 | ArgEffect Receiver; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 367 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 368 | /// Ret - The effect on the return value. Used to indicate if the |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 369 | /// function/method call returns a new tracked symbol. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 370 | RetEffect Ret; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 371 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 372 | public: |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 373 | RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff, |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 374 | ArgEffect ReceiverEff) |
| 375 | : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 376 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 377 | /// getArg - Return the argument effect on the argument specified by |
| 378 | /// idx (starting from 0). |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 379 | ArgEffect getArg(unsigned idx) const { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 380 | if (const ArgEffect *AE = Args.lookup(idx)) |
| 381 | return *AE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 382 | |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 383 | return DefaultArgEffect; |
Ted Kremenek | 1ac08d6 | 2008-03-11 17:48:22 +0000 | [diff] [blame] | 384 | } |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 385 | |
| 386 | void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) { |
| 387 | Args = af.add(Args, idx, e); |
| 388 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 389 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 390 | /// setDefaultArgEffect - Set the default argument effect. |
| 391 | void setDefaultArgEffect(ArgEffect E) { |
| 392 | DefaultArgEffect = E; |
| 393 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 394 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 395 | /// getRetEffect - Returns the effect on the return value of the call. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 396 | RetEffect getRetEffect() const { return Ret; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 397 | |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 398 | /// setRetEffect - Set the effect of the return value of the call. |
| 399 | void setRetEffect(RetEffect E) { Ret = E; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 400 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 401 | |
| 402 | /// Sets the effect on the receiver of the message. |
| 403 | void setReceiverEffect(ArgEffect e) { Receiver = e; } |
| 404 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 405 | /// getReceiverEffect - Returns the effect on the receiver of the call. |
| 406 | /// This is only meaningful if the summary applies to an ObjCMessageExpr*. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 407 | ArgEffect getReceiverEffect() const { return Receiver; } |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 408 | |
| 409 | /// Test if two retain summaries are identical. Note that merely equivalent |
| 410 | /// summaries are not necessarily identical (for example, if an explicit |
| 411 | /// argument effect matches the default effect). |
| 412 | bool operator==(const RetainSummary &Other) const { |
| 413 | return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect && |
| 414 | Receiver == Other.Receiver && Ret == Other.Ret; |
| 415 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 416 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 417 | } // end anonymous namespace |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 418 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 419 | //===----------------------------------------------------------------------===// |
| 420 | // Data structures for constructing summaries. |
| 421 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 53301ba | 2008-06-24 03:49:48 +0000 | [diff] [blame] | 422 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 423 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 424 | class ObjCSummaryKey { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 425 | IdentifierInfo* II; |
| 426 | Selector S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 427 | public: |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 428 | ObjCSummaryKey(IdentifierInfo* ii, Selector s) |
| 429 | : II(ii), S(s) {} |
| 430 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 431 | ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 432 | : II(d ? d->getIdentifier() : 0), S(s) {} |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 433 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 434 | ObjCSummaryKey(const ObjCInterfaceDecl *d, IdentifierInfo *ii, Selector s) |
Ted Kremenek | 70b6a83 | 2009-05-13 18:16:01 +0000 | [diff] [blame] | 435 | : II(d ? d->getIdentifier() : ii), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 436 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 437 | ObjCSummaryKey(Selector s) |
| 438 | : II(0), S(s) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 439 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 440 | IdentifierInfo *getIdentifier() const { return II; } |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 441 | Selector getSelector() const { return S; } |
| 442 | }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 443 | } |
| 444 | |
| 445 | namespace llvm { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 446 | template <> struct DenseMapInfo<ObjCSummaryKey> { |
| 447 | static inline ObjCSummaryKey getEmptyKey() { |
| 448 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(), |
| 449 | DenseMapInfo<Selector>::getEmptyKey()); |
| 450 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 451 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 452 | static inline ObjCSummaryKey getTombstoneKey() { |
| 453 | return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(), |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 454 | DenseMapInfo<Selector>::getTombstoneKey()); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 455 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 456 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 457 | static unsigned getHashValue(const ObjCSummaryKey &V) { |
| 458 | return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier()) |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 459 | & 0x88888888) |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 460 | | (DenseMapInfo<Selector>::getHashValue(V.getSelector()) |
| 461 | & 0x55555555); |
| 462 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 463 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 464 | static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) { |
| 465 | return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(), |
| 466 | RHS.getIdentifier()) && |
| 467 | DenseMapInfo<Selector>::isEqual(LHS.getSelector(), |
| 468 | RHS.getSelector()); |
| 469 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 470 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 471 | }; |
Chris Lattner | 06159e8 | 2009-12-15 07:26:51 +0000 | [diff] [blame] | 472 | template <> |
| 473 | struct isPodLike<ObjCSummaryKey> { static const bool value = true; }; |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 474 | } // end llvm namespace |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 475 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 476 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 477 | class ObjCSummaryCache { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 478 | typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 479 | MapTy M; |
| 480 | public: |
| 481 | ObjCSummaryCache() {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 482 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 483 | const RetainSummary * find(const ObjCInterfaceDecl *D, IdentifierInfo *ClsName, |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 484 | Selector S) { |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 485 | // Lookup the method using the decl for the class @interface. If we |
| 486 | // have no decl, lookup using the class name. |
| 487 | return D ? find(D, S) : find(ClsName, S); |
| 488 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 489 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 490 | const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 491 | // Do a lookup with the (D,S) pair. If we find a match return |
| 492 | // the iterator. |
| 493 | ObjCSummaryKey K(D, S); |
| 494 | MapTy::iterator I = M.find(K); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 495 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 496 | if (I != M.end() || !D) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 497 | return I->second; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 498 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 499 | // Walk the super chain. If we find a hit with a parent, we'll end |
| 500 | // up returning that summary. We actually allow that key (null,S), as |
| 501 | // we cache summaries for the null ObjCInterfaceDecl* to allow us to |
| 502 | // generate initial summaries without having to worry about NSObject |
| 503 | // being declared. |
| 504 | // FIXME: We may change this at some point. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 505 | for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 506 | if ((I = M.find(ObjCSummaryKey(C, S))) != M.end()) |
| 507 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 508 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 509 | if (!C) |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 510 | return NULL; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 511 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 512 | |
| 513 | // Cache the summary with original key to make the next lookup faster |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 514 | // and return the iterator. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 515 | const RetainSummary *Summ = I->second; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 516 | M[K] = Summ; |
| 517 | return Summ; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 518 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 519 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 520 | const RetainSummary *find(IdentifierInfo* II, Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 521 | // FIXME: Class method lookup. Right now we dont' have a good way |
| 522 | // of going between IdentifierInfo* and the class hierarchy. |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 523 | MapTy::iterator I = M.find(ObjCSummaryKey(II, S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 524 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 525 | if (I == M.end()) |
| 526 | I = M.find(ObjCSummaryKey(S)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 527 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 528 | return I == M.end() ? NULL : I->second; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 529 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 530 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 531 | const RetainSummary *& operator[](ObjCSummaryKey K) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 532 | return M[K]; |
| 533 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 534 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 535 | const RetainSummary *& operator[](Selector S) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 536 | return M[ ObjCSummaryKey(S) ]; |
| 537 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 538 | }; |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 539 | } // end anonymous namespace |
| 540 | |
| 541 | //===----------------------------------------------------------------------===// |
| 542 | // Data structures for managing collections of summaries. |
| 543 | //===----------------------------------------------------------------------===// |
| 544 | |
| 545 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 546 | class RetainSummaryManager { |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 547 | |
| 548 | //==-----------------------------------------------------------------==// |
| 549 | // Typedefs. |
| 550 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 551 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 552 | typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *> |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 553 | FuncSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 554 | |
Ted Kremenek | 4f22a78 | 2008-06-23 23:30:29 +0000 | [diff] [blame] | 555 | typedef ObjCSummaryCache ObjCMethodSummariesTy; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 556 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 557 | //==-----------------------------------------------------------------==// |
| 558 | // Data. |
| 559 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 560 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 561 | /// Ctx - The ASTContext object for the analyzed ASTs. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 562 | ASTContext &Ctx; |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 563 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 564 | /// GCEnabled - Records whether or not the analyzed code runs in GC mode. |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 565 | const bool GCEnabled; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 566 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 567 | /// Records whether or not the analyzed code runs in ARC mode. |
| 568 | const bool ARCEnabled; |
| 569 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 570 | /// FuncSummaries - A map from FunctionDecls to summaries. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 571 | FuncSummariesTy FuncSummaries; |
| 572 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 573 | /// ObjCClassMethodSummaries - A map from selectors (for instance methods) |
| 574 | /// to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 575 | ObjCMethodSummariesTy ObjCClassMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 576 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 577 | /// ObjCMethodSummaries - A map from selectors to summaries. |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 578 | ObjCMethodSummariesTy ObjCMethodSummaries; |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 579 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 580 | /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects, |
| 581 | /// and all other data used by the checker. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 582 | llvm::BumpPtrAllocator BPAlloc; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 583 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 584 | /// AF - A factory for ArgEffects objects. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 585 | ArgEffects::Factory AF; |
| 586 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 587 | /// ScratchArgs - A holding buffer for construct ArgEffects. |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 588 | ArgEffects ScratchArgs; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 589 | |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 590 | /// ObjCAllocRetE - Default return effect for methods returning Objective-C |
| 591 | /// objects. |
| 592 | RetEffect ObjCAllocRetE; |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 593 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 594 | /// ObjCInitRetE - Default return effect for init methods returning |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 595 | /// Objective-C objects. |
Ted Kremenek | 547d495 | 2009-06-05 23:18:01 +0000 | [diff] [blame] | 596 | RetEffect ObjCInitRetE; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 597 | |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 598 | RetainSummary DefaultSummary; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 599 | const RetainSummary *StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 600 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 601 | //==-----------------------------------------------------------------==// |
| 602 | // Methods. |
| 603 | //==-----------------------------------------------------------------==// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 604 | |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 605 | /// getArgEffects - Returns a persistent ArgEffects object based on the |
| 606 | /// data in ScratchArgs. |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 607 | ArgEffects getArgEffects(); |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 608 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 609 | enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable }; |
| 610 | |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 611 | public: |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 612 | RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; } |
| 613 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 614 | const RetainSummary *getDefaultSummary() { |
| 615 | return &DefaultSummary; |
| 616 | } |
| 617 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 618 | const RetainSummary *getUnarySummary(const FunctionType* FT, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 619 | UnaryFuncKind func); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 620 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 621 | const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD); |
| 622 | const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD); |
| 623 | const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 624 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 625 | const RetainSummary *getPersistentSummary(ArgEffects AE, RetEffect RetEff, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 626 | ArgEffect ReceiverEff = DoNothing, |
| 627 | ArgEffect DefaultEff = MayEscape); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 628 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 629 | const RetainSummary *getPersistentSummary(RetEffect RE, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 630 | ArgEffect ReceiverEff = DoNothing, |
| 631 | ArgEffect DefaultEff = MayEscape) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 632 | return getPersistentSummary(getArgEffects(), RE, ReceiverEff, DefaultEff); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 633 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 634 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 635 | const RetainSummary *getPersistentStopSummary() { |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 636 | if (StopSummary) |
| 637 | return StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 638 | |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 639 | StopSummary = getPersistentSummary(RetEffect::MakeNoRet(), |
| 640 | StopTracking, StopTracking); |
Ted Kremenek | 706522f | 2008-10-29 04:07:07 +0000 | [diff] [blame] | 641 | |
Ted Kremenek | 432af59 | 2008-05-06 18:11:36 +0000 | [diff] [blame] | 642 | return StopSummary; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 643 | } |
Ted Kremenek | b309525 | 2008-05-06 04:20:12 +0000 | [diff] [blame] | 644 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 645 | void InitializeClassMethodSummaries(); |
| 646 | void InitializeMethodSummaries(); |
Ted Kremenek | 896cd9d | 2008-10-23 01:56:15 +0000 | [diff] [blame] | 647 | private: |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 648 | void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 649 | ObjCClassMethodSummaries[S] = Summ; |
| 650 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 651 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 652 | void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 653 | ObjCMethodSummaries[S] = Summ; |
| 654 | } |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 655 | |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 656 | void addClassMethSummary(const char* Cls, const char* name, |
| 657 | const RetainSummary *Summ, bool isNullary = true) { |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 658 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 659 | Selector S = isNullary ? GetNullarySelector(name, Ctx) |
| 660 | : GetUnarySelector(name, Ctx); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 661 | ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 662 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 663 | |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 664 | void addInstMethSummary(const char* Cls, const char* nullaryName, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 665 | const RetainSummary *Summ) { |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 666 | IdentifierInfo* ClsII = &Ctx.Idents.get(Cls); |
| 667 | Selector S = GetNullarySelector(nullaryName, Ctx); |
| 668 | ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ; |
| 669 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 670 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 671 | Selector generateSelector(va_list argp) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 672 | SmallVector<IdentifierInfo*, 10> II; |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 673 | |
Ted Kremenek | 9e476de | 2008-08-12 18:30:56 +0000 | [diff] [blame] | 674 | while (const char* s = va_arg(argp, const char*)) |
| 675 | II.push_back(&Ctx.Idents.get(s)); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 676 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 677 | return Ctx.Selectors.getSelector(II.size(), &II[0]); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 678 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 679 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 680 | void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 681 | const RetainSummary * Summ, va_list argp) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 682 | Selector S = generateSelector(argp); |
| 683 | Summaries[ObjCSummaryKey(ClsII, S)] = Summ; |
Ted Kremenek | 70a733e | 2008-07-18 17:24:20 +0000 | [diff] [blame] | 684 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 685 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 686 | void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 687 | va_list argp; |
| 688 | va_start(argp, Summ); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 689 | addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 690 | va_end(argp); |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 691 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 692 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 693 | void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 694 | va_list argp; |
| 695 | va_start(argp, Summ); |
| 696 | addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp); |
| 697 | va_end(argp); |
| 698 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 699 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 700 | void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) { |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 701 | va_list argp; |
| 702 | va_start(argp, Summ); |
| 703 | addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp); |
| 704 | va_end(argp); |
| 705 | } |
| 706 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 707 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 708 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 709 | RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC) |
Ted Kremenek | 179064e | 2008-07-01 17:21:27 +0000 | [diff] [blame] | 710 | : Ctx(ctx), |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 711 | GCEnabled(gcenabled), |
| 712 | ARCEnabled(usesARC), |
| 713 | AF(BPAlloc), ScratchArgs(AF.getEmptyMap()), |
| 714 | ObjCAllocRetE(gcenabled |
| 715 | ? RetEffect::MakeGCNotOwned() |
| 716 | : (usesARC ? RetEffect::MakeARCNotOwned() |
| 717 | : RetEffect::MakeOwned(RetEffect::ObjC, true))), |
| 718 | ObjCInitRetE(gcenabled |
| 719 | ? RetEffect::MakeGCNotOwned() |
| 720 | : (usesARC ? RetEffect::MakeARCNotOwned() |
| 721 | : RetEffect::MakeOwnedWhenTrackedReceiver())), |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 722 | DefaultSummary(AF.getEmptyMap() /* per-argument effects (none) */, |
Ted Kremenek | 7faca82 | 2009-05-04 04:57:00 +0000 | [diff] [blame] | 723 | RetEffect::MakeNoRet() /* return effect */, |
Ted Kremenek | ebd5a2d | 2009-05-11 18:30:24 +0000 | [diff] [blame] | 724 | MayEscape, /* default argument effect */ |
| 725 | DoNothing /* receiver effect */), |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 726 | StopSummary(0) { |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 727 | |
| 728 | InitializeClassMethodSummaries(); |
| 729 | InitializeMethodSummaries(); |
| 730 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 731 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 732 | const RetainSummary *getSummary(const FunctionDecl *FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 733 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 734 | const RetainSummary *getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 735 | const ObjCInterfaceDecl *ID, |
| 736 | const ObjCMethodDecl *MD, |
| 737 | QualType RetTy, |
| 738 | ObjCMethodSummariesTy &CachedSummaries); |
| 739 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 740 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 741 | ProgramStateRef state, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 742 | const LocationContext *LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 743 | |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 744 | const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 745 | const ObjCInterfaceDecl *ID) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 746 | return getMethodSummary(msg.getSelector(), 0, ID, msg.getMethodDecl(), |
| 747 | msg.getType(Ctx), ObjCMethodSummaries); |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 748 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 749 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 750 | const RetainSummary *getClassMethodSummary(const ObjCMessage &msg) { |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 751 | const ObjCInterfaceDecl *Class = 0; |
| 752 | if (!msg.isInstanceMessage()) |
| 753 | Class = msg.getReceiverInterface(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 754 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 755 | return getMethodSummary(msg.getSelector(), Class->getIdentifier(), |
| 756 | Class, msg.getMethodDecl(), msg.getType(Ctx), |
| 757 | ObjCClassMethodSummaries); |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 758 | } |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 759 | |
| 760 | /// getMethodSummary - This version of getMethodSummary is used to query |
| 761 | /// the summary for the current method being analyzed. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 762 | const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) { |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 763 | // FIXME: Eventually this should be unneeded. |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 764 | const ObjCInterfaceDecl *ID = MD->getClassInterface(); |
Ted Kremenek | 70a6576 | 2009-04-30 05:41:14 +0000 | [diff] [blame] | 765 | Selector S = MD->getSelector(); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 766 | IdentifierInfo *ClsName = ID->getIdentifier(); |
| 767 | QualType ResultTy = MD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 768 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 769 | ObjCMethodSummariesTy *CachedSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 770 | if (MD->isInstanceMethod()) |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 771 | CachedSummaries = &ObjCMethodSummaries; |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 772 | else |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 773 | CachedSummaries = &ObjCClassMethodSummaries; |
| 774 | |
| 775 | return getMethodSummary(S, ClsName, ID, MD, ResultTy, *CachedSummaries); |
Ted Kremenek | 552333c | 2009-04-29 17:17:48 +0000 | [diff] [blame] | 776 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 777 | |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 778 | const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD, |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 779 | Selector S, QualType RetTy); |
Ted Kremenek | a883355 | 2009-04-29 23:03:22 +0000 | [diff] [blame] | 780 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 781 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 782 | const ObjCMethodDecl *MD); |
| 783 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 784 | void updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 785 | const FunctionDecl *FD); |
| 786 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 787 | bool isGCEnabled() const { return GCEnabled; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 788 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 789 | bool isARCEnabled() const { return ARCEnabled; } |
| 790 | |
| 791 | bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; } |
| 792 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 793 | const RetainSummary *copySummary(const RetainSummary *OldSumm) { |
| 794 | RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>(); |
Ted Kremenek | 885c27b | 2009-05-04 05:31:22 +0000 | [diff] [blame] | 795 | new (Summ) RetainSummary(*OldSumm); |
| 796 | return Summ; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 797 | } |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 798 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 799 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 800 | // Used to avoid allocating long-term (BPAlloc'd) memory for default retain |
| 801 | // summaries. If a function or method looks like it has a default summary, but |
| 802 | // it has annotations, the annotations are added to the stack-based template |
| 803 | // and then copied into managed memory. |
| 804 | class RetainSummaryTemplate { |
| 805 | RetainSummaryManager &Manager; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 806 | const RetainSummary *&RealSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 807 | RetainSummary ScratchSummary; |
| 808 | bool Accessed; |
| 809 | public: |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 810 | RetainSummaryTemplate(const RetainSummary *&real, const RetainSummary &base, |
| 811 | RetainSummaryManager &mgr) |
| 812 | : Manager(mgr), RealSummary(real), ScratchSummary(real ? *real : base), |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 813 | Accessed(false) {} |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 814 | |
| 815 | ~RetainSummaryTemplate() { |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 816 | if (Accessed) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 817 | RealSummary = Manager.copySummary(&ScratchSummary); |
| 818 | } |
| 819 | |
| 820 | RetainSummary &operator*() { |
| 821 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 822 | return ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 823 | } |
| 824 | |
| 825 | RetainSummary *operator->() { |
| 826 | Accessed = true; |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 827 | return &ScratchSummary; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 828 | } |
| 829 | }; |
| 830 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 831 | } // end anonymous namespace |
| 832 | |
| 833 | //===----------------------------------------------------------------------===// |
| 834 | // Implementation of checker data structures. |
| 835 | //===----------------------------------------------------------------------===// |
| 836 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 837 | ArgEffects RetainSummaryManager::getArgEffects() { |
| 838 | ArgEffects AE = ScratchArgs; |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 839 | ScratchArgs = AF.getEmptyMap(); |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 840 | return AE; |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 841 | } |
| 842 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 843 | const RetainSummary * |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 844 | RetainSummaryManager::getPersistentSummary(ArgEffects AE, RetEffect RetEff, |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 845 | ArgEffect ReceiverEff, |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 846 | ArgEffect DefaultEff) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 847 | // Create the summary and return it. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 848 | RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>(); |
Jordy Rose | e62e87b | 2011-08-20 20:55:40 +0000 | [diff] [blame] | 849 | new (Summ) RetainSummary(AE, RetEff, DefaultEff, ReceiverEff); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 850 | return Summ; |
| 851 | } |
| 852 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 853 | //===----------------------------------------------------------------------===// |
| 854 | // Summary creation for functions (largely uses of Core Foundation). |
| 855 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 856 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 857 | static bool isRetain(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 858 | return FName.endswith("Retain"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 859 | } |
| 860 | |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 861 | static bool isRelease(const FunctionDecl *FD, StringRef FName) { |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 862 | return FName.endswith("Release"); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 863 | } |
| 864 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 865 | static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) { |
| 866 | // FIXME: Remove FunctionDecl parameter. |
| 867 | // FIXME: Is it really okay if MakeCollectable isn't a suffix? |
| 868 | return FName.find("MakeCollectable") != StringRef::npos; |
| 869 | } |
| 870 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 871 | const RetainSummary * RetainSummaryManager::getSummary(const FunctionDecl *FD) { |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 872 | // Look up a summary in our cache of FunctionDecls -> Summaries. |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 873 | FuncSummariesTy::iterator I = FuncSummaries.find(FD); |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 874 | if (I != FuncSummaries.end()) |
Ted Kremenek | 891d5cc | 2008-04-24 17:22:33 +0000 | [diff] [blame] | 875 | return I->second; |
| 876 | |
Ted Kremenek | e401a0c | 2009-05-04 15:34:07 +0000 | [diff] [blame] | 877 | // No summary? Generate one. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 878 | const RetainSummary *S = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 879 | |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 880 | do { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 881 | // We generate "stop" summaries for implicitly defined functions. |
| 882 | if (FD->isImplicit()) { |
| 883 | S = getPersistentStopSummary(); |
| 884 | break; |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 885 | } |
Ted Kremenek | 9ca2851 | 2011-05-02 21:21:42 +0000 | [diff] [blame] | 886 | // For C++ methods, generate an implicit "stop" summary as well. We |
| 887 | // can relax this once we have a clear policy for C++ methods and |
| 888 | // ownership attributes. |
| 889 | if (isa<CXXMethodDecl>(FD)) { |
| 890 | S = getPersistentStopSummary(); |
| 891 | break; |
| 892 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 893 | |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 894 | // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the |
Ted Kremenek | 9989065 | 2009-01-16 18:40:33 +0000 | [diff] [blame] | 895 | // function's type. |
John McCall | 183700f | 2009-09-21 23:43:11 +0000 | [diff] [blame] | 896 | const FunctionType* FT = FD->getType()->getAs<FunctionType>(); |
Ted Kremenek | 48c6d18 | 2009-12-16 06:06:43 +0000 | [diff] [blame] | 897 | const IdentifierInfo *II = FD->getIdentifier(); |
| 898 | if (!II) |
| 899 | break; |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 900 | |
| 901 | StringRef FName = II->getName(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 902 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 903 | // Strip away preceding '_'. Doing this here will effect all the checks |
| 904 | // down below. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 905 | FName = FName.substr(FName.find_first_not_of('_')); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 906 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 907 | // Inspect the result type. |
| 908 | QualType RetTy = FT->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 909 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 910 | // FIXME: This should all be refactored into a chain of "summary lookup" |
| 911 | // filters. |
Ted Kremenek | 008636a | 2009-10-14 00:27:24 +0000 | [diff] [blame] | 912 | assert(ScratchArgs.isEmpty()); |
Ted Kremenek | 39d88b0 | 2009-06-15 20:36:07 +0000 | [diff] [blame] | 913 | |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 914 | if (FName == "pthread_create") { |
| 915 | // Part of: <rdar://problem/7299394>. This will be addressed |
| 916 | // better with IPA. |
| 917 | S = getPersistentStopSummary(); |
| 918 | } else if (FName == "NSMakeCollectable") { |
| 919 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 920 | S = (RetTy->isObjCIdType()) |
| 921 | ? getUnarySummary(FT, cfmakecollectable) |
| 922 | : getPersistentStopSummary(); |
| 923 | } else if (FName == "IOBSDNameMatching" || |
| 924 | FName == "IOServiceMatching" || |
| 925 | FName == "IOServiceNameMatching" || |
| 926 | FName == "IORegistryEntryIDMatching" || |
| 927 | FName == "IOOpenFirmwarePathMatching") { |
| 928 | // Part of <rdar://problem/6961230>. (IOKit) |
| 929 | // This should be addressed using a API table. |
| 930 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 931 | DoNothing, DoNothing); |
| 932 | } else if (FName == "IOServiceGetMatchingService" || |
| 933 | FName == "IOServiceGetMatchingServices") { |
| 934 | // FIXES: <rdar://problem/6326900> |
| 935 | // This should be addressed using a API table. This strcmp is also |
| 936 | // a little gross, but there is no need to super optimize here. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 937 | ScratchArgs = AF.add(ScratchArgs, 1, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 938 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 939 | } else if (FName == "IOServiceAddNotification" || |
| 940 | FName == "IOServiceAddMatchingNotification") { |
| 941 | // Part of <rdar://problem/6961230>. (IOKit) |
| 942 | // This should be addressed using a API table. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 943 | ScratchArgs = AF.add(ScratchArgs, 2, DecRef); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 944 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 945 | } else if (FName == "CVPixelBufferCreateWithBytes") { |
| 946 | // FIXES: <rdar://problem/7283567> |
| 947 | // Eventually this can be improved by recognizing that the pixel |
| 948 | // buffer passed to CVPixelBufferCreateWithBytes is released via |
| 949 | // a callback and doing full IPA to make sure this is done correctly. |
| 950 | // FIXME: This function has an out parameter that returns an |
| 951 | // allocated object. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 952 | ScratchArgs = AF.add(ScratchArgs, 7, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 953 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
| 954 | } else if (FName == "CGBitmapContextCreateWithData") { |
| 955 | // FIXES: <rdar://problem/7358899> |
| 956 | // Eventually this can be improved by recognizing that 'releaseInfo' |
| 957 | // passed to CGBitmapContextCreateWithData is released via |
| 958 | // a callback and doing full IPA to make sure this is done correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 959 | ScratchArgs = AF.add(ScratchArgs, 8, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 960 | S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true), |
| 961 | DoNothing, DoNothing); |
| 962 | } else if (FName == "CVPixelBufferCreateWithPlanarBytes") { |
| 963 | // FIXES: <rdar://problem/7283567> |
| 964 | // Eventually this can be improved by recognizing that the pixel |
| 965 | // buffer passed to CVPixelBufferCreateWithPlanarBytes is released |
| 966 | // via a callback and doing full IPA to make sure this is done |
| 967 | // correctly. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 968 | ScratchArgs = AF.add(ScratchArgs, 12, StopTracking); |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 969 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 970 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 971 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 972 | // Did we get a summary? |
| 973 | if (S) |
| 974 | break; |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 975 | |
| 976 | // Enable this code once the semantics of NSDeallocateObject are resolved |
| 977 | // for GC. <rdar://problem/6619988> |
| 978 | #if 0 |
| 979 | // Handle: NSDeallocateObject(id anObject); |
| 980 | // This method does allow 'nil' (although we don't check it now). |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 981 | if (strcmp(FName, "NSDeallocateObject") == 0) { |
Ted Kremenek | 6199190 | 2009-03-17 22:43:44 +0000 | [diff] [blame] | 982 | return RetTy == Ctx.VoidTy |
| 983 | ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc) |
| 984 | : getPersistentStopSummary(); |
| 985 | } |
| 986 | #endif |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 987 | |
| 988 | if (RetTy->isPointerType()) { |
| 989 | // For CoreFoundation ('CF') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 990 | if (cocoa::isRefType(RetTy, "CF", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 991 | if (isRetain(FD, FName)) |
| 992 | S = getUnarySummary(FT, cfretain); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 993 | else if (isMakeCollectable(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 994 | S = getUnarySummary(FT, cfmakecollectable); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 995 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 996 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 997 | |
| 998 | break; |
| 999 | } |
| 1000 | |
| 1001 | // For CoreGraphics ('CG') types. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1002 | if (cocoa::isRefType(RetTy, "CG", FName)) { |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1003 | if (isRetain(FD, FName)) |
| 1004 | S = getUnarySummary(FT, cfretain); |
| 1005 | else |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1006 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1007 | |
| 1008 | break; |
| 1009 | } |
| 1010 | |
| 1011 | // For the Disk Arbitration API (DiskArbitration/DADisk.h) |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1012 | if (cocoa::isRefType(RetTy, "DADisk") || |
| 1013 | cocoa::isRefType(RetTy, "DADissenter") || |
| 1014 | cocoa::isRefType(RetTy, "DASessionRef")) { |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1015 | S = getCFCreateGetRuleSummary(FD); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1016 | break; |
| 1017 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1018 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1019 | break; |
| 1020 | } |
| 1021 | |
| 1022 | // Check for release functions, the only kind of functions that we care |
| 1023 | // about that don't return a pointer type. |
| 1024 | if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) { |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1025 | // Test for 'CGCF'. |
Benjamin Kramer | b6f3c70 | 2010-02-08 18:38:55 +0000 | [diff] [blame] | 1026 | FName = FName.substr(FName.startswith("CGCF") ? 4 : 2); |
Ted Kremenek | e7d0312 | 2010-02-08 16:45:01 +0000 | [diff] [blame] | 1027 | |
Ted Kremenek | bf0a4dd | 2009-03-05 22:11:14 +0000 | [diff] [blame] | 1028 | if (isRelease(FD, FName)) |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1029 | S = getUnarySummary(FT, cfrelease); |
| 1030 | else { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1031 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1032 | // Remaining CoreFoundation and CoreGraphics functions. |
| 1033 | // We use to assume that they all strictly followed the ownership idiom |
| 1034 | // and that ownership cannot be transferred. While this is technically |
| 1035 | // correct, many methods allow a tracked object to escape. For example: |
| 1036 | // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1037 | // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1038 | // CFDictionaryAddValue(y, key, x); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1039 | // CFRelease(x); |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1040 | // ... it is okay to use 'x' since 'y' has a reference to it |
| 1041 | // |
| 1042 | // We handle this and similar cases with the follow heuristic. If the |
Ted Kremenek | c484381 | 2009-08-20 00:57:22 +0000 | [diff] [blame] | 1043 | // function name contains "InsertValue", "SetValue", "AddValue", |
| 1044 | // "AppendValue", or "SetAttribute", then we assume that arguments may |
| 1045 | // "escape." This means that something else holds on to the object, |
| 1046 | // allowing it be used even after its local retain count drops to 0. |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1047 | ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos|| |
| 1048 | StrInStrNoCase(FName, "AddValue") != StringRef::npos || |
| 1049 | StrInStrNoCase(FName, "SetValue") != StringRef::npos || |
| 1050 | StrInStrNoCase(FName, "AppendValue") != StringRef::npos|| |
Benjamin Kramer | c027e54 | 2010-01-11 20:15:06 +0000 | [diff] [blame] | 1051 | StrInStrNoCase(FName, "SetAttribute") != StringRef::npos) |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1052 | ? MayEscape : DoNothing; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1053 | |
Ted Kremenek | 6818928 | 2009-01-29 22:45:13 +0000 | [diff] [blame] | 1054 | S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1055 | } |
| 1056 | } |
Ted Kremenek | 37d785b | 2008-07-15 16:50:12 +0000 | [diff] [blame] | 1057 | } |
| 1058 | while (0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1059 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1060 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1061 | updateSummaryFromAnnotations(S, FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1062 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1063 | FuncSummaries[FD] = S; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1064 | return S; |
Ted Kremenek | 2fff37e | 2008-03-06 00:08:09 +0000 | [diff] [blame] | 1065 | } |
| 1066 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1067 | const RetainSummary * |
John McCall | 7df2ff4 | 2011-10-01 00:48:56 +0000 | [diff] [blame] | 1068 | RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) { |
| 1069 | if (coreFoundation::followsCreateRule(FD)) |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1070 | return getCFSummaryCreateRule(FD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1071 | |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 1072 | return getCFSummaryGetRule(FD); |
Ted Kremenek | 86ad3bc | 2008-05-05 16:51:50 +0000 | [diff] [blame] | 1073 | } |
| 1074 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1075 | const RetainSummary * |
Ted Kremenek | 6ad315a | 2009-02-23 16:51:39 +0000 | [diff] [blame] | 1076 | RetainSummaryManager::getUnarySummary(const FunctionType* FT, |
| 1077 | UnaryFuncKind func) { |
| 1078 | |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1079 | // Sanity check that this is *really* a unary function. This can |
| 1080 | // happen if people do weird things. |
Douglas Gregor | 72564e7 | 2009-02-26 23:50:07 +0000 | [diff] [blame] | 1081 | const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT); |
Ted Kremenek | 1261938 | 2009-01-12 21:45:02 +0000 | [diff] [blame] | 1082 | if (!FTP || FTP->getNumArgs() != 1) |
| 1083 | return getPersistentStopSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1084 | |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1085 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1086 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1087 | ArgEffect Effect; |
Ted Kremenek | 377e230 | 2008-04-29 05:33:51 +0000 | [diff] [blame] | 1088 | switch (func) { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1089 | case cfretain: Effect = IncRef; break; |
| 1090 | case cfrelease: Effect = DecRef; break; |
| 1091 | case cfmakecollectable: Effect = MakeCollectable; break; |
Ted Kremenek | 940b1d8 | 2008-04-10 23:44:06 +0000 | [diff] [blame] | 1092 | } |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 1093 | |
| 1094 | ScratchArgs = AF.add(ScratchArgs, 0, Effect); |
| 1095 | return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1096 | } |
| 1097 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1098 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1099 | RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) { |
Ted Kremenek | b77449c | 2009-05-03 05:20:50 +0000 | [diff] [blame] | 1100 | assert (ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1101 | |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1102 | return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1103 | } |
| 1104 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1105 | const RetainSummary * |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1106 | RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1107 | assert (ScratchArgs.isEmpty()); |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1108 | return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF), |
| 1109 | DoNothing, DoNothing); |
Ted Kremenek | 00a3a5f | 2008-03-12 01:21:45 +0000 | [diff] [blame] | 1110 | } |
| 1111 | |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 1112 | //===----------------------------------------------------------------------===// |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1113 | // Summary creation for Selectors. |
| 1114 | //===----------------------------------------------------------------------===// |
| 1115 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1116 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1117 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1118 | const FunctionDecl *FD) { |
| 1119 | if (!FD) |
| 1120 | return; |
| 1121 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1122 | RetainSummaryTemplate Template(Summ, DefaultSummary, *this); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1123 | |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1124 | // Effects on the parameters. |
| 1125 | unsigned parm_idx = 0; |
| 1126 | for (FunctionDecl::param_const_iterator pi = FD->param_begin(), |
John McCall | 98b8f16 | 2011-04-06 09:02:12 +0000 | [diff] [blame] | 1127 | pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1128 | const ParmVarDecl *pd = *pi; |
| 1129 | if (pd->getAttr<NSConsumedAttr>()) { |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1130 | if (!GCEnabled) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1131 | Template->addArg(AF, parm_idx, DecRef); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1132 | } |
| 1133 | } else if (pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1134 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1135 | } |
| 1136 | } |
| 1137 | |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1138 | QualType RetTy = FD->getResultType(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1139 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1140 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1141 | if (cocoa::isCocoaObjectRef(RetTy)) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1142 | if (FD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1143 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1144 | } |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1145 | else if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1146 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1147 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1148 | else if (FD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1149 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1150 | } |
| 1151 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1152 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1153 | } |
| 1154 | } else if (RetTy->getAs<PointerType>()) { |
| 1155 | if (FD->getAttr<CFReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1156 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1157 | } |
| 1158 | else if (FD->getAttr<CFReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1159 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1160 | } |
Ted Kremenek | b04cb59 | 2009-06-11 18:17:24 +0000 | [diff] [blame] | 1161 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1162 | } |
| 1163 | |
| 1164 | void |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1165 | RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ, |
| 1166 | const ObjCMethodDecl *MD) { |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1167 | if (!MD) |
| 1168 | return; |
| 1169 | |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1170 | RetainSummaryTemplate Template(Summ, DefaultSummary, *this); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1171 | bool isTrackedLoc = false; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1172 | |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1173 | // Effects on the receiver. |
| 1174 | if (MD->getAttr<NSConsumesSelfAttr>()) { |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1175 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1176 | Template->setReceiverEffect(DecRefMsg); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1177 | } |
| 1178 | |
| 1179 | // Effects on the parameters. |
| 1180 | unsigned parm_idx = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1181 | for (ObjCMethodDecl::param_const_iterator |
| 1182 | pi=MD->param_begin(), pe=MD->param_end(); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1183 | pi != pe; ++pi, ++parm_idx) { |
| 1184 | const ParmVarDecl *pd = *pi; |
| 1185 | if (pd->getAttr<NSConsumedAttr>()) { |
| 1186 | if (!GCEnabled) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1187 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1188 | } |
| 1189 | else if(pd->getAttr<CFConsumedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1190 | Template->addArg(AF, parm_idx, DecRef); |
Ted Kremenek | 11fe175 | 2011-01-27 18:43:03 +0000 | [diff] [blame] | 1191 | } |
Ted Kremenek | 12b9434 | 2011-01-27 06:54:14 +0000 | [diff] [blame] | 1192 | } |
| 1193 | |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1194 | // Determine if there is a special return effect for this method. |
Ted Kremenek | 78acdbf | 2010-01-27 18:00:17 +0000 | [diff] [blame] | 1195 | if (cocoa::isCocoaObjectRef(MD->getResultType())) { |
Argyrios Kyrtzidis | 40b598e | 2009-06-30 02:34:44 +0000 | [diff] [blame] | 1196 | if (MD->getAttr<NSReturnsRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1197 | Template->setRetEffect(ObjCAllocRetE); |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1198 | return; |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1199 | } |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1200 | if (MD->getAttr<NSReturnsNotRetainedAttr>()) { |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1201 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1202 | return; |
| 1203 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1204 | |
Ted Kremenek | 6d4b76d | 2009-07-06 18:30:43 +0000 | [diff] [blame] | 1205 | isTrackedLoc = true; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1206 | } else { |
Ted Kremenek | 6217b80 | 2009-07-29 21:53:49 +0000 | [diff] [blame] | 1207 | isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL; |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1208 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1209 | |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1210 | if (isTrackedLoc) { |
| 1211 | if (MD->getAttr<CFReturnsRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1212 | Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1213 | else if (MD->getAttr<CFReturnsNotRetainedAttr>()) |
Jordy Rose | 0fe62f8 | 2011-08-24 09:02:37 +0000 | [diff] [blame] | 1214 | Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF)); |
Ted Kremenek | 6041111 | 2010-02-18 00:06:12 +0000 | [diff] [blame] | 1215 | } |
Ted Kremenek | 4dd8fb4 | 2009-05-09 02:58:13 +0000 | [diff] [blame] | 1216 | } |
| 1217 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1218 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 1219 | RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD, |
| 1220 | Selector S, QualType RetTy) { |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1221 | |
Ted Kremenek | fcd7c6f | 2009-04-29 00:42:39 +0000 | [diff] [blame] | 1222 | if (MD) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1223 | // Scan the method decl for 'void*' arguments. These should be treated |
| 1224 | // as 'StopTracking' because they are often used with delegates. |
| 1225 | // Delegates are a frequent form of false positives with the retain |
| 1226 | // count checker. |
| 1227 | unsigned i = 0; |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1228 | for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(), |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1229 | E = MD->param_end(); I != E; ++I, ++i) |
Argyrios Kyrtzidis | 491306a | 2011-10-03 06:37:04 +0000 | [diff] [blame] | 1230 | if (const ParmVarDecl *PD = *I) { |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1231 | QualType Ty = Ctx.getCanonicalType(PD->getType()); |
Douglas Gregor | a4923eb | 2009-11-16 21:35:15 +0000 | [diff] [blame] | 1232 | if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy) |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1233 | ScratchArgs = AF.add(ScratchArgs, i, StopTracking); |
Ted Kremenek | 376d1e7 | 2009-04-24 18:00:17 +0000 | [diff] [blame] | 1234 | } |
| 1235 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1236 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1237 | // Any special effects? |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1238 | ArgEffect ReceiverEff = DoNothing; |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1239 | RetEffect ResultEff = RetEffect::MakeNoRet(); |
| 1240 | |
| 1241 | // Check the method family, and apply any default annotations. |
| 1242 | switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) { |
| 1243 | case OMF_None: |
| 1244 | case OMF_performSelector: |
| 1245 | // Assume all Objective-C methods follow Cocoa Memory Management rules. |
| 1246 | // FIXME: Does the non-threaded performSelector family really belong here? |
| 1247 | // The selector could be, say, @selector(copy). |
| 1248 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1249 | ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 1250 | else if (coreFoundation::isCFObjectRef(RetTy)) { |
| 1251 | // ObjCMethodDecl currently doesn't consider CF objects as valid return |
| 1252 | // values for alloc, new, copy, or mutableCopy, so we have to |
| 1253 | // double-check with the selector. This is ugly, but there aren't that |
| 1254 | // many Objective-C methods that return CF objects, right? |
| 1255 | if (MD) { |
| 1256 | switch (S.getMethodFamily()) { |
| 1257 | case OMF_alloc: |
| 1258 | case OMF_new: |
| 1259 | case OMF_copy: |
| 1260 | case OMF_mutableCopy: |
| 1261 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1262 | break; |
| 1263 | default: |
| 1264 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1265 | break; |
| 1266 | } |
| 1267 | } else { |
| 1268 | ResultEff = RetEffect::MakeNotOwned(RetEffect::CF); |
| 1269 | } |
| 1270 | } |
| 1271 | break; |
| 1272 | case OMF_init: |
| 1273 | ResultEff = ObjCInitRetE; |
| 1274 | ReceiverEff = DecRefMsg; |
| 1275 | break; |
| 1276 | case OMF_alloc: |
| 1277 | case OMF_new: |
| 1278 | case OMF_copy: |
| 1279 | case OMF_mutableCopy: |
| 1280 | if (cocoa::isCocoaObjectRef(RetTy)) |
| 1281 | ResultEff = ObjCAllocRetE; |
| 1282 | else if (coreFoundation::isCFObjectRef(RetTy)) |
| 1283 | ResultEff = RetEffect::MakeOwned(RetEffect::CF, true); |
| 1284 | break; |
| 1285 | case OMF_autorelease: |
| 1286 | ReceiverEff = Autorelease; |
| 1287 | break; |
| 1288 | case OMF_retain: |
| 1289 | ReceiverEff = IncRefMsg; |
| 1290 | break; |
| 1291 | case OMF_release: |
| 1292 | ReceiverEff = DecRefMsg; |
| 1293 | break; |
| 1294 | case OMF_dealloc: |
| 1295 | ReceiverEff = Dealloc; |
| 1296 | break; |
| 1297 | case OMF_self: |
| 1298 | // -self is handled specially by the ExprEngine to propagate the receiver. |
| 1299 | break; |
| 1300 | case OMF_retainCount: |
| 1301 | case OMF_finalize: |
| 1302 | // These methods don't return objects. |
| 1303 | break; |
| 1304 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1305 | |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1306 | // If one of the arguments in the selector has the keyword 'delegate' we |
| 1307 | // should stop tracking the reference count for the receiver. This is |
| 1308 | // because the reference count is quite possibly handled by a delegate |
| 1309 | // method. |
| 1310 | if (S.isKeywordSelector()) { |
| 1311 | const std::string &str = S.getAsString(); |
| 1312 | assert(!str.empty()); |
Benjamin Kramer | e45c149 | 2010-01-11 19:46:28 +0000 | [diff] [blame] | 1313 | if (StrInStrNoCase(str, "delegate:") != StringRef::npos) |
| 1314 | ReceiverEff = StopTracking; |
Ted Kremenek | 8ee885b | 2009-04-24 21:56:17 +0000 | [diff] [blame] | 1315 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1316 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1317 | if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing && |
| 1318 | ResultEff.getKind() == RetEffect::NoRet) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1319 | return getDefaultSummary(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1320 | |
Jordy Rose | e921b1a | 2012-03-17 19:53:04 +0000 | [diff] [blame] | 1321 | return getPersistentSummary(ResultEff, ReceiverEff, MayEscape); |
Ted Kremenek | 250b1fa | 2009-04-23 23:08:22 +0000 | [diff] [blame] | 1322 | } |
| 1323 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1324 | const RetainSummary * |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1325 | RetainSummaryManager::getInstanceMethodSummary(const ObjCMessage &msg, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1326 | ProgramStateRef state, |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1327 | const LocationContext *LC) { |
| 1328 | |
| 1329 | // We need the type-information of the tracked receiver object |
| 1330 | // Retrieve it from the state. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1331 | const Expr *Receiver = msg.getInstanceReceiver(); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1332 | const ObjCInterfaceDecl *ID = 0; |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1333 | |
| 1334 | // FIXME: Is this really working as expected? There are cases where |
| 1335 | // we just use the 'ID' from the message expression. |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1336 | SVal receiverV; |
| 1337 | |
Ted Kremenek | 8f32675 | 2010-05-21 21:56:53 +0000 | [diff] [blame] | 1338 | if (Receiver) { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1339 | receiverV = state->getSValAsScalarOrLoc(Receiver, LC); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1340 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1341 | // FIXME: Eventually replace the use of state->get<RefBindings> with |
| 1342 | // a generic API for reasoning about the Objective-C types of symbolic |
| 1343 | // objects. |
| 1344 | if (SymbolRef Sym = receiverV.getAsLocSymbol()) |
| 1345 | if (const RefVal *T = state->get<RefBindings>(Sym)) |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1346 | if (const ObjCObjectPointerType* PT = |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1347 | T->getType()->getAs<ObjCObjectPointerType>()) |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1348 | ID = PT->getInterfaceDecl(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 1349 | |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1350 | // FIXME: this is a hack. This may or may not be the actual method |
| 1351 | // that is called. |
| 1352 | if (!ID) { |
| 1353 | if (const ObjCObjectPointerType *PT = |
| 1354 | Receiver->getType()->getAs<ObjCObjectPointerType>()) |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1355 | ID = PT->getInterfaceDecl(); |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1356 | } |
| 1357 | } else { |
| 1358 | // FIXME: Hack for 'super'. |
Argyrios Kyrtzidis | 432424d | 2011-01-25 00:03:53 +0000 | [diff] [blame] | 1359 | ID = msg.getReceiverInterface(); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1360 | } |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1361 | |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1362 | // FIXME: The receiver could be a reference to a class, meaning that |
| 1363 | // we should use the class method. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1364 | return getInstanceMethodSummary(msg, ID); |
Ted Kremenek | b7ddd9b | 2009-11-13 01:54:21 +0000 | [diff] [blame] | 1365 | } |
| 1366 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1367 | const RetainSummary * |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 1368 | RetainSummaryManager::getMethodSummary(Selector S, IdentifierInfo *ClsName, |
| 1369 | const ObjCInterfaceDecl *ID, |
| 1370 | const ObjCMethodDecl *MD, QualType RetTy, |
| 1371 | ObjCMethodSummariesTy &CachedSummaries) { |
Ted Kremenek | 1bffd74 | 2008-05-06 15:44:25 +0000 | [diff] [blame] | 1372 | |
Ted Kremenek | 8711c03 | 2009-04-29 05:04:30 +0000 | [diff] [blame] | 1373 | // Look up a summary in our summary cache. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 1374 | const RetainSummary *Summ = CachedSummaries.find(ID, ClsName, S); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1375 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1376 | if (!Summ) { |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 1377 | Summ = getStandardMethodSummary(MD, S, RetTy); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1378 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1379 | // Annotations override defaults. |
Jordy Rose | 4df54fe | 2011-08-23 04:27:15 +0000 | [diff] [blame] | 1380 | updateSummaryFromAnnotations(Summ, MD); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1381 | |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1382 | // Memoize the summary. |
Jordy Rose | f3aae58 | 2012-03-17 21:13:07 +0000 | [diff] [blame^] | 1383 | CachedSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ; |
Ted Kremenek | 614cc54 | 2009-07-21 23:27:57 +0000 | [diff] [blame] | 1384 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1385 | |
Ted Kremenek | e87450e | 2009-04-23 19:11:35 +0000 | [diff] [blame] | 1386 | return Summ; |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1387 | } |
| 1388 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1389 | void RetainSummaryManager::InitializeClassMethodSummaries() { |
Ted Kremenek | ec31533 | 2009-05-07 23:40:42 +0000 | [diff] [blame] | 1390 | assert(ScratchArgs.isEmpty()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1391 | // Create the [NSAssertionHandler currentHander] summary. |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1392 | addClassMethSummary("NSAssertionHandler", "currentHandler", |
Ted Kremenek | 2d1652e | 2009-01-28 05:56:51 +0000 | [diff] [blame] | 1393 | getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC))); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1394 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1395 | // Create the [NSAutoreleasePool addObject:] summary. |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1396 | ScratchArgs = AF.add(ScratchArgs, 0, Autorelease); |
Ted Kremenek | 6fe2b7a | 2009-10-15 22:25:12 +0000 | [diff] [blame] | 1397 | addClassMethSummary("NSAutoreleasePool", "addObject", |
| 1398 | getPersistentSummary(RetEffect::MakeNoRet(), |
| 1399 | DoNothing, Autorelease)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1400 | |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1401 | // Create the summaries for [NSObject performSelector...]. We treat |
| 1402 | // these as 'stop tracking' for the arguments because they are often |
| 1403 | // used for delegates that can release the object. When we have better |
| 1404 | // inter-procedural analysis we can potentially do something better. This |
| 1405 | // workaround is to remove false positives. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1406 | const RetainSummary *Summ = |
Ted Kremenek | 012614e | 2011-08-17 21:04:19 +0000 | [diff] [blame] | 1407 | getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking); |
Ted Kremenek | de4d533 | 2009-04-24 17:50:11 +0000 | [diff] [blame] | 1408 | IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject"); |
| 1409 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1410 | "afterDelay", NULL); |
| 1411 | addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject", |
| 1412 | "afterDelay", "inModes", NULL); |
| 1413 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1414 | "withObject", "waitUntilDone", NULL); |
| 1415 | addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread", |
| 1416 | "withObject", "waitUntilDone", "modes", NULL); |
| 1417 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1418 | "withObject", "waitUntilDone", NULL); |
| 1419 | addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread", |
| 1420 | "withObject", "waitUntilDone", "modes", NULL); |
| 1421 | addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground", |
| 1422 | "withObject", NULL); |
Ted Kremenek | 9c32d08 | 2008-05-06 00:30:21 +0000 | [diff] [blame] | 1423 | } |
| 1424 | |
Ted Kremenek | 1f180c3 | 2008-06-23 22:21:20 +0000 | [diff] [blame] | 1425 | void RetainSummaryManager::InitializeMethodSummaries() { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1426 | |
| 1427 | assert (ScratchArgs.isEmpty()); |
| 1428 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1429 | // Create the "init" selector. It just acts as a pass-through for the |
| 1430 | // receiver. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1431 | const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg); |
Ted Kremenek | ac02f20 | 2009-08-20 05:13:36 +0000 | [diff] [blame] | 1432 | addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm); |
| 1433 | |
| 1434 | // awakeAfterUsingCoder: behaves basically like an 'init' method. It |
| 1435 | // claims the receiver and returns a retained object. |
| 1436 | addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx), |
| 1437 | InitSumm); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1438 | |
Ted Kremenek | c839560 | 2008-05-06 21:26:51 +0000 | [diff] [blame] | 1439 | // The next methods are allocators. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1440 | const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE); |
| 1441 | const RetainSummary *CFAllocSumm = |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1442 | getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1443 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1444 | // Create the "retain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1445 | RetEffect NoRet = RetEffect::MakeNoRet(); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1446 | const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1447 | addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1448 | |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1449 | // Create the "release" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1450 | Summ = getPersistentSummary(NoRet, DecRefMsg); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1451 | addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1452 | |
Ted Kremenek | 299e815 | 2008-05-07 21:17:39 +0000 | [diff] [blame] | 1453 | // Create the "drain" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1454 | Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1455 | addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1456 | |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1457 | // Create the -dealloc summary. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1458 | Summ = getPersistentSummary(NoRet, Dealloc); |
Ted Kremenek | f95e9fc | 2009-03-17 19:42:23 +0000 | [diff] [blame] | 1459 | addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ); |
Ted Kremenek | 3c0cea3 | 2008-05-06 02:26:56 +0000 | [diff] [blame] | 1460 | |
| 1461 | // Create the "autorelease" selector. |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1462 | Summ = getPersistentSummary(NoRet, Autorelease); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1463 | addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1464 | |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1465 | // Specially handle NSAutoreleasePool. |
Ted Kremenek | 6c4becb | 2009-02-25 02:54:57 +0000 | [diff] [blame] | 1466 | addInstMethSummary("NSAutoreleasePool", "init", |
Jordy Rose | 500abad | 2011-08-21 19:41:36 +0000 | [diff] [blame] | 1467 | getPersistentSummary(NoRet, NewAutoreleasePool)); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1468 | |
| 1469 | // For NSWindow, allocated objects are (initially) self-owned. |
Ted Kremenek | 89e202d | 2009-02-23 02:51:29 +0000 | [diff] [blame] | 1470 | // FIXME: For now we opt for false negatives with NSWindow, as these objects |
| 1471 | // self-own themselves. However, they only do this once they are displayed. |
| 1472 | // Thus, we need to track an NSWindow's display status. |
| 1473 | // This is tracked in <rdar://problem/6062711>. |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1474 | // See also http://llvm.org/bugs/show_bug.cgi?id=3714. |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 1475 | const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(), |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1476 | StopTracking, |
| 1477 | StopTracking); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1478 | |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1479 | addClassMethSummary("NSWindow", "alloc", NoTrackYet); |
| 1480 | |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1481 | #if 0 |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1482 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1483 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1484 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1485 | addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1486 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 3aa7ecd | 2009-03-04 23:30:42 +0000 | [diff] [blame] | 1487 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1488 | |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1489 | // For NSPanel (which subclasses NSWindow), allocated objects are not |
| 1490 | // self-owned. |
Ted Kremenek | 99d0269 | 2009-04-03 19:02:51 +0000 | [diff] [blame] | 1491 | // FIXME: For now we don't track NSPanels. object for the same reason |
| 1492 | // as for NSWindow objects. |
| 1493 | addClassMethSummary("NSPanel", "alloc", NoTrackYet); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1494 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1495 | #if 0 |
| 1496 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1497 | "styleMask", "backing", "defer", NULL); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1498 | |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1499 | addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect", |
Ted Kremenek | af9dc27 | 2008-08-12 18:48:50 +0000 | [diff] [blame] | 1500 | "styleMask", "backing", "defer", "screen", NULL); |
Ted Kremenek | 78a35a3 | 2009-05-12 20:06:54 +0000 | [diff] [blame] | 1501 | #endif |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1502 | |
Ted Kremenek | ba67f6a | 2009-05-18 23:14:34 +0000 | [diff] [blame] | 1503 | // Don't track allocated autorelease pools yet, as it is okay to prematurely |
| 1504 | // exit a method. |
| 1505 | addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet); |
Ted Kremenek | a979712 | 2012-02-18 21:37:48 +0000 | [diff] [blame] | 1506 | addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false); |
Ted Kremenek | 553cf18 | 2008-06-25 21:21:56 +0000 | [diff] [blame] | 1507 | |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1508 | // Create summaries QCRenderer/QCView -createSnapShotImageOfType: |
| 1509 | addInstMethSummary("QCRenderer", AllocSumm, |
| 1510 | "createSnapshotImageOfType", NULL); |
| 1511 | addInstMethSummary("QCView", AllocSumm, |
| 1512 | "createSnapshotImageOfType", NULL); |
| 1513 | |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1514 | // Create summaries for CIContext, 'createCGImage' and |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1515 | // 'createCGLayerWithSize'. These objects are CF objects, and are not |
| 1516 | // automatically garbage collected. |
| 1517 | addInstMethSummary("CIContext", CFAllocSumm, |
Ted Kremenek | 767d649 | 2009-05-20 22:39:57 +0000 | [diff] [blame] | 1518 | "createCGImage", "fromRect", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1519 | addInstMethSummary("CIContext", CFAllocSumm, |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1520 | "createCGImage", "fromRect", "format", "colorSpace", NULL); |
Ted Kremenek | a834fb4 | 2009-08-28 19:52:12 +0000 | [diff] [blame] | 1521 | addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize", |
Ted Kremenek | 211a9c6 | 2009-06-15 20:58:58 +0000 | [diff] [blame] | 1522 | "info", NULL); |
Ted Kremenek | b3c3c28 | 2008-05-06 00:38:54 +0000 | [diff] [blame] | 1523 | } |
| 1524 | |
Ted Kremenek | d3dbcf4 | 2008-05-05 22:11:16 +0000 | [diff] [blame] | 1525 | //===----------------------------------------------------------------------===// |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1526 | // AutoreleaseBindings - State used to track objects in autorelease pools. |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1527 | //===----------------------------------------------------------------------===// |
| 1528 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1529 | typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts; |
| 1530 | typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents; |
| 1531 | typedef llvm::ImmutableList<SymbolRef> ARStack; |
Ted Kremenek | f9a8e2e | 2009-02-23 17:45:03 +0000 | [diff] [blame] | 1532 | |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1533 | static int AutoRCIndex = 0; |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1534 | static int AutoRBIndex = 0; |
| 1535 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1536 | namespace { class AutoreleasePoolContents {}; } |
| 1537 | namespace { class AutoreleaseStack {}; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1538 | |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1539 | namespace clang { |
Ted Kremenek | 9ef6537 | 2010-12-23 07:20:52 +0000 | [diff] [blame] | 1540 | namespace ento { |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1541 | template<> struct ProgramStateTrait<AutoreleaseStack> |
| 1542 | : public ProgramStatePartialTrait<ARStack> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1543 | static inline void *GDMIndex() { return &AutoRBIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1544 | }; |
| 1545 | |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1546 | template<> struct ProgramStateTrait<AutoreleasePoolContents> |
| 1547 | : public ProgramStatePartialTrait<ARPoolContents> { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1548 | static inline void *GDMIndex() { return &AutoRCIndex; } |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1549 | }; |
Argyrios Kyrtzidis | 5a4f98f | 2010-12-22 18:53:20 +0000 | [diff] [blame] | 1550 | } // end GR namespace |
Ted Kremenek | 4d3957d | 2009-02-24 19:15:11 +0000 | [diff] [blame] | 1551 | } // end clang namespace |
Ted Kremenek | 6d34893 | 2008-10-21 15:53:15 +0000 | [diff] [blame] | 1552 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1553 | static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1554 | ARStack stack = state->get<AutoreleaseStack>(); |
| 1555 | return stack.isEmpty() ? SymbolRef() : stack.getHead(); |
| 1556 | } |
| 1557 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1558 | static ProgramStateRef |
| 1559 | SendAutorelease(ProgramStateRef state, |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 1560 | ARCounts::Factory &F, |
| 1561 | SymbolRef sym) { |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1562 | SymbolRef pool = GetCurrentAutoreleasePool(state); |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1563 | const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1564 | ARCounts newCnts(0); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1565 | |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1566 | if (cnts) { |
| 1567 | const unsigned *cnt = (*cnts).lookup(sym); |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1568 | newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1569 | } |
| 1570 | else |
Ted Kremenek | 3baf672 | 2010-11-24 00:54:37 +0000 | [diff] [blame] | 1571 | newCnts = F.add(F.getEmptyMap(), sym, 1); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1572 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1573 | return state->set<AutoreleasePoolContents>(pool, newCnts); |
Ted Kremenek | 7037ab8 | 2009-03-20 17:34:15 +0000 | [diff] [blame] | 1574 | } |
| 1575 | |
Ted Kremenek | 1392261 | 2008-04-16 20:40:59 +0000 | [diff] [blame] | 1576 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1577 | // Error reporting. |
| 1578 | //===----------------------------------------------------------------------===// |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1579 | namespace { |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1580 | typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *> |
| 1581 | SummaryLogTy; |
| 1582 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1583 | //===-------------===// |
| 1584 | // Bug Descriptions. // |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1585 | //===-------------===// |
| 1586 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1587 | class CFRefBug : public BugType { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1588 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1589 | CFRefBug(StringRef name) |
| 1590 | : BugType(name, "Memory (Core Foundation/Objective-C)") {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1591 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1592 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1593 | // FIXME: Eventually remove. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1594 | virtual const char *getDescription() const = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1595 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1596 | virtual bool isLeak() const { return false; } |
| 1597 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1598 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1599 | class UseAfterRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1600 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1601 | UseAfterRelease() : CFRefBug("Use-after-release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1602 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1603 | const char *getDescription() const { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1604 | return "Reference-counted object is used after it is released"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1605 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1606 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1607 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1608 | class BadRelease : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1609 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1610 | BadRelease() : CFRefBug("Bad release") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1611 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1612 | const char *getDescription() const { |
Ted Kremenek | bb206fd | 2009-10-01 17:31:50 +0000 | [diff] [blame] | 1613 | return "Incorrect decrement of the reference count of an object that is " |
| 1614 | "not owned at this point by the caller"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1615 | } |
| 1616 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1617 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1618 | class DeallocGC : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1619 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1620 | DeallocGC() |
| 1621 | : CFRefBug("-dealloc called while using garbage collection") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1622 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1623 | const char *getDescription() const { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1624 | return "-dealloc called while using garbage collection"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1625 | } |
| 1626 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1627 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1628 | class DeallocNotOwned : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1629 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1630 | DeallocNotOwned() |
| 1631 | : CFRefBug("-dealloc sent to non-exclusively owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1632 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1633 | const char *getDescription() const { |
| 1634 | return "-dealloc sent to object that may be referenced elsewhere"; |
| 1635 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1636 | }; |
| 1637 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1638 | class OverAutorelease : public CFRefBug { |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1639 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1640 | OverAutorelease() |
| 1641 | : CFRefBug("Object sent -autorelease too many times") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1642 | |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1643 | const char *getDescription() const { |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1644 | return "Object sent -autorelease too many times"; |
Ted Kremenek | 369de56 | 2009-05-09 00:10:05 +0000 | [diff] [blame] | 1645 | } |
| 1646 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1647 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1648 | class ReturnedNotOwnedForOwned : public CFRefBug { |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1649 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1650 | ReturnedNotOwnedForOwned() |
| 1651 | : CFRefBug("Method should return an owned object") {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1652 | |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1653 | const char *getDescription() const { |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 1654 | return "Object with a +0 retain count returned to caller where a +1 " |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 1655 | "(owning) retain count is expected"; |
| 1656 | } |
| 1657 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1658 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1659 | class Leak : public CFRefBug { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1660 | const bool isReturn; |
| 1661 | protected: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1662 | Leak(StringRef name, bool isRet) |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 1663 | : CFRefBug(name), isReturn(isRet) { |
| 1664 | // Leaks should not be reported if they are post-dominated by a sink. |
| 1665 | setSuppressOnSink(true); |
| 1666 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1667 | public: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1668 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1669 | const char *getDescription() const { return ""; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1670 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1671 | bool isLeak() const { return true; } |
| 1672 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1673 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1674 | class LeakAtReturn : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1675 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1676 | LeakAtReturn(StringRef name) |
| 1677 | : Leak(name, true) {} |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1678 | }; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1679 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1680 | class LeakWithinFunction : public Leak { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1681 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1682 | LeakWithinFunction(StringRef name) |
| 1683 | : Leak(name, false) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1684 | }; |
| 1685 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1686 | //===---------===// |
| 1687 | // Bug Reports. // |
| 1688 | //===---------===// |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1689 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1690 | class CFRefReportVisitor : public BugReporterVisitor { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1691 | protected: |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1692 | SymbolRef Sym; |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1693 | const SummaryLogTy &SummaryLog; |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1694 | bool GCEnabled; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1695 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1696 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1697 | CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log) |
| 1698 | : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {} |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1699 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1700 | virtual void Profile(llvm::FoldingSetNodeID &ID) const { |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1701 | static int x = 0; |
| 1702 | ID.AddPointer(&x); |
| 1703 | ID.AddPointer(Sym); |
| 1704 | } |
| 1705 | |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1706 | virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N, |
| 1707 | const ExplodedNode *PrevN, |
| 1708 | BugReporterContext &BRC, |
| 1709 | BugReport &BR); |
| 1710 | |
| 1711 | virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1712 | const ExplodedNode *N, |
| 1713 | BugReport &BR); |
| 1714 | }; |
| 1715 | |
| 1716 | class CFRefLeakReportVisitor : public CFRefReportVisitor { |
| 1717 | public: |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1718 | CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled, |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1719 | const SummaryLogTy &log) |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1720 | : CFRefReportVisitor(sym, GCEnabled, log) {} |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1721 | |
| 1722 | PathDiagnosticPiece *getEndPath(BugReporterContext &BRC, |
| 1723 | const ExplodedNode *N, |
| 1724 | BugReport &BR); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1725 | }; |
| 1726 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1727 | class CFRefReport : public BugReport { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1728 | void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1729 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1730 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1731 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1732 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1733 | bool registerVisitor = true) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1734 | : BugReport(D, D.getDescription(), n) { |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1735 | if (registerVisitor) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1736 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1737 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1738 | } |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1739 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1740 | CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1741 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
| 1742 | StringRef endText) |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1743 | : BugReport(D, D.getDescription(), endText, n) { |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1744 | addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log)); |
| 1745 | addGCModeDescription(LOpts, GCEnabled); |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1746 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1747 | |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1748 | virtual std::pair<ranges_iterator, ranges_iterator> getRanges() { |
Anna Zaks | edf4dae | 2011-08-22 18:54:07 +0000 | [diff] [blame] | 1749 | const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType()); |
| 1750 | if (!BugTy.isLeak()) |
Anna Zaks | e172e8b | 2011-08-17 23:00:25 +0000 | [diff] [blame] | 1751 | return BugReport::getRanges(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1752 | else |
Argyrios Kyrtzidis | 640ccf0 | 2010-12-04 01:12:15 +0000 | [diff] [blame] | 1753 | return std::make_pair(ranges_iterator(), ranges_iterator()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1754 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1755 | }; |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 1756 | |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 1757 | class CFRefLeakReport : public CFRefReport { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1758 | const MemRegion* AllocBinding; |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 1759 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1760 | public: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1761 | CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled, |
| 1762 | const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 1763 | CheckerContext &Ctx); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1764 | |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 1765 | PathDiagnosticLocation getLocation(const SourceManager &SM) const { |
| 1766 | assert(Location.isValid()); |
| 1767 | return Location; |
| 1768 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1769 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1770 | } // end anonymous namespace |
| 1771 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1772 | void CFRefReport::addGCModeDescription(const LangOptions &LOpts, |
| 1773 | bool GCEnabled) { |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1774 | const char *GCModeDescription = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1775 | |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 1776 | switch (LOpts.getGC()) { |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1777 | case LangOptions::GCOnly: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1778 | assert(GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1779 | GCModeDescription = "Code is compiled to only use garbage collection"; |
| 1780 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1781 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1782 | case LangOptions::NonGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1783 | assert(!GCEnabled); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1784 | GCModeDescription = "Code is compiled to use reference counts"; |
| 1785 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1786 | |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1787 | case LangOptions::HybridGC: |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 1788 | if (GCEnabled) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1789 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1790 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1791 | "with GC enabled"; |
| 1792 | break; |
| 1793 | } else { |
| 1794 | GCModeDescription = "Code is compiled to use either garbage collection " |
| 1795 | "(GC) or reference counts (non-GC). The bug occurs " |
| 1796 | "in non-GC mode"; |
| 1797 | break; |
Anna Zaks | 7f2531c | 2011-08-22 20:31:28 +0000 | [diff] [blame] | 1798 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1799 | } |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1800 | |
Jordy Rose | f95b19d | 2011-08-24 20:38:42 +0000 | [diff] [blame] | 1801 | assert(GCModeDescription && "invalid/unknown GC mode"); |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1802 | addExtraText(GCModeDescription); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1803 | } |
| 1804 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 1805 | // FIXME: This should be a method on SmallVector. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1806 | static inline bool contains(const SmallVectorImpl<ArgEffect>& V, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1807 | ArgEffect X) { |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1808 | for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1809 | I!=E; ++I) |
| 1810 | if (*I == X) return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1811 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1812 | return false; |
| 1813 | } |
| 1814 | |
Ted Kremenek | 4c42bb7 | 2011-11-14 21:59:21 +0000 | [diff] [blame] | 1815 | static bool isPropertyAccess(const Stmt *S, ParentMap &PM) { |
| 1816 | unsigned maxDepth = 4; |
| 1817 | while (S && maxDepth) { |
| 1818 | if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) { |
| 1819 | if (!isa<ObjCMessageExpr>(PO->getSyntacticForm())) |
| 1820 | return true; |
| 1821 | return false; |
| 1822 | } |
| 1823 | S = PM.getParent(S); |
| 1824 | --maxDepth; |
| 1825 | } |
| 1826 | return false; |
| 1827 | } |
| 1828 | |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 1829 | PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N, |
| 1830 | const ExplodedNode *PrevN, |
| 1831 | BugReporterContext &BRC, |
| 1832 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1833 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1834 | if (!isa<StmtPoint>(N->getLocation())) |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 1835 | return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1836 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 1837 | // Check if the type state has changed. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 1838 | ProgramStateRef PrevSt = PrevN->getState(); |
| 1839 | ProgramStateRef CurrSt = N->getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1840 | const LocationContext *LCtx = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1841 | |
| 1842 | const RefVal* CurrT = CurrSt->get<RefBindings>(Sym); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1843 | if (!CurrT) return NULL; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1844 | |
Ted Kremenek | b65be70 | 2009-06-18 01:23:53 +0000 | [diff] [blame] | 1845 | const RefVal &CurrV = *CurrT; |
| 1846 | const RefVal *PrevT = PrevSt->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1847 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1848 | // Create a string buffer to constain all the useful things we want |
| 1849 | // to tell the user. |
| 1850 | std::string sbuf; |
| 1851 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1852 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1853 | // This is the allocation site since the previous node had no bindings |
| 1854 | // for this symbol. |
| 1855 | if (!PrevT) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1856 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1857 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1858 | if (isa<ObjCArrayLiteral>(S)) { |
| 1859 | os << "NSArray literal is an object with a +0 retain count"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1860 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1861 | else if (isa<ObjCDictionaryLiteral>(S)) { |
| 1862 | os << "NSDictionary literal is an object with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1863 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1864 | else { |
| 1865 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
| 1866 | // Get the name of the callee (if it is available). |
| 1867 | SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx); |
| 1868 | if (const FunctionDecl *FD = X.getAsFunctionDecl()) |
| 1869 | os << "Call to function '" << *FD << '\''; |
| 1870 | else |
| 1871 | os << "function call"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1872 | } |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 1873 | else { |
| 1874 | assert(isa<ObjCMessageExpr>(S)); |
| 1875 | // The message expression may have between written directly or as |
| 1876 | // a property access. Lazily determine which case we are looking at. |
| 1877 | os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method"); |
| 1878 | } |
| 1879 | |
| 1880 | if (CurrV.getObjKind() == RetEffect::CF) { |
| 1881 | os << " returns a Core Foundation object with a "; |
| 1882 | } |
| 1883 | else { |
| 1884 | assert (CurrV.getObjKind() == RetEffect::ObjC); |
| 1885 | os << " returns an Objective-C object with a "; |
| 1886 | } |
| 1887 | |
| 1888 | if (CurrV.isOwned()) { |
| 1889 | os << "+1 retain count"; |
| 1890 | |
| 1891 | if (GCEnabled) { |
| 1892 | assert(CurrV.getObjKind() == RetEffect::CF); |
| 1893 | os << ". " |
| 1894 | "Core Foundation objects are not automatically garbage collected."; |
| 1895 | } |
| 1896 | } |
| 1897 | else { |
| 1898 | assert (CurrV.isNotOwned()); |
| 1899 | os << "+0 retain count"; |
| 1900 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1901 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1902 | |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 1903 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 1904 | N->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1905 | return new PathDiagnosticEventPiece(Pos, os.str()); |
| 1906 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1907 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1908 | // Gather up the effects that were performed on the object at this |
| 1909 | // program point |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 1910 | SmallVector<ArgEffect, 2> AEffects; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1911 | |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 1912 | const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N); |
| 1913 | if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1914 | // We only have summaries attached to nodes after evaluating CallExpr and |
| 1915 | // ObjCMessageExprs. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1916 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1917 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1918 | if (const CallExpr *CE = dyn_cast<CallExpr>(S)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1919 | // Iterate through the parameter expressions and see if the symbol |
| 1920 | // was ever passed as an argument. |
| 1921 | unsigned i = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1922 | |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 1923 | for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1924 | AI!=AE; ++AI, ++i) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1925 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1926 | // Retrieve the value of the argument. Is it the symbol |
| 1927 | // we are interested in? |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1928 | if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1929 | continue; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1930 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1931 | // We have an argument. Get the effect! |
| 1932 | AEffects.push_back(Summ->getArg(i)); |
| 1933 | } |
| 1934 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1935 | else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) { |
Douglas Gregor | 04badcf | 2010-04-21 00:45:42 +0000 | [diff] [blame] | 1936 | if (const Expr *receiver = ME->getInstanceReceiver()) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1937 | if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx) |
| 1938 | .getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1939 | // The symbol we are tracking is the receiver. |
| 1940 | AEffects.push_back(Summ->getReceiverEffect()); |
| 1941 | } |
| 1942 | } |
| 1943 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1944 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1945 | do { |
| 1946 | // Get the previous type state. |
| 1947 | RefVal PrevV = *PrevT; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1948 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1949 | // Specially handle -dealloc. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1950 | if (!GCEnabled && contains(AEffects, Dealloc)) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1951 | // Determine if the object's reference count was pushed to zero. |
| 1952 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
| 1953 | // We may not have transitioned to 'release' if we hit an error. |
| 1954 | // This case is handled elsewhere. |
| 1955 | if (CurrV.getKind() == RefVal::Released) { |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 1956 | assert(CurrV.getCombinedCounts() == 0); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1957 | os << "Object released by directly sending the '-dealloc' message"; |
| 1958 | break; |
| 1959 | } |
| 1960 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1961 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1962 | // Specially handle CFMakeCollectable and friends. |
| 1963 | if (contains(AEffects, MakeCollectable)) { |
| 1964 | // Get the name of the function. |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 1965 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 1966 | SVal X = |
| 1967 | CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 1968 | const FunctionDecl *FD = X.getAsFunctionDecl(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1969 | |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 1970 | if (GCEnabled) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1971 | // Determine if the object's reference count was pushed to zero. |
| 1972 | assert(!(PrevV == CurrV) && "The typestate *must* have changed."); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1973 | |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 1974 | os << "In GC mode a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1975 | << "' decrements an object's retain count and registers the " |
| 1976 | "object with the garbage collector. "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1977 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1978 | if (CurrV.getKind() == RefVal::Released) { |
| 1979 | assert(CurrV.getCount() == 0); |
| 1980 | os << "Since it now has a 0 retain count the object can be " |
| 1981 | "automatically collected by the garbage collector."; |
| 1982 | } |
| 1983 | else |
| 1984 | os << "An object must have a 0 retain count to be garbage collected. " |
| 1985 | "After this call its retain count is +" << CurrV.getCount() |
| 1986 | << '.'; |
| 1987 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1988 | else |
Benjamin Kramer | b8989f2 | 2011-10-14 18:45:37 +0000 | [diff] [blame] | 1989 | os << "When GC is not enabled a call to '" << *FD |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1990 | << "' has no effect on its argument."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1991 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1992 | // Nothing more to say. |
| 1993 | break; |
| 1994 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 1995 | |
| 1996 | // Determine if the typestate has changed. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 1997 | if (!(PrevV == CurrV)) |
| 1998 | switch (CurrV.getKind()) { |
| 1999 | case RefVal::Owned: |
| 2000 | case RefVal::NotOwned: |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2001 | |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2002 | if (PrevV.getCount() == CurrV.getCount()) { |
| 2003 | // Did an autorelease message get sent? |
| 2004 | if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount()) |
| 2005 | return 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2006 | |
Zhongxing Xu | 264e937 | 2009-05-12 10:10:00 +0000 | [diff] [blame] | 2007 | assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount()); |
Ted Kremenek | eaedfea | 2009-05-10 05:11:21 +0000 | [diff] [blame] | 2008 | os << "Object sent -autorelease message"; |
Ted Kremenek | f21332e | 2009-05-08 20:01:42 +0000 | [diff] [blame] | 2009 | break; |
| 2010 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2011 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2012 | if (PrevV.getCount() > CurrV.getCount()) |
| 2013 | os << "Reference count decremented."; |
| 2014 | else |
| 2015 | os << "Reference count incremented."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2016 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2017 | if (unsigned Count = CurrV.getCount()) |
| 2018 | os << " The object now has a +" << Count << " retain count."; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2019 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2020 | if (PrevV.getKind() == RefVal::Released) { |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2021 | assert(GCEnabled && CurrV.getCount() > 0); |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2022 | os << " The object is not eligible for garbage collection until " |
| 2023 | "the retain count reaches 0 again."; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2024 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2025 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2026 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2027 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2028 | case RefVal::Released: |
| 2029 | os << "Object released."; |
| 2030 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2031 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2032 | case RefVal::ReturnedOwned: |
Jordy Rose | 74b7b2b | 2012-03-17 05:49:15 +0000 | [diff] [blame] | 2033 | // Autoreleases can be applied after marking a node ReturnedOwned. |
| 2034 | if (CurrV.getAutoreleaseCount()) |
| 2035 | return NULL; |
| 2036 | |
| 2037 | os << "Object returned to caller as an owning reference (single " |
| 2038 | "retain count transferred to caller)"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2039 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2040 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2041 | case RefVal::ReturnedNotOwned: |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2042 | os << "Object returned to caller with a +0 retain count"; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2043 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2044 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2045 | default: |
| 2046 | return NULL; |
| 2047 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2048 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2049 | // Emit any remaining diagnostics for the argument effects (if any). |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2050 | for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(), |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2051 | E=AEffects.end(); I != E; ++I) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2052 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2053 | // A bunch of things have alternate behavior under GC. |
Jordy Rose | 35c8695 | 2011-08-24 05:47:39 +0000 | [diff] [blame] | 2054 | if (GCEnabled) |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2055 | switch (*I) { |
| 2056 | default: break; |
| 2057 | case Autorelease: |
| 2058 | os << "In GC mode an 'autorelease' has no effect."; |
| 2059 | continue; |
| 2060 | case IncRefMsg: |
| 2061 | os << "In GC mode the 'retain' message has no effect."; |
| 2062 | continue; |
| 2063 | case DecRefMsg: |
| 2064 | os << "In GC mode the 'release' message has no effect."; |
| 2065 | continue; |
| 2066 | } |
| 2067 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2068 | } while (0); |
| 2069 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2070 | if (os.str().empty()) |
| 2071 | return 0; // We have nothing to say! |
Ted Kremenek | 2033a95 | 2009-05-13 07:12:33 +0000 | [diff] [blame] | 2072 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2073 | const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt(); |
Anna Zaks | 220ac8c | 2011-09-15 01:08:34 +0000 | [diff] [blame] | 2074 | PathDiagnosticLocation Pos(S, BRC.getSourceManager(), |
| 2075 | N->getLocationContext()); |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2076 | PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str()); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2077 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2078 | // Add the range by scanning the children of the statement for any bindings |
| 2079 | // to Sym. |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2080 | for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end(); |
Ted Kremenek | 5f85e17 | 2009-07-22 22:35:28 +0000 | [diff] [blame] | 2081 | I!=E; ++I) |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2082 | if (const Expr *Exp = dyn_cast_or_null<Expr>(*I)) |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2083 | if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) { |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2084 | P->addRange(Exp->getSourceRange()); |
| 2085 | break; |
| 2086 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2087 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2088 | return P; |
| 2089 | } |
| 2090 | |
| 2091 | namespace { |
Kovarththanan Rajaratnam | ba5fb5a | 2009-11-28 06:07:30 +0000 | [diff] [blame] | 2092 | class FindUniqueBinding : |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2093 | public StoreManager::BindingsHandler { |
| 2094 | SymbolRef Sym; |
| 2095 | const MemRegion* Binding; |
| 2096 | bool First; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2097 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2098 | public: |
| 2099 | FindUniqueBinding(SymbolRef sym) : Sym(sym), Binding(0), First(true) {} |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2100 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2101 | bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R, |
| 2102 | SVal val) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2103 | |
| 2104 | SymbolRef SymV = val.getAsSymbol(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2105 | if (!SymV || SymV != Sym) |
| 2106 | return true; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2107 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2108 | if (Binding) { |
| 2109 | First = false; |
| 2110 | return false; |
| 2111 | } |
| 2112 | else |
| 2113 | Binding = R; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2114 | |
| 2115 | return true; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2116 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2117 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2118 | operator bool() { return First && Binding; } |
Ted Kremenek | 0507f7e | 2012-01-04 00:35:45 +0000 | [diff] [blame] | 2119 | const MemRegion *getRegion() { return Binding; } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2120 | }; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2121 | } |
| 2122 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2123 | // Find the first node in the current function context that referred to the |
| 2124 | // tracked symbol and the memory location that value was stored to. Note, the |
| 2125 | // value is only reported if the allocation occurred in the same function as |
| 2126 | // the leak. |
Zhongxing Xu | c5619d9 | 2009-08-06 01:32:16 +0000 | [diff] [blame] | 2127 | static std::pair<const ExplodedNode*,const MemRegion*> |
Ted Kremenek | 18c66fd | 2011-08-15 22:09:50 +0000 | [diff] [blame] | 2128 | GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N, |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2129 | SymbolRef Sym) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2130 | const ExplodedNode *Last = N; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2131 | const MemRegion* FirstBinding = 0; |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2132 | const LocationContext *LeakContext = N->getLocationContext(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2133 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2134 | while (N) { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2135 | ProgramStateRef St = N->getState(); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2136 | RefBindings B = St->get<RefBindings>(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2137 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2138 | if (!B.lookup(Sym)) |
| 2139 | break; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2140 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2141 | FindUniqueBinding FB(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2142 | StateMgr.iterBindings(St, FB); |
| 2143 | if (FB) FirstBinding = FB.getRegion(); |
| 2144 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2145 | // Allocation node, is the last node in the current context in which the |
| 2146 | // symbol was tracked. |
| 2147 | if (N->getLocationContext() == LeakContext) |
| 2148 | Last = N; |
| 2149 | |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2150 | N = N->pred_empty() ? NULL : *(N->pred_begin()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2151 | } |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2152 | |
Anna Zaks | e7e0168 | 2012-02-28 22:39:22 +0000 | [diff] [blame] | 2153 | // If allocation happened in a function different from the leak node context, |
| 2154 | // do not report the binding. |
| 2155 | if (N->getLocationContext() != LeakContext) { |
| 2156 | FirstBinding = 0; |
| 2157 | } |
| 2158 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2159 | return std::make_pair(Last, FirstBinding); |
| 2160 | } |
| 2161 | |
| 2162 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2163 | CFRefReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2164 | const ExplodedNode *EndN, |
| 2165 | BugReport &BR) { |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2166 | BR.markInteresting(Sym); |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2167 | return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2168 | } |
| 2169 | |
| 2170 | PathDiagnosticPiece* |
Anna Zaks | 23f395e | 2011-08-20 01:27:22 +0000 | [diff] [blame] | 2171 | CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC, |
| 2172 | const ExplodedNode *EndN, |
| 2173 | BugReport &BR) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2174 | |
Ted Kremenek | 8966bc1 | 2009-05-06 21:39:49 +0000 | [diff] [blame] | 2175 | // Tell the BugReporterContext to report cases when the tracked symbol is |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2176 | // assigned to different variables, etc. |
Ted Kremenek | 76aadc3 | 2012-03-09 01:13:14 +0000 | [diff] [blame] | 2177 | BR.markInteresting(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2178 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2179 | // We are reporting a leak. Walk up the graph to get to the first node where |
| 2180 | // the symbol appeared, and also get the first VarDecl that tracked object |
| 2181 | // is stored to. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2182 | const ExplodedNode *AllocNode = 0; |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2183 | const MemRegion* FirstBinding = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2184 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2185 | llvm::tie(AllocNode, FirstBinding) = |
Ted Kremenek | f04dced | 2009-05-08 23:32:51 +0000 | [diff] [blame] | 2186 | GetAllocationSite(BRC.getStateManager(), EndN, Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2187 | |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2188 | SourceManager& SM = BRC.getSourceManager(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2189 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2190 | // Compute an actual location for the leak. Sometimes a leak doesn't |
| 2191 | // occur at an actual statement (e.g., transition between blocks; end |
| 2192 | // of function) so we need to walk the graph and compute a real location. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2193 | const ExplodedNode *LeakN = EndN; |
Anna Zaks | 4fdf97b | 2011-09-15 18:56:07 +0000 | [diff] [blame] | 2194 | PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2195 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2196 | std::string sbuf; |
| 2197 | llvm::raw_string_ostream os(sbuf); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2198 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2199 | os << "Object leaked: "; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2200 | |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2201 | if (FirstBinding) { |
| 2202 | os << "object allocated and stored into '" |
| 2203 | << FirstBinding->getString() << '\''; |
| 2204 | } |
| 2205 | else |
| 2206 | os << "allocated object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2207 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2208 | // Get the retain count. |
| 2209 | const RefVal* RV = EndN->getState()->get<RefBindings>(Sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2210 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2211 | if (RV->getKind() == RefVal::ErrorLeakReturned) { |
| 2212 | // FIXME: Per comments in rdar://6320065, "create" only applies to CF |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2213 | // objects. Only "copy", "alloc", "retain" and "new" transfer ownership |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2214 | // to the caller for NS objects. |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2215 | const Decl *D = &EndN->getCodeDecl(); |
| 2216 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) { |
| 2217 | os << " is returned from a method whose name ('" |
| 2218 | << MD->getSelector().getAsString() |
| 2219 | << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'." |
Jordy Rose | 5b5402b | 2011-07-15 22:17:54 +0000 | [diff] [blame] | 2220 | " This violates the naming convention rules" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2221 | " given in the Memory Management Guide for Cocoa"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2222 | } |
| 2223 | else { |
| 2224 | const FunctionDecl *FD = cast<FunctionDecl>(D); |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2225 | os << " is returned from a function whose name ('" |
Benjamin Kramer | a59d20b | 2012-02-07 11:57:57 +0000 | [diff] [blame] | 2226 | << *FD |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2227 | << "') does not contain 'Copy' or 'Create'. This violates the naming" |
Ted Kremenek | b7dcddf | 2011-12-22 06:35:52 +0000 | [diff] [blame] | 2228 | " convention rules given in the Memory Management Guide for Core" |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2229 | " Foundation"; |
Ted Kremenek | d368d71 | 2011-05-25 06:19:45 +0000 | [diff] [blame] | 2230 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2231 | } |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2232 | else if (RV->getKind() == RefVal::ErrorGCLeakReturned) { |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2233 | ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl()); |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2234 | os << " and returned from method '" << MD.getSelector().getAsString() |
Ted Kremenek | 82f2be5 | 2009-05-10 16:52:15 +0000 | [diff] [blame] | 2235 | << "' is potentially leaked when using garbage collection. Callers " |
| 2236 | "of this method do not expect a returned object with a +1 retain " |
| 2237 | "count since they expect the object to be managed by the garbage " |
| 2238 | "collector"; |
Ted Kremenek | e8720ce | 2009-05-10 06:25:57 +0000 | [diff] [blame] | 2239 | } |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2240 | else |
Ted Kremenek | abf517c | 2010-10-15 22:50:23 +0000 | [diff] [blame] | 2241 | os << " is not referenced later in this execution path and has a retain " |
Ted Kremenek | f136546 | 2011-05-26 18:45:44 +0000 | [diff] [blame] | 2242 | "count of +" << RV->getCount(); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2243 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2244 | return new PathDiagnosticEventPiece(L, os.str()); |
| 2245 | } |
| 2246 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2247 | CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, |
| 2248 | bool GCEnabled, const SummaryLogTy &Log, |
| 2249 | ExplodedNode *n, SymbolRef sym, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2250 | CheckerContext &Ctx) |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2251 | : CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) { |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2252 | |
Chris Lattner | fc8f0e1 | 2011-04-15 05:22:18 +0000 | [diff] [blame] | 2253 | // Most bug reports are cached at the location where they occurred. |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2254 | // With leaks, we want to unique them by the location where they were |
| 2255 | // allocated, and only report a single path. To do this, we need to find |
| 2256 | // the allocation site of a piece of tracked memory, which we do via a |
| 2257 | // call to GetAllocationSite. This will walk the ExplodedGraph backwards. |
| 2258 | // Note that this is *not* the trimmed graph; we are guaranteed, however, |
| 2259 | // that all ancestor nodes that represent the allocation site have the |
| 2260 | // same SourceLocation. |
Ted Kremenek | 9c378f7 | 2011-08-12 23:37:29 +0000 | [diff] [blame] | 2261 | const ExplodedNode *AllocNode = 0; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2262 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2263 | const SourceManager& SMgr = Ctx.getSourceManager(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2264 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2265 | llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding. |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2266 | GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym); |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2267 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2268 | // Get the SourceLocation for the allocation site. |
| 2269 | ProgramPoint P = AllocNode->getLocation(); |
Anna Zaks | 590dd8e | 2011-09-20 21:38:35 +0000 | [diff] [blame] | 2270 | const Stmt *AllocStmt = cast<PostStmt>(P).getStmt(); |
| 2271 | Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr, |
| 2272 | n->getLocationContext()); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2273 | // Fill in the description of the bug. |
| 2274 | Description.clear(); |
| 2275 | llvm::raw_string_ostream os(Description); |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2276 | os << "Potential leak "; |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2277 | if (GCEnabled) |
Ted Kremenek | dd924e2 | 2009-05-02 19:05:19 +0000 | [diff] [blame] | 2278 | os << "(when using garbage collection) "; |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2279 | os << "of an object"; |
Mike Stump | 1eb4433 | 2009-09-09 15:08:12 +0000 | [diff] [blame] | 2280 | |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2281 | // FIXME: AllocBinding doesn't get populated for RegionStore yet. |
| 2282 | if (AllocBinding) |
Anna Zaks | 212000e | 2012-02-28 21:49:08 +0000 | [diff] [blame] | 2283 | os << " stored into '" << AllocBinding->getString() << '\''; |
Anna Zaks | dc757b0 | 2011-08-19 23:21:56 +0000 | [diff] [blame] | 2284 | |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 2285 | addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log)); |
Ted Kremenek | c887d13 | 2009-04-29 18:50:19 +0000 | [diff] [blame] | 2286 | } |
| 2287 | |
| 2288 | //===----------------------------------------------------------------------===// |
| 2289 | // Main checker logic. |
| 2290 | //===----------------------------------------------------------------------===// |
| 2291 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2292 | namespace { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2293 | class RetainCountChecker |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2294 | : public Checker< check::Bind, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2295 | check::DeadSymbols, |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2296 | check::EndAnalysis, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2297 | check::EndPath, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2298 | check::PostStmt<BlockExpr>, |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2299 | check::PostStmt<CastExpr>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2300 | check::PostStmt<CallExpr>, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2301 | check::PostStmt<CXXConstructExpr>, |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2302 | check::PostStmt<ObjCArrayLiteral>, |
| 2303 | check::PostStmt<ObjCDictionaryLiteral>, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2304 | check::PostObjCMessage, |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2305 | check::PreStmt<ReturnStmt>, |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2306 | check::RegionChanges, |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2307 | eval::Assume, |
| 2308 | eval::Call > { |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2309 | mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned; |
| 2310 | mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned; |
| 2311 | mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned; |
| 2312 | mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn; |
| 2313 | mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2314 | |
| 2315 | typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap; |
| 2316 | |
| 2317 | // This map is only used to ensure proper deletion of any allocated tags. |
| 2318 | mutable SymbolTagMap DeadSymbolTags; |
| 2319 | |
Dylan Noblesmith | 6f42b62 | 2012-02-05 02:12:40 +0000 | [diff] [blame] | 2320 | mutable OwningPtr<RetainSummaryManager> Summaries; |
| 2321 | mutable OwningPtr<RetainSummaryManager> SummariesGC; |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2322 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2323 | mutable ARCounts::Factory ARCountFactory; |
| 2324 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2325 | mutable SummaryLogTy SummaryLog; |
| 2326 | mutable bool ShouldResetSummaryLog; |
| 2327 | |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2328 | public: |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2329 | RetainCountChecker() : ShouldResetSummaryLog(false) {} |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2330 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2331 | virtual ~RetainCountChecker() { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2332 | DeleteContainerSeconds(DeadSymbolTags); |
| 2333 | } |
| 2334 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2335 | void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR, |
| 2336 | ExprEngine &Eng) const { |
| 2337 | // FIXME: This is a hack to make sure the summary log gets cleared between |
| 2338 | // analyses of different code bodies. |
| 2339 | // |
| 2340 | // Why is this necessary? Because a checker's lifetime is tied to a |
| 2341 | // translation unit, but an ExplodedGraph's lifetime is just a code body. |
| 2342 | // Once in a blue moon, a new ExplodedNode will have the same address as an |
| 2343 | // old one with an associated summary, and the bug report visitor gets very |
| 2344 | // confused. (To make things worse, the summary lifetime is currently also |
| 2345 | // tied to a code body, so we get a crash instead of incorrect results.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2346 | // |
| 2347 | // Why is this a bad solution? Because if the lifetime of the ExplodedGraph |
| 2348 | // changes, things will start going wrong again. Really the lifetime of this |
| 2349 | // log needs to be tied to either the specific nodes in it or the entire |
| 2350 | // ExplodedGraph, not to a specific part of the code being analyzed. |
| 2351 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2352 | // (Also, having stateful local data means that the same checker can't be |
| 2353 | // used from multiple threads, but a lot of checkers have incorrect |
| 2354 | // assumptions about that anyway. So that wasn't a priority at the time of |
| 2355 | // this fix.) |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2356 | // |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2357 | // This happens at the end of analysis, but bug reports are emitted /after/ |
| 2358 | // this point. So we can't just clear the summary log now. Instead, we mark |
| 2359 | // that the next time we access the summary log, it should be cleared. |
| 2360 | |
| 2361 | // If we never reset the summary log during /this/ code body analysis, |
| 2362 | // there were no new summaries. There might still have been summaries from |
| 2363 | // the /last/ analysis, so clear them out to make sure the bug report |
| 2364 | // visitors don't get confused. |
| 2365 | if (ShouldResetSummaryLog) |
| 2366 | SummaryLog.clear(); |
| 2367 | |
| 2368 | ShouldResetSummaryLog = !SummaryLog.empty(); |
Jordy Rose | 1ab51c7 | 2011-08-24 09:27:24 +0000 | [diff] [blame] | 2369 | } |
| 2370 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2371 | CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts, |
| 2372 | bool GCEnabled) const { |
| 2373 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2374 | if (!leakWithinFunctionGC) |
| 2375 | leakWithinFunctionGC.reset(new LeakWithinFunction("Leak of object when " |
| 2376 | "using garbage " |
| 2377 | "collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2378 | return leakWithinFunctionGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2379 | } else { |
| 2380 | if (!leakWithinFunction) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2381 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2382 | leakWithinFunction.reset(new LeakWithinFunction("Leak of object when " |
| 2383 | "not using garbage " |
| 2384 | "collection (GC) in " |
| 2385 | "dual GC/non-GC " |
| 2386 | "code")); |
| 2387 | } else { |
| 2388 | leakWithinFunction.reset(new LeakWithinFunction("Leak")); |
| 2389 | } |
| 2390 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2391 | return leakWithinFunction.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2392 | } |
| 2393 | } |
| 2394 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2395 | CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const { |
| 2396 | if (GCEnabled) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2397 | if (!leakAtReturnGC) |
| 2398 | leakAtReturnGC.reset(new LeakAtReturn("Leak of returned object when " |
| 2399 | "using garbage collection")); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2400 | return leakAtReturnGC.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2401 | } else { |
| 2402 | if (!leakAtReturn) { |
Douglas Gregor | e289d81 | 2011-09-13 17:21:33 +0000 | [diff] [blame] | 2403 | if (LOpts.getGC() == LangOptions::HybridGC) { |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2404 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object when " |
| 2405 | "not using garbage collection " |
| 2406 | "(GC) in dual GC/non-GC code")); |
| 2407 | } else { |
| 2408 | leakAtReturn.reset(new LeakAtReturn("Leak of returned object")); |
| 2409 | } |
| 2410 | } |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2411 | return leakAtReturn.get(); |
Jordy Rose | db92bb6 | 2011-08-25 01:14:38 +0000 | [diff] [blame] | 2412 | } |
| 2413 | } |
| 2414 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2415 | RetainSummaryManager &getSummaryManager(ASTContext &Ctx, |
| 2416 | bool GCEnabled) const { |
| 2417 | // FIXME: We don't support ARC being turned on and off during one analysis. |
| 2418 | // (nor, for that matter, do we support changing ASTContexts) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2419 | bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2420 | if (GCEnabled) { |
| 2421 | if (!SummariesGC) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2422 | SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2423 | else |
| 2424 | assert(SummariesGC->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2425 | return *SummariesGC; |
| 2426 | } else { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2427 | if (!Summaries) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2428 | Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled)); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2429 | else |
| 2430 | assert(Summaries->isARCEnabled() == ARCEnabled); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2431 | return *Summaries; |
| 2432 | } |
| 2433 | } |
| 2434 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2435 | RetainSummaryManager &getSummaryManager(CheckerContext &C) const { |
| 2436 | return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled()); |
| 2437 | } |
| 2438 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2439 | void printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 2440 | const char *NL, const char *Sep) const; |
| 2441 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 2442 | void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2443 | void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const; |
| 2444 | void checkPostStmt(const CastExpr *CE, CheckerContext &C) const; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2445 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2446 | void checkPostStmt(const CallExpr *CE, CheckerContext &C) const; |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2447 | void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2448 | void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const; |
| 2449 | void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2450 | void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2451 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2452 | void checkSummary(const RetainSummary &Summ, const CallOrObjCMessage &Call, |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2453 | CheckerContext &C) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2454 | |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 2455 | bool evalCall(const CallExpr *CE, CheckerContext &C) const; |
| 2456 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2457 | ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond, |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2458 | bool Assumption) const; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2459 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2460 | ProgramStateRef |
| 2461 | checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2462 | const StoreManager::InvalidatedSymbols *invalidated, |
| 2463 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 2464 | ArrayRef<const MemRegion *> Regions, |
| 2465 | const CallOrObjCMessage *Call) const; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2466 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2467 | bool wantsRegionChangeUpdate(ProgramStateRef state) const { |
Jordy Rose | 2f9a66d | 2011-08-20 21:17:59 +0000 | [diff] [blame] | 2468 | return true; |
Jordy Rose | ab027fd | 2011-08-20 21:16:58 +0000 | [diff] [blame] | 2469 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2470 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2471 | void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const; |
| 2472 | void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C, |
| 2473 | ExplodedNode *Pred, RetEffect RE, RefVal X, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2474 | SymbolRef Sym, ProgramStateRef state) const; |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 2475 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2476 | void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const; |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 2477 | void checkEndPath(CheckerContext &C) const; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2478 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2479 | ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2480 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2481 | CheckerContext &C) const; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2482 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2483 | void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange, |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2484 | RefVal::Kind ErrorKind, SymbolRef Sym, |
| 2485 | CheckerContext &C) const; |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2486 | |
| 2487 | void processObjCLiterals(CheckerContext &C, const Expr *Ex) const; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2488 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2489 | const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const; |
| 2490 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2491 | ProgramStateRef handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2492 | SymbolRef sid, RefVal V, |
| 2493 | SmallVectorImpl<SymbolRef> &Leaked) const; |
| 2494 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2495 | std::pair<ExplodedNode *, ProgramStateRef > |
| 2496 | handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2497 | GenericNodeBuilderRefCount Bd, ExplodedNode *Pred, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2498 | CheckerContext &Ctx, SymbolRef Sym, RefVal V) const; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 2499 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2500 | ExplodedNode *processLeaks(ProgramStateRef state, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2501 | SmallVectorImpl<SymbolRef> &Leaked, |
| 2502 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 2503 | CheckerContext &Ctx, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 2504 | ExplodedNode *Pred = 0) const; |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 2505 | }; |
| 2506 | } // end anonymous namespace |
| 2507 | |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2508 | namespace { |
| 2509 | class StopTrackingCallback : public SymbolVisitor { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2510 | ProgramStateRef state; |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2511 | public: |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2512 | StopTrackingCallback(ProgramStateRef st) : state(st) {} |
| 2513 | ProgramStateRef getState() const { return state; } |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2514 | |
| 2515 | bool VisitSymbol(SymbolRef sym) { |
| 2516 | state = state->remove<RefBindings>(sym); |
| 2517 | return true; |
| 2518 | } |
| 2519 | }; |
| 2520 | } // end anonymous namespace |
| 2521 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2522 | //===----------------------------------------------------------------------===// |
| 2523 | // Handle statements that may have an effect on refcounts. |
| 2524 | //===----------------------------------------------------------------------===// |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2525 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2526 | void RetainCountChecker::checkPostStmt(const BlockExpr *BE, |
| 2527 | CheckerContext &C) const { |
Jordy Rose | 6704429 | 2011-08-17 21:27:39 +0000 | [diff] [blame] | 2528 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2529 | // Scan the BlockDecRefExprs for any object the retain count checker |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2530 | // may be tracking. |
John McCall | 469a1eb | 2011-02-02 13:00:07 +0000 | [diff] [blame] | 2531 | if (!BE->getBlockDecl()->hasCaptures()) |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2532 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2533 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2534 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2535 | const BlockDataRegion *R = |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2536 | cast<BlockDataRegion>(state->getSVal(BE, |
| 2537 | C.getLocationContext()).getAsRegion()); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2538 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2539 | BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(), |
| 2540 | E = R->referenced_vars_end(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2541 | |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2542 | if (I == E) |
| 2543 | return; |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2544 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2545 | // FIXME: For now we invalidate the tracking of all symbols passed to blocks |
| 2546 | // via captured variables, even though captured variables result in a copy |
| 2547 | // and in implicit increment/decrement of a retain count. |
Chris Lattner | 5f9e272 | 2011-07-23 10:55:15 +0000 | [diff] [blame] | 2548 | SmallVector<const MemRegion*, 10> Regions; |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2549 | const LocationContext *LC = C.getLocationContext(); |
Ted Kremenek | c8413fd | 2010-12-02 07:49:45 +0000 | [diff] [blame] | 2550 | MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager(); |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2551 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2552 | for ( ; I != E; ++I) { |
| 2553 | const VarRegion *VR = *I; |
| 2554 | if (VR->getSuperRegion() == R) { |
| 2555 | VR = MemMgr.getVarRegion(VR->getDecl(), LC); |
| 2556 | } |
| 2557 | Regions.push_back(VR); |
| 2558 | } |
Ted Kremenek | dcee3ce | 2010-07-01 20:16:50 +0000 | [diff] [blame] | 2559 | |
Ted Kremenek | 67d1287 | 2009-12-07 22:05:27 +0000 | [diff] [blame] | 2560 | state = |
| 2561 | state->scanReachableSymbols<StopTrackingCallback>(Regions.data(), |
| 2562 | Regions.data() + Regions.size()).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2563 | C.addTransition(state); |
Ted Kremenek | 38cc6bc | 2009-11-26 02:38:19 +0000 | [diff] [blame] | 2564 | } |
| 2565 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2566 | void RetainCountChecker::checkPostStmt(const CastExpr *CE, |
| 2567 | CheckerContext &C) const { |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2568 | const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE); |
| 2569 | if (!BE) |
| 2570 | return; |
| 2571 | |
John McCall | 71c482c | 2011-06-17 06:50:50 +0000 | [diff] [blame] | 2572 | ArgEffect AE = IncRef; |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2573 | |
| 2574 | switch (BE->getBridgeKind()) { |
| 2575 | case clang::OBC_Bridge: |
| 2576 | // Do nothing. |
| 2577 | return; |
| 2578 | case clang::OBC_BridgeRetained: |
| 2579 | AE = IncRef; |
| 2580 | break; |
| 2581 | case clang::OBC_BridgeTransfer: |
| 2582 | AE = DecRefBridgedTransfered; |
| 2583 | break; |
| 2584 | } |
| 2585 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2586 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2587 | SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol(); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2588 | if (!Sym) |
| 2589 | return; |
| 2590 | const RefVal* T = state->get<RefBindings>(Sym); |
| 2591 | if (!T) |
| 2592 | return; |
| 2593 | |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2594 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2595 | state = updateSymbol(state, Sym, *T, AE, hasErr, C); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2596 | |
| 2597 | if (hasErr) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2598 | // FIXME: If we get an error during a bridge cast, should we report it? |
| 2599 | // Should we assert that there is no error? |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2600 | return; |
| 2601 | } |
| 2602 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2603 | C.addTransition(state); |
John McCall | f85e193 | 2011-06-15 23:02:42 +0000 | [diff] [blame] | 2604 | } |
| 2605 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2606 | void RetainCountChecker::checkPostStmt(const CallExpr *CE, |
| 2607 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2608 | // Get the callee. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2609 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2610 | const Expr *Callee = CE->getCallee(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2611 | SVal L = state->getSVal(Callee, C.getLocationContext()); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2612 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2613 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2614 | const RetainSummary *Summ = 0; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2615 | |
| 2616 | // FIXME: Better support for blocks. For now we stop tracking anything |
| 2617 | // that is passed to blocks. |
| 2618 | // FIXME: Need to handle variables that are "captured" by the block. |
| 2619 | if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) { |
| 2620 | Summ = Summaries.getPersistentStopSummary(); |
| 2621 | } else if (const FunctionDecl *FD = L.getAsFunctionDecl()) { |
| 2622 | Summ = Summaries.getSummary(FD); |
| 2623 | } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) { |
| 2624 | if (const CXXMethodDecl *MD = me->getMethodDecl()) |
| 2625 | Summ = Summaries.getSummary(MD); |
| 2626 | } |
| 2627 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2628 | if (!Summ) |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2629 | Summ = Summaries.getDefaultSummary(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2630 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2631 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2632 | } |
| 2633 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2634 | void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE, |
| 2635 | CheckerContext &C) const { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2636 | const CXXConstructorDecl *Ctor = CE->getConstructor(); |
| 2637 | if (!Ctor) |
| 2638 | return; |
| 2639 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2640 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2641 | const RetainSummary *Summ = Summaries.getSummary(Ctor); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2642 | |
| 2643 | // If we didn't get a summary, this constructor doesn't affect retain counts. |
| 2644 | if (!Summ) |
| 2645 | return; |
| 2646 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2647 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2648 | checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C); |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2649 | } |
| 2650 | |
Ted Kremenek | 1a45a5f | 2012-03-06 20:06:12 +0000 | [diff] [blame] | 2651 | void RetainCountChecker::processObjCLiterals(CheckerContext &C, |
| 2652 | const Expr *Ex) const { |
| 2653 | ProgramStateRef state = C.getState(); |
| 2654 | const ExplodedNode *pred = C.getPredecessor(); |
| 2655 | for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ; |
| 2656 | it != et ; ++it) { |
| 2657 | const Stmt *child = *it; |
| 2658 | SVal V = state->getSVal(child, pred->getLocationContext()); |
| 2659 | if (SymbolRef sym = V.getAsSymbol()) |
| 2660 | if (const RefVal* T = state->get<RefBindings>(sym)) { |
| 2661 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2662 | state = updateSymbol(state, sym, *T, MayEscape, hasErr, C); |
| 2663 | if (hasErr) { |
| 2664 | processNonLeakError(state, child->getSourceRange(), hasErr, sym, C); |
| 2665 | return; |
| 2666 | } |
| 2667 | } |
| 2668 | } |
| 2669 | |
| 2670 | // Return the object as autoreleased. |
| 2671 | // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC); |
| 2672 | if (SymbolRef sym = |
| 2673 | state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) { |
| 2674 | QualType ResultTy = Ex->getType(); |
| 2675 | state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC, |
| 2676 | ResultTy)); |
| 2677 | } |
| 2678 | |
| 2679 | C.addTransition(state); |
| 2680 | } |
| 2681 | |
| 2682 | void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL, |
| 2683 | CheckerContext &C) const { |
| 2684 | // Apply the 'MayEscape' to all values. |
| 2685 | processObjCLiterals(C, AL); |
| 2686 | } |
| 2687 | |
| 2688 | void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL, |
| 2689 | CheckerContext &C) const { |
| 2690 | // Apply the 'MayEscape' to all keys and values. |
| 2691 | processObjCLiterals(C, DL); |
| 2692 | } |
| 2693 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2694 | void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg, |
| 2695 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2696 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2697 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2698 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2699 | |
Ted Kremenek | 93edbc5 | 2011-10-05 23:54:29 +0000 | [diff] [blame] | 2700 | const RetainSummary *Summ; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2701 | if (Msg.isInstanceMessage()) { |
Anna Zaks | a2a8603 | 2011-11-01 22:41:01 +0000 | [diff] [blame] | 2702 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2703 | Summ = Summaries.getInstanceMethodSummary(Msg, state, LC); |
| 2704 | } else { |
| 2705 | Summ = Summaries.getClassMethodSummary(Msg); |
| 2706 | } |
| 2707 | |
| 2708 | // If we didn't get a summary, this message doesn't affect retain counts. |
| 2709 | if (!Summ) |
| 2710 | return; |
| 2711 | |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2712 | checkSummary(*Summ, CallOrObjCMessage(Msg, state, C.getLocationContext()), C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2713 | } |
| 2714 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2715 | /// GetReturnType - Used to get the return type of a message expression or |
| 2716 | /// function call with the intention of affixing that type to a tracked symbol. |
| 2717 | /// While the the return type can be queried directly from RetEx, when |
| 2718 | /// invoking class methods we augment to the return type to be that of |
| 2719 | /// a pointer to the class (as opposed it just being id). |
| 2720 | // FIXME: We may be able to do this with related result types instead. |
| 2721 | // This function is probably overestimating. |
| 2722 | static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) { |
| 2723 | QualType RetTy = RetE->getType(); |
| 2724 | // If RetE is not a message expression just return its type. |
| 2725 | // If RetE is a message expression, return its types if it is something |
| 2726 | /// more specific than id. |
| 2727 | if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE)) |
| 2728 | if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>()) |
| 2729 | if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() || |
| 2730 | PT->isObjCClassType()) { |
| 2731 | // At this point we know the return type of the message expression is |
| 2732 | // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this |
| 2733 | // is a call to a class method whose type we can resolve. In such |
| 2734 | // cases, promote the return type to XXX* (where XXX is the class). |
| 2735 | const ObjCInterfaceDecl *D = ME->getReceiverInterface(); |
| 2736 | return !D ? RetTy : |
| 2737 | Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D)); |
| 2738 | } |
| 2739 | |
| 2740 | return RetTy; |
| 2741 | } |
| 2742 | |
| 2743 | void RetainCountChecker::checkSummary(const RetainSummary &Summ, |
| 2744 | const CallOrObjCMessage &CallOrMsg, |
| 2745 | CheckerContext &C) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2746 | ProgramStateRef state = C.getState(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2747 | |
| 2748 | // Evaluate the effect of the arguments. |
| 2749 | RefVal::Kind hasErr = (RefVal::Kind) 0; |
| 2750 | SourceRange ErrorRange; |
| 2751 | SymbolRef ErrorSym = 0; |
| 2752 | |
| 2753 | for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) { |
Jordy Rose | 537716a | 2011-08-27 22:51:26 +0000 | [diff] [blame] | 2754 | SVal V = CallOrMsg.getArgSVal(idx); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2755 | |
| 2756 | if (SymbolRef Sym = V.getAsLocSymbol()) { |
| 2757 | if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) { |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2758 | state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2759 | if (hasErr) { |
| 2760 | ErrorRange = CallOrMsg.getArgSourceRange(idx); |
| 2761 | ErrorSym = Sym; |
| 2762 | break; |
| 2763 | } |
| 2764 | } |
| 2765 | } |
| 2766 | } |
| 2767 | |
| 2768 | // Evaluate the effect on the message receiver. |
| 2769 | bool ReceiverIsTracked = false; |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2770 | if (!hasErr && CallOrMsg.isObjCMessage()) { |
Anna Zaks | 39ac187 | 2011-10-26 21:06:44 +0000 | [diff] [blame] | 2771 | const LocationContext *LC = C.getLocationContext(); |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2772 | SVal Receiver = CallOrMsg.getInstanceMessageReceiver(LC); |
| 2773 | if (SymbolRef Sym = Receiver.getAsLocSymbol()) { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2774 | if (const RefVal *T = state->get<RefBindings>(Sym)) { |
| 2775 | ReceiverIsTracked = true; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2776 | state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(), |
| 2777 | hasErr, C); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2778 | if (hasErr) { |
Jordy Rose | e38dd95 | 2011-08-28 05:16:28 +0000 | [diff] [blame] | 2779 | ErrorRange = CallOrMsg.getReceiverSourceRange(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2780 | ErrorSym = Sym; |
| 2781 | } |
| 2782 | } |
| 2783 | } |
| 2784 | } |
| 2785 | |
| 2786 | // Process any errors. |
| 2787 | if (hasErr) { |
| 2788 | processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C); |
| 2789 | return; |
| 2790 | } |
| 2791 | |
| 2792 | // Consult the summary for the return value. |
| 2793 | RetEffect RE = Summ.getRetEffect(); |
| 2794 | |
| 2795 | if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) { |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2796 | if (ReceiverIsTracked) |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2797 | RE = getSummaryManager(C).getObjAllocRetEffect(); |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 2798 | else |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2799 | RE = RetEffect::MakeNoRet(); |
| 2800 | } |
| 2801 | |
| 2802 | switch (RE.getKind()) { |
| 2803 | default: |
David Blaikie | 7530c03 | 2012-01-17 06:56:22 +0000 | [diff] [blame] | 2804 | llvm_unreachable("Unhandled RetEffect."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2805 | |
| 2806 | case RetEffect::NoRet: |
| 2807 | // No work necessary. |
| 2808 | break; |
| 2809 | |
| 2810 | case RetEffect::OwnedAllocatedSymbol: |
| 2811 | case RetEffect::OwnedSymbol: { |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2812 | SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(), |
| 2813 | C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2814 | if (!Sym) |
| 2815 | break; |
| 2816 | |
| 2817 | // Use the result type from callOrMsg as it automatically adjusts |
| 2818 | // for methods/functions that return references. |
| 2819 | QualType ResultTy = CallOrMsg.getResultType(C.getASTContext()); |
| 2820 | state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(), |
| 2821 | ResultTy)); |
| 2822 | |
| 2823 | // FIXME: Add a flag to the checker where allocations are assumed to |
| 2824 | // *not* fail. (The code below is out-of-date, though.) |
| 2825 | #if 0 |
| 2826 | if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) { |
| 2827 | bool isFeasible; |
| 2828 | state = state.assume(loc::SymbolVal(Sym), true, isFeasible); |
| 2829 | assert(isFeasible && "Cannot assume fresh symbol is non-null."); |
| 2830 | } |
| 2831 | #endif |
| 2832 | |
| 2833 | break; |
| 2834 | } |
| 2835 | |
| 2836 | case RetEffect::GCNotOwnedSymbol: |
| 2837 | case RetEffect::ARCNotOwnedSymbol: |
| 2838 | case RetEffect::NotOwnedSymbol: { |
| 2839 | const Expr *Ex = CallOrMsg.getOriginExpr(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 2840 | SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol(); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2841 | if (!Sym) |
| 2842 | break; |
| 2843 | |
| 2844 | // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *. |
| 2845 | QualType ResultTy = GetReturnType(Ex, C.getASTContext()); |
| 2846 | state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(), |
| 2847 | ResultTy)); |
| 2848 | break; |
| 2849 | } |
| 2850 | } |
| 2851 | |
| 2852 | // This check is actually necessary; otherwise the statement builder thinks |
| 2853 | // we've hit a previously-found path. |
| 2854 | // Normally addTransition takes care of this, but we want the node pointer. |
| 2855 | ExplodedNode *NewNode; |
| 2856 | if (state == C.getState()) { |
| 2857 | NewNode = C.getPredecessor(); |
| 2858 | } else { |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 2859 | NewNode = C.addTransition(state); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2860 | } |
| 2861 | |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2862 | // Annotate the node with summary we used. |
| 2863 | if (NewNode) { |
| 2864 | // FIXME: This is ugly. See checkEndAnalysis for why it's necessary. |
| 2865 | if (ShouldResetSummaryLog) { |
| 2866 | SummaryLog.clear(); |
| 2867 | ShouldResetSummaryLog = false; |
| 2868 | } |
Jordy Rose | ec9ef85 | 2011-08-23 20:55:48 +0000 | [diff] [blame] | 2869 | SummaryLog[NewNode] = &Summ; |
Jordy Rose | 9c083b7 | 2011-08-24 18:56:32 +0000 | [diff] [blame] | 2870 | } |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 2871 | } |
| 2872 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2873 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 2874 | ProgramStateRef |
| 2875 | RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2876 | RefVal V, ArgEffect E, RefVal::Kind &hasErr, |
| 2877 | CheckerContext &C) const { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2878 | // In GC mode [... release] and [... retain] do nothing. |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 2879 | // In ARC mode they shouldn't exist at all, but we just ignore them. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2880 | bool IgnoreRetainMsg = C.isObjCGCEnabled(); |
| 2881 | if (!IgnoreRetainMsg) |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 2882 | IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2883 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2884 | switch (E) { |
| 2885 | default: break; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2886 | case IncRefMsg: E = IgnoreRetainMsg ? DoNothing : IncRef; break; |
| 2887 | case DecRefMsg: E = IgnoreRetainMsg ? DoNothing : DecRef; break; |
| 2888 | case MakeCollectable: E = C.isObjCGCEnabled() ? DecRef : DoNothing; break; |
| 2889 | case NewAutoreleasePool: E = C.isObjCGCEnabled() ? DoNothing : |
| 2890 | NewAutoreleasePool; break; |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2891 | } |
| 2892 | |
| 2893 | // Handle all use-after-releases. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2894 | if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2895 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 2896 | hasErr = V.getKind(); |
| 2897 | return state->set<RefBindings>(sym, V); |
| 2898 | } |
| 2899 | |
| 2900 | switch (E) { |
| 2901 | case DecRefMsg: |
| 2902 | case IncRefMsg: |
| 2903 | case MakeCollectable: |
| 2904 | llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted"); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2905 | |
| 2906 | case Dealloc: |
| 2907 | // Any use of -dealloc in GC is *bad*. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2908 | if (C.isObjCGCEnabled()) { |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2909 | V = V ^ RefVal::ErrorDeallocGC; |
| 2910 | hasErr = V.getKind(); |
| 2911 | break; |
| 2912 | } |
| 2913 | |
| 2914 | switch (V.getKind()) { |
| 2915 | default: |
| 2916 | llvm_unreachable("Invalid RefVal state for an explicit dealloc."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2917 | case RefVal::Owned: |
| 2918 | // The object immediately transitions to the released state. |
| 2919 | V = V ^ RefVal::Released; |
| 2920 | V.clearCounts(); |
| 2921 | return state->set<RefBindings>(sym, V); |
| 2922 | case RefVal::NotOwned: |
| 2923 | V = V ^ RefVal::ErrorDeallocNotOwned; |
| 2924 | hasErr = V.getKind(); |
| 2925 | break; |
| 2926 | } |
| 2927 | break; |
| 2928 | |
| 2929 | case NewAutoreleasePool: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2930 | assert(!C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2931 | return state->add<AutoreleaseStack>(sym); |
| 2932 | |
| 2933 | case MayEscape: |
| 2934 | if (V.getKind() == RefVal::Owned) { |
| 2935 | V = V ^ RefVal::NotOwned; |
| 2936 | break; |
| 2937 | } |
| 2938 | |
| 2939 | // Fall-through. |
| 2940 | |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2941 | case DoNothing: |
| 2942 | return state; |
| 2943 | |
| 2944 | case Autorelease: |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2945 | if (C.isObjCGCEnabled()) |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2946 | return state; |
| 2947 | |
| 2948 | // Update the autorelease counts. |
| 2949 | state = SendAutorelease(state, ARCountFactory, sym); |
| 2950 | V = V.autorelease(); |
| 2951 | break; |
| 2952 | |
| 2953 | case StopTracking: |
| 2954 | return state->remove<RefBindings>(sym); |
| 2955 | |
| 2956 | case IncRef: |
| 2957 | switch (V.getKind()) { |
| 2958 | default: |
| 2959 | llvm_unreachable("Invalid RefVal state for a retain."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2960 | case RefVal::Owned: |
| 2961 | case RefVal::NotOwned: |
| 2962 | V = V + 1; |
| 2963 | break; |
| 2964 | case RefVal::Released: |
| 2965 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 2966 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2967 | V = (V ^ RefVal::Owned) + 1; |
| 2968 | break; |
| 2969 | } |
| 2970 | break; |
| 2971 | |
| 2972 | case SelfOwn: |
| 2973 | V = V ^ RefVal::NotOwned; |
| 2974 | // Fall-through. |
| 2975 | case DecRef: |
| 2976 | case DecRefBridgedTransfered: |
| 2977 | switch (V.getKind()) { |
| 2978 | default: |
| 2979 | // case 'RefVal::Released' handled above. |
| 2980 | llvm_unreachable("Invalid RefVal state for a release."); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 2981 | |
| 2982 | case RefVal::Owned: |
| 2983 | assert(V.getCount() > 0); |
| 2984 | if (V.getCount() == 1) |
| 2985 | V = V ^ (E == DecRefBridgedTransfered ? |
| 2986 | RefVal::NotOwned : RefVal::Released); |
| 2987 | V = V - 1; |
| 2988 | break; |
| 2989 | |
| 2990 | case RefVal::NotOwned: |
| 2991 | if (V.getCount() > 0) |
| 2992 | V = V - 1; |
| 2993 | else { |
| 2994 | V = V ^ RefVal::ErrorReleaseNotOwned; |
| 2995 | hasErr = V.getKind(); |
| 2996 | } |
| 2997 | break; |
| 2998 | |
| 2999 | case RefVal::Released: |
| 3000 | // Non-GC cases are handled above. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3001 | assert(C.isObjCGCEnabled()); |
Jordy Rose | e0a5d32 | 2011-08-23 20:27:16 +0000 | [diff] [blame] | 3002 | V = V ^ RefVal::ErrorUseAfterRelease; |
| 3003 | hasErr = V.getKind(); |
| 3004 | break; |
| 3005 | } |
| 3006 | break; |
| 3007 | } |
| 3008 | return state->set<RefBindings>(sym, V); |
| 3009 | } |
| 3010 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3011 | void RetainCountChecker::processNonLeakError(ProgramStateRef St, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3012 | SourceRange ErrorRange, |
| 3013 | RefVal::Kind ErrorKind, |
| 3014 | SymbolRef Sym, |
| 3015 | CheckerContext &C) const { |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3016 | ExplodedNode *N = C.generateSink(St); |
| 3017 | if (!N) |
| 3018 | return; |
| 3019 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3020 | CFRefBug *BT; |
| 3021 | switch (ErrorKind) { |
| 3022 | default: |
| 3023 | llvm_unreachable("Unhandled error."); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3024 | case RefVal::ErrorUseAfterRelease: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3025 | if (!useAfterRelease) |
| 3026 | useAfterRelease.reset(new UseAfterRelease()); |
| 3027 | BT = &*useAfterRelease; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3028 | break; |
| 3029 | case RefVal::ErrorReleaseNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3030 | if (!releaseNotOwned) |
| 3031 | releaseNotOwned.reset(new BadRelease()); |
| 3032 | BT = &*releaseNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3033 | break; |
| 3034 | case RefVal::ErrorDeallocGC: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3035 | if (!deallocGC) |
| 3036 | deallocGC.reset(new DeallocGC()); |
| 3037 | BT = &*deallocGC; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3038 | break; |
| 3039 | case RefVal::ErrorDeallocNotOwned: |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3040 | if (!deallocNotOwned) |
| 3041 | deallocNotOwned.reset(new DeallocNotOwned()); |
| 3042 | BT = &*deallocNotOwned; |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3043 | break; |
| 3044 | } |
| 3045 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3046 | assert(BT); |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3047 | CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3048 | C.isObjCGCEnabled(), SummaryLog, |
| 3049 | N, Sym); |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3050 | report->addRange(ErrorRange); |
| 3051 | C.EmitReport(report); |
| 3052 | } |
| 3053 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3054 | //===----------------------------------------------------------------------===// |
| 3055 | // Handle the return values of retain-count-related functions. |
| 3056 | //===----------------------------------------------------------------------===// |
| 3057 | |
| 3058 | bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const { |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3059 | // Get the callee. We're only interested in simple C functions. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3060 | ProgramStateRef state = C.getState(); |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3061 | const FunctionDecl *FD = C.getCalleeDecl(CE); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3062 | if (!FD) |
| 3063 | return false; |
| 3064 | |
| 3065 | IdentifierInfo *II = FD->getIdentifier(); |
| 3066 | if (!II) |
| 3067 | return false; |
| 3068 | |
| 3069 | // For now, we're only handling the functions that return aliases of their |
| 3070 | // arguments: CFRetain and CFMakeCollectable (and their families). |
| 3071 | // Eventually we should add other functions we can model entirely, |
| 3072 | // such as CFRelease, which don't invalidate their arguments or globals. |
| 3073 | if (CE->getNumArgs() != 1) |
| 3074 | return false; |
| 3075 | |
| 3076 | // Get the name of the function. |
| 3077 | StringRef FName = II->getName(); |
| 3078 | FName = FName.substr(FName.find_first_not_of('_')); |
| 3079 | |
| 3080 | // See if it's one of the specific functions we know how to eval. |
| 3081 | bool canEval = false; |
| 3082 | |
Anna Zaks | b805c8f | 2011-12-01 05:57:37 +0000 | [diff] [blame] | 3083 | QualType ResultTy = CE->getCallReturnType(); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3084 | if (ResultTy->isObjCIdType()) { |
| 3085 | // Handle: id NSMakeCollectable(CFTypeRef) |
| 3086 | canEval = II->isStr("NSMakeCollectable"); |
| 3087 | } else if (ResultTy->isPointerType()) { |
| 3088 | // Handle: (CF|CG)Retain |
| 3089 | // CFMakeCollectable |
| 3090 | // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist). |
| 3091 | if (cocoa::isRefType(ResultTy, "CF", FName) || |
| 3092 | cocoa::isRefType(ResultTy, "CG", FName)) { |
| 3093 | canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName); |
| 3094 | } |
| 3095 | } |
| 3096 | |
| 3097 | if (!canEval) |
| 3098 | return false; |
| 3099 | |
| 3100 | // Bind the return value. |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3101 | const LocationContext *LCtx = C.getLocationContext(); |
| 3102 | SVal RetVal = state->getSVal(CE->getArg(0), LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3103 | if (RetVal.isUnknown()) { |
| 3104 | // If the receiver is unknown, conjure a return value. |
| 3105 | SValBuilder &SVB = C.getSValBuilder(); |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3106 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3107 | SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3108 | } |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3109 | state = state->BindExpr(CE, LCtx, RetVal, false); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3110 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3111 | // FIXME: This should not be necessary, but otherwise the argument seems to be |
| 3112 | // considered alive during the next statement. |
| 3113 | if (const MemRegion *ArgRegion = RetVal.getAsRegion()) { |
| 3114 | // Save the refcount status of the argument. |
| 3115 | SymbolRef Sym = RetVal.getAsLocSymbol(); |
| 3116 | RefBindings::data_type *Binding = 0; |
| 3117 | if (Sym) |
| 3118 | Binding = state->get<RefBindings>(Sym); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3119 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3120 | // Invalidate the argument region. |
Anna Zaks | 5d0ea6d | 2011-10-04 20:43:05 +0000 | [diff] [blame] | 3121 | unsigned Count = C.getCurrentBlockCount(); |
Ted Kremenek | 3133f79 | 2012-02-17 23:13:45 +0000 | [diff] [blame] | 3122 | state = state->invalidateRegions(ArgRegion, CE, Count, LCtx); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3123 | |
Jordy Rose | 294396b | 2011-08-22 23:48:23 +0000 | [diff] [blame] | 3124 | // Restore the refcount status of the argument. |
| 3125 | if (Binding) |
| 3126 | state = state->set<RefBindings>(Sym, *Binding); |
| 3127 | } |
| 3128 | |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3129 | C.addTransition(state); |
Jordy Rose | 76c506f | 2011-08-21 21:58:18 +0000 | [diff] [blame] | 3130 | return true; |
| 3131 | } |
| 3132 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3133 | //===----------------------------------------------------------------------===// |
| 3134 | // Handle return statements. |
| 3135 | //===----------------------------------------------------------------------===// |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3136 | |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3137 | // Return true if the current LocationContext has no caller context. |
| 3138 | static bool inTopFrame(CheckerContext &C) { |
| 3139 | const LocationContext *LC = C.getLocationContext(); |
| 3140 | return LC->getParent() == 0; |
| 3141 | } |
| 3142 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3143 | void RetainCountChecker::checkPreStmt(const ReturnStmt *S, |
| 3144 | CheckerContext &C) const { |
Ted Kremenek | e571578 | 2012-02-25 02:09:09 +0000 | [diff] [blame] | 3145 | |
| 3146 | // Only adjust the reference count if this is the top-level call frame, |
| 3147 | // and not the result of inlining. In the future, we should do |
| 3148 | // better checking even for inlined calls, and see if they match |
| 3149 | // with their expected semantics (e.g., the method should return a retained |
| 3150 | // object, etc.). |
| 3151 | if (!inTopFrame(C)) |
| 3152 | return; |
| 3153 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3154 | const Expr *RetE = S->getRetValue(); |
| 3155 | if (!RetE) |
| 3156 | return; |
| 3157 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3158 | ProgramStateRef state = C.getState(); |
Ted Kremenek | 5eca482 | 2012-01-06 22:09:28 +0000 | [diff] [blame] | 3159 | SymbolRef Sym = |
| 3160 | state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3161 | if (!Sym) |
| 3162 | return; |
| 3163 | |
| 3164 | // Get the reference count binding (if any). |
| 3165 | const RefVal *T = state->get<RefBindings>(Sym); |
| 3166 | if (!T) |
| 3167 | return; |
| 3168 | |
| 3169 | // Change the reference count. |
| 3170 | RefVal X = *T; |
| 3171 | |
| 3172 | switch (X.getKind()) { |
| 3173 | case RefVal::Owned: { |
| 3174 | unsigned cnt = X.getCount(); |
| 3175 | assert(cnt > 0); |
| 3176 | X.setCount(cnt - 1); |
| 3177 | X = X ^ RefVal::ReturnedOwned; |
| 3178 | break; |
| 3179 | } |
| 3180 | |
| 3181 | case RefVal::NotOwned: { |
| 3182 | unsigned cnt = X.getCount(); |
| 3183 | if (cnt) { |
| 3184 | X.setCount(cnt - 1); |
| 3185 | X = X ^ RefVal::ReturnedOwned; |
| 3186 | } |
| 3187 | else { |
| 3188 | X = X ^ RefVal::ReturnedNotOwned; |
| 3189 | } |
| 3190 | break; |
| 3191 | } |
| 3192 | |
| 3193 | default: |
| 3194 | return; |
| 3195 | } |
| 3196 | |
| 3197 | // Update the binding. |
| 3198 | state = state->set<RefBindings>(Sym, X); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3199 | ExplodedNode *Pred = C.addTransition(state); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3200 | |
| 3201 | // At this point we have updated the state properly. |
| 3202 | // Everything after this is merely checking to see if the return value has |
| 3203 | // been over- or under-retained. |
| 3204 | |
| 3205 | // Did we cache out? |
| 3206 | if (!Pred) |
| 3207 | return; |
| 3208 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3209 | // Update the autorelease counts. |
| 3210 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3211 | AutoreleaseTag("RetainCountChecker : Autorelease"); |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3212 | GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3213 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3214 | |
| 3215 | // Did we cache out? |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3216 | if (!Pred) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3217 | return; |
| 3218 | |
| 3219 | // Get the updated binding. |
| 3220 | T = state->get<RefBindings>(Sym); |
| 3221 | assert(T); |
| 3222 | X = *T; |
| 3223 | |
| 3224 | // Consult the summary of the enclosing method. |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3225 | RetainSummaryManager &Summaries = getSummaryManager(C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3226 | const Decl *CD = &Pred->getCodeDecl(); |
| 3227 | |
| 3228 | if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) { |
| 3229 | // Unlike regular functions, /all/ ObjC methods are assumed to always |
| 3230 | // follow Cocoa retain-count conventions, not just those with special |
| 3231 | // names or attributes. |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3232 | const RetainSummary *Summ = Summaries.getMethodSummary(MD); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3233 | RetEffect RE = Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet(); |
| 3234 | checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state); |
| 3235 | } |
| 3236 | |
| 3237 | if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) { |
| 3238 | if (!isa<CXXMethodDecl>(FD)) |
Jordy Rose | b6cfc09 | 2011-08-25 00:10:37 +0000 | [diff] [blame] | 3239 | if (const RetainSummary *Summ = Summaries.getSummary(FD)) |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3240 | checkReturnWithRetEffect(S, C, Pred, Summ->getRetEffect(), X, |
| 3241 | Sym, state); |
| 3242 | } |
| 3243 | } |
| 3244 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3245 | void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S, |
| 3246 | CheckerContext &C, |
| 3247 | ExplodedNode *Pred, |
| 3248 | RetEffect RE, RefVal X, |
| 3249 | SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3250 | ProgramStateRef state) const { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3251 | // Any leaks or other errors? |
| 3252 | if (X.isReturnedOwned() && X.getCount() == 0) { |
| 3253 | if (RE.getKind() != RetEffect::NoRet) { |
| 3254 | bool hasError = false; |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3255 | if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) { |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3256 | // Things are more complicated with garbage collection. If the |
| 3257 | // returned object is suppose to be an Objective-C object, we have |
| 3258 | // a leak (as the caller expects a GC'ed object) because no |
| 3259 | // method should return ownership unless it returns a CF object. |
| 3260 | hasError = true; |
| 3261 | X = X ^ RefVal::ErrorGCLeakReturned; |
| 3262 | } |
| 3263 | else if (!RE.isOwned()) { |
| 3264 | // Either we are using GC and the returned object is a CF type |
| 3265 | // or we aren't using GC. In either case, we expect that the |
| 3266 | // enclosing method is expected to return ownership. |
| 3267 | hasError = true; |
| 3268 | X = X ^ RefVal::ErrorLeakReturned; |
| 3269 | } |
| 3270 | |
| 3271 | if (hasError) { |
| 3272 | // Generate an error node. |
| 3273 | state = state->set<RefBindings>(Sym, X); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3274 | |
| 3275 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3276 | ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3277 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3278 | if (N) { |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3279 | const LangOptions &LOpts = C.getASTContext().getLangOpts(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3280 | bool GCEnabled = C.isObjCGCEnabled(); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3281 | CFRefReport *report = |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3282 | new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled), |
| 3283 | LOpts, GCEnabled, SummaryLog, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3284 | N, Sym, C); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3285 | C.EmitReport(report); |
| 3286 | } |
| 3287 | } |
| 3288 | } |
| 3289 | } else if (X.isReturnedNotOwned()) { |
| 3290 | if (RE.isOwned()) { |
| 3291 | // Trying to return a not owned object to a caller expecting an |
| 3292 | // owned object. |
| 3293 | state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3294 | |
| 3295 | static SimpleProgramPointTag |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3296 | ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned"); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3297 | ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3298 | if (N) { |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3299 | if (!returnNotOwnedForOwned) |
| 3300 | returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned()); |
| 3301 | |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3302 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3303 | new CFRefReport(*returnNotOwnedForOwned, |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3304 | C.getASTContext().getLangOpts(), |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3305 | C.isObjCGCEnabled(), SummaryLog, N, Sym); |
Jordy Rose | f53e8c7 | 2011-08-23 19:43:16 +0000 | [diff] [blame] | 3306 | C.EmitReport(report); |
| 3307 | } |
| 3308 | } |
| 3309 | } |
| 3310 | } |
| 3311 | |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3312 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3313 | // Check various ways a symbol can be invalidated. |
| 3314 | //===----------------------------------------------------------------------===// |
| 3315 | |
Anna Zaks | 390909c | 2011-10-06 00:43:15 +0000 | [diff] [blame] | 3316 | void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3317 | CheckerContext &C) const { |
| 3318 | // Are we storing to something that causes the value to "escape"? |
| 3319 | bool escapes = true; |
| 3320 | |
| 3321 | // A value escapes in three possible cases (this may change): |
| 3322 | // |
| 3323 | // (1) we are binding to something that is not a memory region. |
| 3324 | // (2) we are binding to a memregion that does not have stack storage |
| 3325 | // (3) we are binding to a memregion with stack storage that the store |
| 3326 | // does not understand. |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3327 | ProgramStateRef state = C.getState(); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3328 | |
| 3329 | if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) { |
| 3330 | escapes = !regionLoc->getRegion()->hasStackStorage(); |
| 3331 | |
| 3332 | if (!escapes) { |
| 3333 | // To test (3), generate a new state with the binding added. If it is |
| 3334 | // the same state, then it escapes (since the store cannot represent |
| 3335 | // the binding). |
| 3336 | escapes = (state == (state->bindLoc(*regionLoc, val))); |
| 3337 | } |
| 3338 | } |
| 3339 | |
| 3340 | // If our store can represent the binding and we aren't storing to something |
| 3341 | // that doesn't have local storage then just return and have the simulation |
| 3342 | // state continue as is. |
| 3343 | if (!escapes) |
| 3344 | return; |
| 3345 | |
| 3346 | // Otherwise, find all symbols referenced by 'val' that we are tracking |
| 3347 | // and stop tracking them. |
| 3348 | state = state->scanReachableSymbols<StopTrackingCallback>(val).getState(); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3349 | C.addTransition(state); |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3350 | } |
| 3351 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3352 | ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3353 | SVal Cond, |
| 3354 | bool Assumption) const { |
| 3355 | |
| 3356 | // FIXME: We may add to the interface of evalAssume the list of symbols |
| 3357 | // whose assumptions have changed. For now we just iterate through the |
| 3358 | // bindings and check if any of the tracked symbols are NULL. This isn't |
| 3359 | // too bad since the number of symbols we will track in practice are |
| 3360 | // probably small and evalAssume is only called at branches and a few |
| 3361 | // other places. |
| 3362 | RefBindings B = state->get<RefBindings>(); |
| 3363 | |
| 3364 | if (B.isEmpty()) |
| 3365 | return state; |
| 3366 | |
| 3367 | bool changed = false; |
| 3368 | RefBindings::Factory &RefBFactory = state->get_context<RefBindings>(); |
| 3369 | |
| 3370 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3371 | // Check if the symbol is null (or equal to any constant). |
| 3372 | // If this is the case, stop tracking the symbol. |
| 3373 | if (state->getSymVal(I.getKey())) { |
| 3374 | changed = true; |
| 3375 | B = RefBFactory.remove(B, I.getKey()); |
| 3376 | } |
| 3377 | } |
| 3378 | |
| 3379 | if (changed) |
| 3380 | state = state->set<RefBindings>(B); |
| 3381 | |
| 3382 | return state; |
| 3383 | } |
| 3384 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3385 | ProgramStateRef |
| 3386 | RetainCountChecker::checkRegionChanges(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3387 | const StoreManager::InvalidatedSymbols *invalidated, |
| 3388 | ArrayRef<const MemRegion *> ExplicitRegions, |
Anna Zaks | 66c4040 | 2012-02-14 21:55:24 +0000 | [diff] [blame] | 3389 | ArrayRef<const MemRegion *> Regions, |
| 3390 | const CallOrObjCMessage *Call) const { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3391 | if (!invalidated) |
| 3392 | return state; |
| 3393 | |
| 3394 | llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols; |
| 3395 | for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(), |
| 3396 | E = ExplicitRegions.end(); I != E; ++I) { |
| 3397 | if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>()) |
| 3398 | WhitelistedSymbols.insert(SR->getSymbol()); |
| 3399 | } |
| 3400 | |
| 3401 | for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(), |
| 3402 | E = invalidated->end(); I!=E; ++I) { |
| 3403 | SymbolRef sym = *I; |
| 3404 | if (WhitelistedSymbols.count(sym)) |
| 3405 | continue; |
| 3406 | // Remove any existing reference-count binding. |
| 3407 | state = state->remove<RefBindings>(sym); |
| 3408 | } |
| 3409 | return state; |
| 3410 | } |
| 3411 | |
| 3412 | //===----------------------------------------------------------------------===// |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3413 | // Handle dead symbols and end-of-path. |
| 3414 | //===----------------------------------------------------------------------===// |
| 3415 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3416 | std::pair<ExplodedNode *, ProgramStateRef > |
| 3417 | RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3418 | GenericNodeBuilderRefCount Bd, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3419 | ExplodedNode *Pred, |
| 3420 | CheckerContext &Ctx, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3421 | SymbolRef Sym, RefVal V) const { |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3422 | unsigned ACnt = V.getAutoreleaseCount(); |
| 3423 | |
| 3424 | // No autorelease counts? Nothing to be done. |
| 3425 | if (!ACnt) |
| 3426 | return std::make_pair(Pred, state); |
| 3427 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3428 | assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?"); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3429 | unsigned Cnt = V.getCount(); |
| 3430 | |
| 3431 | // FIXME: Handle sending 'autorelease' to already released object. |
| 3432 | |
| 3433 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3434 | ++Cnt; |
| 3435 | |
| 3436 | if (ACnt <= Cnt) { |
| 3437 | if (ACnt == Cnt) { |
| 3438 | V.clearCounts(); |
| 3439 | if (V.getKind() == RefVal::ReturnedOwned) |
| 3440 | V = V ^ RefVal::ReturnedNotOwned; |
| 3441 | else |
| 3442 | V = V ^ RefVal::NotOwned; |
| 3443 | } else { |
| 3444 | V.setCount(Cnt - ACnt); |
| 3445 | V.setAutoreleaseCount(0); |
| 3446 | } |
| 3447 | state = state->set<RefBindings>(Sym, V); |
| 3448 | ExplodedNode *N = Bd.MakeNode(state, Pred); |
| 3449 | if (N == 0) |
| 3450 | state = 0; |
| 3451 | return std::make_pair(N, state); |
| 3452 | } |
| 3453 | |
| 3454 | // Woah! More autorelease counts then retain counts left. |
| 3455 | // Emit hard error. |
| 3456 | V = V ^ RefVal::ErrorOverAutorelease; |
| 3457 | state = state->set<RefBindings>(Sym, V); |
| 3458 | |
Anna Zaks | f05aac8 | 2011-10-18 23:05:58 +0000 | [diff] [blame] | 3459 | if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3460 | SmallString<128> sbuf; |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3461 | llvm::raw_svector_ostream os(sbuf); |
| 3462 | os << "Object over-autoreleased: object was sent -autorelease "; |
| 3463 | if (V.getAutoreleaseCount() > 1) |
| 3464 | os << V.getAutoreleaseCount() << " times "; |
| 3465 | os << "but the object has a +" << V.getCount() << " retain count"; |
| 3466 | |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3467 | if (!overAutorelease) |
| 3468 | overAutorelease.reset(new OverAutorelease()); |
| 3469 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3470 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3471 | CFRefReport *report = |
Jordy Rose | d6334e1 | 2011-08-25 00:34:03 +0000 | [diff] [blame] | 3472 | new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false, |
| 3473 | SummaryLog, N, Sym, os.str()); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3474 | Ctx.EmitReport(report); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3475 | } |
| 3476 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3477 | return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0); |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3478 | } |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3479 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3480 | ProgramStateRef |
| 3481 | RetainCountChecker::handleSymbolDeath(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3482 | SymbolRef sid, RefVal V, |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3483 | SmallVectorImpl<SymbolRef> &Leaked) const { |
Jordy Rose | 5337612 | 2011-08-24 04:48:19 +0000 | [diff] [blame] | 3484 | bool hasLeak = false; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3485 | if (V.isOwned()) |
| 3486 | hasLeak = true; |
| 3487 | else if (V.isNotOwned() || V.isReturnedOwned()) |
| 3488 | hasLeak = (V.getCount() > 0); |
| 3489 | |
| 3490 | if (!hasLeak) |
| 3491 | return state->remove<RefBindings>(sid); |
| 3492 | |
| 3493 | Leaked.push_back(sid); |
| 3494 | return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak); |
| 3495 | } |
| 3496 | |
| 3497 | ExplodedNode * |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3498 | RetainCountChecker::processLeaks(ProgramStateRef state, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3499 | SmallVectorImpl<SymbolRef> &Leaked, |
| 3500 | GenericNodeBuilderRefCount &Builder, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3501 | CheckerContext &Ctx, |
| 3502 | ExplodedNode *Pred) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3503 | if (Leaked.empty()) |
| 3504 | return Pred; |
| 3505 | |
| 3506 | // Generate an intermediate node representing the leak point. |
| 3507 | ExplodedNode *N = Builder.MakeNode(state, Pred); |
| 3508 | |
| 3509 | if (N) { |
| 3510 | for (SmallVectorImpl<SymbolRef>::iterator |
| 3511 | I = Leaked.begin(), E = Leaked.end(); I != E; ++I) { |
| 3512 | |
David Blaikie | 4e4d084 | 2012-03-11 07:00:24 +0000 | [diff] [blame] | 3513 | const LangOptions &LOpts = Ctx.getASTContext().getLangOpts(); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3514 | bool GCEnabled = Ctx.isObjCGCEnabled(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3515 | CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled) |
| 3516 | : getLeakAtReturnBug(LOpts, GCEnabled); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3517 | assert(BT && "BugType not initialized."); |
Jordy Rose | 2058956 | 2011-08-24 22:39:09 +0000 | [diff] [blame] | 3518 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3519 | CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled, |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3520 | SummaryLog, N, *I, Ctx); |
| 3521 | Ctx.EmitReport(report); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3522 | } |
| 3523 | } |
| 3524 | |
| 3525 | return N; |
| 3526 | } |
| 3527 | |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3528 | void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const { |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3529 | ProgramStateRef state = Ctx.getState(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3530 | GenericNodeBuilderRefCount Bd(Ctx); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3531 | RefBindings B = state->get<RefBindings>(); |
Anna Zaks | af498a2 | 2011-10-25 19:56:48 +0000 | [diff] [blame] | 3532 | ExplodedNode *Pred = Ctx.getPredecessor(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3533 | |
| 3534 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3535 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3536 | I->first, I->second); |
| 3537 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3538 | return; |
| 3539 | } |
| 3540 | |
Ted Kremenek | 0cf3d47 | 2012-02-07 00:24:33 +0000 | [diff] [blame] | 3541 | // If the current LocationContext has a parent, don't check for leaks. |
| 3542 | // We will do that later. |
| 3543 | // FIXME: we should instead check for imblances of the retain/releases, |
| 3544 | // and suggest annotations. |
| 3545 | if (Ctx.getLocationContext()->getParent()) |
| 3546 | return; |
| 3547 | |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3548 | B = state->get<RefBindings>(); |
| 3549 | SmallVector<SymbolRef, 10> Leaked; |
| 3550 | |
| 3551 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3552 | state = handleSymbolDeath(state, I->first, I->second, Leaked); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3553 | |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3554 | processLeaks(state, Leaked, Bd, Ctx, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3555 | } |
| 3556 | |
| 3557 | const ProgramPointTag * |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3558 | RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3559 | const SimpleProgramPointTag *&tag = DeadSymbolTags[sym]; |
| 3560 | if (!tag) { |
Dylan Noblesmith | f7ccbad | 2012-02-05 02:13:05 +0000 | [diff] [blame] | 3561 | SmallString<64> buf; |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3562 | llvm::raw_svector_ostream out(buf); |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3563 | out << "RetainCountChecker : Dead Symbol : "; |
| 3564 | sym->dumpToStream(out); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3565 | tag = new SimpleProgramPointTag(out.str()); |
| 3566 | } |
| 3567 | return tag; |
| 3568 | } |
| 3569 | |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3570 | void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper, |
| 3571 | CheckerContext &C) const { |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3572 | ExplodedNode *Pred = C.getPredecessor(); |
| 3573 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3574 | ProgramStateRef state = C.getState(); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3575 | RefBindings B = state->get<RefBindings>(); |
| 3576 | |
| 3577 | // Update counts from autorelease pools |
| 3578 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3579 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3580 | SymbolRef Sym = *I; |
| 3581 | if (const RefVal *T = B.lookup(Sym)){ |
| 3582 | // Use the symbol as the tag. |
| 3583 | // FIXME: This might not be as unique as we would like. |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3584 | GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym)); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3585 | llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, |
Jordy Rose | 8d22863 | 2011-08-23 20:07:14 +0000 | [diff] [blame] | 3586 | Sym, *T); |
| 3587 | if (!state) |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3588 | return; |
| 3589 | } |
| 3590 | } |
| 3591 | |
| 3592 | B = state->get<RefBindings>(); |
| 3593 | SmallVector<SymbolRef, 10> Leaked; |
| 3594 | |
| 3595 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3596 | E = SymReaper.dead_end(); I != E; ++I) { |
| 3597 | if (const RefVal *T = B.lookup(*I)) |
| 3598 | state = handleSymbolDeath(state, *I, *T, Leaked); |
| 3599 | } |
| 3600 | |
| 3601 | { |
Anna Zaks | 4eff823 | 2011-10-05 23:44:11 +0000 | [diff] [blame] | 3602 | GenericNodeBuilderRefCount Bd(C, this); |
Anna Zaks | 6a93bd5 | 2011-10-25 19:57:11 +0000 | [diff] [blame] | 3603 | Pred = processLeaks(state, Leaked, Bd, C, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3604 | } |
| 3605 | |
| 3606 | // Did we cache out? |
| 3607 | if (!Pred) |
| 3608 | return; |
| 3609 | |
| 3610 | // Now generate a new node that nukes the old bindings. |
| 3611 | RefBindings::Factory &F = state->get_context<RefBindings>(); |
| 3612 | |
| 3613 | for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(), |
| 3614 | E = SymReaper.dead_end(); I != E; ++I) |
| 3615 | B = F.remove(B, *I); |
| 3616 | |
| 3617 | state = state->set<RefBindings>(B); |
Anna Zaks | 0bd6b11 | 2011-10-26 21:06:34 +0000 | [diff] [blame] | 3618 | C.addTransition(state, Pred); |
Jordy Rose | 38f17d6 | 2011-08-23 19:01:07 +0000 | [diff] [blame] | 3619 | } |
| 3620 | |
Ted Kremenek | d593eb9 | 2009-11-25 22:17:44 +0000 | [diff] [blame] | 3621 | //===----------------------------------------------------------------------===// |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3622 | // Debug printing of refcount bindings and autorelease pools. |
| 3623 | //===----------------------------------------------------------------------===// |
| 3624 | |
| 3625 | static void PrintPool(raw_ostream &Out, SymbolRef Sym, |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3626 | ProgramStateRef State) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3627 | Out << ' '; |
| 3628 | if (Sym) |
Anna Zaks | f62ceec | 2011-12-05 18:58:11 +0000 | [diff] [blame] | 3629 | Sym->dumpToStream(Out); |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3630 | else |
| 3631 | Out << "<pool>"; |
| 3632 | Out << ":{"; |
| 3633 | |
| 3634 | // Get the contents of the pool. |
| 3635 | if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym)) |
| 3636 | for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I) |
| 3637 | Out << '(' << I.getKey() << ',' << I.getData() << ')'; |
| 3638 | |
| 3639 | Out << '}'; |
| 3640 | } |
| 3641 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3642 | static bool UsesAutorelease(ProgramStateRef state) { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3643 | // A state uses autorelease if it allocated an autorelease pool or if it has |
| 3644 | // objects in the caller's autorelease pool. |
| 3645 | return !state->get<AutoreleaseStack>().isEmpty() || |
| 3646 | state->get<AutoreleasePoolContents>(SymbolRef()); |
| 3647 | } |
| 3648 | |
Ted Kremenek | 8bef823 | 2012-01-26 21:29:00 +0000 | [diff] [blame] | 3649 | void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State, |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3650 | const char *NL, const char *Sep) const { |
Jordy Rose | dbd658e | 2011-08-28 19:11:56 +0000 | [diff] [blame] | 3651 | |
| 3652 | RefBindings B = State->get<RefBindings>(); |
| 3653 | |
| 3654 | if (!B.isEmpty()) |
| 3655 | Out << Sep << NL; |
| 3656 | |
| 3657 | for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) { |
| 3658 | Out << I->first << " : "; |
| 3659 | I->second.print(Out); |
| 3660 | Out << NL; |
| 3661 | } |
| 3662 | |
| 3663 | // Print the autorelease stack. |
| 3664 | if (UsesAutorelease(State)) { |
| 3665 | Out << Sep << NL << "AR pool stack:"; |
| 3666 | ARStack Stack = State->get<AutoreleaseStack>(); |
| 3667 | |
| 3668 | PrintPool(Out, SymbolRef(), State); // Print the caller's pool. |
| 3669 | for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I) |
| 3670 | PrintPool(Out, *I, State); |
| 3671 | |
| 3672 | Out << NL; |
| 3673 | } |
| 3674 | } |
| 3675 | |
| 3676 | //===----------------------------------------------------------------------===// |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3677 | // Checker registration. |
Ted Kremenek | 6b3a0f7 | 2008-03-11 06:39:11 +0000 | [diff] [blame] | 3678 | //===----------------------------------------------------------------------===// |
| 3679 | |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3680 | void ento::registerRetainCountChecker(CheckerManager &Mgr) { |
Jordy Rose | 910c405 | 2011-09-02 06:44:22 +0000 | [diff] [blame] | 3681 | Mgr.registerChecker<RetainCountChecker>(); |
Jordy Rose | 17a38e2 | 2011-09-02 05:55:19 +0000 | [diff] [blame] | 3682 | } |
| 3683 | |