blob: dae115ba49b75a79c79f599a32d32b58a1e530a5 [file] [log] [blame]
Jordy Rose910c4052011-09-02 06:44:22 +00001//==-- RetainCountChecker.cpp - Checks for leaks and other issues -*- C++ -*--//
Ted Kremenek2fff37e2008-03-06 00:08:09 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Jordy Rose910c4052011-09-02 06:44:22 +000010// This file defines the methods for RetainCountChecker, which implements
11// a reference count checker for Core Foundation and Cocoa on (Mac OS X).
Ted Kremenek2fff37e2008-03-06 00:08:09 +000012//
13//===----------------------------------------------------------------------===//
14
Jordy Rose910c4052011-09-02 06:44:22 +000015#include "ClangSACheckers.h"
Mike Stump1eb44332009-09-09 15:08:12 +000016#include "clang/AST/DeclObjC.h"
Ted Kremenekb2771592011-03-30 17:41:19 +000017#include "clang/AST/DeclCXX.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000018#include "clang/Basic/LangOptions.h"
19#include "clang/Basic/SourceManager.h"
Jordy Rose910c4052011-09-02 06:44:22 +000020#include "clang/Analysis/DomainSpecific/CocoaConventions.h"
Ted Kremenek4c42bb72011-11-14 21:59:21 +000021#include "clang/AST/ParentMap.h"
Jordy Rose910c4052011-09-02 06:44:22 +000022#include "clang/StaticAnalyzer/Core/Checker.h"
23#include "clang/StaticAnalyzer/Core/CheckerManager.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000024#include "clang/StaticAnalyzer/Core/BugReporter/BugType.h"
25#include "clang/StaticAnalyzer/Core/BugReporter/PathDiagnostic.h"
Jordy Rose910c4052011-09-02 06:44:22 +000026#include "clang/StaticAnalyzer/Core/PathSensitive/CheckerContext.h"
Ted Kremenek18c66fd2011-08-15 22:09:50 +000027#include "clang/StaticAnalyzer/Core/PathSensitive/ProgramStateTrait.h"
Ted Kremenek9b663712011-02-10 01:03:03 +000028#include "clang/StaticAnalyzer/Core/PathSensitive/SymbolManager.h"
Jordy Rosed1e5a892011-09-02 08:02:59 +000029#include "clang/StaticAnalyzer/Core/PathSensitive/ObjCMessage.h"
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000030#include "llvm/ADT/DenseMap.h"
31#include "llvm/ADT/FoldingSet.h"
Ted Kremenek6d348932008-10-21 15:53:15 +000032#include "llvm/ADT/ImmutableList.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000033#include "llvm/ADT/ImmutableMap.h"
Benjamin Kramer8fe83e12012-02-04 13:45:25 +000034#include "llvm/ADT/SmallString.h"
Ted Kremenek6ed9afc2008-05-16 18:33:44 +000035#include "llvm/ADT/STLExtras.h"
Ted Kremenek0b526b42010-02-18 00:05:58 +000036#include "llvm/ADT/StringExtras.h"
Chris Lattner5f9e2722011-07-23 10:55:15 +000037#include <cstdarg>
Ted Kremenek2fff37e2008-03-06 00:08:09 +000038
39using namespace clang;
Ted Kremenek9ef65372010-12-23 07:20:52 +000040using namespace ento;
Ted Kremeneka64e89b2010-01-27 06:13:48 +000041using llvm::StrInStrNoCase;
Ted Kremenek4c79e552008-11-05 16:54:44 +000042
Ted Kremenekd775c662010-05-21 21:57:00 +000043namespace {
Jordy Rose910c4052011-09-02 06:44:22 +000044/// Wrapper around different kinds of node builder, so that helper functions
45/// can have a common interface.
Francois Pichetea097852011-01-11 10:41:37 +000046class GenericNodeBuilderRefCount {
Anna Zaks4eff8232011-10-05 23:44:11 +000047 CheckerContext *C;
Ted Kremenekca804532011-08-12 23:04:46 +000048 const ProgramPointTag *tag;
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000049public:
Anna Zaks4eff8232011-10-05 23:44:11 +000050 GenericNodeBuilderRefCount(CheckerContext &c,
Anna Zaksaf498a22011-10-25 19:56:48 +000051 const ProgramPointTag *t = 0)
Anna Zaks6a93bd52011-10-25 19:57:11 +000052 : C(&c), tag(t){}
Zhongxing Xu031ccc02009-08-06 12:48:26 +000053
Ted Kremenek8bef8232012-01-26 21:29:00 +000054 ExplodedNode *MakeNode(ProgramStateRef state, ExplodedNode *Pred,
Anna Zaksf05aac82011-10-18 23:05:58 +000055 bool MarkAsSink = false) {
Anna Zaks0bd6b112011-10-26 21:06:34 +000056 return C->addTransition(state, Pred, tag, MarkAsSink);
Ted Kremenek9d9d3a62009-05-08 23:09:42 +000057 }
58};
59} // end anonymous namespace
60
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000061//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +000062// Primitives used for constructing summaries for function/method calls.
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000063//===----------------------------------------------------------------------===//
64
Ted Kremenek553cf182008-06-25 21:21:56 +000065/// ArgEffect is used to summarize a function/method call's effect on a
66/// particular argument.
Jordy Rosebd85b132011-08-24 19:10:50 +000067enum ArgEffect { DoNothing, Autorelease, Dealloc, DecRef, DecRefMsg,
John McCallf85e1932011-06-15 23:02:42 +000068 DecRefBridgedTransfered,
Jordy Rosebd85b132011-08-24 19:10:50 +000069 IncRefMsg, IncRef, MakeCollectable, MayEscape,
Ted Kremenekf95e9fc2009-03-17 19:42:23 +000070 NewAutoreleasePool, SelfOwn, StopTracking };
Ted Kremenek553cf182008-06-25 21:21:56 +000071
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000072namespace llvm {
Ted Kremenekb77449c2009-05-03 05:20:50 +000073template <> struct FoldingSetTrait<ArgEffect> {
74static inline void Profile(const ArgEffect X, FoldingSetNodeID& ID) {
75 ID.AddInteger((unsigned) X);
76}
Ted Kremenek553cf182008-06-25 21:21:56 +000077};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000078} // end llvm namespace
79
Ted Kremenekb77449c2009-05-03 05:20:50 +000080/// ArgEffects summarizes the effects of a function/method call on all of
81/// its arguments.
82typedef llvm::ImmutableMap<unsigned,ArgEffect> ArgEffects;
83
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000084namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +000085
86/// RetEffect is used to summarize a function/method call's behavior with
Mike Stump1eb44332009-09-09 15:08:12 +000087/// respect to its return value.
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +000088class RetEffect {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000089public:
Jordy Rose76c506f2011-08-21 21:58:18 +000090 enum Kind { NoRet, OwnedSymbol, OwnedAllocatedSymbol,
John McCallf85e1932011-06-15 23:02:42 +000091 NotOwnedSymbol, GCNotOwnedSymbol, ARCNotOwnedSymbol,
Ted Kremenek78a35a32009-05-12 20:06:54 +000092 OwnedWhenTrackedReceiver };
Mike Stump1eb44332009-09-09 15:08:12 +000093
94 enum ObjKind { CF, ObjC, AnyObj };
Ted Kremenek2d1652e2009-01-28 05:56:51 +000095
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000096private:
Ted Kremenek2d1652e2009-01-28 05:56:51 +000097 Kind K;
98 ObjKind O;
Ted Kremenek2d1652e2009-01-28 05:56:51 +000099
Jordy Rose76c506f2011-08-21 21:58:18 +0000100 RetEffect(Kind k, ObjKind o = AnyObj) : K(k), O(o) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000101
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000102public:
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000103 Kind getKind() const { return K; }
104
105 ObjKind getObjKind() const { return O; }
Mike Stump1eb44332009-09-09 15:08:12 +0000106
Ted Kremeneka8833552009-04-29 23:03:22 +0000107 bool isOwned() const {
Ted Kremenek78a35a32009-05-12 20:06:54 +0000108 return K == OwnedSymbol || K == OwnedAllocatedSymbol ||
109 K == OwnedWhenTrackedReceiver;
Ted Kremeneka8833552009-04-29 23:03:22 +0000110 }
Mike Stump1eb44332009-09-09 15:08:12 +0000111
Jordy Rose4df54fe2011-08-23 04:27:15 +0000112 bool operator==(const RetEffect &Other) const {
113 return K == Other.K && O == Other.O;
114 }
115
Ted Kremenek78a35a32009-05-12 20:06:54 +0000116 static RetEffect MakeOwnedWhenTrackedReceiver() {
117 return RetEffect(OwnedWhenTrackedReceiver, ObjC);
118 }
Mike Stump1eb44332009-09-09 15:08:12 +0000119
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000120 static RetEffect MakeOwned(ObjKind o, bool isAllocated = false) {
121 return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol, o);
Mike Stump1eb44332009-09-09 15:08:12 +0000122 }
Ted Kremenek2d1652e2009-01-28 05:56:51 +0000123 static RetEffect MakeNotOwned(ObjKind o) {
124 return RetEffect(NotOwnedSymbol, o);
Ted Kremeneke798e7c2009-04-27 19:14:45 +0000125 }
126 static RetEffect MakeGCNotOwned() {
127 return RetEffect(GCNotOwnedSymbol, ObjC);
128 }
John McCallf85e1932011-06-15 23:02:42 +0000129 static RetEffect MakeARCNotOwned() {
130 return RetEffect(ARCNotOwnedSymbol, ObjC);
131 }
Ted Kremenek553cf182008-06-25 21:21:56 +0000132 static RetEffect MakeNoRet() {
133 return RetEffect(NoRet);
Ted Kremeneka7344702008-06-23 18:02:52 +0000134 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000135};
Mike Stump1eb44332009-09-09 15:08:12 +0000136
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000137//===----------------------------------------------------------------------===//
138// Reference-counting logic (typestate + counts).
139//===----------------------------------------------------------------------===//
Mike Stump1eb44332009-09-09 15:08:12 +0000140
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000141class RefVal {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000142public:
143 enum Kind {
144 Owned = 0, // Owning reference.
145 NotOwned, // Reference is not owned by still valid (not freed).
146 Released, // Object has been released.
147 ReturnedOwned, // Returned object passes ownership to caller.
148 ReturnedNotOwned, // Return object does not pass ownership to caller.
149 ERROR_START,
150 ErrorDeallocNotOwned, // -dealloc called on non-owned object.
151 ErrorDeallocGC, // Calling -dealloc with GC enabled.
152 ErrorUseAfterRelease, // Object used after released.
153 ErrorReleaseNotOwned, // Release of an object that was not owned.
154 ERROR_LEAK_START,
155 ErrorLeak, // A memory leak due to excessive reference counts.
156 ErrorLeakReturned, // A memory leak due to the returning method not having
157 // the correct naming conventions.
158 ErrorGCLeakReturned,
159 ErrorOverAutorelease,
160 ErrorReturnedNotOwned
161 };
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000162
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000163private:
164 Kind kind;
165 RetEffect::ObjKind okind;
166 unsigned Cnt;
167 unsigned ACnt;
168 QualType T;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000169
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000170 RefVal(Kind k, RetEffect::ObjKind o, unsigned cnt, unsigned acnt, QualType t)
171 : kind(k), okind(o), Cnt(cnt), ACnt(acnt), T(t) {}
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000172
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000173public:
174 Kind getKind() const { return kind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000175
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000176 RetEffect::ObjKind getObjKind() const { return okind; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000177
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000178 unsigned getCount() const { return Cnt; }
179 unsigned getAutoreleaseCount() const { return ACnt; }
180 unsigned getCombinedCounts() const { return Cnt + ACnt; }
181 void clearCounts() { Cnt = 0; ACnt = 0; }
182 void setCount(unsigned i) { Cnt = i; }
183 void setAutoreleaseCount(unsigned i) { ACnt = i; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000184
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000185 QualType getType() const { return T; }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000186
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000187 bool isOwned() const {
188 return getKind() == Owned;
189 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000190
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000191 bool isNotOwned() const {
192 return getKind() == NotOwned;
193 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000194
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000195 bool isReturnedOwned() const {
196 return getKind() == ReturnedOwned;
197 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000198
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000199 bool isReturnedNotOwned() const {
200 return getKind() == ReturnedNotOwned;
201 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000202
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000203 static RefVal makeOwned(RetEffect::ObjKind o, QualType t,
204 unsigned Count = 1) {
205 return RefVal(Owned, o, Count, 0, t);
206 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000207
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000208 static RefVal makeNotOwned(RetEffect::ObjKind o, QualType t,
209 unsigned Count = 0) {
210 return RefVal(NotOwned, o, Count, 0, t);
211 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000212
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000213 // Comparison, profiling, and pretty-printing.
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000214
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000215 bool operator==(const RefVal& X) const {
216 return kind == X.kind && Cnt == X.Cnt && T == X.T && ACnt == X.ACnt;
217 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000218
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000219 RefVal operator-(size_t i) const {
220 return RefVal(getKind(), getObjKind(), getCount() - i,
221 getAutoreleaseCount(), getType());
222 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000223
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000224 RefVal operator+(size_t i) const {
225 return RefVal(getKind(), getObjKind(), getCount() + i,
226 getAutoreleaseCount(), getType());
227 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000228
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000229 RefVal operator^(Kind k) const {
230 return RefVal(k, getObjKind(), getCount(), getAutoreleaseCount(),
231 getType());
232 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000233
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000234 RefVal autorelease() const {
235 return RefVal(getKind(), getObjKind(), getCount(), getAutoreleaseCount()+1,
236 getType());
237 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000238
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000239 void Profile(llvm::FoldingSetNodeID& ID) const {
240 ID.AddInteger((unsigned) kind);
241 ID.AddInteger(Cnt);
242 ID.AddInteger(ACnt);
243 ID.Add(T);
244 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000245
Ted Kremenek9c378f72011-08-12 23:37:29 +0000246 void print(raw_ostream &Out) const;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000247};
248
Ted Kremenek9c378f72011-08-12 23:37:29 +0000249void RefVal::print(raw_ostream &Out) const {
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000250 if (!T.isNull())
Jordy Rosedbd658e2011-08-28 19:11:56 +0000251 Out << "Tracked " << T.getAsString() << '/';
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000252
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000253 switch (getKind()) {
Jordy Rose910c4052011-09-02 06:44:22 +0000254 default: llvm_unreachable("Invalid RefVal kind");
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000255 case Owned: {
256 Out << "Owned";
257 unsigned cnt = getCount();
258 if (cnt) Out << " (+ " << cnt << ")";
259 break;
260 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000261
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000262 case NotOwned: {
263 Out << "NotOwned";
264 unsigned cnt = getCount();
265 if (cnt) Out << " (+ " << cnt << ")";
266 break;
267 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000268
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000269 case ReturnedOwned: {
270 Out << "ReturnedOwned";
271 unsigned cnt = getCount();
272 if (cnt) Out << " (+ " << cnt << ")";
273 break;
274 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000275
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000276 case ReturnedNotOwned: {
277 Out << "ReturnedNotOwned";
278 unsigned cnt = getCount();
279 if (cnt) Out << " (+ " << cnt << ")";
280 break;
281 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000282
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000283 case Released:
284 Out << "Released";
285 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000286
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000287 case ErrorDeallocGC:
288 Out << "-dealloc (GC)";
289 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000290
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000291 case ErrorDeallocNotOwned:
292 Out << "-dealloc (not-owned)";
293 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000294
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000295 case ErrorLeak:
296 Out << "Leaked";
297 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000298
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000299 case ErrorLeakReturned:
300 Out << "Leaked (Bad naming)";
301 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000302
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000303 case ErrorGCLeakReturned:
304 Out << "Leaked (GC-ed at return)";
305 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000306
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000307 case ErrorUseAfterRelease:
308 Out << "Use-After-Release [ERROR]";
309 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000310
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000311 case ErrorReleaseNotOwned:
312 Out << "Release of Not-Owned [ERROR]";
313 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000314
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000315 case RefVal::ErrorOverAutorelease:
316 Out << "Over autoreleased";
317 break;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000318
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000319 case RefVal::ErrorReturnedNotOwned:
320 Out << "Non-owned object returned instead of owned";
321 break;
322 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000323
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000324 if (ACnt) {
325 Out << " [ARC +" << ACnt << ']';
326 }
327}
328} //end anonymous namespace
329
330//===----------------------------------------------------------------------===//
331// RefBindings - State used to track object reference counts.
332//===----------------------------------------------------------------------===//
333
334typedef llvm::ImmutableMap<SymbolRef, RefVal> RefBindings;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000335
336namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +0000337namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +0000338template<>
339struct ProgramStateTrait<RefBindings>
340 : public ProgramStatePartialTrait<RefBindings> {
341 static void *GDMIndex() {
342 static int RefBIndex = 0;
343 return &RefBIndex;
344 }
345};
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000346}
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +0000347}
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000348
349//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +0000350// Function/Method behavior summaries.
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +0000351//===----------------------------------------------------------------------===//
352
353namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000354class RetainSummary {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000355 /// Args - an ordered vector of (index, ArgEffect) pairs, where index
356 /// specifies the argument (starting from 0). This can be sparsely
357 /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000358 ArgEffects Args;
Mike Stump1eb44332009-09-09 15:08:12 +0000359
Ted Kremenek1bffd742008-05-06 15:44:25 +0000360 /// DefaultArgEffect - The default ArgEffect to apply to arguments that
361 /// do not have an entry in Args.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000362 ArgEffect DefaultArgEffect;
Mike Stump1eb44332009-09-09 15:08:12 +0000363
Ted Kremenek553cf182008-06-25 21:21:56 +0000364 /// Receiver - If this summary applies to an Objective-C message expression,
365 /// this is the effect applied to the state of the receiver.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000366 ArgEffect Receiver;
Mike Stump1eb44332009-09-09 15:08:12 +0000367
Ted Kremenek553cf182008-06-25 21:21:56 +0000368 /// Ret - The effect on the return value. Used to indicate if the
Jordy Rose76c506f2011-08-21 21:58:18 +0000369 /// function/method call returns a new tracked symbol.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000370 RetEffect Ret;
Mike Stump1eb44332009-09-09 15:08:12 +0000371
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000372public:
Ted Kremenekb77449c2009-05-03 05:20:50 +0000373 RetainSummary(ArgEffects A, RetEffect R, ArgEffect defaultEff,
Jordy Rosee62e87b2011-08-20 20:55:40 +0000374 ArgEffect ReceiverEff)
375 : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000376
Ted Kremenek553cf182008-06-25 21:21:56 +0000377 /// getArg - Return the argument effect on the argument specified by
378 /// idx (starting from 0).
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000379 ArgEffect getArg(unsigned idx) const {
Ted Kremenekb77449c2009-05-03 05:20:50 +0000380 if (const ArgEffect *AE = Args.lookup(idx))
381 return *AE;
Mike Stump1eb44332009-09-09 15:08:12 +0000382
Ted Kremenek1bffd742008-05-06 15:44:25 +0000383 return DefaultArgEffect;
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000384 }
Ted Kremenek11fe1752011-01-27 18:43:03 +0000385
386 void addArg(ArgEffects::Factory &af, unsigned idx, ArgEffect e) {
387 Args = af.add(Args, idx, e);
388 }
Mike Stump1eb44332009-09-09 15:08:12 +0000389
Ted Kremenek885c27b2009-05-04 05:31:22 +0000390 /// setDefaultArgEffect - Set the default argument effect.
391 void setDefaultArgEffect(ArgEffect E) {
392 DefaultArgEffect = E;
393 }
Mike Stump1eb44332009-09-09 15:08:12 +0000394
Ted Kremenek553cf182008-06-25 21:21:56 +0000395 /// getRetEffect - Returns the effect on the return value of the call.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000396 RetEffect getRetEffect() const { return Ret; }
Mike Stump1eb44332009-09-09 15:08:12 +0000397
Ted Kremenek885c27b2009-05-04 05:31:22 +0000398 /// setRetEffect - Set the effect of the return value of the call.
399 void setRetEffect(RetEffect E) { Ret = E; }
Mike Stump1eb44332009-09-09 15:08:12 +0000400
Ted Kremenek12b94342011-01-27 06:54:14 +0000401
402 /// Sets the effect on the receiver of the message.
403 void setReceiverEffect(ArgEffect e) { Receiver = e; }
404
Ted Kremenek553cf182008-06-25 21:21:56 +0000405 /// getReceiverEffect - Returns the effect on the receiver of the call.
406 /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000407 ArgEffect getReceiverEffect() const { return Receiver; }
Jordy Rose4df54fe2011-08-23 04:27:15 +0000408
409 /// Test if two retain summaries are identical. Note that merely equivalent
410 /// summaries are not necessarily identical (for example, if an explicit
411 /// argument effect matches the default effect).
412 bool operator==(const RetainSummary &Other) const {
413 return Args == Other.Args && DefaultArgEffect == Other.DefaultArgEffect &&
414 Receiver == Other.Receiver && Ret == Other.Ret;
415 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000416};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000417} // end anonymous namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000418
Ted Kremenek553cf182008-06-25 21:21:56 +0000419//===----------------------------------------------------------------------===//
420// Data structures for constructing summaries.
421//===----------------------------------------------------------------------===//
Ted Kremenek53301ba2008-06-24 03:49:48 +0000422
Ted Kremenek553cf182008-06-25 21:21:56 +0000423namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000424class ObjCSummaryKey {
Ted Kremenek553cf182008-06-25 21:21:56 +0000425 IdentifierInfo* II;
426 Selector S;
Mike Stump1eb44332009-09-09 15:08:12 +0000427public:
Ted Kremenek553cf182008-06-25 21:21:56 +0000428 ObjCSummaryKey(IdentifierInfo* ii, Selector s)
429 : II(ii), S(s) {}
430
Ted Kremenek9c378f72011-08-12 23:37:29 +0000431 ObjCSummaryKey(const ObjCInterfaceDecl *d, Selector s)
Ted Kremenek553cf182008-06-25 21:21:56 +0000432 : II(d ? d->getIdentifier() : 0), S(s) {}
Ted Kremenek70b6a832009-05-13 18:16:01 +0000433
Ted Kremenek9c378f72011-08-12 23:37:29 +0000434 ObjCSummaryKey(const ObjCInterfaceDecl *d, IdentifierInfo *ii, Selector s)
Ted Kremenek70b6a832009-05-13 18:16:01 +0000435 : II(d ? d->getIdentifier() : ii), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000436
Ted Kremenek553cf182008-06-25 21:21:56 +0000437 ObjCSummaryKey(Selector s)
438 : II(0), S(s) {}
Mike Stump1eb44332009-09-09 15:08:12 +0000439
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000440 IdentifierInfo *getIdentifier() const { return II; }
Ted Kremenek553cf182008-06-25 21:21:56 +0000441 Selector getSelector() const { return S; }
442};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000443}
444
445namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000446template <> struct DenseMapInfo<ObjCSummaryKey> {
447 static inline ObjCSummaryKey getEmptyKey() {
448 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
449 DenseMapInfo<Selector>::getEmptyKey());
450 }
Mike Stump1eb44332009-09-09 15:08:12 +0000451
Ted Kremenek553cf182008-06-25 21:21:56 +0000452 static inline ObjCSummaryKey getTombstoneKey() {
453 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
Mike Stump1eb44332009-09-09 15:08:12 +0000454 DenseMapInfo<Selector>::getTombstoneKey());
Ted Kremenek553cf182008-06-25 21:21:56 +0000455 }
Mike Stump1eb44332009-09-09 15:08:12 +0000456
Ted Kremenek553cf182008-06-25 21:21:56 +0000457 static unsigned getHashValue(const ObjCSummaryKey &V) {
458 return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier())
Mike Stump1eb44332009-09-09 15:08:12 +0000459 & 0x88888888)
Ted Kremenek553cf182008-06-25 21:21:56 +0000460 | (DenseMapInfo<Selector>::getHashValue(V.getSelector())
461 & 0x55555555);
462 }
Mike Stump1eb44332009-09-09 15:08:12 +0000463
Ted Kremenek553cf182008-06-25 21:21:56 +0000464 static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
465 return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(),
466 RHS.getIdentifier()) &&
467 DenseMapInfo<Selector>::isEqual(LHS.getSelector(),
468 RHS.getSelector());
469 }
Mike Stump1eb44332009-09-09 15:08:12 +0000470
Ted Kremenek553cf182008-06-25 21:21:56 +0000471};
Chris Lattner06159e82009-12-15 07:26:51 +0000472template <>
473struct isPodLike<ObjCSummaryKey> { static const bool value = true; };
Ted Kremenek4f22a782008-06-23 23:30:29 +0000474} // end llvm namespace
Mike Stump1eb44332009-09-09 15:08:12 +0000475
Ted Kremenek4f22a782008-06-23 23:30:29 +0000476namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000477class ObjCSummaryCache {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000478 typedef llvm::DenseMap<ObjCSummaryKey, const RetainSummary *> MapTy;
Ted Kremenek553cf182008-06-25 21:21:56 +0000479 MapTy M;
480public:
481 ObjCSummaryCache() {}
Mike Stump1eb44332009-09-09 15:08:12 +0000482
Ted Kremenek93edbc52011-10-05 23:54:29 +0000483 const RetainSummary * find(const ObjCInterfaceDecl *D, IdentifierInfo *ClsName,
Ted Kremeneka8833552009-04-29 23:03:22 +0000484 Selector S) {
Ted Kremenek8711c032009-04-29 05:04:30 +0000485 // Lookup the method using the decl for the class @interface. If we
486 // have no decl, lookup using the class name.
487 return D ? find(D, S) : find(ClsName, S);
488 }
Mike Stump1eb44332009-09-09 15:08:12 +0000489
Ted Kremenek93edbc52011-10-05 23:54:29 +0000490 const RetainSummary * find(const ObjCInterfaceDecl *D, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000491 // Do a lookup with the (D,S) pair. If we find a match return
492 // the iterator.
493 ObjCSummaryKey K(D, S);
494 MapTy::iterator I = M.find(K);
Mike Stump1eb44332009-09-09 15:08:12 +0000495
Ted Kremenek553cf182008-06-25 21:21:56 +0000496 if (I != M.end() || !D)
Ted Kremenek614cc542009-07-21 23:27:57 +0000497 return I->second;
Mike Stump1eb44332009-09-09 15:08:12 +0000498
Ted Kremenek553cf182008-06-25 21:21:56 +0000499 // Walk the super chain. If we find a hit with a parent, we'll end
500 // up returning that summary. We actually allow that key (null,S), as
501 // we cache summaries for the null ObjCInterfaceDecl* to allow us to
502 // generate initial summaries without having to worry about NSObject
503 // being declared.
504 // FIXME: We may change this at some point.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000505 for (ObjCInterfaceDecl *C=D->getSuperClass() ;; C=C->getSuperClass()) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000506 if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
507 break;
Mike Stump1eb44332009-09-09 15:08:12 +0000508
Ted Kremenek553cf182008-06-25 21:21:56 +0000509 if (!C)
Ted Kremenek614cc542009-07-21 23:27:57 +0000510 return NULL;
Ted Kremenek553cf182008-06-25 21:21:56 +0000511 }
Mike Stump1eb44332009-09-09 15:08:12 +0000512
513 // Cache the summary with original key to make the next lookup faster
Ted Kremenek553cf182008-06-25 21:21:56 +0000514 // and return the iterator.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000515 const RetainSummary *Summ = I->second;
Ted Kremenek614cc542009-07-21 23:27:57 +0000516 M[K] = Summ;
517 return Summ;
Ted Kremenek553cf182008-06-25 21:21:56 +0000518 }
Mike Stump1eb44332009-09-09 15:08:12 +0000519
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000520 const RetainSummary *find(IdentifierInfo* II, Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000521 // FIXME: Class method lookup. Right now we dont' have a good way
522 // of going between IdentifierInfo* and the class hierarchy.
Ted Kremenek614cc542009-07-21 23:27:57 +0000523 MapTy::iterator I = M.find(ObjCSummaryKey(II, S));
Mike Stump1eb44332009-09-09 15:08:12 +0000524
Ted Kremenek614cc542009-07-21 23:27:57 +0000525 if (I == M.end())
526 I = M.find(ObjCSummaryKey(S));
Mike Stump1eb44332009-09-09 15:08:12 +0000527
Ted Kremenek614cc542009-07-21 23:27:57 +0000528 return I == M.end() ? NULL : I->second;
Ted Kremenek553cf182008-06-25 21:21:56 +0000529 }
Mike Stump1eb44332009-09-09 15:08:12 +0000530
Ted Kremenek93edbc52011-10-05 23:54:29 +0000531 const RetainSummary *& operator[](ObjCSummaryKey K) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000532 return M[K];
533 }
Mike Stump1eb44332009-09-09 15:08:12 +0000534
Ted Kremenek93edbc52011-10-05 23:54:29 +0000535 const RetainSummary *& operator[](Selector S) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000536 return M[ ObjCSummaryKey(S) ];
537 }
Mike Stump1eb44332009-09-09 15:08:12 +0000538};
Ted Kremenek553cf182008-06-25 21:21:56 +0000539} // end anonymous namespace
540
541//===----------------------------------------------------------------------===//
542// Data structures for managing collections of summaries.
543//===----------------------------------------------------------------------===//
544
545namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +0000546class RetainSummaryManager {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000547
548 //==-----------------------------------------------------------------==//
549 // Typedefs.
550 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000551
Ted Kremenek93edbc52011-10-05 23:54:29 +0000552 typedef llvm::DenseMap<const FunctionDecl*, const RetainSummary *>
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000553 FuncSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000554
Ted Kremenek4f22a782008-06-23 23:30:29 +0000555 typedef ObjCSummaryCache ObjCMethodSummariesTy;
Mike Stump1eb44332009-09-09 15:08:12 +0000556
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000557 //==-----------------------------------------------------------------==//
558 // Data.
559 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000560
Ted Kremenek553cf182008-06-25 21:21:56 +0000561 /// Ctx - The ASTContext object for the analyzed ASTs.
Ted Kremenek9c378f72011-08-12 23:37:29 +0000562 ASTContext &Ctx;
Ted Kremenek179064e2008-07-01 17:21:27 +0000563
Ted Kremenek553cf182008-06-25 21:21:56 +0000564 /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
Ted Kremenek377e2302008-04-29 05:33:51 +0000565 const bool GCEnabled;
Mike Stump1eb44332009-09-09 15:08:12 +0000566
John McCallf85e1932011-06-15 23:02:42 +0000567 /// Records whether or not the analyzed code runs in ARC mode.
568 const bool ARCEnabled;
569
Ted Kremenek553cf182008-06-25 21:21:56 +0000570 /// FuncSummaries - A map from FunctionDecls to summaries.
Mike Stump1eb44332009-09-09 15:08:12 +0000571 FuncSummariesTy FuncSummaries;
572
Ted Kremenek553cf182008-06-25 21:21:56 +0000573 /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
574 /// to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000575 ObjCMethodSummariesTy ObjCClassMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000576
Ted Kremenek553cf182008-06-25 21:21:56 +0000577 /// ObjCMethodSummaries - A map from selectors to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000578 ObjCMethodSummariesTy ObjCMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000579
Ted Kremenek553cf182008-06-25 21:21:56 +0000580 /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
581 /// and all other data used by the checker.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000582 llvm::BumpPtrAllocator BPAlloc;
Mike Stump1eb44332009-09-09 15:08:12 +0000583
Ted Kremenekb77449c2009-05-03 05:20:50 +0000584 /// AF - A factory for ArgEffects objects.
Mike Stump1eb44332009-09-09 15:08:12 +0000585 ArgEffects::Factory AF;
586
Ted Kremenek553cf182008-06-25 21:21:56 +0000587 /// ScratchArgs - A holding buffer for construct ArgEffects.
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000588 ArgEffects ScratchArgs;
Mike Stump1eb44332009-09-09 15:08:12 +0000589
Ted Kremenekec315332009-05-07 23:40:42 +0000590 /// ObjCAllocRetE - Default return effect for methods returning Objective-C
591 /// objects.
592 RetEffect ObjCAllocRetE;
Ted Kremenek547d4952009-06-05 23:18:01 +0000593
Mike Stump1eb44332009-09-09 15:08:12 +0000594 /// ObjCInitRetE - Default return effect for init methods returning
Ted Kremenekac02f202009-08-20 05:13:36 +0000595 /// Objective-C objects.
Ted Kremenek547d4952009-06-05 23:18:01 +0000596 RetEffect ObjCInitRetE;
Mike Stump1eb44332009-09-09 15:08:12 +0000597
Ted Kremenek7faca822009-05-04 04:57:00 +0000598 RetainSummary DefaultSummary;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000599 const RetainSummary *StopSummary;
Mike Stump1eb44332009-09-09 15:08:12 +0000600
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000601 //==-----------------------------------------------------------------==//
602 // Methods.
603 //==-----------------------------------------------------------------==//
Mike Stump1eb44332009-09-09 15:08:12 +0000604
Ted Kremenek553cf182008-06-25 21:21:56 +0000605 /// getArgEffects - Returns a persistent ArgEffects object based on the
606 /// data in ScratchArgs.
Ted Kremenekb77449c2009-05-03 05:20:50 +0000607 ArgEffects getArgEffects();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000608
Mike Stump1eb44332009-09-09 15:08:12 +0000609 enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
610
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000611public:
Ted Kremenek78a35a32009-05-12 20:06:54 +0000612 RetEffect getObjAllocRetEffect() const { return ObjCAllocRetE; }
613
Ted Kremenek93edbc52011-10-05 23:54:29 +0000614 const RetainSummary *getDefaultSummary() {
615 return &DefaultSummary;
616 }
617
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000618 const RetainSummary *getUnarySummary(const FunctionType* FT,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000619 UnaryFuncKind func);
Mike Stump1eb44332009-09-09 15:08:12 +0000620
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000621 const RetainSummary *getCFSummaryCreateRule(const FunctionDecl *FD);
622 const RetainSummary *getCFSummaryGetRule(const FunctionDecl *FD);
623 const RetainSummary *getCFCreateGetRuleSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000624
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000625 const RetainSummary *getPersistentSummary(ArgEffects AE, RetEffect RetEff,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000626 ArgEffect ReceiverEff = DoNothing,
627 ArgEffect DefaultEff = MayEscape);
Ted Kremenek706522f2008-10-29 04:07:07 +0000628
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000629 const RetainSummary *getPersistentSummary(RetEffect RE,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000630 ArgEffect ReceiverEff = DoNothing,
631 ArgEffect DefaultEff = MayEscape) {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000632 return getPersistentSummary(getArgEffects(), RE, ReceiverEff, DefaultEff);
Ted Kremenek9c32d082008-05-06 00:30:21 +0000633 }
Mike Stump1eb44332009-09-09 15:08:12 +0000634
Ted Kremenek93edbc52011-10-05 23:54:29 +0000635 const RetainSummary *getPersistentStopSummary() {
Ted Kremenek432af592008-05-06 18:11:36 +0000636 if (StopSummary)
637 return StopSummary;
Mike Stump1eb44332009-09-09 15:08:12 +0000638
Ted Kremenek432af592008-05-06 18:11:36 +0000639 StopSummary = getPersistentSummary(RetEffect::MakeNoRet(),
640 StopTracking, StopTracking);
Ted Kremenek706522f2008-10-29 04:07:07 +0000641
Ted Kremenek432af592008-05-06 18:11:36 +0000642 return StopSummary;
Mike Stump1eb44332009-09-09 15:08:12 +0000643 }
Ted Kremenekb3095252008-05-06 04:20:12 +0000644
Ted Kremenek1f180c32008-06-23 22:21:20 +0000645 void InitializeClassMethodSummaries();
646 void InitializeMethodSummaries();
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000647private:
Ted Kremenek93edbc52011-10-05 23:54:29 +0000648 void addNSObjectClsMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000649 ObjCClassMethodSummaries[S] = Summ;
650 }
Mike Stump1eb44332009-09-09 15:08:12 +0000651
Ted Kremenek93edbc52011-10-05 23:54:29 +0000652 void addNSObjectMethSummary(Selector S, const RetainSummary *Summ) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000653 ObjCMethodSummaries[S] = Summ;
654 }
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000655
Ted Kremeneka9797122012-02-18 21:37:48 +0000656 void addClassMethSummary(const char* Cls, const char* name,
657 const RetainSummary *Summ, bool isNullary = true) {
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000658 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
Ted Kremeneka9797122012-02-18 21:37:48 +0000659 Selector S = isNullary ? GetNullarySelector(name, Ctx)
660 : GetUnarySelector(name, Ctx);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +0000661 ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
662 }
Mike Stump1eb44332009-09-09 15:08:12 +0000663
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000664 void addInstMethSummary(const char* Cls, const char* nullaryName,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000665 const RetainSummary *Summ) {
Ted Kremenek6c4becb2009-02-25 02:54:57 +0000666 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
667 Selector S = GetNullarySelector(nullaryName, Ctx);
668 ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
669 }
Mike Stump1eb44332009-09-09 15:08:12 +0000670
Ted Kremenekde4d5332009-04-24 17:50:11 +0000671 Selector generateSelector(va_list argp) {
Chris Lattner5f9e2722011-07-23 10:55:15 +0000672 SmallVector<IdentifierInfo*, 10> II;
Ted Kremenekde4d5332009-04-24 17:50:11 +0000673
Ted Kremenek9e476de2008-08-12 18:30:56 +0000674 while (const char* s = va_arg(argp, const char*))
675 II.push_back(&Ctx.Idents.get(s));
Ted Kremenekde4d5332009-04-24 17:50:11 +0000676
Mike Stump1eb44332009-09-09 15:08:12 +0000677 return Ctx.Selectors.getSelector(II.size(), &II[0]);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000678 }
Mike Stump1eb44332009-09-09 15:08:12 +0000679
Ted Kremenekde4d5332009-04-24 17:50:11 +0000680 void addMethodSummary(IdentifierInfo *ClsII, ObjCMethodSummariesTy& Summaries,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000681 const RetainSummary * Summ, va_list argp) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000682 Selector S = generateSelector(argp);
683 Summaries[ObjCSummaryKey(ClsII, S)] = Summ;
Ted Kremenek70a733e2008-07-18 17:24:20 +0000684 }
Mike Stump1eb44332009-09-09 15:08:12 +0000685
Ted Kremenek93edbc52011-10-05 23:54:29 +0000686 void addInstMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000687 va_list argp;
688 va_start(argp, Summ);
Ted Kremenekde4d5332009-04-24 17:50:11 +0000689 addMethodSummary(&Ctx.Idents.get(Cls), ObjCMethodSummaries, Summ, argp);
Mike Stump1eb44332009-09-09 15:08:12 +0000690 va_end(argp);
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000691 }
Mike Stump1eb44332009-09-09 15:08:12 +0000692
Ted Kremenek93edbc52011-10-05 23:54:29 +0000693 void addClsMethSummary(const char* Cls, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000694 va_list argp;
695 va_start(argp, Summ);
696 addMethodSummary(&Ctx.Idents.get(Cls),ObjCClassMethodSummaries, Summ, argp);
697 va_end(argp);
698 }
Mike Stump1eb44332009-09-09 15:08:12 +0000699
Ted Kremenek93edbc52011-10-05 23:54:29 +0000700 void addClsMethSummary(IdentifierInfo *II, const RetainSummary * Summ, ...) {
Ted Kremenekde4d5332009-04-24 17:50:11 +0000701 va_list argp;
702 va_start(argp, Summ);
703 addMethodSummary(II, ObjCClassMethodSummaries, Summ, argp);
704 va_end(argp);
705 }
706
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000707public:
Mike Stump1eb44332009-09-09 15:08:12 +0000708
Ted Kremenek9c378f72011-08-12 23:37:29 +0000709 RetainSummaryManager(ASTContext &ctx, bool gcenabled, bool usesARC)
Ted Kremenek179064e2008-07-01 17:21:27 +0000710 : Ctx(ctx),
John McCallf85e1932011-06-15 23:02:42 +0000711 GCEnabled(gcenabled),
712 ARCEnabled(usesARC),
713 AF(BPAlloc), ScratchArgs(AF.getEmptyMap()),
714 ObjCAllocRetE(gcenabled
715 ? RetEffect::MakeGCNotOwned()
716 : (usesARC ? RetEffect::MakeARCNotOwned()
717 : RetEffect::MakeOwned(RetEffect::ObjC, true))),
718 ObjCInitRetE(gcenabled
719 ? RetEffect::MakeGCNotOwned()
720 : (usesARC ? RetEffect::MakeARCNotOwned()
721 : RetEffect::MakeOwnedWhenTrackedReceiver())),
Ted Kremenek3baf6722010-11-24 00:54:37 +0000722 DefaultSummary(AF.getEmptyMap() /* per-argument effects (none) */,
Ted Kremenek7faca822009-05-04 04:57:00 +0000723 RetEffect::MakeNoRet() /* return effect */,
Ted Kremenekebd5a2d2009-05-11 18:30:24 +0000724 MayEscape, /* default argument effect */
725 DoNothing /* receiver effect */),
Ted Kremenekb77449c2009-05-03 05:20:50 +0000726 StopSummary(0) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000727
728 InitializeClassMethodSummaries();
729 InitializeMethodSummaries();
730 }
Mike Stump1eb44332009-09-09 15:08:12 +0000731
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000732 const RetainSummary *getSummary(const FunctionDecl *FD);
Mike Stump1eb44332009-09-09 15:08:12 +0000733
Jordy Rosef3aae582012-03-17 21:13:07 +0000734 const RetainSummary *getMethodSummary(Selector S, IdentifierInfo *ClsName,
735 const ObjCInterfaceDecl *ID,
736 const ObjCMethodDecl *MD,
737 QualType RetTy,
738 ObjCMethodSummariesTy &CachedSummaries);
739
Ted Kremenek93edbc52011-10-05 23:54:29 +0000740 const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek8bef8232012-01-26 21:29:00 +0000741 ProgramStateRef state,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000742 const LocationContext *LC);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +0000743
Ted Kremenek0507f7e2012-01-04 00:35:45 +0000744 const RetainSummary *getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000745 const ObjCInterfaceDecl *ID) {
Jordy Rosef3aae582012-03-17 21:13:07 +0000746 return getMethodSummary(msg.getSelector(), 0, ID, msg.getMethodDecl(),
747 msg.getType(Ctx), ObjCMethodSummaries);
Ted Kremenek8711c032009-04-29 05:04:30 +0000748 }
Mike Stump1eb44332009-09-09 15:08:12 +0000749
Ted Kremenek93edbc52011-10-05 23:54:29 +0000750 const RetainSummary *getClassMethodSummary(const ObjCMessage &msg) {
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +0000751 const ObjCInterfaceDecl *Class = 0;
752 if (!msg.isInstanceMessage())
753 Class = msg.getReceiverInterface();
Douglas Gregor04badcf2010-04-21 00:45:42 +0000754
Jordy Rosef3aae582012-03-17 21:13:07 +0000755 return getMethodSummary(msg.getSelector(), Class->getIdentifier(),
756 Class, msg.getMethodDecl(), msg.getType(Ctx),
757 ObjCClassMethodSummaries);
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +0000758 }
Ted Kremenek552333c2009-04-29 17:17:48 +0000759
760 /// getMethodSummary - This version of getMethodSummary is used to query
761 /// the summary for the current method being analyzed.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000762 const RetainSummary *getMethodSummary(const ObjCMethodDecl *MD) {
Ted Kremeneka8833552009-04-29 23:03:22 +0000763 // FIXME: Eventually this should be unneeded.
Ted Kremeneka8833552009-04-29 23:03:22 +0000764 const ObjCInterfaceDecl *ID = MD->getClassInterface();
Ted Kremenek70a65762009-04-30 05:41:14 +0000765 Selector S = MD->getSelector();
Ted Kremenek552333c2009-04-29 17:17:48 +0000766 IdentifierInfo *ClsName = ID->getIdentifier();
767 QualType ResultTy = MD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000768
Jordy Rosef3aae582012-03-17 21:13:07 +0000769 ObjCMethodSummariesTy *CachedSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000770 if (MD->isInstanceMethod())
Jordy Rosef3aae582012-03-17 21:13:07 +0000771 CachedSummaries = &ObjCMethodSummaries;
Ted Kremenek552333c2009-04-29 17:17:48 +0000772 else
Jordy Rosef3aae582012-03-17 21:13:07 +0000773 CachedSummaries = &ObjCClassMethodSummaries;
774
775 return getMethodSummary(S, ClsName, ID, MD, ResultTy, *CachedSummaries);
Ted Kremenek552333c2009-04-29 17:17:48 +0000776 }
Mike Stump1eb44332009-09-09 15:08:12 +0000777
Jordy Rosef3aae582012-03-17 21:13:07 +0000778 const RetainSummary *getStandardMethodSummary(const ObjCMethodDecl *MD,
Ted Kremenek93edbc52011-10-05 23:54:29 +0000779 Selector S, QualType RetTy);
Ted Kremeneka8833552009-04-29 23:03:22 +0000780
Ted Kremenek93edbc52011-10-05 23:54:29 +0000781 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000782 const ObjCMethodDecl *MD);
783
Ted Kremenek93edbc52011-10-05 23:54:29 +0000784 void updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +0000785 const FunctionDecl *FD);
786
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000787 bool isGCEnabled() const { return GCEnabled; }
Mike Stump1eb44332009-09-09 15:08:12 +0000788
John McCallf85e1932011-06-15 23:02:42 +0000789 bool isARCEnabled() const { return ARCEnabled; }
790
791 bool isARCorGCEnabled() const { return GCEnabled || ARCEnabled; }
792
Ted Kremenek93edbc52011-10-05 23:54:29 +0000793 const RetainSummary *copySummary(const RetainSummary *OldSumm) {
794 RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
Ted Kremenek885c27b2009-05-04 05:31:22 +0000795 new (Summ) RetainSummary(*OldSumm);
796 return Summ;
Mike Stump1eb44332009-09-09 15:08:12 +0000797 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000798};
Mike Stump1eb44332009-09-09 15:08:12 +0000799
Jordy Rose0fe62f82011-08-24 09:02:37 +0000800// Used to avoid allocating long-term (BPAlloc'd) memory for default retain
801// summaries. If a function or method looks like it has a default summary, but
802// it has annotations, the annotations are added to the stack-based template
803// and then copied into managed memory.
804class RetainSummaryTemplate {
805 RetainSummaryManager &Manager;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000806 const RetainSummary *&RealSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000807 RetainSummary ScratchSummary;
808 bool Accessed;
809public:
Jordy Rosee921b1a2012-03-17 19:53:04 +0000810 RetainSummaryTemplate(const RetainSummary *&real, const RetainSummary &base,
811 RetainSummaryManager &mgr)
812 : Manager(mgr), RealSummary(real), ScratchSummary(real ? *real : base),
Ted Kremenek93edbc52011-10-05 23:54:29 +0000813 Accessed(false) {}
Jordy Rose0fe62f82011-08-24 09:02:37 +0000814
815 ~RetainSummaryTemplate() {
Ted Kremenek93edbc52011-10-05 23:54:29 +0000816 if (Accessed)
Jordy Rose0fe62f82011-08-24 09:02:37 +0000817 RealSummary = Manager.copySummary(&ScratchSummary);
818 }
819
820 RetainSummary &operator*() {
821 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000822 return ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000823 }
824
825 RetainSummary *operator->() {
826 Accessed = true;
Ted Kremenek93edbc52011-10-05 23:54:29 +0000827 return &ScratchSummary;
Jordy Rose0fe62f82011-08-24 09:02:37 +0000828 }
829};
830
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000831} // end anonymous namespace
832
833//===----------------------------------------------------------------------===//
834// Implementation of checker data structures.
835//===----------------------------------------------------------------------===//
836
Ted Kremenekb77449c2009-05-03 05:20:50 +0000837ArgEffects RetainSummaryManager::getArgEffects() {
838 ArgEffects AE = ScratchArgs;
Ted Kremenek3baf6722010-11-24 00:54:37 +0000839 ScratchArgs = AF.getEmptyMap();
Ted Kremenekb77449c2009-05-03 05:20:50 +0000840 return AE;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000841}
842
Ted Kremenek93edbc52011-10-05 23:54:29 +0000843const RetainSummary *
Ted Kremenekb77449c2009-05-03 05:20:50 +0000844RetainSummaryManager::getPersistentSummary(ArgEffects AE, RetEffect RetEff,
Ted Kremenek1bffd742008-05-06 15:44:25 +0000845 ArgEffect ReceiverEff,
Jordy Rosee62e87b2011-08-20 20:55:40 +0000846 ArgEffect DefaultEff) {
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000847 // Create the summary and return it.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000848 RetainSummary *Summ = (RetainSummary *) BPAlloc.Allocate<RetainSummary>();
Jordy Rosee62e87b2011-08-20 20:55:40 +0000849 new (Summ) RetainSummary(AE, RetEff, DefaultEff, ReceiverEff);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000850 return Summ;
851}
852
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000853//===----------------------------------------------------------------------===//
854// Summary creation for functions (largely uses of Core Foundation).
855//===----------------------------------------------------------------------===//
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000856
Ted Kremenek9c378f72011-08-12 23:37:29 +0000857static bool isRetain(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000858 return FName.endswith("Retain");
Ted Kremenek12619382009-01-12 21:45:02 +0000859}
860
Ted Kremenek9c378f72011-08-12 23:37:29 +0000861static bool isRelease(const FunctionDecl *FD, StringRef FName) {
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000862 return FName.endswith("Release");
Ted Kremenek12619382009-01-12 21:45:02 +0000863}
864
Jordy Rose76c506f2011-08-21 21:58:18 +0000865static bool isMakeCollectable(const FunctionDecl *FD, StringRef FName) {
866 // FIXME: Remove FunctionDecl parameter.
867 // FIXME: Is it really okay if MakeCollectable isn't a suffix?
868 return FName.find("MakeCollectable") != StringRef::npos;
869}
870
Ted Kremenek93edbc52011-10-05 23:54:29 +0000871const RetainSummary * RetainSummaryManager::getSummary(const FunctionDecl *FD) {
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000872 // Look up a summary in our cache of FunctionDecls -> Summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000873 FuncSummariesTy::iterator I = FuncSummaries.find(FD);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000874 if (I != FuncSummaries.end())
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000875 return I->second;
876
Ted Kremeneke401a0c2009-05-04 15:34:07 +0000877 // No summary? Generate one.
Ted Kremenek93edbc52011-10-05 23:54:29 +0000878 const RetainSummary *S = 0;
Mike Stump1eb44332009-09-09 15:08:12 +0000879
Ted Kremenek37d785b2008-07-15 16:50:12 +0000880 do {
Ted Kremenek12619382009-01-12 21:45:02 +0000881 // We generate "stop" summaries for implicitly defined functions.
882 if (FD->isImplicit()) {
883 S = getPersistentStopSummary();
884 break;
Ted Kremenek37d785b2008-07-15 16:50:12 +0000885 }
Ted Kremenek9ca28512011-05-02 21:21:42 +0000886 // For C++ methods, generate an implicit "stop" summary as well. We
887 // can relax this once we have a clear policy for C++ methods and
888 // ownership attributes.
889 if (isa<CXXMethodDecl>(FD)) {
890 S = getPersistentStopSummary();
891 break;
892 }
Mike Stump1eb44332009-09-09 15:08:12 +0000893
John McCall183700f2009-09-21 23:43:11 +0000894 // [PR 3337] Use 'getAs<FunctionType>' to strip away any typedefs on the
Ted Kremenek99890652009-01-16 18:40:33 +0000895 // function's type.
John McCall183700f2009-09-21 23:43:11 +0000896 const FunctionType* FT = FD->getType()->getAs<FunctionType>();
Ted Kremenek48c6d182009-12-16 06:06:43 +0000897 const IdentifierInfo *II = FD->getIdentifier();
898 if (!II)
899 break;
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000900
901 StringRef FName = II->getName();
Mike Stump1eb44332009-09-09 15:08:12 +0000902
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +0000903 // Strip away preceding '_'. Doing this here will effect all the checks
904 // down below.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000905 FName = FName.substr(FName.find_first_not_of('_'));
Mike Stump1eb44332009-09-09 15:08:12 +0000906
Ted Kremenek12619382009-01-12 21:45:02 +0000907 // Inspect the result type.
908 QualType RetTy = FT->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +0000909
Ted Kremenek12619382009-01-12 21:45:02 +0000910 // FIXME: This should all be refactored into a chain of "summary lookup"
911 // filters.
Ted Kremenek008636a2009-10-14 00:27:24 +0000912 assert(ScratchArgs.isEmpty());
Ted Kremenek39d88b02009-06-15 20:36:07 +0000913
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000914 if (FName == "pthread_create") {
915 // Part of: <rdar://problem/7299394>. This will be addressed
916 // better with IPA.
917 S = getPersistentStopSummary();
918 } else if (FName == "NSMakeCollectable") {
919 // Handle: id NSMakeCollectable(CFTypeRef)
920 S = (RetTy->isObjCIdType())
921 ? getUnarySummary(FT, cfmakecollectable)
922 : getPersistentStopSummary();
923 } else if (FName == "IOBSDNameMatching" ||
924 FName == "IOServiceMatching" ||
925 FName == "IOServiceNameMatching" ||
926 FName == "IORegistryEntryIDMatching" ||
927 FName == "IOOpenFirmwarePathMatching") {
928 // Part of <rdar://problem/6961230>. (IOKit)
929 // This should be addressed using a API table.
930 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
931 DoNothing, DoNothing);
932 } else if (FName == "IOServiceGetMatchingService" ||
933 FName == "IOServiceGetMatchingServices") {
934 // FIXES: <rdar://problem/6326900>
935 // This should be addressed using a API table. This strcmp is also
936 // a little gross, but there is no need to super optimize here.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000937 ScratchArgs = AF.add(ScratchArgs, 1, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000938 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
939 } else if (FName == "IOServiceAddNotification" ||
940 FName == "IOServiceAddMatchingNotification") {
941 // Part of <rdar://problem/6961230>. (IOKit)
942 // This should be addressed using a API table.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000943 ScratchArgs = AF.add(ScratchArgs, 2, DecRef);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000944 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
945 } else if (FName == "CVPixelBufferCreateWithBytes") {
946 // FIXES: <rdar://problem/7283567>
947 // Eventually this can be improved by recognizing that the pixel
948 // buffer passed to CVPixelBufferCreateWithBytes is released via
949 // a callback and doing full IPA to make sure this is done correctly.
950 // FIXME: This function has an out parameter that returns an
951 // allocated object.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000952 ScratchArgs = AF.add(ScratchArgs, 7, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000953 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
954 } else if (FName == "CGBitmapContextCreateWithData") {
955 // FIXES: <rdar://problem/7358899>
956 // Eventually this can be improved by recognizing that 'releaseInfo'
957 // passed to CGBitmapContextCreateWithData is released via
958 // a callback and doing full IPA to make sure this is done correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000959 ScratchArgs = AF.add(ScratchArgs, 8, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000960 S = getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true),
961 DoNothing, DoNothing);
962 } else if (FName == "CVPixelBufferCreateWithPlanarBytes") {
963 // FIXES: <rdar://problem/7283567>
964 // Eventually this can be improved by recognizing that the pixel
965 // buffer passed to CVPixelBufferCreateWithPlanarBytes is released
966 // via a callback and doing full IPA to make sure this is done
967 // correctly.
Ted Kremenek3baf6722010-11-24 00:54:37 +0000968 ScratchArgs = AF.add(ScratchArgs, 12, StopTracking);
Benjamin Kramerb6f3c702010-02-08 18:38:55 +0000969 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenekb04cb592009-06-11 18:17:24 +0000970 }
Mike Stump1eb44332009-09-09 15:08:12 +0000971
Ted Kremenekb04cb592009-06-11 18:17:24 +0000972 // Did we get a summary?
973 if (S)
974 break;
Ted Kremenek61991902009-03-17 22:43:44 +0000975
976 // Enable this code once the semantics of NSDeallocateObject are resolved
977 // for GC. <rdar://problem/6619988>
978#if 0
979 // Handle: NSDeallocateObject(id anObject);
980 // This method does allow 'nil' (although we don't check it now).
Mike Stump1eb44332009-09-09 15:08:12 +0000981 if (strcmp(FName, "NSDeallocateObject") == 0) {
Ted Kremenek61991902009-03-17 22:43:44 +0000982 return RetTy == Ctx.VoidTy
983 ? getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, Dealloc)
984 : getPersistentStopSummary();
985 }
986#endif
Ted Kremenek12619382009-01-12 21:45:02 +0000987
988 if (RetTy->isPointerType()) {
989 // For CoreFoundation ('CF') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +0000990 if (cocoa::isRefType(RetTy, "CF", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +0000991 if (isRetain(FD, FName))
992 S = getUnarySummary(FT, cfretain);
Jordy Rose76c506f2011-08-21 21:58:18 +0000993 else if (isMakeCollectable(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +0000994 S = getUnarySummary(FT, cfmakecollectable);
Mike Stump1eb44332009-09-09 15:08:12 +0000995 else
John McCall7df2ff42011-10-01 00:48:56 +0000996 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +0000997
998 break;
999 }
1000
1001 // For CoreGraphics ('CG') types.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001002 if (cocoa::isRefType(RetTy, "CG", FName)) {
Ted Kremenek12619382009-01-12 21:45:02 +00001003 if (isRetain(FD, FName))
1004 S = getUnarySummary(FT, cfretain);
1005 else
John McCall7df2ff42011-10-01 00:48:56 +00001006 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001007
1008 break;
1009 }
1010
1011 // For the Disk Arbitration API (DiskArbitration/DADisk.h)
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001012 if (cocoa::isRefType(RetTy, "DADisk") ||
1013 cocoa::isRefType(RetTy, "DADissenter") ||
1014 cocoa::isRefType(RetTy, "DASessionRef")) {
John McCall7df2ff42011-10-01 00:48:56 +00001015 S = getCFCreateGetRuleSummary(FD);
Ted Kremenek12619382009-01-12 21:45:02 +00001016 break;
1017 }
Mike Stump1eb44332009-09-09 15:08:12 +00001018
Ted Kremenek12619382009-01-12 21:45:02 +00001019 break;
1020 }
1021
1022 // Check for release functions, the only kind of functions that we care
1023 // about that don't return a pointer type.
1024 if (FName[0] == 'C' && (FName[1] == 'F' || FName[1] == 'G')) {
Ted Kremeneke7d03122010-02-08 16:45:01 +00001025 // Test for 'CGCF'.
Benjamin Kramerb6f3c702010-02-08 18:38:55 +00001026 FName = FName.substr(FName.startswith("CGCF") ? 4 : 2);
Ted Kremeneke7d03122010-02-08 16:45:01 +00001027
Ted Kremenekbf0a4dd2009-03-05 22:11:14 +00001028 if (isRelease(FD, FName))
Ted Kremenek12619382009-01-12 21:45:02 +00001029 S = getUnarySummary(FT, cfrelease);
1030 else {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001031 assert (ScratchArgs.isEmpty());
Ted Kremenek68189282009-01-29 22:45:13 +00001032 // Remaining CoreFoundation and CoreGraphics functions.
1033 // We use to assume that they all strictly followed the ownership idiom
1034 // and that ownership cannot be transferred. While this is technically
1035 // correct, many methods allow a tracked object to escape. For example:
1036 //
Mike Stump1eb44332009-09-09 15:08:12 +00001037 // CFMutableDictionaryRef x = CFDictionaryCreateMutable(...);
Ted Kremenek68189282009-01-29 22:45:13 +00001038 // CFDictionaryAddValue(y, key, x);
Mike Stump1eb44332009-09-09 15:08:12 +00001039 // CFRelease(x);
Ted Kremenek68189282009-01-29 22:45:13 +00001040 // ... it is okay to use 'x' since 'y' has a reference to it
1041 //
1042 // We handle this and similar cases with the follow heuristic. If the
Ted Kremenekc4843812009-08-20 00:57:22 +00001043 // function name contains "InsertValue", "SetValue", "AddValue",
1044 // "AppendValue", or "SetAttribute", then we assume that arguments may
1045 // "escape." This means that something else holds on to the object,
1046 // allowing it be used even after its local retain count drops to 0.
Benjamin Kramere45c1492010-01-11 19:46:28 +00001047 ArgEffect E = (StrInStrNoCase(FName, "InsertValue") != StringRef::npos||
1048 StrInStrNoCase(FName, "AddValue") != StringRef::npos ||
1049 StrInStrNoCase(FName, "SetValue") != StringRef::npos ||
1050 StrInStrNoCase(FName, "AppendValue") != StringRef::npos||
Benjamin Kramerc027e542010-01-11 20:15:06 +00001051 StrInStrNoCase(FName, "SetAttribute") != StringRef::npos)
Ted Kremenek68189282009-01-29 22:45:13 +00001052 ? MayEscape : DoNothing;
Mike Stump1eb44332009-09-09 15:08:12 +00001053
Ted Kremenek68189282009-01-29 22:45:13 +00001054 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, E);
Ted Kremenek12619382009-01-12 21:45:02 +00001055 }
1056 }
Ted Kremenek37d785b2008-07-15 16:50:12 +00001057 }
1058 while (0);
Mike Stump1eb44332009-09-09 15:08:12 +00001059
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001060 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001061 updateSummaryFromAnnotations(S, FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001062
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001063 FuncSummaries[FD] = S;
Mike Stump1eb44332009-09-09 15:08:12 +00001064 return S;
Ted Kremenek2fff37e2008-03-06 00:08:09 +00001065}
1066
Ted Kremenek93edbc52011-10-05 23:54:29 +00001067const RetainSummary *
John McCall7df2ff42011-10-01 00:48:56 +00001068RetainSummaryManager::getCFCreateGetRuleSummary(const FunctionDecl *FD) {
1069 if (coreFoundation::followsCreateRule(FD))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001070 return getCFSummaryCreateRule(FD);
Mike Stump1eb44332009-09-09 15:08:12 +00001071
Ted Kremenekd368d712011-05-25 06:19:45 +00001072 return getCFSummaryGetRule(FD);
Ted Kremenek86ad3bc2008-05-05 16:51:50 +00001073}
1074
Ted Kremenek93edbc52011-10-05 23:54:29 +00001075const RetainSummary *
Ted Kremenek6ad315a2009-02-23 16:51:39 +00001076RetainSummaryManager::getUnarySummary(const FunctionType* FT,
1077 UnaryFuncKind func) {
1078
Ted Kremenek12619382009-01-12 21:45:02 +00001079 // Sanity check that this is *really* a unary function. This can
1080 // happen if people do weird things.
Douglas Gregor72564e72009-02-26 23:50:07 +00001081 const FunctionProtoType* FTP = dyn_cast<FunctionProtoType>(FT);
Ted Kremenek12619382009-01-12 21:45:02 +00001082 if (!FTP || FTP->getNumArgs() != 1)
1083 return getPersistentStopSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001084
Ted Kremenekb77449c2009-05-03 05:20:50 +00001085 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001086
Jordy Rose76c506f2011-08-21 21:58:18 +00001087 ArgEffect Effect;
Ted Kremenek377e2302008-04-29 05:33:51 +00001088 switch (func) {
Jordy Rose76c506f2011-08-21 21:58:18 +00001089 case cfretain: Effect = IncRef; break;
1090 case cfrelease: Effect = DecRef; break;
1091 case cfmakecollectable: Effect = MakeCollectable; break;
Ted Kremenek940b1d82008-04-10 23:44:06 +00001092 }
Jordy Rose76c506f2011-08-21 21:58:18 +00001093
1094 ScratchArgs = AF.add(ScratchArgs, 0, Effect);
1095 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001096}
1097
Ted Kremenek93edbc52011-10-05 23:54:29 +00001098const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001099RetainSummaryManager::getCFSummaryCreateRule(const FunctionDecl *FD) {
Ted Kremenekb77449c2009-05-03 05:20:50 +00001100 assert (ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001101
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001102 return getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001103}
1104
Ted Kremenek93edbc52011-10-05 23:54:29 +00001105const RetainSummary *
Ted Kremenek9c378f72011-08-12 23:37:29 +00001106RetainSummaryManager::getCFSummaryGetRule(const FunctionDecl *FD) {
Mike Stump1eb44332009-09-09 15:08:12 +00001107 assert (ScratchArgs.isEmpty());
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001108 return getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::CF),
1109 DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001110}
1111
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001112//===----------------------------------------------------------------------===//
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001113// Summary creation for Selectors.
1114//===----------------------------------------------------------------------===//
1115
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001116void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001117RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001118 const FunctionDecl *FD) {
1119 if (!FD)
1120 return;
1121
Jordy Rose0fe62f82011-08-24 09:02:37 +00001122 RetainSummaryTemplate Template(Summ, DefaultSummary, *this);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001123
Ted Kremenek11fe1752011-01-27 18:43:03 +00001124 // Effects on the parameters.
1125 unsigned parm_idx = 0;
1126 for (FunctionDecl::param_const_iterator pi = FD->param_begin(),
John McCall98b8f162011-04-06 09:02:12 +00001127 pe = FD->param_end(); pi != pe; ++pi, ++parm_idx) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001128 const ParmVarDecl *pd = *pi;
1129 if (pd->getAttr<NSConsumedAttr>()) {
Jordy Rose4df54fe2011-08-23 04:27:15 +00001130 if (!GCEnabled) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001131 Template->addArg(AF, parm_idx, DecRef);
Jordy Rose4df54fe2011-08-23 04:27:15 +00001132 }
1133 } else if (pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001134 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001135 }
1136 }
1137
Ted Kremenekb04cb592009-06-11 18:17:24 +00001138 QualType RetTy = FD->getResultType();
Mike Stump1eb44332009-09-09 15:08:12 +00001139
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001140 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001141 if (cocoa::isCocoaObjectRef(RetTy)) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001142 if (FD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001143 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001144 }
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001145 else if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001146 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenekb04cb592009-06-11 18:17:24 +00001147 }
Ted Kremenek60411112010-02-18 00:06:12 +00001148 else if (FD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001149 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001150 }
1151 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001152 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001153 }
1154 } else if (RetTy->getAs<PointerType>()) {
1155 if (FD->getAttr<CFReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001156 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Jordy Rose4df54fe2011-08-23 04:27:15 +00001157 }
1158 else if (FD->getAttr<CFReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001159 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001160 }
Ted Kremenekb04cb592009-06-11 18:17:24 +00001161 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001162}
1163
1164void
Ted Kremenek93edbc52011-10-05 23:54:29 +00001165RetainSummaryManager::updateSummaryFromAnnotations(const RetainSummary *&Summ,
1166 const ObjCMethodDecl *MD) {
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001167 if (!MD)
1168 return;
1169
Jordy Rose0fe62f82011-08-24 09:02:37 +00001170 RetainSummaryTemplate Template(Summ, DefaultSummary, *this);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001171 bool isTrackedLoc = false;
Mike Stump1eb44332009-09-09 15:08:12 +00001172
Ted Kremenek12b94342011-01-27 06:54:14 +00001173 // Effects on the receiver.
1174 if (MD->getAttr<NSConsumesSelfAttr>()) {
Ted Kremenek11fe1752011-01-27 18:43:03 +00001175 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001176 Template->setReceiverEffect(DecRefMsg);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001177 }
1178
1179 // Effects on the parameters.
1180 unsigned parm_idx = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001181 for (ObjCMethodDecl::param_const_iterator
1182 pi=MD->param_begin(), pe=MD->param_end();
Ted Kremenek11fe1752011-01-27 18:43:03 +00001183 pi != pe; ++pi, ++parm_idx) {
1184 const ParmVarDecl *pd = *pi;
1185 if (pd->getAttr<NSConsumedAttr>()) {
1186 if (!GCEnabled)
Jordy Rose0fe62f82011-08-24 09:02:37 +00001187 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001188 }
1189 else if(pd->getAttr<CFConsumedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001190 Template->addArg(AF, parm_idx, DecRef);
Ted Kremenek11fe1752011-01-27 18:43:03 +00001191 }
Ted Kremenek12b94342011-01-27 06:54:14 +00001192 }
1193
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001194 // Determine if there is a special return effect for this method.
Ted Kremenek78acdbf2010-01-27 18:00:17 +00001195 if (cocoa::isCocoaObjectRef(MD->getResultType())) {
Argyrios Kyrtzidis40b598e2009-06-30 02:34:44 +00001196 if (MD->getAttr<NSReturnsRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001197 Template->setRetEffect(ObjCAllocRetE);
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001198 return;
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001199 }
Ted Kremenek60411112010-02-18 00:06:12 +00001200 if (MD->getAttr<NSReturnsNotRetainedAttr>()) {
Jordy Rose0fe62f82011-08-24 09:02:37 +00001201 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::ObjC));
Ted Kremenek60411112010-02-18 00:06:12 +00001202 return;
1203 }
Mike Stump1eb44332009-09-09 15:08:12 +00001204
Ted Kremenek6d4b76d2009-07-06 18:30:43 +00001205 isTrackedLoc = true;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001206 } else {
Ted Kremenek6217b802009-07-29 21:53:49 +00001207 isTrackedLoc = MD->getResultType()->getAs<PointerType>() != NULL;
Jordy Rose0fe62f82011-08-24 09:02:37 +00001208 }
Mike Stump1eb44332009-09-09 15:08:12 +00001209
Ted Kremenek60411112010-02-18 00:06:12 +00001210 if (isTrackedLoc) {
1211 if (MD->getAttr<CFReturnsRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001212 Template->setRetEffect(RetEffect::MakeOwned(RetEffect::CF, true));
Ted Kremenek60411112010-02-18 00:06:12 +00001213 else if (MD->getAttr<CFReturnsNotRetainedAttr>())
Jordy Rose0fe62f82011-08-24 09:02:37 +00001214 Template->setRetEffect(RetEffect::MakeNotOwned(RetEffect::CF));
Ted Kremenek60411112010-02-18 00:06:12 +00001215 }
Ted Kremenek4dd8fb42009-05-09 02:58:13 +00001216}
1217
Ted Kremenek93edbc52011-10-05 23:54:29 +00001218const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001219RetainSummaryManager::getStandardMethodSummary(const ObjCMethodDecl *MD,
1220 Selector S, QualType RetTy) {
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001221
Ted Kremenekfcd7c6f2009-04-29 00:42:39 +00001222 if (MD) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001223 // Scan the method decl for 'void*' arguments. These should be treated
1224 // as 'StopTracking' because they are often used with delegates.
1225 // Delegates are a frequent form of false positives with the retain
1226 // count checker.
1227 unsigned i = 0;
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001228 for (ObjCMethodDecl::param_const_iterator I = MD->param_begin(),
Ted Kremenek376d1e72009-04-24 18:00:17 +00001229 E = MD->param_end(); I != E; ++I, ++i)
Argyrios Kyrtzidis491306a2011-10-03 06:37:04 +00001230 if (const ParmVarDecl *PD = *I) {
Ted Kremenek376d1e72009-04-24 18:00:17 +00001231 QualType Ty = Ctx.getCanonicalType(PD->getType());
Douglas Gregora4923eb2009-11-16 21:35:15 +00001232 if (Ty.getLocalUnqualifiedType() == Ctx.VoidPtrTy)
Ted Kremenek3baf6722010-11-24 00:54:37 +00001233 ScratchArgs = AF.add(ScratchArgs, i, StopTracking);
Ted Kremenek376d1e72009-04-24 18:00:17 +00001234 }
1235 }
Mike Stump1eb44332009-09-09 15:08:12 +00001236
Jordy Rosee921b1a2012-03-17 19:53:04 +00001237 // Any special effects?
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001238 ArgEffect ReceiverEff = DoNothing;
Jordy Rosee921b1a2012-03-17 19:53:04 +00001239 RetEffect ResultEff = RetEffect::MakeNoRet();
1240
1241 // Check the method family, and apply any default annotations.
1242 switch (MD ? MD->getMethodFamily() : S.getMethodFamily()) {
1243 case OMF_None:
1244 case OMF_performSelector:
1245 // Assume all Objective-C methods follow Cocoa Memory Management rules.
1246 // FIXME: Does the non-threaded performSelector family really belong here?
1247 // The selector could be, say, @selector(copy).
1248 if (cocoa::isCocoaObjectRef(RetTy))
1249 ResultEff = RetEffect::MakeNotOwned(RetEffect::ObjC);
1250 else if (coreFoundation::isCFObjectRef(RetTy)) {
1251 // ObjCMethodDecl currently doesn't consider CF objects as valid return
1252 // values for alloc, new, copy, or mutableCopy, so we have to
1253 // double-check with the selector. This is ugly, but there aren't that
1254 // many Objective-C methods that return CF objects, right?
1255 if (MD) {
1256 switch (S.getMethodFamily()) {
1257 case OMF_alloc:
1258 case OMF_new:
1259 case OMF_copy:
1260 case OMF_mutableCopy:
1261 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1262 break;
1263 default:
1264 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1265 break;
1266 }
1267 } else {
1268 ResultEff = RetEffect::MakeNotOwned(RetEffect::CF);
1269 }
1270 }
1271 break;
1272 case OMF_init:
1273 ResultEff = ObjCInitRetE;
1274 ReceiverEff = DecRefMsg;
1275 break;
1276 case OMF_alloc:
1277 case OMF_new:
1278 case OMF_copy:
1279 case OMF_mutableCopy:
1280 if (cocoa::isCocoaObjectRef(RetTy))
1281 ResultEff = ObjCAllocRetE;
1282 else if (coreFoundation::isCFObjectRef(RetTy))
1283 ResultEff = RetEffect::MakeOwned(RetEffect::CF, true);
1284 break;
1285 case OMF_autorelease:
1286 ReceiverEff = Autorelease;
1287 break;
1288 case OMF_retain:
1289 ReceiverEff = IncRefMsg;
1290 break;
1291 case OMF_release:
1292 ReceiverEff = DecRefMsg;
1293 break;
1294 case OMF_dealloc:
1295 ReceiverEff = Dealloc;
1296 break;
1297 case OMF_self:
1298 // -self is handled specially by the ExprEngine to propagate the receiver.
1299 break;
1300 case OMF_retainCount:
1301 case OMF_finalize:
1302 // These methods don't return objects.
1303 break;
1304 }
Mike Stump1eb44332009-09-09 15:08:12 +00001305
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001306 // If one of the arguments in the selector has the keyword 'delegate' we
1307 // should stop tracking the reference count for the receiver. This is
1308 // because the reference count is quite possibly handled by a delegate
1309 // method.
1310 if (S.isKeywordSelector()) {
1311 const std::string &str = S.getAsString();
1312 assert(!str.empty());
Benjamin Kramere45c1492010-01-11 19:46:28 +00001313 if (StrInStrNoCase(str, "delegate:") != StringRef::npos)
1314 ReceiverEff = StopTracking;
Ted Kremenek8ee885b2009-04-24 21:56:17 +00001315 }
Mike Stump1eb44332009-09-09 15:08:12 +00001316
Jordy Rosee921b1a2012-03-17 19:53:04 +00001317 if (ScratchArgs.isEmpty() && ReceiverEff == DoNothing &&
1318 ResultEff.getKind() == RetEffect::NoRet)
Ted Kremenek93edbc52011-10-05 23:54:29 +00001319 return getDefaultSummary();
Mike Stump1eb44332009-09-09 15:08:12 +00001320
Jordy Rosee921b1a2012-03-17 19:53:04 +00001321 return getPersistentSummary(ResultEff, ReceiverEff, MayEscape);
Ted Kremenek250b1fa2009-04-23 23:08:22 +00001322}
1323
Ted Kremenek93edbc52011-10-05 23:54:29 +00001324const RetainSummary *
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001325RetainSummaryManager::getInstanceMethodSummary(const ObjCMessage &msg,
Ted Kremenek8bef8232012-01-26 21:29:00 +00001326 ProgramStateRef state,
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001327 const LocationContext *LC) {
1328
1329 // We need the type-information of the tracked receiver object
1330 // Retrieve it from the state.
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001331 const Expr *Receiver = msg.getInstanceReceiver();
Ted Kremenek9c378f72011-08-12 23:37:29 +00001332 const ObjCInterfaceDecl *ID = 0;
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001333
1334 // FIXME: Is this really working as expected? There are cases where
1335 // we just use the 'ID' from the message expression.
Douglas Gregor04badcf2010-04-21 00:45:42 +00001336 SVal receiverV;
1337
Ted Kremenek8f326752010-05-21 21:56:53 +00001338 if (Receiver) {
Ted Kremenek5eca4822012-01-06 22:09:28 +00001339 receiverV = state->getSValAsScalarOrLoc(Receiver, LC);
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001340
Douglas Gregor04badcf2010-04-21 00:45:42 +00001341 // FIXME: Eventually replace the use of state->get<RefBindings> with
1342 // a generic API for reasoning about the Objective-C types of symbolic
1343 // objects.
1344 if (SymbolRef Sym = receiverV.getAsLocSymbol())
1345 if (const RefVal *T = state->get<RefBindings>(Sym))
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001346 if (const ObjCObjectPointerType* PT =
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001347 T->getType()->getAs<ObjCObjectPointerType>())
Douglas Gregor04badcf2010-04-21 00:45:42 +00001348 ID = PT->getInterfaceDecl();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00001349
Douglas Gregor04badcf2010-04-21 00:45:42 +00001350 // FIXME: this is a hack. This may or may not be the actual method
1351 // that is called.
1352 if (!ID) {
1353 if (const ObjCObjectPointerType *PT =
1354 Receiver->getType()->getAs<ObjCObjectPointerType>())
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001355 ID = PT->getInterfaceDecl();
Douglas Gregor04badcf2010-04-21 00:45:42 +00001356 }
1357 } else {
1358 // FIXME: Hack for 'super'.
Argyrios Kyrtzidis432424d2011-01-25 00:03:53 +00001359 ID = msg.getReceiverInterface();
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001360 }
Douglas Gregor04badcf2010-04-21 00:45:42 +00001361
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001362 // FIXME: The receiver could be a reference to a class, meaning that
1363 // we should use the class method.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001364 return getInstanceMethodSummary(msg, ID);
Ted Kremenekb7ddd9b2009-11-13 01:54:21 +00001365}
1366
Ted Kremenek93edbc52011-10-05 23:54:29 +00001367const RetainSummary *
Jordy Rosef3aae582012-03-17 21:13:07 +00001368RetainSummaryManager::getMethodSummary(Selector S, IdentifierInfo *ClsName,
1369 const ObjCInterfaceDecl *ID,
1370 const ObjCMethodDecl *MD, QualType RetTy,
1371 ObjCMethodSummariesTy &CachedSummaries) {
Ted Kremenek1bffd742008-05-06 15:44:25 +00001372
Ted Kremenek8711c032009-04-29 05:04:30 +00001373 // Look up a summary in our summary cache.
Jordy Rosef3aae582012-03-17 21:13:07 +00001374 const RetainSummary *Summ = CachedSummaries.find(ID, ClsName, S);
Mike Stump1eb44332009-09-09 15:08:12 +00001375
Ted Kremenek614cc542009-07-21 23:27:57 +00001376 if (!Summ) {
Jordy Rosef3aae582012-03-17 21:13:07 +00001377 Summ = getStandardMethodSummary(MD, S, RetTy);
Mike Stump1eb44332009-09-09 15:08:12 +00001378
Ted Kremenek614cc542009-07-21 23:27:57 +00001379 // Annotations override defaults.
Jordy Rose4df54fe2011-08-23 04:27:15 +00001380 updateSummaryFromAnnotations(Summ, MD);
Mike Stump1eb44332009-09-09 15:08:12 +00001381
Ted Kremenek614cc542009-07-21 23:27:57 +00001382 // Memoize the summary.
Jordy Rosef3aae582012-03-17 21:13:07 +00001383 CachedSummaries[ObjCSummaryKey(ID, ClsName, S)] = Summ;
Ted Kremenek614cc542009-07-21 23:27:57 +00001384 }
Mike Stump1eb44332009-09-09 15:08:12 +00001385
Ted Kremeneke87450e2009-04-23 19:11:35 +00001386 return Summ;
Ted Kremenekc8395602008-05-06 21:26:51 +00001387}
1388
Mike Stump1eb44332009-09-09 15:08:12 +00001389void RetainSummaryManager::InitializeClassMethodSummaries() {
Ted Kremenekec315332009-05-07 23:40:42 +00001390 assert(ScratchArgs.isEmpty());
Mike Stump1eb44332009-09-09 15:08:12 +00001391 // Create the [NSAssertionHandler currentHander] summary.
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001392 addClassMethSummary("NSAssertionHandler", "currentHandler",
Ted Kremenek2d1652e2009-01-28 05:56:51 +00001393 getPersistentSummary(RetEffect::MakeNotOwned(RetEffect::ObjC)));
Mike Stump1eb44332009-09-09 15:08:12 +00001394
Ted Kremenek6d348932008-10-21 15:53:15 +00001395 // Create the [NSAutoreleasePool addObject:] summary.
Ted Kremenek3baf6722010-11-24 00:54:37 +00001396 ScratchArgs = AF.add(ScratchArgs, 0, Autorelease);
Ted Kremenek6fe2b7a2009-10-15 22:25:12 +00001397 addClassMethSummary("NSAutoreleasePool", "addObject",
1398 getPersistentSummary(RetEffect::MakeNoRet(),
1399 DoNothing, Autorelease));
Mike Stump1eb44332009-09-09 15:08:12 +00001400
Ted Kremenekde4d5332009-04-24 17:50:11 +00001401 // Create the summaries for [NSObject performSelector...]. We treat
1402 // these as 'stop tracking' for the arguments because they are often
1403 // used for delegates that can release the object. When we have better
1404 // inter-procedural analysis we can potentially do something better. This
1405 // workaround is to remove false positives.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001406 const RetainSummary *Summ =
Ted Kremenek012614e2011-08-17 21:04:19 +00001407 getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, StopTracking);
Ted Kremenekde4d5332009-04-24 17:50:11 +00001408 IdentifierInfo *NSObjectII = &Ctx.Idents.get("NSObject");
1409 addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject",
1410 "afterDelay", NULL);
1411 addClsMethSummary(NSObjectII, Summ, "performSelector", "withObject",
1412 "afterDelay", "inModes", NULL);
1413 addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread",
1414 "withObject", "waitUntilDone", NULL);
1415 addClsMethSummary(NSObjectII, Summ, "performSelectorOnMainThread",
1416 "withObject", "waitUntilDone", "modes", NULL);
1417 addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread",
1418 "withObject", "waitUntilDone", NULL);
1419 addClsMethSummary(NSObjectII, Summ, "performSelector", "onThread",
1420 "withObject", "waitUntilDone", "modes", NULL);
1421 addClsMethSummary(NSObjectII, Summ, "performSelectorInBackground",
1422 "withObject", NULL);
Ted Kremenek9c32d082008-05-06 00:30:21 +00001423}
1424
Ted Kremenek1f180c32008-06-23 22:21:20 +00001425void RetainSummaryManager::InitializeMethodSummaries() {
Mike Stump1eb44332009-09-09 15:08:12 +00001426
1427 assert (ScratchArgs.isEmpty());
1428
Ted Kremenekc8395602008-05-06 21:26:51 +00001429 // Create the "init" selector. It just acts as a pass-through for the
1430 // receiver.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001431 const RetainSummary *InitSumm = getPersistentSummary(ObjCInitRetE, DecRefMsg);
Ted Kremenekac02f202009-08-20 05:13:36 +00001432 addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
1433
1434 // awakeAfterUsingCoder: behaves basically like an 'init' method. It
1435 // claims the receiver and returns a retained object.
1436 addNSObjectMethSummary(GetUnarySelector("awakeAfterUsingCoder", Ctx),
1437 InitSumm);
Mike Stump1eb44332009-09-09 15:08:12 +00001438
Ted Kremenekc8395602008-05-06 21:26:51 +00001439 // The next methods are allocators.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001440 const RetainSummary *AllocSumm = getPersistentSummary(ObjCAllocRetE);
1441 const RetainSummary *CFAllocSumm =
Ted Kremeneka834fb42009-08-28 19:52:12 +00001442 getPersistentSummary(RetEffect::MakeOwned(RetEffect::CF, true));
Mike Stump1eb44332009-09-09 15:08:12 +00001443
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001444 // Create the "retain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001445 RetEffect NoRet = RetEffect::MakeNoRet();
Ted Kremenek93edbc52011-10-05 23:54:29 +00001446 const RetainSummary *Summ = getPersistentSummary(NoRet, IncRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001447 addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001448
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001449 // Create the "release" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001450 Summ = getPersistentSummary(NoRet, DecRefMsg);
Ted Kremenek553cf182008-06-25 21:21:56 +00001451 addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001452
Ted Kremenek299e8152008-05-07 21:17:39 +00001453 // Create the "drain" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001454 Summ = getPersistentSummary(NoRet, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001455 addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001456
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001457 // Create the -dealloc summary.
Jordy Rose500abad2011-08-21 19:41:36 +00001458 Summ = getPersistentSummary(NoRet, Dealloc);
Ted Kremenekf95e9fc2009-03-17 19:42:23 +00001459 addNSObjectMethSummary(GetNullarySelector("dealloc", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001460
1461 // Create the "autorelease" selector.
Jordy Rose500abad2011-08-21 19:41:36 +00001462 Summ = getPersistentSummary(NoRet, Autorelease);
Ted Kremenek553cf182008-06-25 21:21:56 +00001463 addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
Mike Stump1eb44332009-09-09 15:08:12 +00001464
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001465 // Specially handle NSAutoreleasePool.
Ted Kremenek6c4becb2009-02-25 02:54:57 +00001466 addInstMethSummary("NSAutoreleasePool", "init",
Jordy Rose500abad2011-08-21 19:41:36 +00001467 getPersistentSummary(NoRet, NewAutoreleasePool));
Mike Stump1eb44332009-09-09 15:08:12 +00001468
1469 // For NSWindow, allocated objects are (initially) self-owned.
Ted Kremenek89e202d2009-02-23 02:51:29 +00001470 // FIXME: For now we opt for false negatives with NSWindow, as these objects
1471 // self-own themselves. However, they only do this once they are displayed.
1472 // Thus, we need to track an NSWindow's display status.
1473 // This is tracked in <rdar://problem/6062711>.
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001474 // See also http://llvm.org/bugs/show_bug.cgi?id=3714.
Ted Kremenek93edbc52011-10-05 23:54:29 +00001475 const RetainSummary *NoTrackYet = getPersistentSummary(RetEffect::MakeNoRet(),
Ted Kremenek78a35a32009-05-12 20:06:54 +00001476 StopTracking,
1477 StopTracking);
Mike Stump1eb44332009-09-09 15:08:12 +00001478
Ted Kremenek99d02692009-04-03 19:02:51 +00001479 addClassMethSummary("NSWindow", "alloc", NoTrackYet);
1480
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001481#if 0
Ted Kremenek78a35a32009-05-12 20:06:54 +00001482 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001483 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001484
Ted Kremenek78a35a32009-05-12 20:06:54 +00001485 addInstMethSummary("NSWindow", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001486 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek3aa7ecd2009-03-04 23:30:42 +00001487#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001488
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001489 // For NSPanel (which subclasses NSWindow), allocated objects are not
1490 // self-owned.
Ted Kremenek99d02692009-04-03 19:02:51 +00001491 // FIXME: For now we don't track NSPanels. object for the same reason
1492 // as for NSWindow objects.
1493 addClassMethSummary("NSPanel", "alloc", NoTrackYet);
Mike Stump1eb44332009-09-09 15:08:12 +00001494
Ted Kremenek78a35a32009-05-12 20:06:54 +00001495#if 0
1496 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001497 "styleMask", "backing", "defer", NULL);
Mike Stump1eb44332009-09-09 15:08:12 +00001498
Ted Kremenek78a35a32009-05-12 20:06:54 +00001499 addInstMethSummary("NSPanel", NoTrackYet, "initWithContentRect",
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001500 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek78a35a32009-05-12 20:06:54 +00001501#endif
Mike Stump1eb44332009-09-09 15:08:12 +00001502
Ted Kremenekba67f6a2009-05-18 23:14:34 +00001503 // Don't track allocated autorelease pools yet, as it is okay to prematurely
1504 // exit a method.
1505 addClassMethSummary("NSAutoreleasePool", "alloc", NoTrackYet);
Ted Kremeneka9797122012-02-18 21:37:48 +00001506 addClassMethSummary("NSAutoreleasePool", "allocWithZone", NoTrackYet, false);
Ted Kremenek553cf182008-06-25 21:21:56 +00001507
Ted Kremenek767d6492009-05-20 22:39:57 +00001508 // Create summaries QCRenderer/QCView -createSnapShotImageOfType:
1509 addInstMethSummary("QCRenderer", AllocSumm,
1510 "createSnapshotImageOfType", NULL);
1511 addInstMethSummary("QCView", AllocSumm,
1512 "createSnapshotImageOfType", NULL);
1513
Ted Kremenek211a9c62009-06-15 20:58:58 +00001514 // Create summaries for CIContext, 'createCGImage' and
Ted Kremeneka834fb42009-08-28 19:52:12 +00001515 // 'createCGLayerWithSize'. These objects are CF objects, and are not
1516 // automatically garbage collected.
1517 addInstMethSummary("CIContext", CFAllocSumm,
Ted Kremenek767d6492009-05-20 22:39:57 +00001518 "createCGImage", "fromRect", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001519 addInstMethSummary("CIContext", CFAllocSumm,
Mike Stump1eb44332009-09-09 15:08:12 +00001520 "createCGImage", "fromRect", "format", "colorSpace", NULL);
Ted Kremeneka834fb42009-08-28 19:52:12 +00001521 addInstMethSummary("CIContext", CFAllocSumm, "createCGLayerWithSize",
Ted Kremenek211a9c62009-06-15 20:58:58 +00001522 "info", NULL);
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001523}
1524
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001525//===----------------------------------------------------------------------===//
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001526// AutoreleaseBindings - State used to track objects in autorelease pools.
Ted Kremenek6d348932008-10-21 15:53:15 +00001527//===----------------------------------------------------------------------===//
1528
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001529typedef llvm::ImmutableMap<SymbolRef, unsigned> ARCounts;
1530typedef llvm::ImmutableMap<SymbolRef, ARCounts> ARPoolContents;
1531typedef llvm::ImmutableList<SymbolRef> ARStack;
Ted Kremenekf9a8e2e2009-02-23 17:45:03 +00001532
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001533static int AutoRCIndex = 0;
Ted Kremenek6d348932008-10-21 15:53:15 +00001534static int AutoRBIndex = 0;
1535
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001536namespace { class AutoreleasePoolContents {}; }
1537namespace { class AutoreleaseStack {}; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001538
Ted Kremenek6d348932008-10-21 15:53:15 +00001539namespace clang {
Ted Kremenek9ef65372010-12-23 07:20:52 +00001540namespace ento {
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001541template<> struct ProgramStateTrait<AutoreleaseStack>
1542 : public ProgramStatePartialTrait<ARStack> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001543 static inline void *GDMIndex() { return &AutoRBIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001544};
1545
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001546template<> struct ProgramStateTrait<AutoreleasePoolContents>
1547 : public ProgramStatePartialTrait<ARPoolContents> {
Ted Kremenek9c378f72011-08-12 23:37:29 +00001548 static inline void *GDMIndex() { return &AutoRCIndex; }
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001549};
Argyrios Kyrtzidis5a4f98f2010-12-22 18:53:20 +00001550} // end GR namespace
Ted Kremenek4d3957d2009-02-24 19:15:11 +00001551} // end clang namespace
Ted Kremenek6d348932008-10-21 15:53:15 +00001552
Ted Kremenek8bef8232012-01-26 21:29:00 +00001553static SymbolRef GetCurrentAutoreleasePool(ProgramStateRef state) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001554 ARStack stack = state->get<AutoreleaseStack>();
1555 return stack.isEmpty() ? SymbolRef() : stack.getHead();
1556}
1557
Ted Kremenek8bef8232012-01-26 21:29:00 +00001558static ProgramStateRef
1559SendAutorelease(ProgramStateRef state,
Ted Kremenek18c66fd2011-08-15 22:09:50 +00001560 ARCounts::Factory &F,
1561 SymbolRef sym) {
Ted Kremenek7037ab82009-03-20 17:34:15 +00001562 SymbolRef pool = GetCurrentAutoreleasePool(state);
Ted Kremenekb65be702009-06-18 01:23:53 +00001563 const ARCounts *cnts = state->get<AutoreleasePoolContents>(pool);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001564 ARCounts newCnts(0);
Mike Stump1eb44332009-09-09 15:08:12 +00001565
Ted Kremenek7037ab82009-03-20 17:34:15 +00001566 if (cnts) {
1567 const unsigned *cnt = (*cnts).lookup(sym);
Ted Kremenek3baf6722010-11-24 00:54:37 +00001568 newCnts = F.add(*cnts, sym, cnt ? *cnt + 1 : 1);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001569 }
1570 else
Ted Kremenek3baf6722010-11-24 00:54:37 +00001571 newCnts = F.add(F.getEmptyMap(), sym, 1);
Mike Stump1eb44332009-09-09 15:08:12 +00001572
Ted Kremenekb65be702009-06-18 01:23:53 +00001573 return state->set<AutoreleasePoolContents>(pool, newCnts);
Ted Kremenek7037ab82009-03-20 17:34:15 +00001574}
1575
Ted Kremenek13922612008-04-16 20:40:59 +00001576//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001577// Error reporting.
1578//===----------------------------------------------------------------------===//
Ted Kremenekc887d132009-04-29 18:50:19 +00001579namespace {
Jordy Roseec9ef852011-08-23 20:55:48 +00001580 typedef llvm::DenseMap<const ExplodedNode *, const RetainSummary *>
1581 SummaryLogTy;
1582
Ted Kremenekc887d132009-04-29 18:50:19 +00001583 //===-------------===//
1584 // Bug Descriptions. //
Mike Stump1eb44332009-09-09 15:08:12 +00001585 //===-------------===//
1586
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001587 class CFRefBug : public BugType {
Ted Kremenekc887d132009-04-29 18:50:19 +00001588 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001589 CFRefBug(StringRef name)
1590 : BugType(name, "Memory (Core Foundation/Objective-C)") {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001591 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001592
Ted Kremenekc887d132009-04-29 18:50:19 +00001593 // FIXME: Eventually remove.
Jordy Rose35c86952011-08-24 05:47:39 +00001594 virtual const char *getDescription() const = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001595
Ted Kremenekc887d132009-04-29 18:50:19 +00001596 virtual bool isLeak() const { return false; }
1597 };
Mike Stump1eb44332009-09-09 15:08:12 +00001598
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001599 class UseAfterRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001600 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001601 UseAfterRelease() : CFRefBug("Use-after-release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001602
Jordy Rose35c86952011-08-24 05:47:39 +00001603 const char *getDescription() const {
Ted Kremenekc887d132009-04-29 18:50:19 +00001604 return "Reference-counted object is used after it is released";
Mike Stump1eb44332009-09-09 15:08:12 +00001605 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001606 };
Mike Stump1eb44332009-09-09 15:08:12 +00001607
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001608 class BadRelease : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001609 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001610 BadRelease() : CFRefBug("Bad release") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001611
Jordy Rose35c86952011-08-24 05:47:39 +00001612 const char *getDescription() const {
Ted Kremenekbb206fd2009-10-01 17:31:50 +00001613 return "Incorrect decrement of the reference count of an object that is "
1614 "not owned at this point by the caller";
Ted Kremenekc887d132009-04-29 18:50:19 +00001615 }
1616 };
Mike Stump1eb44332009-09-09 15:08:12 +00001617
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001618 class DeallocGC : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001619 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001620 DeallocGC()
1621 : CFRefBug("-dealloc called while using garbage collection") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001622
Ted Kremenekc887d132009-04-29 18:50:19 +00001623 const char *getDescription() const {
Ted Kremenek369de562009-05-09 00:10:05 +00001624 return "-dealloc called while using garbage collection";
Ted Kremenekc887d132009-04-29 18:50:19 +00001625 }
1626 };
Mike Stump1eb44332009-09-09 15:08:12 +00001627
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001628 class DeallocNotOwned : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001629 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001630 DeallocNotOwned()
1631 : CFRefBug("-dealloc sent to non-exclusively owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001632
Ted Kremenekc887d132009-04-29 18:50:19 +00001633 const char *getDescription() const {
1634 return "-dealloc sent to object that may be referenced elsewhere";
1635 }
Mike Stump1eb44332009-09-09 15:08:12 +00001636 };
1637
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001638 class OverAutorelease : public CFRefBug {
Ted Kremenek369de562009-05-09 00:10:05 +00001639 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001640 OverAutorelease()
1641 : CFRefBug("Object sent -autorelease too many times") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001642
Ted Kremenek369de562009-05-09 00:10:05 +00001643 const char *getDescription() const {
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001644 return "Object sent -autorelease too many times";
Ted Kremenek369de562009-05-09 00:10:05 +00001645 }
1646 };
Mike Stump1eb44332009-09-09 15:08:12 +00001647
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001648 class ReturnedNotOwnedForOwned : public CFRefBug {
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001649 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001650 ReturnedNotOwnedForOwned()
1651 : CFRefBug("Method should return an owned object") {}
Mike Stump1eb44332009-09-09 15:08:12 +00001652
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001653 const char *getDescription() const {
Jordy Rose5b5402b2011-07-15 22:17:54 +00001654 return "Object with a +0 retain count returned to caller where a +1 "
Ted Kremeneke8720ce2009-05-10 06:25:57 +00001655 "(owning) retain count is expected";
1656 }
1657 };
Mike Stump1eb44332009-09-09 15:08:12 +00001658
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001659 class Leak : public CFRefBug {
Ted Kremenekc887d132009-04-29 18:50:19 +00001660 const bool isReturn;
1661 protected:
Jordy Rose35c86952011-08-24 05:47:39 +00001662 Leak(StringRef name, bool isRet)
Jordy Rosedb92bb62011-08-25 01:14:38 +00001663 : CFRefBug(name), isReturn(isRet) {
1664 // Leaks should not be reported if they are post-dominated by a sink.
1665 setSuppressOnSink(true);
1666 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001667 public:
Mike Stump1eb44332009-09-09 15:08:12 +00001668
Jordy Rose35c86952011-08-24 05:47:39 +00001669 const char *getDescription() const { return ""; }
Mike Stump1eb44332009-09-09 15:08:12 +00001670
Ted Kremenekc887d132009-04-29 18:50:19 +00001671 bool isLeak() const { return true; }
1672 };
Mike Stump1eb44332009-09-09 15:08:12 +00001673
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001674 class LeakAtReturn : public Leak {
Ted Kremenekc887d132009-04-29 18:50:19 +00001675 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001676 LeakAtReturn(StringRef name)
1677 : Leak(name, true) {}
Ted Kremenekc887d132009-04-29 18:50:19 +00001678 };
Mike Stump1eb44332009-09-09 15:08:12 +00001679
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001680 class LeakWithinFunction : public Leak {
Ted Kremenekc887d132009-04-29 18:50:19 +00001681 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001682 LeakWithinFunction(StringRef name)
1683 : Leak(name, false) {}
Mike Stump1eb44332009-09-09 15:08:12 +00001684 };
1685
Ted Kremenekc887d132009-04-29 18:50:19 +00001686 //===---------===//
1687 // Bug Reports. //
1688 //===---------===//
Mike Stump1eb44332009-09-09 15:08:12 +00001689
Anna Zaksdc757b02011-08-19 23:21:56 +00001690 class CFRefReportVisitor : public BugReporterVisitor {
Anna Zaks23f395e2011-08-20 01:27:22 +00001691 protected:
Anna Zaksdc757b02011-08-19 23:21:56 +00001692 SymbolRef Sym;
Jordy Roseec9ef852011-08-23 20:55:48 +00001693 const SummaryLogTy &SummaryLog;
Jordy Rose35c86952011-08-24 05:47:39 +00001694 bool GCEnabled;
Anna Zaks23f395e2011-08-20 01:27:22 +00001695
Anna Zaksdc757b02011-08-19 23:21:56 +00001696 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001697 CFRefReportVisitor(SymbolRef sym, bool gcEnabled, const SummaryLogTy &log)
1698 : Sym(sym), SummaryLog(log), GCEnabled(gcEnabled) {}
Anna Zaksdc757b02011-08-19 23:21:56 +00001699
Anna Zaks23f395e2011-08-20 01:27:22 +00001700 virtual void Profile(llvm::FoldingSetNodeID &ID) const {
Anna Zaksdc757b02011-08-19 23:21:56 +00001701 static int x = 0;
1702 ID.AddPointer(&x);
1703 ID.AddPointer(Sym);
1704 }
1705
Anna Zaks23f395e2011-08-20 01:27:22 +00001706 virtual PathDiagnosticPiece *VisitNode(const ExplodedNode *N,
1707 const ExplodedNode *PrevN,
1708 BugReporterContext &BRC,
1709 BugReport &BR);
1710
1711 virtual PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1712 const ExplodedNode *N,
1713 BugReport &BR);
1714 };
1715
1716 class CFRefLeakReportVisitor : public CFRefReportVisitor {
1717 public:
Jordy Rose35c86952011-08-24 05:47:39 +00001718 CFRefLeakReportVisitor(SymbolRef sym, bool GCEnabled,
Jordy Roseec9ef852011-08-23 20:55:48 +00001719 const SummaryLogTy &log)
Jordy Rose35c86952011-08-24 05:47:39 +00001720 : CFRefReportVisitor(sym, GCEnabled, log) {}
Anna Zaks23f395e2011-08-20 01:27:22 +00001721
1722 PathDiagnosticPiece *getEndPath(BugReporterContext &BRC,
1723 const ExplodedNode *N,
1724 BugReport &BR);
Anna Zaksdc757b02011-08-19 23:21:56 +00001725 };
1726
Anna Zakse172e8b2011-08-17 23:00:25 +00001727 class CFRefReport : public BugReport {
Jordy Rose20589562011-08-24 22:39:09 +00001728 void addGCModeDescription(const LangOptions &LOpts, bool GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001729
Ted Kremenekc887d132009-04-29 18:50:19 +00001730 public:
Jordy Rose20589562011-08-24 22:39:09 +00001731 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1732 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1733 bool registerVisitor = true)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001734 : BugReport(D, D.getDescription(), n) {
Anna Zaks23f395e2011-08-20 01:27:22 +00001735 if (registerVisitor)
Jordy Rose20589562011-08-24 22:39:09 +00001736 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1737 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001738 }
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001739
Jordy Rose20589562011-08-24 22:39:09 +00001740 CFRefReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1741 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
1742 StringRef endText)
Anna Zaksedf4dae2011-08-22 18:54:07 +00001743 : BugReport(D, D.getDescription(), endText, n) {
Jordy Rose20589562011-08-24 22:39:09 +00001744 addVisitor(new CFRefReportVisitor(sym, GCEnabled, Log));
1745 addGCModeDescription(LOpts, GCEnabled);
Anna Zaksdc757b02011-08-19 23:21:56 +00001746 }
Mike Stump1eb44332009-09-09 15:08:12 +00001747
Anna Zakse172e8b2011-08-17 23:00:25 +00001748 virtual std::pair<ranges_iterator, ranges_iterator> getRanges() {
Anna Zaksedf4dae2011-08-22 18:54:07 +00001749 const CFRefBug& BugTy = static_cast<CFRefBug&>(getBugType());
1750 if (!BugTy.isLeak())
Anna Zakse172e8b2011-08-17 23:00:25 +00001751 return BugReport::getRanges();
Ted Kremenekc887d132009-04-29 18:50:19 +00001752 else
Argyrios Kyrtzidis640ccf02010-12-04 01:12:15 +00001753 return std::make_pair(ranges_iterator(), ranges_iterator());
Ted Kremenekc887d132009-04-29 18:50:19 +00001754 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001755 };
Ted Kremenekeaedfea2009-05-10 05:11:21 +00001756
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00001757 class CFRefLeakReport : public CFRefReport {
Ted Kremenekc887d132009-04-29 18:50:19 +00001758 const MemRegion* AllocBinding;
Anna Zaks23f395e2011-08-20 01:27:22 +00001759
Ted Kremenekc887d132009-04-29 18:50:19 +00001760 public:
Jordy Rose20589562011-08-24 22:39:09 +00001761 CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts, bool GCEnabled,
1762 const SummaryLogTy &Log, ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00001763 CheckerContext &Ctx);
Mike Stump1eb44332009-09-09 15:08:12 +00001764
Anna Zaks590dd8e2011-09-20 21:38:35 +00001765 PathDiagnosticLocation getLocation(const SourceManager &SM) const {
1766 assert(Location.isValid());
1767 return Location;
1768 }
Mike Stump1eb44332009-09-09 15:08:12 +00001769 };
Ted Kremenekc887d132009-04-29 18:50:19 +00001770} // end anonymous namespace
1771
Jordy Rose20589562011-08-24 22:39:09 +00001772void CFRefReport::addGCModeDescription(const LangOptions &LOpts,
1773 bool GCEnabled) {
Jordy Rosef95b19d2011-08-24 20:38:42 +00001774 const char *GCModeDescription = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001775
Douglas Gregore289d812011-09-13 17:21:33 +00001776 switch (LOpts.getGC()) {
Anna Zaks7f2531c2011-08-22 20:31:28 +00001777 case LangOptions::GCOnly:
Jordy Rose20589562011-08-24 22:39:09 +00001778 assert(GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001779 GCModeDescription = "Code is compiled to only use garbage collection";
1780 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001781
Anna Zaks7f2531c2011-08-22 20:31:28 +00001782 case LangOptions::NonGC:
Jordy Rose20589562011-08-24 22:39:09 +00001783 assert(!GCEnabled);
Jordy Rose35c86952011-08-24 05:47:39 +00001784 GCModeDescription = "Code is compiled to use reference counts";
1785 break;
Mike Stump1eb44332009-09-09 15:08:12 +00001786
Anna Zaks7f2531c2011-08-22 20:31:28 +00001787 case LangOptions::HybridGC:
Jordy Rose20589562011-08-24 22:39:09 +00001788 if (GCEnabled) {
Jordy Rose35c86952011-08-24 05:47:39 +00001789 GCModeDescription = "Code is compiled to use either garbage collection "
1790 "(GC) or reference counts (non-GC). The bug occurs "
1791 "with GC enabled";
1792 break;
1793 } else {
1794 GCModeDescription = "Code is compiled to use either garbage collection "
1795 "(GC) or reference counts (non-GC). The bug occurs "
1796 "in non-GC mode";
1797 break;
Anna Zaks7f2531c2011-08-22 20:31:28 +00001798 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001799 }
Jordy Rose35c86952011-08-24 05:47:39 +00001800
Jordy Rosef95b19d2011-08-24 20:38:42 +00001801 assert(GCModeDescription && "invalid/unknown GC mode");
Jordy Rose35c86952011-08-24 05:47:39 +00001802 addExtraText(GCModeDescription);
Ted Kremenekc887d132009-04-29 18:50:19 +00001803}
1804
Jordy Rose910c4052011-09-02 06:44:22 +00001805// FIXME: This should be a method on SmallVector.
Chris Lattner5f9e2722011-07-23 10:55:15 +00001806static inline bool contains(const SmallVectorImpl<ArgEffect>& V,
Ted Kremenekc887d132009-04-29 18:50:19 +00001807 ArgEffect X) {
Chris Lattner5f9e2722011-07-23 10:55:15 +00001808 for (SmallVectorImpl<ArgEffect>::const_iterator I=V.begin(), E=V.end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001809 I!=E; ++I)
1810 if (*I == X) return true;
Mike Stump1eb44332009-09-09 15:08:12 +00001811
Ted Kremenekc887d132009-04-29 18:50:19 +00001812 return false;
1813}
1814
Ted Kremenek4c42bb72011-11-14 21:59:21 +00001815static bool isPropertyAccess(const Stmt *S, ParentMap &PM) {
1816 unsigned maxDepth = 4;
1817 while (S && maxDepth) {
1818 if (const PseudoObjectExpr *PO = dyn_cast<PseudoObjectExpr>(S)) {
1819 if (!isa<ObjCMessageExpr>(PO->getSyntacticForm()))
1820 return true;
1821 return false;
1822 }
1823 S = PM.getParent(S);
1824 --maxDepth;
1825 }
1826 return false;
1827}
1828
Anna Zaksdc757b02011-08-19 23:21:56 +00001829PathDiagnosticPiece *CFRefReportVisitor::VisitNode(const ExplodedNode *N,
1830 const ExplodedNode *PrevN,
1831 BugReporterContext &BRC,
1832 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00001833
Jordy Rosef53e8c72011-08-23 19:43:16 +00001834 if (!isa<StmtPoint>(N->getLocation()))
Ted Kremenek2033a952009-05-13 07:12:33 +00001835 return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001836
Ted Kremenek8966bc12009-05-06 21:39:49 +00001837 // Check if the type state has changed.
Ted Kremenek8bef8232012-01-26 21:29:00 +00001838 ProgramStateRef PrevSt = PrevN->getState();
1839 ProgramStateRef CurrSt = N->getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001840 const LocationContext *LCtx = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00001841
1842 const RefVal* CurrT = CurrSt->get<RefBindings>(Sym);
Ted Kremenekc887d132009-04-29 18:50:19 +00001843 if (!CurrT) return NULL;
Mike Stump1eb44332009-09-09 15:08:12 +00001844
Ted Kremenekb65be702009-06-18 01:23:53 +00001845 const RefVal &CurrV = *CurrT;
1846 const RefVal *PrevT = PrevSt->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00001847
Ted Kremenekc887d132009-04-29 18:50:19 +00001848 // Create a string buffer to constain all the useful things we want
1849 // to tell the user.
1850 std::string sbuf;
1851 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00001852
Ted Kremenekc887d132009-04-29 18:50:19 +00001853 // This is the allocation site since the previous node had no bindings
1854 // for this symbol.
1855 if (!PrevT) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00001856 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001857
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001858 if (isa<ObjCArrayLiteral>(S)) {
1859 os << "NSArray literal is an object with a +0 retain count";
Mike Stump1eb44332009-09-09 15:08:12 +00001860 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001861 else if (isa<ObjCDictionaryLiteral>(S)) {
1862 os << "NSDictionary literal is an object with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00001863 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001864 else {
1865 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
1866 // Get the name of the callee (if it is available).
1867 SVal X = CurrSt->getSValAsScalarOrLoc(CE->getCallee(), LCtx);
1868 if (const FunctionDecl *FD = X.getAsFunctionDecl())
1869 os << "Call to function '" << *FD << '\'';
1870 else
1871 os << "function call";
Ted Kremenekc887d132009-04-29 18:50:19 +00001872 }
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00001873 else {
1874 assert(isa<ObjCMessageExpr>(S));
1875 // The message expression may have between written directly or as
1876 // a property access. Lazily determine which case we are looking at.
1877 os << (isPropertyAccess(S, N->getParentMap()) ? "Property" : "Method");
1878 }
1879
1880 if (CurrV.getObjKind() == RetEffect::CF) {
1881 os << " returns a Core Foundation object with a ";
1882 }
1883 else {
1884 assert (CurrV.getObjKind() == RetEffect::ObjC);
1885 os << " returns an Objective-C object with a ";
1886 }
1887
1888 if (CurrV.isOwned()) {
1889 os << "+1 retain count";
1890
1891 if (GCEnabled) {
1892 assert(CurrV.getObjKind() == RetEffect::CF);
1893 os << ". "
1894 "Core Foundation objects are not automatically garbage collected.";
1895 }
1896 }
1897 else {
1898 assert (CurrV.isNotOwned());
1899 os << "+0 retain count";
1900 }
Ted Kremenekc887d132009-04-29 18:50:19 +00001901 }
Mike Stump1eb44332009-09-09 15:08:12 +00001902
Anna Zaks220ac8c2011-09-15 01:08:34 +00001903 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
1904 N->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00001905 return new PathDiagnosticEventPiece(Pos, os.str());
1906 }
Mike Stump1eb44332009-09-09 15:08:12 +00001907
Ted Kremenekc887d132009-04-29 18:50:19 +00001908 // Gather up the effects that were performed on the object at this
1909 // program point
Chris Lattner5f9e2722011-07-23 10:55:15 +00001910 SmallVector<ArgEffect, 2> AEffects;
Mike Stump1eb44332009-09-09 15:08:12 +00001911
Jordy Roseec9ef852011-08-23 20:55:48 +00001912 const ExplodedNode *OrigNode = BRC.getNodeResolver().getOriginalNode(N);
1913 if (const RetainSummary *Summ = SummaryLog.lookup(OrigNode)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001914 // We only have summaries attached to nodes after evaluating CallExpr and
1915 // ObjCMessageExprs.
Jordy Rosef53e8c72011-08-23 19:43:16 +00001916 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Mike Stump1eb44332009-09-09 15:08:12 +00001917
Ted Kremenek5f85e172009-07-22 22:35:28 +00001918 if (const CallExpr *CE = dyn_cast<CallExpr>(S)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001919 // Iterate through the parameter expressions and see if the symbol
1920 // was ever passed as an argument.
1921 unsigned i = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00001922
Ted Kremenek5f85e172009-07-22 22:35:28 +00001923 for (CallExpr::const_arg_iterator AI=CE->arg_begin(), AE=CE->arg_end();
Ted Kremenekc887d132009-04-29 18:50:19 +00001924 AI!=AE; ++AI, ++i) {
Mike Stump1eb44332009-09-09 15:08:12 +00001925
Ted Kremenekc887d132009-04-29 18:50:19 +00001926 // Retrieve the value of the argument. Is it the symbol
1927 // we are interested in?
Ted Kremenek5eca4822012-01-06 22:09:28 +00001928 if (CurrSt->getSValAsScalarOrLoc(*AI, LCtx).getAsLocSymbol() != Sym)
Ted Kremenekc887d132009-04-29 18:50:19 +00001929 continue;
Mike Stump1eb44332009-09-09 15:08:12 +00001930
Ted Kremenekc887d132009-04-29 18:50:19 +00001931 // We have an argument. Get the effect!
1932 AEffects.push_back(Summ->getArg(i));
1933 }
1934 }
Mike Stump1eb44332009-09-09 15:08:12 +00001935 else if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(S)) {
Douglas Gregor04badcf2010-04-21 00:45:42 +00001936 if (const Expr *receiver = ME->getInstanceReceiver())
Ted Kremenek5eca4822012-01-06 22:09:28 +00001937 if (CurrSt->getSValAsScalarOrLoc(receiver, LCtx)
1938 .getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001939 // The symbol we are tracking is the receiver.
1940 AEffects.push_back(Summ->getReceiverEffect());
1941 }
1942 }
1943 }
Mike Stump1eb44332009-09-09 15:08:12 +00001944
Ted Kremenekc887d132009-04-29 18:50:19 +00001945 do {
1946 // Get the previous type state.
1947 RefVal PrevV = *PrevT;
Mike Stump1eb44332009-09-09 15:08:12 +00001948
Ted Kremenekc887d132009-04-29 18:50:19 +00001949 // Specially handle -dealloc.
Jordy Rose35c86952011-08-24 05:47:39 +00001950 if (!GCEnabled && contains(AEffects, Dealloc)) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001951 // Determine if the object's reference count was pushed to zero.
1952 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
1953 // We may not have transitioned to 'release' if we hit an error.
1954 // This case is handled elsewhere.
1955 if (CurrV.getKind() == RefVal::Released) {
Ted Kremenekf21332e2009-05-08 20:01:42 +00001956 assert(CurrV.getCombinedCounts() == 0);
Ted Kremenekc887d132009-04-29 18:50:19 +00001957 os << "Object released by directly sending the '-dealloc' message";
1958 break;
1959 }
1960 }
Mike Stump1eb44332009-09-09 15:08:12 +00001961
Ted Kremenekc887d132009-04-29 18:50:19 +00001962 // Specially handle CFMakeCollectable and friends.
1963 if (contains(AEffects, MakeCollectable)) {
1964 // Get the name of the function.
Jordy Rosef53e8c72011-08-23 19:43:16 +00001965 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Ted Kremenek5eca4822012-01-06 22:09:28 +00001966 SVal X =
1967 CurrSt->getSValAsScalarOrLoc(cast<CallExpr>(S)->getCallee(), LCtx);
Ted Kremenek9c378f72011-08-12 23:37:29 +00001968 const FunctionDecl *FD = X.getAsFunctionDecl();
Mike Stump1eb44332009-09-09 15:08:12 +00001969
Jordy Rose35c86952011-08-24 05:47:39 +00001970 if (GCEnabled) {
Ted Kremenekc887d132009-04-29 18:50:19 +00001971 // Determine if the object's reference count was pushed to zero.
1972 assert(!(PrevV == CurrV) && "The typestate *must* have changed.");
Mike Stump1eb44332009-09-09 15:08:12 +00001973
Benjamin Kramerb8989f22011-10-14 18:45:37 +00001974 os << "In GC mode a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00001975 << "' decrements an object's retain count and registers the "
1976 "object with the garbage collector. ";
Mike Stump1eb44332009-09-09 15:08:12 +00001977
Ted Kremenekc887d132009-04-29 18:50:19 +00001978 if (CurrV.getKind() == RefVal::Released) {
1979 assert(CurrV.getCount() == 0);
1980 os << "Since it now has a 0 retain count the object can be "
1981 "automatically collected by the garbage collector.";
1982 }
1983 else
1984 os << "An object must have a 0 retain count to be garbage collected. "
1985 "After this call its retain count is +" << CurrV.getCount()
1986 << '.';
1987 }
Mike Stump1eb44332009-09-09 15:08:12 +00001988 else
Benjamin Kramerb8989f22011-10-14 18:45:37 +00001989 os << "When GC is not enabled a call to '" << *FD
Ted Kremenekc887d132009-04-29 18:50:19 +00001990 << "' has no effect on its argument.";
Mike Stump1eb44332009-09-09 15:08:12 +00001991
Ted Kremenekc887d132009-04-29 18:50:19 +00001992 // Nothing more to say.
1993 break;
1994 }
Mike Stump1eb44332009-09-09 15:08:12 +00001995
1996 // Determine if the typestate has changed.
Ted Kremenekc887d132009-04-29 18:50:19 +00001997 if (!(PrevV == CurrV))
1998 switch (CurrV.getKind()) {
1999 case RefVal::Owned:
2000 case RefVal::NotOwned:
Mike Stump1eb44332009-09-09 15:08:12 +00002001
Ted Kremenekf21332e2009-05-08 20:01:42 +00002002 if (PrevV.getCount() == CurrV.getCount()) {
2003 // Did an autorelease message get sent?
2004 if (PrevV.getAutoreleaseCount() == CurrV.getAutoreleaseCount())
2005 return 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002006
Zhongxing Xu264e9372009-05-12 10:10:00 +00002007 assert(PrevV.getAutoreleaseCount() < CurrV.getAutoreleaseCount());
Ted Kremenekeaedfea2009-05-10 05:11:21 +00002008 os << "Object sent -autorelease message";
Ted Kremenekf21332e2009-05-08 20:01:42 +00002009 break;
2010 }
Mike Stump1eb44332009-09-09 15:08:12 +00002011
Ted Kremenekc887d132009-04-29 18:50:19 +00002012 if (PrevV.getCount() > CurrV.getCount())
2013 os << "Reference count decremented.";
2014 else
2015 os << "Reference count incremented.";
Mike Stump1eb44332009-09-09 15:08:12 +00002016
Ted Kremenekc887d132009-04-29 18:50:19 +00002017 if (unsigned Count = CurrV.getCount())
2018 os << " The object now has a +" << Count << " retain count.";
Mike Stump1eb44332009-09-09 15:08:12 +00002019
Ted Kremenekc887d132009-04-29 18:50:19 +00002020 if (PrevV.getKind() == RefVal::Released) {
Jordy Rose35c86952011-08-24 05:47:39 +00002021 assert(GCEnabled && CurrV.getCount() > 0);
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002022 os << " The object is not eligible for garbage collection until "
2023 "the retain count reaches 0 again.";
Ted Kremenekc887d132009-04-29 18:50:19 +00002024 }
Mike Stump1eb44332009-09-09 15:08:12 +00002025
Ted Kremenekc887d132009-04-29 18:50:19 +00002026 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002027
Ted Kremenekc887d132009-04-29 18:50:19 +00002028 case RefVal::Released:
2029 os << "Object released.";
2030 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002031
Ted Kremenekc887d132009-04-29 18:50:19 +00002032 case RefVal::ReturnedOwned:
Jordy Rose74b7b2b2012-03-17 05:49:15 +00002033 // Autoreleases can be applied after marking a node ReturnedOwned.
2034 if (CurrV.getAutoreleaseCount())
2035 return NULL;
2036
2037 os << "Object returned to caller as an owning reference (single "
2038 "retain count transferred to caller)";
Ted Kremenekc887d132009-04-29 18:50:19 +00002039 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002040
Ted Kremenekc887d132009-04-29 18:50:19 +00002041 case RefVal::ReturnedNotOwned:
Ted Kremenekf1365462011-05-26 18:45:44 +00002042 os << "Object returned to caller with a +0 retain count";
Ted Kremenekc887d132009-04-29 18:50:19 +00002043 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002044
Ted Kremenekc887d132009-04-29 18:50:19 +00002045 default:
2046 return NULL;
2047 }
Mike Stump1eb44332009-09-09 15:08:12 +00002048
Ted Kremenekc887d132009-04-29 18:50:19 +00002049 // Emit any remaining diagnostics for the argument effects (if any).
Chris Lattner5f9e2722011-07-23 10:55:15 +00002050 for (SmallVectorImpl<ArgEffect>::iterator I=AEffects.begin(),
Ted Kremenekc887d132009-04-29 18:50:19 +00002051 E=AEffects.end(); I != E; ++I) {
Mike Stump1eb44332009-09-09 15:08:12 +00002052
Ted Kremenekc887d132009-04-29 18:50:19 +00002053 // A bunch of things have alternate behavior under GC.
Jordy Rose35c86952011-08-24 05:47:39 +00002054 if (GCEnabled)
Ted Kremenekc887d132009-04-29 18:50:19 +00002055 switch (*I) {
2056 default: break;
2057 case Autorelease:
2058 os << "In GC mode an 'autorelease' has no effect.";
2059 continue;
2060 case IncRefMsg:
2061 os << "In GC mode the 'retain' message has no effect.";
2062 continue;
2063 case DecRefMsg:
2064 os << "In GC mode the 'release' message has no effect.";
2065 continue;
2066 }
2067 }
Mike Stump1eb44332009-09-09 15:08:12 +00002068 } while (0);
2069
Ted Kremenekc887d132009-04-29 18:50:19 +00002070 if (os.str().empty())
2071 return 0; // We have nothing to say!
Ted Kremenek2033a952009-05-13 07:12:33 +00002072
Jordy Rosef53e8c72011-08-23 19:43:16 +00002073 const Stmt *S = cast<StmtPoint>(N->getLocation()).getStmt();
Anna Zaks220ac8c2011-09-15 01:08:34 +00002074 PathDiagnosticLocation Pos(S, BRC.getSourceManager(),
2075 N->getLocationContext());
Ted Kremenek9c378f72011-08-12 23:37:29 +00002076 PathDiagnosticPiece *P = new PathDiagnosticEventPiece(Pos, os.str());
Mike Stump1eb44332009-09-09 15:08:12 +00002077
Ted Kremenekc887d132009-04-29 18:50:19 +00002078 // Add the range by scanning the children of the statement for any bindings
2079 // to Sym.
Mike Stump1eb44332009-09-09 15:08:12 +00002080 for (Stmt::const_child_iterator I = S->child_begin(), E = S->child_end();
Ted Kremenek5f85e172009-07-22 22:35:28 +00002081 I!=E; ++I)
Ted Kremenek9c378f72011-08-12 23:37:29 +00002082 if (const Expr *Exp = dyn_cast_or_null<Expr>(*I))
Ted Kremenek5eca4822012-01-06 22:09:28 +00002083 if (CurrSt->getSValAsScalarOrLoc(Exp, LCtx).getAsLocSymbol() == Sym) {
Ted Kremenekc887d132009-04-29 18:50:19 +00002084 P->addRange(Exp->getSourceRange());
2085 break;
2086 }
Mike Stump1eb44332009-09-09 15:08:12 +00002087
Ted Kremenekc887d132009-04-29 18:50:19 +00002088 return P;
2089}
2090
2091namespace {
Kovarththanan Rajaratnamba5fb5a2009-11-28 06:07:30 +00002092 class FindUniqueBinding :
Ted Kremenekc887d132009-04-29 18:50:19 +00002093 public StoreManager::BindingsHandler {
2094 SymbolRef Sym;
2095 const MemRegion* Binding;
2096 bool First;
Mike Stump1eb44332009-09-09 15:08:12 +00002097
Ted Kremenekc887d132009-04-29 18:50:19 +00002098 public:
2099 FindUniqueBinding(SymbolRef sym) : Sym(sym), Binding(0), First(true) {}
Mike Stump1eb44332009-09-09 15:08:12 +00002100
Ted Kremenekc887d132009-04-29 18:50:19 +00002101 bool HandleBinding(StoreManager& SMgr, Store store, const MemRegion* R,
2102 SVal val) {
Mike Stump1eb44332009-09-09 15:08:12 +00002103
2104 SymbolRef SymV = val.getAsSymbol();
Ted Kremenekc887d132009-04-29 18:50:19 +00002105 if (!SymV || SymV != Sym)
2106 return true;
Mike Stump1eb44332009-09-09 15:08:12 +00002107
Ted Kremenekc887d132009-04-29 18:50:19 +00002108 if (Binding) {
2109 First = false;
2110 return false;
2111 }
2112 else
2113 Binding = R;
Mike Stump1eb44332009-09-09 15:08:12 +00002114
2115 return true;
Ted Kremenekc887d132009-04-29 18:50:19 +00002116 }
Mike Stump1eb44332009-09-09 15:08:12 +00002117
Ted Kremenekc887d132009-04-29 18:50:19 +00002118 operator bool() { return First && Binding; }
Ted Kremenek0507f7e2012-01-04 00:35:45 +00002119 const MemRegion *getRegion() { return Binding; }
Mike Stump1eb44332009-09-09 15:08:12 +00002120 };
Ted Kremenekc887d132009-04-29 18:50:19 +00002121}
2122
Anna Zakse7e01682012-02-28 22:39:22 +00002123// Find the first node in the current function context that referred to the
2124// tracked symbol and the memory location that value was stored to. Note, the
2125// value is only reported if the allocation occurred in the same function as
2126// the leak.
Zhongxing Xuc5619d92009-08-06 01:32:16 +00002127static std::pair<const ExplodedNode*,const MemRegion*>
Ted Kremenek18c66fd2011-08-15 22:09:50 +00002128GetAllocationSite(ProgramStateManager& StateMgr, const ExplodedNode *N,
Ted Kremenekc887d132009-04-29 18:50:19 +00002129 SymbolRef Sym) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002130 const ExplodedNode *Last = N;
Mike Stump1eb44332009-09-09 15:08:12 +00002131 const MemRegion* FirstBinding = 0;
Anna Zakse7e01682012-02-28 22:39:22 +00002132 const LocationContext *LeakContext = N->getLocationContext();
Mike Stump1eb44332009-09-09 15:08:12 +00002133
Ted Kremenekc887d132009-04-29 18:50:19 +00002134 while (N) {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002135 ProgramStateRef St = N->getState();
Ted Kremenekc887d132009-04-29 18:50:19 +00002136 RefBindings B = St->get<RefBindings>();
Mike Stump1eb44332009-09-09 15:08:12 +00002137
Ted Kremenekc887d132009-04-29 18:50:19 +00002138 if (!B.lookup(Sym))
2139 break;
Mike Stump1eb44332009-09-09 15:08:12 +00002140
Ted Kremenekc887d132009-04-29 18:50:19 +00002141 FindUniqueBinding FB(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002142 StateMgr.iterBindings(St, FB);
2143 if (FB) FirstBinding = FB.getRegion();
2144
Anna Zakse7e01682012-02-28 22:39:22 +00002145 // Allocation node, is the last node in the current context in which the
2146 // symbol was tracked.
2147 if (N->getLocationContext() == LeakContext)
2148 Last = N;
2149
Mike Stump1eb44332009-09-09 15:08:12 +00002150 N = N->pred_empty() ? NULL : *(N->pred_begin());
Ted Kremenekc887d132009-04-29 18:50:19 +00002151 }
Mike Stump1eb44332009-09-09 15:08:12 +00002152
Anna Zakse7e01682012-02-28 22:39:22 +00002153 // If allocation happened in a function different from the leak node context,
2154 // do not report the binding.
2155 if (N->getLocationContext() != LeakContext) {
2156 FirstBinding = 0;
2157 }
2158
Ted Kremenekc887d132009-04-29 18:50:19 +00002159 return std::make_pair(Last, FirstBinding);
2160}
2161
2162PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002163CFRefReportVisitor::getEndPath(BugReporterContext &BRC,
2164 const ExplodedNode *EndN,
2165 BugReport &BR) {
Ted Kremenek76aadc32012-03-09 01:13:14 +00002166 BR.markInteresting(Sym);
Anna Zaks23f395e2011-08-20 01:27:22 +00002167 return BugReporterVisitor::getDefaultEndPath(BRC, EndN, BR);
Ted Kremenekc887d132009-04-29 18:50:19 +00002168}
2169
2170PathDiagnosticPiece*
Anna Zaks23f395e2011-08-20 01:27:22 +00002171CFRefLeakReportVisitor::getEndPath(BugReporterContext &BRC,
2172 const ExplodedNode *EndN,
2173 BugReport &BR) {
Mike Stump1eb44332009-09-09 15:08:12 +00002174
Ted Kremenek8966bc12009-05-06 21:39:49 +00002175 // Tell the BugReporterContext to report cases when the tracked symbol is
Ted Kremenekc887d132009-04-29 18:50:19 +00002176 // assigned to different variables, etc.
Ted Kremenek76aadc32012-03-09 01:13:14 +00002177 BR.markInteresting(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002178
Ted Kremenekc887d132009-04-29 18:50:19 +00002179 // We are reporting a leak. Walk up the graph to get to the first node where
2180 // the symbol appeared, and also get the first VarDecl that tracked object
2181 // is stored to.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002182 const ExplodedNode *AllocNode = 0;
Ted Kremenekc887d132009-04-29 18:50:19 +00002183 const MemRegion* FirstBinding = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002184
Ted Kremenekc887d132009-04-29 18:50:19 +00002185 llvm::tie(AllocNode, FirstBinding) =
Ted Kremenekf04dced2009-05-08 23:32:51 +00002186 GetAllocationSite(BRC.getStateManager(), EndN, Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002187
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002188 SourceManager& SM = BRC.getSourceManager();
Mike Stump1eb44332009-09-09 15:08:12 +00002189
Ted Kremenekc887d132009-04-29 18:50:19 +00002190 // Compute an actual location for the leak. Sometimes a leak doesn't
2191 // occur at an actual statement (e.g., transition between blocks; end
2192 // of function) so we need to walk the graph and compute a real location.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002193 const ExplodedNode *LeakN = EndN;
Anna Zaks4fdf97b2011-09-15 18:56:07 +00002194 PathDiagnosticLocation L = PathDiagnosticLocation::createEndOfPath(LeakN, SM);
Mike Stump1eb44332009-09-09 15:08:12 +00002195
Ted Kremenekc887d132009-04-29 18:50:19 +00002196 std::string sbuf;
2197 llvm::raw_string_ostream os(sbuf);
Mike Stump1eb44332009-09-09 15:08:12 +00002198
Ted Kremenekf1365462011-05-26 18:45:44 +00002199 os << "Object leaked: ";
Mike Stump1eb44332009-09-09 15:08:12 +00002200
Ted Kremenekf1365462011-05-26 18:45:44 +00002201 if (FirstBinding) {
2202 os << "object allocated and stored into '"
2203 << FirstBinding->getString() << '\'';
2204 }
2205 else
2206 os << "allocated object";
Mike Stump1eb44332009-09-09 15:08:12 +00002207
Ted Kremenekc887d132009-04-29 18:50:19 +00002208 // Get the retain count.
2209 const RefVal* RV = EndN->getState()->get<RefBindings>(Sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002210
Ted Kremenekc887d132009-04-29 18:50:19 +00002211 if (RV->getKind() == RefVal::ErrorLeakReturned) {
2212 // FIXME: Per comments in rdar://6320065, "create" only applies to CF
Jordy Rose5b5402b2011-07-15 22:17:54 +00002213 // objects. Only "copy", "alloc", "retain" and "new" transfer ownership
Ted Kremenekc887d132009-04-29 18:50:19 +00002214 // to the caller for NS objects.
Ted Kremenekd368d712011-05-25 06:19:45 +00002215 const Decl *D = &EndN->getCodeDecl();
2216 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(D)) {
2217 os << " is returned from a method whose name ('"
2218 << MD->getSelector().getAsString()
2219 << "') does not start with 'copy', 'mutableCopy', 'alloc' or 'new'."
Jordy Rose5b5402b2011-07-15 22:17:54 +00002220 " This violates the naming convention rules"
Ted Kremenekf1365462011-05-26 18:45:44 +00002221 " given in the Memory Management Guide for Cocoa";
Ted Kremenekd368d712011-05-25 06:19:45 +00002222 }
2223 else {
2224 const FunctionDecl *FD = cast<FunctionDecl>(D);
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002225 os << " is returned from a function whose name ('"
Benjamin Kramera59d20b2012-02-07 11:57:57 +00002226 << *FD
Ted Kremenekd368d712011-05-25 06:19:45 +00002227 << "') does not contain 'Copy' or 'Create'. This violates the naming"
Ted Kremenekb7dcddf2011-12-22 06:35:52 +00002228 " convention rules given in the Memory Management Guide for Core"
Ted Kremenekf1365462011-05-26 18:45:44 +00002229 " Foundation";
Ted Kremenekd368d712011-05-25 06:19:45 +00002230 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002231 }
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002232 else if (RV->getKind() == RefVal::ErrorGCLeakReturned) {
Ted Kremenek9c378f72011-08-12 23:37:29 +00002233 ObjCMethodDecl &MD = cast<ObjCMethodDecl>(EndN->getCodeDecl());
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002234 os << " and returned from method '" << MD.getSelector().getAsString()
Ted Kremenek82f2be52009-05-10 16:52:15 +00002235 << "' is potentially leaked when using garbage collection. Callers "
2236 "of this method do not expect a returned object with a +1 retain "
2237 "count since they expect the object to be managed by the garbage "
2238 "collector";
Ted Kremeneke8720ce2009-05-10 06:25:57 +00002239 }
Ted Kremenekc887d132009-04-29 18:50:19 +00002240 else
Ted Kremenekabf517c2010-10-15 22:50:23 +00002241 os << " is not referenced later in this execution path and has a retain "
Ted Kremenekf1365462011-05-26 18:45:44 +00002242 "count of +" << RV->getCount();
Mike Stump1eb44332009-09-09 15:08:12 +00002243
Ted Kremenekc887d132009-04-29 18:50:19 +00002244 return new PathDiagnosticEventPiece(L, os.str());
2245}
2246
Jordy Rose20589562011-08-24 22:39:09 +00002247CFRefLeakReport::CFRefLeakReport(CFRefBug &D, const LangOptions &LOpts,
2248 bool GCEnabled, const SummaryLogTy &Log,
2249 ExplodedNode *n, SymbolRef sym,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002250 CheckerContext &Ctx)
Jordy Rose20589562011-08-24 22:39:09 +00002251: CFRefReport(D, LOpts, GCEnabled, Log, n, sym, false) {
Mike Stump1eb44332009-09-09 15:08:12 +00002252
Chris Lattnerfc8f0e12011-04-15 05:22:18 +00002253 // Most bug reports are cached at the location where they occurred.
Ted Kremenekc887d132009-04-29 18:50:19 +00002254 // With leaks, we want to unique them by the location where they were
2255 // allocated, and only report a single path. To do this, we need to find
2256 // the allocation site of a piece of tracked memory, which we do via a
2257 // call to GetAllocationSite. This will walk the ExplodedGraph backwards.
2258 // Note that this is *not* the trimmed graph; we are guaranteed, however,
2259 // that all ancestor nodes that represent the allocation site have the
2260 // same SourceLocation.
Ted Kremenek9c378f72011-08-12 23:37:29 +00002261 const ExplodedNode *AllocNode = 0;
Mike Stump1eb44332009-09-09 15:08:12 +00002262
Anna Zaks6a93bd52011-10-25 19:57:11 +00002263 const SourceManager& SMgr = Ctx.getSourceManager();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002264
Ted Kremenekc887d132009-04-29 18:50:19 +00002265 llvm::tie(AllocNode, AllocBinding) = // Set AllocBinding.
Anna Zaks6a93bd52011-10-25 19:57:11 +00002266 GetAllocationSite(Ctx.getStateManager(), getErrorNode(), sym);
Mike Stump1eb44332009-09-09 15:08:12 +00002267
Ted Kremenekc887d132009-04-29 18:50:19 +00002268 // Get the SourceLocation for the allocation site.
2269 ProgramPoint P = AllocNode->getLocation();
Anna Zaks590dd8e2011-09-20 21:38:35 +00002270 const Stmt *AllocStmt = cast<PostStmt>(P).getStmt();
2271 Location = PathDiagnosticLocation::createBegin(AllocStmt, SMgr,
2272 n->getLocationContext());
Ted Kremenekc887d132009-04-29 18:50:19 +00002273 // Fill in the description of the bug.
2274 Description.clear();
2275 llvm::raw_string_ostream os(Description);
Ted Kremenekdd924e22009-05-02 19:05:19 +00002276 os << "Potential leak ";
Jordy Rose20589562011-08-24 22:39:09 +00002277 if (GCEnabled)
Ted Kremenekdd924e22009-05-02 19:05:19 +00002278 os << "(when using garbage collection) ";
Anna Zaks212000e2012-02-28 21:49:08 +00002279 os << "of an object";
Mike Stump1eb44332009-09-09 15:08:12 +00002280
Ted Kremenekc887d132009-04-29 18:50:19 +00002281 // FIXME: AllocBinding doesn't get populated for RegionStore yet.
2282 if (AllocBinding)
Anna Zaks212000e2012-02-28 21:49:08 +00002283 os << " stored into '" << AllocBinding->getString() << '\'';
Anna Zaksdc757b02011-08-19 23:21:56 +00002284
Jordy Rose20589562011-08-24 22:39:09 +00002285 addVisitor(new CFRefLeakReportVisitor(sym, GCEnabled, Log));
Ted Kremenekc887d132009-04-29 18:50:19 +00002286}
2287
2288//===----------------------------------------------------------------------===//
2289// Main checker logic.
2290//===----------------------------------------------------------------------===//
2291
Ted Kremenekd593eb92009-11-25 22:17:44 +00002292namespace {
Jordy Rose910c4052011-09-02 06:44:22 +00002293class RetainCountChecker
Jordy Rose9c083b72011-08-24 18:56:32 +00002294 : public Checker< check::Bind,
Jordy Rose38f17d62011-08-23 19:01:07 +00002295 check::DeadSymbols,
Jordy Rose9c083b72011-08-24 18:56:32 +00002296 check::EndAnalysis,
Jordy Rose38f17d62011-08-23 19:01:07 +00002297 check::EndPath,
Jordy Rose67044292011-08-17 21:27:39 +00002298 check::PostStmt<BlockExpr>,
John McCallf85e1932011-06-15 23:02:42 +00002299 check::PostStmt<CastExpr>,
Jordy Rose294396b2011-08-22 23:48:23 +00002300 check::PostStmt<CallExpr>,
Jordy Rose537716a2011-08-27 22:51:26 +00002301 check::PostStmt<CXXConstructExpr>,
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002302 check::PostStmt<ObjCArrayLiteral>,
2303 check::PostStmt<ObjCDictionaryLiteral>,
Jordy Rose294396b2011-08-22 23:48:23 +00002304 check::PostObjCMessage,
Jordy Rosef53e8c72011-08-23 19:43:16 +00002305 check::PreStmt<ReturnStmt>,
Jordy Rose67044292011-08-17 21:27:39 +00002306 check::RegionChanges,
Jordy Rose76c506f2011-08-21 21:58:18 +00002307 eval::Assume,
2308 eval::Call > {
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002309 mutable OwningPtr<CFRefBug> useAfterRelease, releaseNotOwned;
2310 mutable OwningPtr<CFRefBug> deallocGC, deallocNotOwned;
2311 mutable OwningPtr<CFRefBug> overAutorelease, returnNotOwnedForOwned;
2312 mutable OwningPtr<CFRefBug> leakWithinFunction, leakAtReturn;
2313 mutable OwningPtr<CFRefBug> leakWithinFunctionGC, leakAtReturnGC;
Jordy Rose38f17d62011-08-23 19:01:07 +00002314
2315 typedef llvm::DenseMap<SymbolRef, const SimpleProgramPointTag *> SymbolTagMap;
2316
2317 // This map is only used to ensure proper deletion of any allocated tags.
2318 mutable SymbolTagMap DeadSymbolTags;
2319
Dylan Noblesmith6f42b622012-02-05 02:12:40 +00002320 mutable OwningPtr<RetainSummaryManager> Summaries;
2321 mutable OwningPtr<RetainSummaryManager> SummariesGC;
Jordy Roseb6cfc092011-08-25 00:10:37 +00002322
Jordy Rosee0a5d322011-08-23 20:27:16 +00002323 mutable ARCounts::Factory ARCountFactory;
2324
Jordy Rose9c083b72011-08-24 18:56:32 +00002325 mutable SummaryLogTy SummaryLog;
2326 mutable bool ShouldResetSummaryLog;
2327
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002328public:
Jordy Rose910c4052011-09-02 06:44:22 +00002329 RetainCountChecker() : ShouldResetSummaryLog(false) {}
Jordy Rose38f17d62011-08-23 19:01:07 +00002330
Jordy Rose910c4052011-09-02 06:44:22 +00002331 virtual ~RetainCountChecker() {
Jordy Rose38f17d62011-08-23 19:01:07 +00002332 DeleteContainerSeconds(DeadSymbolTags);
2333 }
2334
Jordy Rose9c083b72011-08-24 18:56:32 +00002335 void checkEndAnalysis(ExplodedGraph &G, BugReporter &BR,
2336 ExprEngine &Eng) const {
2337 // FIXME: This is a hack to make sure the summary log gets cleared between
2338 // analyses of different code bodies.
2339 //
2340 // Why is this necessary? Because a checker's lifetime is tied to a
2341 // translation unit, but an ExplodedGraph's lifetime is just a code body.
2342 // Once in a blue moon, a new ExplodedNode will have the same address as an
2343 // old one with an associated summary, and the bug report visitor gets very
2344 // confused. (To make things worse, the summary lifetime is currently also
2345 // tied to a code body, so we get a crash instead of incorrect results.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002346 //
2347 // Why is this a bad solution? Because if the lifetime of the ExplodedGraph
2348 // changes, things will start going wrong again. Really the lifetime of this
2349 // log needs to be tied to either the specific nodes in it or the entire
2350 // ExplodedGraph, not to a specific part of the code being analyzed.
2351 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002352 // (Also, having stateful local data means that the same checker can't be
2353 // used from multiple threads, but a lot of checkers have incorrect
2354 // assumptions about that anyway. So that wasn't a priority at the time of
2355 // this fix.)
Jordy Rose1ab51c72011-08-24 09:27:24 +00002356 //
Jordy Rose9c083b72011-08-24 18:56:32 +00002357 // This happens at the end of analysis, but bug reports are emitted /after/
2358 // this point. So we can't just clear the summary log now. Instead, we mark
2359 // that the next time we access the summary log, it should be cleared.
2360
2361 // If we never reset the summary log during /this/ code body analysis,
2362 // there were no new summaries. There might still have been summaries from
2363 // the /last/ analysis, so clear them out to make sure the bug report
2364 // visitors don't get confused.
2365 if (ShouldResetSummaryLog)
2366 SummaryLog.clear();
2367
2368 ShouldResetSummaryLog = !SummaryLog.empty();
Jordy Rose1ab51c72011-08-24 09:27:24 +00002369 }
2370
Jordy Rose17a38e22011-09-02 05:55:19 +00002371 CFRefBug *getLeakWithinFunctionBug(const LangOptions &LOpts,
2372 bool GCEnabled) const {
2373 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002374 if (!leakWithinFunctionGC)
2375 leakWithinFunctionGC.reset(new LeakWithinFunction("Leak of object when "
2376 "using garbage "
2377 "collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002378 return leakWithinFunctionGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002379 } else {
2380 if (!leakWithinFunction) {
Douglas Gregore289d812011-09-13 17:21:33 +00002381 if (LOpts.getGC() == LangOptions::HybridGC) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002382 leakWithinFunction.reset(new LeakWithinFunction("Leak of object when "
2383 "not using garbage "
2384 "collection (GC) in "
2385 "dual GC/non-GC "
2386 "code"));
2387 } else {
2388 leakWithinFunction.reset(new LeakWithinFunction("Leak"));
2389 }
2390 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002391 return leakWithinFunction.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002392 }
2393 }
2394
Jordy Rose17a38e22011-09-02 05:55:19 +00002395 CFRefBug *getLeakAtReturnBug(const LangOptions &LOpts, bool GCEnabled) const {
2396 if (GCEnabled) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002397 if (!leakAtReturnGC)
2398 leakAtReturnGC.reset(new LeakAtReturn("Leak of returned object when "
2399 "using garbage collection"));
Jordy Rose17a38e22011-09-02 05:55:19 +00002400 return leakAtReturnGC.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002401 } else {
2402 if (!leakAtReturn) {
Douglas Gregore289d812011-09-13 17:21:33 +00002403 if (LOpts.getGC() == LangOptions::HybridGC) {
Jordy Rosedb92bb62011-08-25 01:14:38 +00002404 leakAtReturn.reset(new LeakAtReturn("Leak of returned object when "
2405 "not using garbage collection "
2406 "(GC) in dual GC/non-GC code"));
2407 } else {
2408 leakAtReturn.reset(new LeakAtReturn("Leak of returned object"));
2409 }
2410 }
Jordy Rose17a38e22011-09-02 05:55:19 +00002411 return leakAtReturn.get();
Jordy Rosedb92bb62011-08-25 01:14:38 +00002412 }
2413 }
2414
Jordy Rose17a38e22011-09-02 05:55:19 +00002415 RetainSummaryManager &getSummaryManager(ASTContext &Ctx,
2416 bool GCEnabled) const {
2417 // FIXME: We don't support ARC being turned on and off during one analysis.
2418 // (nor, for that matter, do we support changing ASTContexts)
David Blaikie4e4d0842012-03-11 07:00:24 +00002419 bool ARCEnabled = (bool)Ctx.getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002420 if (GCEnabled) {
2421 if (!SummariesGC)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002422 SummariesGC.reset(new RetainSummaryManager(Ctx, true, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002423 else
2424 assert(SummariesGC->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002425 return *SummariesGC;
2426 } else {
Jordy Rose17a38e22011-09-02 05:55:19 +00002427 if (!Summaries)
Jordy Roseb6cfc092011-08-25 00:10:37 +00002428 Summaries.reset(new RetainSummaryManager(Ctx, false, ARCEnabled));
Jordy Rose17a38e22011-09-02 05:55:19 +00002429 else
2430 assert(Summaries->isARCEnabled() == ARCEnabled);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002431 return *Summaries;
2432 }
2433 }
2434
Jordy Rose17a38e22011-09-02 05:55:19 +00002435 RetainSummaryManager &getSummaryManager(CheckerContext &C) const {
2436 return getSummaryManager(C.getASTContext(), C.isObjCGCEnabled());
2437 }
2438
Ted Kremenek8bef8232012-01-26 21:29:00 +00002439 void printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rosedbd658e2011-08-28 19:11:56 +00002440 const char *NL, const char *Sep) const;
2441
Anna Zaks390909c2011-10-06 00:43:15 +00002442 void checkBind(SVal loc, SVal val, const Stmt *S, CheckerContext &C) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002443 void checkPostStmt(const BlockExpr *BE, CheckerContext &C) const;
2444 void checkPostStmt(const CastExpr *CE, CheckerContext &C) const;
John McCallf85e1932011-06-15 23:02:42 +00002445
Jordy Rose294396b2011-08-22 23:48:23 +00002446 void checkPostStmt(const CallExpr *CE, CheckerContext &C) const;
Jordy Rose537716a2011-08-27 22:51:26 +00002447 void checkPostStmt(const CXXConstructExpr *CE, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002448 void checkPostStmt(const ObjCArrayLiteral *AL, CheckerContext &C) const;
2449 void checkPostStmt(const ObjCDictionaryLiteral *DL, CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002450 void checkPostObjCMessage(const ObjCMessage &Msg, CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002451
Jordy Rose294396b2011-08-22 23:48:23 +00002452 void checkSummary(const RetainSummary &Summ, const CallOrObjCMessage &Call,
Jordy Rosee38dd952011-08-28 05:16:28 +00002453 CheckerContext &C) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002454
Jordy Rose76c506f2011-08-21 21:58:18 +00002455 bool evalCall(const CallExpr *CE, CheckerContext &C) const;
2456
Ted Kremenek8bef8232012-01-26 21:29:00 +00002457 ProgramStateRef evalAssume(ProgramStateRef state, SVal Cond,
Jordy Roseab027fd2011-08-20 21:16:58 +00002458 bool Assumption) const;
Jordy Rose67044292011-08-17 21:27:39 +00002459
Ted Kremenek8bef8232012-01-26 21:29:00 +00002460 ProgramStateRef
2461 checkRegionChanges(ProgramStateRef state,
Jordy Rose537716a2011-08-27 22:51:26 +00002462 const StoreManager::InvalidatedSymbols *invalidated,
2463 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00002464 ArrayRef<const MemRegion *> Regions,
2465 const CallOrObjCMessage *Call) const;
Jordy Roseab027fd2011-08-20 21:16:58 +00002466
Ted Kremenek8bef8232012-01-26 21:29:00 +00002467 bool wantsRegionChangeUpdate(ProgramStateRef state) const {
Jordy Rose2f9a66d2011-08-20 21:17:59 +00002468 return true;
Jordy Roseab027fd2011-08-20 21:16:58 +00002469 }
Jordy Rose294396b2011-08-22 23:48:23 +00002470
Jordy Rosef53e8c72011-08-23 19:43:16 +00002471 void checkPreStmt(const ReturnStmt *S, CheckerContext &C) const;
2472 void checkReturnWithRetEffect(const ReturnStmt *S, CheckerContext &C,
2473 ExplodedNode *Pred, RetEffect RE, RefVal X,
Ted Kremenek8bef8232012-01-26 21:29:00 +00002474 SymbolRef Sym, ProgramStateRef state) const;
Jordy Rosef53e8c72011-08-23 19:43:16 +00002475
Jordy Rose38f17d62011-08-23 19:01:07 +00002476 void checkDeadSymbols(SymbolReaper &SymReaper, CheckerContext &C) const;
Anna Zaksaf498a22011-10-25 19:56:48 +00002477 void checkEndPath(CheckerContext &C) const;
Jordy Rose38f17d62011-08-23 19:01:07 +00002478
Ted Kremenek8bef8232012-01-26 21:29:00 +00002479 ProgramStateRef updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose17a38e22011-09-02 05:55:19 +00002480 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2481 CheckerContext &C) const;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002482
Ted Kremenek8bef8232012-01-26 21:29:00 +00002483 void processNonLeakError(ProgramStateRef St, SourceRange ErrorRange,
Jordy Rose294396b2011-08-22 23:48:23 +00002484 RefVal::Kind ErrorKind, SymbolRef Sym,
2485 CheckerContext &C) const;
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002486
2487 void processObjCLiterals(CheckerContext &C, const Expr *Ex) const;
Jordy Rose294396b2011-08-22 23:48:23 +00002488
Jordy Rose38f17d62011-08-23 19:01:07 +00002489 const ProgramPointTag *getDeadSymbolTag(SymbolRef sym) const;
2490
Ted Kremenek8bef8232012-01-26 21:29:00 +00002491 ProgramStateRef handleSymbolDeath(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002492 SymbolRef sid, RefVal V,
2493 SmallVectorImpl<SymbolRef> &Leaked) const;
2494
Ted Kremenek8bef8232012-01-26 21:29:00 +00002495 std::pair<ExplodedNode *, ProgramStateRef >
2496 handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose8d228632011-08-23 20:07:14 +00002497 GenericNodeBuilderRefCount Bd, ExplodedNode *Pred,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002498 CheckerContext &Ctx, SymbolRef Sym, RefVal V) const;
Jordy Rose8d228632011-08-23 20:07:14 +00002499
Ted Kremenek8bef8232012-01-26 21:29:00 +00002500 ExplodedNode *processLeaks(ProgramStateRef state,
Jordy Rose38f17d62011-08-23 19:01:07 +00002501 SmallVectorImpl<SymbolRef> &Leaked,
2502 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00002503 CheckerContext &Ctx,
Jordy Rose38f17d62011-08-23 19:01:07 +00002504 ExplodedNode *Pred = 0) const;
Ted Kremenekd593eb92009-11-25 22:17:44 +00002505};
2506} // end anonymous namespace
2507
Jordy Rose67044292011-08-17 21:27:39 +00002508namespace {
2509class StopTrackingCallback : public SymbolVisitor {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002510 ProgramStateRef state;
Jordy Rose67044292011-08-17 21:27:39 +00002511public:
Ted Kremenek8bef8232012-01-26 21:29:00 +00002512 StopTrackingCallback(ProgramStateRef st) : state(st) {}
2513 ProgramStateRef getState() const { return state; }
Jordy Rose67044292011-08-17 21:27:39 +00002514
2515 bool VisitSymbol(SymbolRef sym) {
2516 state = state->remove<RefBindings>(sym);
2517 return true;
2518 }
2519};
2520} // end anonymous namespace
2521
Jordy Rose910c4052011-09-02 06:44:22 +00002522//===----------------------------------------------------------------------===//
2523// Handle statements that may have an effect on refcounts.
2524//===----------------------------------------------------------------------===//
Jordy Rose67044292011-08-17 21:27:39 +00002525
Jordy Rose910c4052011-09-02 06:44:22 +00002526void RetainCountChecker::checkPostStmt(const BlockExpr *BE,
2527 CheckerContext &C) const {
Jordy Rose67044292011-08-17 21:27:39 +00002528
Jordy Rose910c4052011-09-02 06:44:22 +00002529 // Scan the BlockDecRefExprs for any object the retain count checker
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002530 // may be tracking.
John McCall469a1eb2011-02-02 13:00:07 +00002531 if (!BE->getBlockDecl()->hasCaptures())
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002532 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002533
Ted Kremenek8bef8232012-01-26 21:29:00 +00002534 ProgramStateRef state = C.getState();
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002535 const BlockDataRegion *R =
Ted Kremenek5eca4822012-01-06 22:09:28 +00002536 cast<BlockDataRegion>(state->getSVal(BE,
2537 C.getLocationContext()).getAsRegion());
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002538
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002539 BlockDataRegion::referenced_vars_iterator I = R->referenced_vars_begin(),
2540 E = R->referenced_vars_end();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002541
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002542 if (I == E)
2543 return;
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002544
Ted Kremenek67d12872009-12-07 22:05:27 +00002545 // FIXME: For now we invalidate the tracking of all symbols passed to blocks
2546 // via captured variables, even though captured variables result in a copy
2547 // and in implicit increment/decrement of a retain count.
Chris Lattner5f9e2722011-07-23 10:55:15 +00002548 SmallVector<const MemRegion*, 10> Regions;
Anna Zaks39ac1872011-10-26 21:06:44 +00002549 const LocationContext *LC = C.getLocationContext();
Ted Kremenekc8413fd2010-12-02 07:49:45 +00002550 MemRegionManager &MemMgr = C.getSValBuilder().getRegionManager();
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002551
Ted Kremenek67d12872009-12-07 22:05:27 +00002552 for ( ; I != E; ++I) {
2553 const VarRegion *VR = *I;
2554 if (VR->getSuperRegion() == R) {
2555 VR = MemMgr.getVarRegion(VR->getDecl(), LC);
2556 }
2557 Regions.push_back(VR);
2558 }
Ted Kremenekdcee3ce2010-07-01 20:16:50 +00002559
Ted Kremenek67d12872009-12-07 22:05:27 +00002560 state =
2561 state->scanReachableSymbols<StopTrackingCallback>(Regions.data(),
2562 Regions.data() + Regions.size()).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00002563 C.addTransition(state);
Ted Kremenek38cc6bc2009-11-26 02:38:19 +00002564}
2565
Jordy Rose910c4052011-09-02 06:44:22 +00002566void RetainCountChecker::checkPostStmt(const CastExpr *CE,
2567 CheckerContext &C) const {
John McCallf85e1932011-06-15 23:02:42 +00002568 const ObjCBridgedCastExpr *BE = dyn_cast<ObjCBridgedCastExpr>(CE);
2569 if (!BE)
2570 return;
2571
John McCall71c482c2011-06-17 06:50:50 +00002572 ArgEffect AE = IncRef;
John McCallf85e1932011-06-15 23:02:42 +00002573
2574 switch (BE->getBridgeKind()) {
2575 case clang::OBC_Bridge:
2576 // Do nothing.
2577 return;
2578 case clang::OBC_BridgeRetained:
2579 AE = IncRef;
2580 break;
2581 case clang::OBC_BridgeTransfer:
2582 AE = DecRefBridgedTransfered;
2583 break;
2584 }
2585
Ted Kremenek8bef8232012-01-26 21:29:00 +00002586 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002587 SymbolRef Sym = state->getSVal(CE, C.getLocationContext()).getAsLocSymbol();
John McCallf85e1932011-06-15 23:02:42 +00002588 if (!Sym)
2589 return;
2590 const RefVal* T = state->get<RefBindings>(Sym);
2591 if (!T)
2592 return;
2593
John McCallf85e1932011-06-15 23:02:42 +00002594 RefVal::Kind hasErr = (RefVal::Kind) 0;
Jordy Rose17a38e22011-09-02 05:55:19 +00002595 state = updateSymbol(state, Sym, *T, AE, hasErr, C);
John McCallf85e1932011-06-15 23:02:42 +00002596
2597 if (hasErr) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002598 // FIXME: If we get an error during a bridge cast, should we report it?
2599 // Should we assert that there is no error?
John McCallf85e1932011-06-15 23:02:42 +00002600 return;
2601 }
2602
Anna Zaks0bd6b112011-10-26 21:06:34 +00002603 C.addTransition(state);
John McCallf85e1932011-06-15 23:02:42 +00002604}
2605
Jordy Rose910c4052011-09-02 06:44:22 +00002606void RetainCountChecker::checkPostStmt(const CallExpr *CE,
2607 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00002608 // Get the callee.
Ted Kremenek8bef8232012-01-26 21:29:00 +00002609 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002610 const Expr *Callee = CE->getCallee();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002611 SVal L = state->getSVal(Callee, C.getLocationContext());
Jordy Rose294396b2011-08-22 23:48:23 +00002612
Jordy Rose17a38e22011-09-02 05:55:19 +00002613 RetainSummaryManager &Summaries = getSummaryManager(C);
Ted Kremenek93edbc52011-10-05 23:54:29 +00002614 const RetainSummary *Summ = 0;
Jordy Rose294396b2011-08-22 23:48:23 +00002615
2616 // FIXME: Better support for blocks. For now we stop tracking anything
2617 // that is passed to blocks.
2618 // FIXME: Need to handle variables that are "captured" by the block.
2619 if (dyn_cast_or_null<BlockDataRegion>(L.getAsRegion())) {
2620 Summ = Summaries.getPersistentStopSummary();
2621 } else if (const FunctionDecl *FD = L.getAsFunctionDecl()) {
2622 Summ = Summaries.getSummary(FD);
2623 } else if (const CXXMemberCallExpr *me = dyn_cast<CXXMemberCallExpr>(CE)) {
2624 if (const CXXMethodDecl *MD = me->getMethodDecl())
2625 Summ = Summaries.getSummary(MD);
2626 }
2627
Jordy Rose294396b2011-08-22 23:48:23 +00002628 if (!Summ)
Ted Kremenek93edbc52011-10-05 23:54:29 +00002629 Summ = Summaries.getDefaultSummary();
Jordy Rose294396b2011-08-22 23:48:23 +00002630
Ted Kremenek5eca4822012-01-06 22:09:28 +00002631 checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C);
Jordy Rose294396b2011-08-22 23:48:23 +00002632}
2633
Jordy Rose910c4052011-09-02 06:44:22 +00002634void RetainCountChecker::checkPostStmt(const CXXConstructExpr *CE,
2635 CheckerContext &C) const {
Jordy Rose537716a2011-08-27 22:51:26 +00002636 const CXXConstructorDecl *Ctor = CE->getConstructor();
2637 if (!Ctor)
2638 return;
2639
Jordy Rose17a38e22011-09-02 05:55:19 +00002640 RetainSummaryManager &Summaries = getSummaryManager(C);
Ted Kremenek93edbc52011-10-05 23:54:29 +00002641 const RetainSummary *Summ = Summaries.getSummary(Ctor);
Jordy Rose537716a2011-08-27 22:51:26 +00002642
2643 // If we didn't get a summary, this constructor doesn't affect retain counts.
2644 if (!Summ)
2645 return;
2646
Ted Kremenek8bef8232012-01-26 21:29:00 +00002647 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002648 checkSummary(*Summ, CallOrObjCMessage(CE, state, C.getLocationContext()), C);
Jordy Rose537716a2011-08-27 22:51:26 +00002649}
2650
Ted Kremenek1a45a5f2012-03-06 20:06:12 +00002651void RetainCountChecker::processObjCLiterals(CheckerContext &C,
2652 const Expr *Ex) const {
2653 ProgramStateRef state = C.getState();
2654 const ExplodedNode *pred = C.getPredecessor();
2655 for (Stmt::const_child_iterator it = Ex->child_begin(), et = Ex->child_end() ;
2656 it != et ; ++it) {
2657 const Stmt *child = *it;
2658 SVal V = state->getSVal(child, pred->getLocationContext());
2659 if (SymbolRef sym = V.getAsSymbol())
2660 if (const RefVal* T = state->get<RefBindings>(sym)) {
2661 RefVal::Kind hasErr = (RefVal::Kind) 0;
2662 state = updateSymbol(state, sym, *T, MayEscape, hasErr, C);
2663 if (hasErr) {
2664 processNonLeakError(state, child->getSourceRange(), hasErr, sym, C);
2665 return;
2666 }
2667 }
2668 }
2669
2670 // Return the object as autoreleased.
2671 // RetEffect RE = RetEffect::MakeNotOwned(RetEffect::ObjC);
2672 if (SymbolRef sym =
2673 state->getSVal(Ex, pred->getLocationContext()).getAsSymbol()) {
2674 QualType ResultTy = Ex->getType();
2675 state = state->set<RefBindings>(sym, RefVal::makeNotOwned(RetEffect::ObjC,
2676 ResultTy));
2677 }
2678
2679 C.addTransition(state);
2680}
2681
2682void RetainCountChecker::checkPostStmt(const ObjCArrayLiteral *AL,
2683 CheckerContext &C) const {
2684 // Apply the 'MayEscape' to all values.
2685 processObjCLiterals(C, AL);
2686}
2687
2688void RetainCountChecker::checkPostStmt(const ObjCDictionaryLiteral *DL,
2689 CheckerContext &C) const {
2690 // Apply the 'MayEscape' to all keys and values.
2691 processObjCLiterals(C, DL);
2692}
2693
Jordy Rose910c4052011-09-02 06:44:22 +00002694void RetainCountChecker::checkPostObjCMessage(const ObjCMessage &Msg,
2695 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002696 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002697
Jordy Rose17a38e22011-09-02 05:55:19 +00002698 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Roseb6cfc092011-08-25 00:10:37 +00002699
Ted Kremenek93edbc52011-10-05 23:54:29 +00002700 const RetainSummary *Summ;
Jordy Rose294396b2011-08-22 23:48:23 +00002701 if (Msg.isInstanceMessage()) {
Anna Zaksa2a86032011-11-01 22:41:01 +00002702 const LocationContext *LC = C.getLocationContext();
Jordy Rose294396b2011-08-22 23:48:23 +00002703 Summ = Summaries.getInstanceMethodSummary(Msg, state, LC);
2704 } else {
2705 Summ = Summaries.getClassMethodSummary(Msg);
2706 }
2707
2708 // If we didn't get a summary, this message doesn't affect retain counts.
2709 if (!Summ)
2710 return;
2711
Ted Kremenek5eca4822012-01-06 22:09:28 +00002712 checkSummary(*Summ, CallOrObjCMessage(Msg, state, C.getLocationContext()), C);
Jordy Rose294396b2011-08-22 23:48:23 +00002713}
2714
Jordy Rose910c4052011-09-02 06:44:22 +00002715/// GetReturnType - Used to get the return type of a message expression or
2716/// function call with the intention of affixing that type to a tracked symbol.
2717/// While the the return type can be queried directly from RetEx, when
2718/// invoking class methods we augment to the return type to be that of
2719/// a pointer to the class (as opposed it just being id).
2720// FIXME: We may be able to do this with related result types instead.
2721// This function is probably overestimating.
2722static QualType GetReturnType(const Expr *RetE, ASTContext &Ctx) {
2723 QualType RetTy = RetE->getType();
2724 // If RetE is not a message expression just return its type.
2725 // If RetE is a message expression, return its types if it is something
2726 /// more specific than id.
2727 if (const ObjCMessageExpr *ME = dyn_cast<ObjCMessageExpr>(RetE))
2728 if (const ObjCObjectPointerType *PT = RetTy->getAs<ObjCObjectPointerType>())
2729 if (PT->isObjCQualifiedIdType() || PT->isObjCIdType() ||
2730 PT->isObjCClassType()) {
2731 // At this point we know the return type of the message expression is
2732 // id, id<...>, or Class. If we have an ObjCInterfaceDecl, we know this
2733 // is a call to a class method whose type we can resolve. In such
2734 // cases, promote the return type to XXX* (where XXX is the class).
2735 const ObjCInterfaceDecl *D = ME->getReceiverInterface();
2736 return !D ? RetTy :
2737 Ctx.getObjCObjectPointerType(Ctx.getObjCInterfaceType(D));
2738 }
2739
2740 return RetTy;
2741}
2742
2743void RetainCountChecker::checkSummary(const RetainSummary &Summ,
2744 const CallOrObjCMessage &CallOrMsg,
2745 CheckerContext &C) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00002746 ProgramStateRef state = C.getState();
Jordy Rose294396b2011-08-22 23:48:23 +00002747
2748 // Evaluate the effect of the arguments.
2749 RefVal::Kind hasErr = (RefVal::Kind) 0;
2750 SourceRange ErrorRange;
2751 SymbolRef ErrorSym = 0;
2752
2753 for (unsigned idx = 0, e = CallOrMsg.getNumArgs(); idx != e; ++idx) {
Jordy Rose537716a2011-08-27 22:51:26 +00002754 SVal V = CallOrMsg.getArgSVal(idx);
Jordy Rose294396b2011-08-22 23:48:23 +00002755
2756 if (SymbolRef Sym = V.getAsLocSymbol()) {
2757 if (RefBindings::data_type *T = state->get<RefBindings>(Sym)) {
Jordy Rose17a38e22011-09-02 05:55:19 +00002758 state = updateSymbol(state, Sym, *T, Summ.getArg(idx), hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002759 if (hasErr) {
2760 ErrorRange = CallOrMsg.getArgSourceRange(idx);
2761 ErrorSym = Sym;
2762 break;
2763 }
2764 }
2765 }
2766 }
2767
2768 // Evaluate the effect on the message receiver.
2769 bool ReceiverIsTracked = false;
Jordy Rosee38dd952011-08-28 05:16:28 +00002770 if (!hasErr && CallOrMsg.isObjCMessage()) {
Anna Zaks39ac1872011-10-26 21:06:44 +00002771 const LocationContext *LC = C.getLocationContext();
Jordy Rosee38dd952011-08-28 05:16:28 +00002772 SVal Receiver = CallOrMsg.getInstanceMessageReceiver(LC);
2773 if (SymbolRef Sym = Receiver.getAsLocSymbol()) {
Jordy Rose294396b2011-08-22 23:48:23 +00002774 if (const RefVal *T = state->get<RefBindings>(Sym)) {
2775 ReceiverIsTracked = true;
Jordy Rose17a38e22011-09-02 05:55:19 +00002776 state = updateSymbol(state, Sym, *T, Summ.getReceiverEffect(),
2777 hasErr, C);
Jordy Rose294396b2011-08-22 23:48:23 +00002778 if (hasErr) {
Jordy Rosee38dd952011-08-28 05:16:28 +00002779 ErrorRange = CallOrMsg.getReceiverSourceRange();
Jordy Rose294396b2011-08-22 23:48:23 +00002780 ErrorSym = Sym;
2781 }
2782 }
2783 }
2784 }
2785
2786 // Process any errors.
2787 if (hasErr) {
2788 processNonLeakError(state, ErrorRange, hasErr, ErrorSym, C);
2789 return;
2790 }
2791
2792 // Consult the summary for the return value.
2793 RetEffect RE = Summ.getRetEffect();
2794
2795 if (RE.getKind() == RetEffect::OwnedWhenTrackedReceiver) {
Jordy Roseb6cfc092011-08-25 00:10:37 +00002796 if (ReceiverIsTracked)
Jordy Rose17a38e22011-09-02 05:55:19 +00002797 RE = getSummaryManager(C).getObjAllocRetEffect();
Jordy Roseb6cfc092011-08-25 00:10:37 +00002798 else
Jordy Rose294396b2011-08-22 23:48:23 +00002799 RE = RetEffect::MakeNoRet();
2800 }
2801
2802 switch (RE.getKind()) {
2803 default:
David Blaikie7530c032012-01-17 06:56:22 +00002804 llvm_unreachable("Unhandled RetEffect.");
Jordy Rose294396b2011-08-22 23:48:23 +00002805
2806 case RetEffect::NoRet:
2807 // No work necessary.
2808 break;
2809
2810 case RetEffect::OwnedAllocatedSymbol:
2811 case RetEffect::OwnedSymbol: {
Ted Kremenek5eca4822012-01-06 22:09:28 +00002812 SymbolRef Sym = state->getSVal(CallOrMsg.getOriginExpr(),
2813 C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002814 if (!Sym)
2815 break;
2816
2817 // Use the result type from callOrMsg as it automatically adjusts
2818 // for methods/functions that return references.
2819 QualType ResultTy = CallOrMsg.getResultType(C.getASTContext());
2820 state = state->set<RefBindings>(Sym, RefVal::makeOwned(RE.getObjKind(),
2821 ResultTy));
2822
2823 // FIXME: Add a flag to the checker where allocations are assumed to
2824 // *not* fail. (The code below is out-of-date, though.)
2825#if 0
2826 if (RE.getKind() == RetEffect::OwnedAllocatedSymbol) {
2827 bool isFeasible;
2828 state = state.assume(loc::SymbolVal(Sym), true, isFeasible);
2829 assert(isFeasible && "Cannot assume fresh symbol is non-null.");
2830 }
2831#endif
2832
2833 break;
2834 }
2835
2836 case RetEffect::GCNotOwnedSymbol:
2837 case RetEffect::ARCNotOwnedSymbol:
2838 case RetEffect::NotOwnedSymbol: {
2839 const Expr *Ex = CallOrMsg.getOriginExpr();
Ted Kremenek5eca4822012-01-06 22:09:28 +00002840 SymbolRef Sym = state->getSVal(Ex, C.getLocationContext()).getAsSymbol();
Jordy Rose294396b2011-08-22 23:48:23 +00002841 if (!Sym)
2842 break;
2843
2844 // Use GetReturnType in order to give [NSFoo alloc] the type NSFoo *.
2845 QualType ResultTy = GetReturnType(Ex, C.getASTContext());
2846 state = state->set<RefBindings>(Sym, RefVal::makeNotOwned(RE.getObjKind(),
2847 ResultTy));
2848 break;
2849 }
2850 }
2851
2852 // This check is actually necessary; otherwise the statement builder thinks
2853 // we've hit a previously-found path.
2854 // Normally addTransition takes care of this, but we want the node pointer.
2855 ExplodedNode *NewNode;
2856 if (state == C.getState()) {
2857 NewNode = C.getPredecessor();
2858 } else {
Anna Zaks0bd6b112011-10-26 21:06:34 +00002859 NewNode = C.addTransition(state);
Jordy Rose294396b2011-08-22 23:48:23 +00002860 }
2861
Jordy Rose9c083b72011-08-24 18:56:32 +00002862 // Annotate the node with summary we used.
2863 if (NewNode) {
2864 // FIXME: This is ugly. See checkEndAnalysis for why it's necessary.
2865 if (ShouldResetSummaryLog) {
2866 SummaryLog.clear();
2867 ShouldResetSummaryLog = false;
2868 }
Jordy Roseec9ef852011-08-23 20:55:48 +00002869 SummaryLog[NewNode] = &Summ;
Jordy Rose9c083b72011-08-24 18:56:32 +00002870 }
Jordy Rose294396b2011-08-22 23:48:23 +00002871}
2872
Jordy Rosee0a5d322011-08-23 20:27:16 +00002873
Ted Kremenek8bef8232012-01-26 21:29:00 +00002874ProgramStateRef
2875RetainCountChecker::updateSymbol(ProgramStateRef state, SymbolRef sym,
Jordy Rose910c4052011-09-02 06:44:22 +00002876 RefVal V, ArgEffect E, RefVal::Kind &hasErr,
2877 CheckerContext &C) const {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002878 // In GC mode [... release] and [... retain] do nothing.
Jordy Rose910c4052011-09-02 06:44:22 +00002879 // In ARC mode they shouldn't exist at all, but we just ignore them.
Jordy Rose17a38e22011-09-02 05:55:19 +00002880 bool IgnoreRetainMsg = C.isObjCGCEnabled();
2881 if (!IgnoreRetainMsg)
David Blaikie4e4d0842012-03-11 07:00:24 +00002882 IgnoreRetainMsg = (bool)C.getASTContext().getLangOpts().ObjCAutoRefCount;
Jordy Rose17a38e22011-09-02 05:55:19 +00002883
Jordy Rosee0a5d322011-08-23 20:27:16 +00002884 switch (E) {
2885 default: break;
Jordy Rose17a38e22011-09-02 05:55:19 +00002886 case IncRefMsg: E = IgnoreRetainMsg ? DoNothing : IncRef; break;
2887 case DecRefMsg: E = IgnoreRetainMsg ? DoNothing : DecRef; break;
2888 case MakeCollectable: E = C.isObjCGCEnabled() ? DecRef : DoNothing; break;
2889 case NewAutoreleasePool: E = C.isObjCGCEnabled() ? DoNothing :
2890 NewAutoreleasePool; break;
Jordy Rosee0a5d322011-08-23 20:27:16 +00002891 }
2892
2893 // Handle all use-after-releases.
Jordy Rose17a38e22011-09-02 05:55:19 +00002894 if (!C.isObjCGCEnabled() && V.getKind() == RefVal::Released) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002895 V = V ^ RefVal::ErrorUseAfterRelease;
2896 hasErr = V.getKind();
2897 return state->set<RefBindings>(sym, V);
2898 }
2899
2900 switch (E) {
2901 case DecRefMsg:
2902 case IncRefMsg:
2903 case MakeCollectable:
2904 llvm_unreachable("DecRefMsg/IncRefMsg/MakeCollectable already converted");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002905
2906 case Dealloc:
2907 // Any use of -dealloc in GC is *bad*.
Jordy Rose17a38e22011-09-02 05:55:19 +00002908 if (C.isObjCGCEnabled()) {
Jordy Rosee0a5d322011-08-23 20:27:16 +00002909 V = V ^ RefVal::ErrorDeallocGC;
2910 hasErr = V.getKind();
2911 break;
2912 }
2913
2914 switch (V.getKind()) {
2915 default:
2916 llvm_unreachable("Invalid RefVal state for an explicit dealloc.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002917 case RefVal::Owned:
2918 // The object immediately transitions to the released state.
2919 V = V ^ RefVal::Released;
2920 V.clearCounts();
2921 return state->set<RefBindings>(sym, V);
2922 case RefVal::NotOwned:
2923 V = V ^ RefVal::ErrorDeallocNotOwned;
2924 hasErr = V.getKind();
2925 break;
2926 }
2927 break;
2928
2929 case NewAutoreleasePool:
Jordy Rose17a38e22011-09-02 05:55:19 +00002930 assert(!C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00002931 return state->add<AutoreleaseStack>(sym);
2932
2933 case MayEscape:
2934 if (V.getKind() == RefVal::Owned) {
2935 V = V ^ RefVal::NotOwned;
2936 break;
2937 }
2938
2939 // Fall-through.
2940
Jordy Rosee0a5d322011-08-23 20:27:16 +00002941 case DoNothing:
2942 return state;
2943
2944 case Autorelease:
Jordy Rose17a38e22011-09-02 05:55:19 +00002945 if (C.isObjCGCEnabled())
Jordy Rosee0a5d322011-08-23 20:27:16 +00002946 return state;
2947
2948 // Update the autorelease counts.
2949 state = SendAutorelease(state, ARCountFactory, sym);
2950 V = V.autorelease();
2951 break;
2952
2953 case StopTracking:
2954 return state->remove<RefBindings>(sym);
2955
2956 case IncRef:
2957 switch (V.getKind()) {
2958 default:
2959 llvm_unreachable("Invalid RefVal state for a retain.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002960 case RefVal::Owned:
2961 case RefVal::NotOwned:
2962 V = V + 1;
2963 break;
2964 case RefVal::Released:
2965 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00002966 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00002967 V = (V ^ RefVal::Owned) + 1;
2968 break;
2969 }
2970 break;
2971
2972 case SelfOwn:
2973 V = V ^ RefVal::NotOwned;
2974 // Fall-through.
2975 case DecRef:
2976 case DecRefBridgedTransfered:
2977 switch (V.getKind()) {
2978 default:
2979 // case 'RefVal::Released' handled above.
2980 llvm_unreachable("Invalid RefVal state for a release.");
Jordy Rosee0a5d322011-08-23 20:27:16 +00002981
2982 case RefVal::Owned:
2983 assert(V.getCount() > 0);
2984 if (V.getCount() == 1)
2985 V = V ^ (E == DecRefBridgedTransfered ?
2986 RefVal::NotOwned : RefVal::Released);
2987 V = V - 1;
2988 break;
2989
2990 case RefVal::NotOwned:
2991 if (V.getCount() > 0)
2992 V = V - 1;
2993 else {
2994 V = V ^ RefVal::ErrorReleaseNotOwned;
2995 hasErr = V.getKind();
2996 }
2997 break;
2998
2999 case RefVal::Released:
3000 // Non-GC cases are handled above.
Jordy Rose17a38e22011-09-02 05:55:19 +00003001 assert(C.isObjCGCEnabled());
Jordy Rosee0a5d322011-08-23 20:27:16 +00003002 V = V ^ RefVal::ErrorUseAfterRelease;
3003 hasErr = V.getKind();
3004 break;
3005 }
3006 break;
3007 }
3008 return state->set<RefBindings>(sym, V);
3009}
3010
Ted Kremenek8bef8232012-01-26 21:29:00 +00003011void RetainCountChecker::processNonLeakError(ProgramStateRef St,
Jordy Rose910c4052011-09-02 06:44:22 +00003012 SourceRange ErrorRange,
3013 RefVal::Kind ErrorKind,
3014 SymbolRef Sym,
3015 CheckerContext &C) const {
Jordy Rose294396b2011-08-22 23:48:23 +00003016 ExplodedNode *N = C.generateSink(St);
3017 if (!N)
3018 return;
3019
Jordy Rose294396b2011-08-22 23:48:23 +00003020 CFRefBug *BT;
3021 switch (ErrorKind) {
3022 default:
3023 llvm_unreachable("Unhandled error.");
Jordy Rose294396b2011-08-22 23:48:23 +00003024 case RefVal::ErrorUseAfterRelease:
Jordy Rosed6334e12011-08-25 00:34:03 +00003025 if (!useAfterRelease)
3026 useAfterRelease.reset(new UseAfterRelease());
3027 BT = &*useAfterRelease;
Jordy Rose294396b2011-08-22 23:48:23 +00003028 break;
3029 case RefVal::ErrorReleaseNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003030 if (!releaseNotOwned)
3031 releaseNotOwned.reset(new BadRelease());
3032 BT = &*releaseNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003033 break;
3034 case RefVal::ErrorDeallocGC:
Jordy Rosed6334e12011-08-25 00:34:03 +00003035 if (!deallocGC)
3036 deallocGC.reset(new DeallocGC());
3037 BT = &*deallocGC;
Jordy Rose294396b2011-08-22 23:48:23 +00003038 break;
3039 case RefVal::ErrorDeallocNotOwned:
Jordy Rosed6334e12011-08-25 00:34:03 +00003040 if (!deallocNotOwned)
3041 deallocNotOwned.reset(new DeallocNotOwned());
3042 BT = &*deallocNotOwned;
Jordy Rose294396b2011-08-22 23:48:23 +00003043 break;
3044 }
3045
Jordy Rosed6334e12011-08-25 00:34:03 +00003046 assert(BT);
David Blaikie4e4d0842012-03-11 07:00:24 +00003047 CFRefReport *report = new CFRefReport(*BT, C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003048 C.isObjCGCEnabled(), SummaryLog,
3049 N, Sym);
Jordy Rose294396b2011-08-22 23:48:23 +00003050 report->addRange(ErrorRange);
3051 C.EmitReport(report);
3052}
3053
Jordy Rose910c4052011-09-02 06:44:22 +00003054//===----------------------------------------------------------------------===//
3055// Handle the return values of retain-count-related functions.
3056//===----------------------------------------------------------------------===//
3057
3058bool RetainCountChecker::evalCall(const CallExpr *CE, CheckerContext &C) const {
Jordy Rose76c506f2011-08-21 21:58:18 +00003059 // Get the callee. We're only interested in simple C functions.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003060 ProgramStateRef state = C.getState();
Anna Zaksb805c8f2011-12-01 05:57:37 +00003061 const FunctionDecl *FD = C.getCalleeDecl(CE);
Jordy Rose76c506f2011-08-21 21:58:18 +00003062 if (!FD)
3063 return false;
3064
3065 IdentifierInfo *II = FD->getIdentifier();
3066 if (!II)
3067 return false;
3068
3069 // For now, we're only handling the functions that return aliases of their
3070 // arguments: CFRetain and CFMakeCollectable (and their families).
3071 // Eventually we should add other functions we can model entirely,
3072 // such as CFRelease, which don't invalidate their arguments or globals.
3073 if (CE->getNumArgs() != 1)
3074 return false;
3075
3076 // Get the name of the function.
3077 StringRef FName = II->getName();
3078 FName = FName.substr(FName.find_first_not_of('_'));
3079
3080 // See if it's one of the specific functions we know how to eval.
3081 bool canEval = false;
3082
Anna Zaksb805c8f2011-12-01 05:57:37 +00003083 QualType ResultTy = CE->getCallReturnType();
Jordy Rose76c506f2011-08-21 21:58:18 +00003084 if (ResultTy->isObjCIdType()) {
3085 // Handle: id NSMakeCollectable(CFTypeRef)
3086 canEval = II->isStr("NSMakeCollectable");
3087 } else if (ResultTy->isPointerType()) {
3088 // Handle: (CF|CG)Retain
3089 // CFMakeCollectable
3090 // It's okay to be a little sloppy here (CGMakeCollectable doesn't exist).
3091 if (cocoa::isRefType(ResultTy, "CF", FName) ||
3092 cocoa::isRefType(ResultTy, "CG", FName)) {
3093 canEval = isRetain(FD, FName) || isMakeCollectable(FD, FName);
3094 }
3095 }
3096
3097 if (!canEval)
3098 return false;
3099
3100 // Bind the return value.
Ted Kremenek5eca4822012-01-06 22:09:28 +00003101 const LocationContext *LCtx = C.getLocationContext();
3102 SVal RetVal = state->getSVal(CE->getArg(0), LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003103 if (RetVal.isUnknown()) {
3104 // If the receiver is unknown, conjure a return value.
3105 SValBuilder &SVB = C.getSValBuilder();
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003106 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003107 SVal RetVal = SVB.getConjuredSymbolVal(0, CE, LCtx, ResultTy, Count);
Jordy Rose76c506f2011-08-21 21:58:18 +00003108 }
Ted Kremenek5eca4822012-01-06 22:09:28 +00003109 state = state->BindExpr(CE, LCtx, RetVal, false);
Jordy Rose76c506f2011-08-21 21:58:18 +00003110
Jordy Rose294396b2011-08-22 23:48:23 +00003111 // FIXME: This should not be necessary, but otherwise the argument seems to be
3112 // considered alive during the next statement.
3113 if (const MemRegion *ArgRegion = RetVal.getAsRegion()) {
3114 // Save the refcount status of the argument.
3115 SymbolRef Sym = RetVal.getAsLocSymbol();
3116 RefBindings::data_type *Binding = 0;
3117 if (Sym)
3118 Binding = state->get<RefBindings>(Sym);
Jordy Rose76c506f2011-08-21 21:58:18 +00003119
Jordy Rose294396b2011-08-22 23:48:23 +00003120 // Invalidate the argument region.
Anna Zaks5d0ea6d2011-10-04 20:43:05 +00003121 unsigned Count = C.getCurrentBlockCount();
Ted Kremenek3133f792012-02-17 23:13:45 +00003122 state = state->invalidateRegions(ArgRegion, CE, Count, LCtx);
Jordy Rose76c506f2011-08-21 21:58:18 +00003123
Jordy Rose294396b2011-08-22 23:48:23 +00003124 // Restore the refcount status of the argument.
3125 if (Binding)
3126 state = state->set<RefBindings>(Sym, *Binding);
3127 }
3128
Anna Zaks0bd6b112011-10-26 21:06:34 +00003129 C.addTransition(state);
Jordy Rose76c506f2011-08-21 21:58:18 +00003130 return true;
3131}
3132
Jordy Rose910c4052011-09-02 06:44:22 +00003133//===----------------------------------------------------------------------===//
3134// Handle return statements.
3135//===----------------------------------------------------------------------===//
Jordy Rosef53e8c72011-08-23 19:43:16 +00003136
Ted Kremeneke5715782012-02-25 02:09:09 +00003137// Return true if the current LocationContext has no caller context.
3138static bool inTopFrame(CheckerContext &C) {
3139 const LocationContext *LC = C.getLocationContext();
3140 return LC->getParent() == 0;
3141}
3142
Jordy Rose910c4052011-09-02 06:44:22 +00003143void RetainCountChecker::checkPreStmt(const ReturnStmt *S,
3144 CheckerContext &C) const {
Ted Kremeneke5715782012-02-25 02:09:09 +00003145
3146 // Only adjust the reference count if this is the top-level call frame,
3147 // and not the result of inlining. In the future, we should do
3148 // better checking even for inlined calls, and see if they match
3149 // with their expected semantics (e.g., the method should return a retained
3150 // object, etc.).
3151 if (!inTopFrame(C))
3152 return;
3153
Jordy Rosef53e8c72011-08-23 19:43:16 +00003154 const Expr *RetE = S->getRetValue();
3155 if (!RetE)
3156 return;
3157
Ted Kremenek8bef8232012-01-26 21:29:00 +00003158 ProgramStateRef state = C.getState();
Ted Kremenek5eca4822012-01-06 22:09:28 +00003159 SymbolRef Sym =
3160 state->getSValAsScalarOrLoc(RetE, C.getLocationContext()).getAsLocSymbol();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003161 if (!Sym)
3162 return;
3163
3164 // Get the reference count binding (if any).
3165 const RefVal *T = state->get<RefBindings>(Sym);
3166 if (!T)
3167 return;
3168
3169 // Change the reference count.
3170 RefVal X = *T;
3171
3172 switch (X.getKind()) {
3173 case RefVal::Owned: {
3174 unsigned cnt = X.getCount();
3175 assert(cnt > 0);
3176 X.setCount(cnt - 1);
3177 X = X ^ RefVal::ReturnedOwned;
3178 break;
3179 }
3180
3181 case RefVal::NotOwned: {
3182 unsigned cnt = X.getCount();
3183 if (cnt) {
3184 X.setCount(cnt - 1);
3185 X = X ^ RefVal::ReturnedOwned;
3186 }
3187 else {
3188 X = X ^ RefVal::ReturnedNotOwned;
3189 }
3190 break;
3191 }
3192
3193 default:
3194 return;
3195 }
3196
3197 // Update the binding.
3198 state = state->set<RefBindings>(Sym, X);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003199 ExplodedNode *Pred = C.addTransition(state);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003200
3201 // At this point we have updated the state properly.
3202 // Everything after this is merely checking to see if the return value has
3203 // been over- or under-retained.
3204
3205 // Did we cache out?
3206 if (!Pred)
3207 return;
3208
Jordy Rosef53e8c72011-08-23 19:43:16 +00003209 // Update the autorelease counts.
3210 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003211 AutoreleaseTag("RetainCountChecker : Autorelease");
Anna Zaks4eff8232011-10-05 23:44:11 +00003212 GenericNodeBuilderRefCount Bd(C, &AutoreleaseTag);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003213 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C, Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003214
3215 // Did we cache out?
Jordy Rose8d228632011-08-23 20:07:14 +00003216 if (!Pred)
Jordy Rosef53e8c72011-08-23 19:43:16 +00003217 return;
3218
3219 // Get the updated binding.
3220 T = state->get<RefBindings>(Sym);
3221 assert(T);
3222 X = *T;
3223
3224 // Consult the summary of the enclosing method.
Jordy Rose17a38e22011-09-02 05:55:19 +00003225 RetainSummaryManager &Summaries = getSummaryManager(C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003226 const Decl *CD = &Pred->getCodeDecl();
3227
3228 if (const ObjCMethodDecl *MD = dyn_cast<ObjCMethodDecl>(CD)) {
3229 // Unlike regular functions, /all/ ObjC methods are assumed to always
3230 // follow Cocoa retain-count conventions, not just those with special
3231 // names or attributes.
Jordy Roseb6cfc092011-08-25 00:10:37 +00003232 const RetainSummary *Summ = Summaries.getMethodSummary(MD);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003233 RetEffect RE = Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet();
3234 checkReturnWithRetEffect(S, C, Pred, RE, X, Sym, state);
3235 }
3236
3237 if (const FunctionDecl *FD = dyn_cast<FunctionDecl>(CD)) {
3238 if (!isa<CXXMethodDecl>(FD))
Jordy Roseb6cfc092011-08-25 00:10:37 +00003239 if (const RetainSummary *Summ = Summaries.getSummary(FD))
Jordy Rosef53e8c72011-08-23 19:43:16 +00003240 checkReturnWithRetEffect(S, C, Pred, Summ->getRetEffect(), X,
3241 Sym, state);
3242 }
3243}
3244
Jordy Rose910c4052011-09-02 06:44:22 +00003245void RetainCountChecker::checkReturnWithRetEffect(const ReturnStmt *S,
3246 CheckerContext &C,
3247 ExplodedNode *Pred,
3248 RetEffect RE, RefVal X,
3249 SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003250 ProgramStateRef state) const {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003251 // Any leaks or other errors?
3252 if (X.isReturnedOwned() && X.getCount() == 0) {
3253 if (RE.getKind() != RetEffect::NoRet) {
3254 bool hasError = false;
Jordy Rose17a38e22011-09-02 05:55:19 +00003255 if (C.isObjCGCEnabled() && RE.getObjKind() == RetEffect::ObjC) {
Jordy Rosef53e8c72011-08-23 19:43:16 +00003256 // Things are more complicated with garbage collection. If the
3257 // returned object is suppose to be an Objective-C object, we have
3258 // a leak (as the caller expects a GC'ed object) because no
3259 // method should return ownership unless it returns a CF object.
3260 hasError = true;
3261 X = X ^ RefVal::ErrorGCLeakReturned;
3262 }
3263 else if (!RE.isOwned()) {
3264 // Either we are using GC and the returned object is a CF type
3265 // or we aren't using GC. In either case, we expect that the
3266 // enclosing method is expected to return ownership.
3267 hasError = true;
3268 X = X ^ RefVal::ErrorLeakReturned;
3269 }
3270
3271 if (hasError) {
3272 // Generate an error node.
3273 state = state->set<RefBindings>(Sym, X);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003274
3275 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003276 ReturnOwnLeakTag("RetainCountChecker : ReturnsOwnLeak");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003277 ExplodedNode *N = C.addTransition(state, Pred, &ReturnOwnLeakTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003278 if (N) {
David Blaikie4e4d0842012-03-11 07:00:24 +00003279 const LangOptions &LOpts = C.getASTContext().getLangOpts();
Jordy Rose17a38e22011-09-02 05:55:19 +00003280 bool GCEnabled = C.isObjCGCEnabled();
Jordy Rosef53e8c72011-08-23 19:43:16 +00003281 CFRefReport *report =
Jordy Rose17a38e22011-09-02 05:55:19 +00003282 new CFRefLeakReport(*getLeakAtReturnBug(LOpts, GCEnabled),
3283 LOpts, GCEnabled, SummaryLog,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003284 N, Sym, C);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003285 C.EmitReport(report);
3286 }
3287 }
3288 }
3289 } else if (X.isReturnedNotOwned()) {
3290 if (RE.isOwned()) {
3291 // Trying to return a not owned object to a caller expecting an
3292 // owned object.
3293 state = state->set<RefBindings>(Sym, X ^ RefVal::ErrorReturnedNotOwned);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003294
3295 static SimpleProgramPointTag
Jordy Rose910c4052011-09-02 06:44:22 +00003296 ReturnNotOwnedTag("RetainCountChecker : ReturnNotOwnedForOwned");
Anna Zaks0bd6b112011-10-26 21:06:34 +00003297 ExplodedNode *N = C.addTransition(state, Pred, &ReturnNotOwnedTag);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003298 if (N) {
Jordy Rosed6334e12011-08-25 00:34:03 +00003299 if (!returnNotOwnedForOwned)
3300 returnNotOwnedForOwned.reset(new ReturnedNotOwnedForOwned());
3301
Jordy Rosef53e8c72011-08-23 19:43:16 +00003302 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003303 new CFRefReport(*returnNotOwnedForOwned,
David Blaikie4e4d0842012-03-11 07:00:24 +00003304 C.getASTContext().getLangOpts(),
Jordy Rose17a38e22011-09-02 05:55:19 +00003305 C.isObjCGCEnabled(), SummaryLog, N, Sym);
Jordy Rosef53e8c72011-08-23 19:43:16 +00003306 C.EmitReport(report);
3307 }
3308 }
3309 }
3310}
3311
Jordy Rose8d228632011-08-23 20:07:14 +00003312//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003313// Check various ways a symbol can be invalidated.
3314//===----------------------------------------------------------------------===//
3315
Anna Zaks390909c2011-10-06 00:43:15 +00003316void RetainCountChecker::checkBind(SVal loc, SVal val, const Stmt *S,
Jordy Rose910c4052011-09-02 06:44:22 +00003317 CheckerContext &C) const {
3318 // Are we storing to something that causes the value to "escape"?
3319 bool escapes = true;
3320
3321 // A value escapes in three possible cases (this may change):
3322 //
3323 // (1) we are binding to something that is not a memory region.
3324 // (2) we are binding to a memregion that does not have stack storage
3325 // (3) we are binding to a memregion with stack storage that the store
3326 // does not understand.
Ted Kremenek8bef8232012-01-26 21:29:00 +00003327 ProgramStateRef state = C.getState();
Jordy Rose910c4052011-09-02 06:44:22 +00003328
3329 if (loc::MemRegionVal *regionLoc = dyn_cast<loc::MemRegionVal>(&loc)) {
3330 escapes = !regionLoc->getRegion()->hasStackStorage();
3331
3332 if (!escapes) {
3333 // To test (3), generate a new state with the binding added. If it is
3334 // the same state, then it escapes (since the store cannot represent
3335 // the binding).
3336 escapes = (state == (state->bindLoc(*regionLoc, val)));
3337 }
3338 }
3339
3340 // If our store can represent the binding and we aren't storing to something
3341 // that doesn't have local storage then just return and have the simulation
3342 // state continue as is.
3343 if (!escapes)
3344 return;
3345
3346 // Otherwise, find all symbols referenced by 'val' that we are tracking
3347 // and stop tracking them.
3348 state = state->scanReachableSymbols<StopTrackingCallback>(val).getState();
Anna Zaks0bd6b112011-10-26 21:06:34 +00003349 C.addTransition(state);
Jordy Rose910c4052011-09-02 06:44:22 +00003350}
3351
Ted Kremenek8bef8232012-01-26 21:29:00 +00003352ProgramStateRef RetainCountChecker::evalAssume(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003353 SVal Cond,
3354 bool Assumption) const {
3355
3356 // FIXME: We may add to the interface of evalAssume the list of symbols
3357 // whose assumptions have changed. For now we just iterate through the
3358 // bindings and check if any of the tracked symbols are NULL. This isn't
3359 // too bad since the number of symbols we will track in practice are
3360 // probably small and evalAssume is only called at branches and a few
3361 // other places.
3362 RefBindings B = state->get<RefBindings>();
3363
3364 if (B.isEmpty())
3365 return state;
3366
3367 bool changed = false;
3368 RefBindings::Factory &RefBFactory = state->get_context<RefBindings>();
3369
3370 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3371 // Check if the symbol is null (or equal to any constant).
3372 // If this is the case, stop tracking the symbol.
3373 if (state->getSymVal(I.getKey())) {
3374 changed = true;
3375 B = RefBFactory.remove(B, I.getKey());
3376 }
3377 }
3378
3379 if (changed)
3380 state = state->set<RefBindings>(B);
3381
3382 return state;
3383}
3384
Ted Kremenek8bef8232012-01-26 21:29:00 +00003385ProgramStateRef
3386RetainCountChecker::checkRegionChanges(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003387 const StoreManager::InvalidatedSymbols *invalidated,
3388 ArrayRef<const MemRegion *> ExplicitRegions,
Anna Zaks66c40402012-02-14 21:55:24 +00003389 ArrayRef<const MemRegion *> Regions,
3390 const CallOrObjCMessage *Call) const {
Jordy Rose910c4052011-09-02 06:44:22 +00003391 if (!invalidated)
3392 return state;
3393
3394 llvm::SmallPtrSet<SymbolRef, 8> WhitelistedSymbols;
3395 for (ArrayRef<const MemRegion *>::iterator I = ExplicitRegions.begin(),
3396 E = ExplicitRegions.end(); I != E; ++I) {
3397 if (const SymbolicRegion *SR = (*I)->StripCasts()->getAs<SymbolicRegion>())
3398 WhitelistedSymbols.insert(SR->getSymbol());
3399 }
3400
3401 for (StoreManager::InvalidatedSymbols::const_iterator I=invalidated->begin(),
3402 E = invalidated->end(); I!=E; ++I) {
3403 SymbolRef sym = *I;
3404 if (WhitelistedSymbols.count(sym))
3405 continue;
3406 // Remove any existing reference-count binding.
3407 state = state->remove<RefBindings>(sym);
3408 }
3409 return state;
3410}
3411
3412//===----------------------------------------------------------------------===//
Jordy Rose8d228632011-08-23 20:07:14 +00003413// Handle dead symbols and end-of-path.
3414//===----------------------------------------------------------------------===//
3415
Ted Kremenek8bef8232012-01-26 21:29:00 +00003416std::pair<ExplodedNode *, ProgramStateRef >
3417RetainCountChecker::handleAutoreleaseCounts(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003418 GenericNodeBuilderRefCount Bd,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003419 ExplodedNode *Pred,
3420 CheckerContext &Ctx,
Jordy Rose910c4052011-09-02 06:44:22 +00003421 SymbolRef Sym, RefVal V) const {
Jordy Rose8d228632011-08-23 20:07:14 +00003422 unsigned ACnt = V.getAutoreleaseCount();
3423
3424 // No autorelease counts? Nothing to be done.
3425 if (!ACnt)
3426 return std::make_pair(Pred, state);
3427
Anna Zaks6a93bd52011-10-25 19:57:11 +00003428 assert(!Ctx.isObjCGCEnabled() && "Autorelease counts in GC mode?");
Jordy Rose8d228632011-08-23 20:07:14 +00003429 unsigned Cnt = V.getCount();
3430
3431 // FIXME: Handle sending 'autorelease' to already released object.
3432
3433 if (V.getKind() == RefVal::ReturnedOwned)
3434 ++Cnt;
3435
3436 if (ACnt <= Cnt) {
3437 if (ACnt == Cnt) {
3438 V.clearCounts();
3439 if (V.getKind() == RefVal::ReturnedOwned)
3440 V = V ^ RefVal::ReturnedNotOwned;
3441 else
3442 V = V ^ RefVal::NotOwned;
3443 } else {
3444 V.setCount(Cnt - ACnt);
3445 V.setAutoreleaseCount(0);
3446 }
3447 state = state->set<RefBindings>(Sym, V);
3448 ExplodedNode *N = Bd.MakeNode(state, Pred);
3449 if (N == 0)
3450 state = 0;
3451 return std::make_pair(N, state);
3452 }
3453
3454 // Woah! More autorelease counts then retain counts left.
3455 // Emit hard error.
3456 V = V ^ RefVal::ErrorOverAutorelease;
3457 state = state->set<RefBindings>(Sym, V);
3458
Anna Zaksf05aac82011-10-18 23:05:58 +00003459 if (ExplodedNode *N = Bd.MakeNode(state, Pred, true)) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003460 SmallString<128> sbuf;
Jordy Rose8d228632011-08-23 20:07:14 +00003461 llvm::raw_svector_ostream os(sbuf);
3462 os << "Object over-autoreleased: object was sent -autorelease ";
3463 if (V.getAutoreleaseCount() > 1)
3464 os << V.getAutoreleaseCount() << " times ";
3465 os << "but the object has a +" << V.getCount() << " retain count";
3466
Jordy Rosed6334e12011-08-25 00:34:03 +00003467 if (!overAutorelease)
3468 overAutorelease.reset(new OverAutorelease());
3469
David Blaikie4e4d0842012-03-11 07:00:24 +00003470 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Jordy Rose8d228632011-08-23 20:07:14 +00003471 CFRefReport *report =
Jordy Rosed6334e12011-08-25 00:34:03 +00003472 new CFRefReport(*overAutorelease, LOpts, /* GCEnabled = */ false,
3473 SummaryLog, N, Sym, os.str());
Anna Zaks6a93bd52011-10-25 19:57:11 +00003474 Ctx.EmitReport(report);
Jordy Rose8d228632011-08-23 20:07:14 +00003475 }
3476
Ted Kremenek8bef8232012-01-26 21:29:00 +00003477 return std::make_pair((ExplodedNode *)0, (ProgramStateRef )0);
Jordy Rose8d228632011-08-23 20:07:14 +00003478}
Jordy Rose38f17d62011-08-23 19:01:07 +00003479
Ted Kremenek8bef8232012-01-26 21:29:00 +00003480ProgramStateRef
3481RetainCountChecker::handleSymbolDeath(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003482 SymbolRef sid, RefVal V,
Jordy Rose38f17d62011-08-23 19:01:07 +00003483 SmallVectorImpl<SymbolRef> &Leaked) const {
Jordy Rose53376122011-08-24 04:48:19 +00003484 bool hasLeak = false;
Jordy Rose38f17d62011-08-23 19:01:07 +00003485 if (V.isOwned())
3486 hasLeak = true;
3487 else if (V.isNotOwned() || V.isReturnedOwned())
3488 hasLeak = (V.getCount() > 0);
3489
3490 if (!hasLeak)
3491 return state->remove<RefBindings>(sid);
3492
3493 Leaked.push_back(sid);
3494 return state->set<RefBindings>(sid, V ^ RefVal::ErrorLeak);
3495}
3496
3497ExplodedNode *
Ted Kremenek8bef8232012-01-26 21:29:00 +00003498RetainCountChecker::processLeaks(ProgramStateRef state,
Jordy Rose910c4052011-09-02 06:44:22 +00003499 SmallVectorImpl<SymbolRef> &Leaked,
3500 GenericNodeBuilderRefCount &Builder,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003501 CheckerContext &Ctx,
3502 ExplodedNode *Pred) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003503 if (Leaked.empty())
3504 return Pred;
3505
3506 // Generate an intermediate node representing the leak point.
3507 ExplodedNode *N = Builder.MakeNode(state, Pred);
3508
3509 if (N) {
3510 for (SmallVectorImpl<SymbolRef>::iterator
3511 I = Leaked.begin(), E = Leaked.end(); I != E; ++I) {
3512
David Blaikie4e4d0842012-03-11 07:00:24 +00003513 const LangOptions &LOpts = Ctx.getASTContext().getLangOpts();
Anna Zaks6a93bd52011-10-25 19:57:11 +00003514 bool GCEnabled = Ctx.isObjCGCEnabled();
Jordy Rose17a38e22011-09-02 05:55:19 +00003515 CFRefBug *BT = Pred ? getLeakWithinFunctionBug(LOpts, GCEnabled)
3516 : getLeakAtReturnBug(LOpts, GCEnabled);
Jordy Rose38f17d62011-08-23 19:01:07 +00003517 assert(BT && "BugType not initialized.");
Jordy Rose20589562011-08-24 22:39:09 +00003518
Jordy Rose17a38e22011-09-02 05:55:19 +00003519 CFRefLeakReport *report = new CFRefLeakReport(*BT, LOpts, GCEnabled,
Anna Zaks6a93bd52011-10-25 19:57:11 +00003520 SummaryLog, N, *I, Ctx);
3521 Ctx.EmitReport(report);
Jordy Rose38f17d62011-08-23 19:01:07 +00003522 }
3523 }
3524
3525 return N;
3526}
3527
Anna Zaksaf498a22011-10-25 19:56:48 +00003528void RetainCountChecker::checkEndPath(CheckerContext &Ctx) const {
Ted Kremenek8bef8232012-01-26 21:29:00 +00003529 ProgramStateRef state = Ctx.getState();
Anna Zaksaf498a22011-10-25 19:56:48 +00003530 GenericNodeBuilderRefCount Bd(Ctx);
Jordy Rose38f17d62011-08-23 19:01:07 +00003531 RefBindings B = state->get<RefBindings>();
Anna Zaksaf498a22011-10-25 19:56:48 +00003532 ExplodedNode *Pred = Ctx.getPredecessor();
Jordy Rose38f17d62011-08-23 19:01:07 +00003533
3534 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
Anna Zaks6a93bd52011-10-25 19:57:11 +00003535 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, Ctx,
Jordy Rose8d228632011-08-23 20:07:14 +00003536 I->first, I->second);
3537 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003538 return;
3539 }
3540
Ted Kremenek0cf3d472012-02-07 00:24:33 +00003541 // If the current LocationContext has a parent, don't check for leaks.
3542 // We will do that later.
3543 // FIXME: we should instead check for imblances of the retain/releases,
3544 // and suggest annotations.
3545 if (Ctx.getLocationContext()->getParent())
3546 return;
3547
Jordy Rose38f17d62011-08-23 19:01:07 +00003548 B = state->get<RefBindings>();
3549 SmallVector<SymbolRef, 10> Leaked;
3550
3551 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I)
Jordy Rose8d228632011-08-23 20:07:14 +00003552 state = handleSymbolDeath(state, I->first, I->second, Leaked);
Jordy Rose38f17d62011-08-23 19:01:07 +00003553
Anna Zaks6a93bd52011-10-25 19:57:11 +00003554 processLeaks(state, Leaked, Bd, Ctx, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003555}
3556
3557const ProgramPointTag *
Jordy Rose910c4052011-09-02 06:44:22 +00003558RetainCountChecker::getDeadSymbolTag(SymbolRef sym) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003559 const SimpleProgramPointTag *&tag = DeadSymbolTags[sym];
3560 if (!tag) {
Dylan Noblesmithf7ccbad2012-02-05 02:13:05 +00003561 SmallString<64> buf;
Jordy Rose38f17d62011-08-23 19:01:07 +00003562 llvm::raw_svector_ostream out(buf);
Anna Zaksf62ceec2011-12-05 18:58:11 +00003563 out << "RetainCountChecker : Dead Symbol : ";
3564 sym->dumpToStream(out);
Jordy Rose38f17d62011-08-23 19:01:07 +00003565 tag = new SimpleProgramPointTag(out.str());
3566 }
3567 return tag;
3568}
3569
Jordy Rose910c4052011-09-02 06:44:22 +00003570void RetainCountChecker::checkDeadSymbols(SymbolReaper &SymReaper,
3571 CheckerContext &C) const {
Jordy Rose38f17d62011-08-23 19:01:07 +00003572 ExplodedNode *Pred = C.getPredecessor();
3573
Ted Kremenek8bef8232012-01-26 21:29:00 +00003574 ProgramStateRef state = C.getState();
Jordy Rose38f17d62011-08-23 19:01:07 +00003575 RefBindings B = state->get<RefBindings>();
3576
3577 // Update counts from autorelease pools
3578 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3579 E = SymReaper.dead_end(); I != E; ++I) {
3580 SymbolRef Sym = *I;
3581 if (const RefVal *T = B.lookup(Sym)){
3582 // Use the symbol as the tag.
3583 // FIXME: This might not be as unique as we would like.
Anna Zaks4eff8232011-10-05 23:44:11 +00003584 GenericNodeBuilderRefCount Bd(C, getDeadSymbolTag(Sym));
Anna Zaks6a93bd52011-10-25 19:57:11 +00003585 llvm::tie(Pred, state) = handleAutoreleaseCounts(state, Bd, Pred, C,
Jordy Rose8d228632011-08-23 20:07:14 +00003586 Sym, *T);
3587 if (!state)
Jordy Rose38f17d62011-08-23 19:01:07 +00003588 return;
3589 }
3590 }
3591
3592 B = state->get<RefBindings>();
3593 SmallVector<SymbolRef, 10> Leaked;
3594
3595 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3596 E = SymReaper.dead_end(); I != E; ++I) {
3597 if (const RefVal *T = B.lookup(*I))
3598 state = handleSymbolDeath(state, *I, *T, Leaked);
3599 }
3600
3601 {
Anna Zaks4eff8232011-10-05 23:44:11 +00003602 GenericNodeBuilderRefCount Bd(C, this);
Anna Zaks6a93bd52011-10-25 19:57:11 +00003603 Pred = processLeaks(state, Leaked, Bd, C, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003604 }
3605
3606 // Did we cache out?
3607 if (!Pred)
3608 return;
3609
3610 // Now generate a new node that nukes the old bindings.
3611 RefBindings::Factory &F = state->get_context<RefBindings>();
3612
3613 for (SymbolReaper::dead_iterator I = SymReaper.dead_begin(),
3614 E = SymReaper.dead_end(); I != E; ++I)
3615 B = F.remove(B, *I);
3616
3617 state = state->set<RefBindings>(B);
Anna Zaks0bd6b112011-10-26 21:06:34 +00003618 C.addTransition(state, Pred);
Jordy Rose38f17d62011-08-23 19:01:07 +00003619}
3620
Ted Kremenekd593eb92009-11-25 22:17:44 +00003621//===----------------------------------------------------------------------===//
Jordy Rosedbd658e2011-08-28 19:11:56 +00003622// Debug printing of refcount bindings and autorelease pools.
3623//===----------------------------------------------------------------------===//
3624
3625static void PrintPool(raw_ostream &Out, SymbolRef Sym,
Ted Kremenek8bef8232012-01-26 21:29:00 +00003626 ProgramStateRef State) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003627 Out << ' ';
3628 if (Sym)
Anna Zaksf62ceec2011-12-05 18:58:11 +00003629 Sym->dumpToStream(Out);
Jordy Rosedbd658e2011-08-28 19:11:56 +00003630 else
3631 Out << "<pool>";
3632 Out << ":{";
3633
3634 // Get the contents of the pool.
3635 if (const ARCounts *Cnts = State->get<AutoreleasePoolContents>(Sym))
3636 for (ARCounts::iterator I = Cnts->begin(), E = Cnts->end(); I != E; ++I)
3637 Out << '(' << I.getKey() << ',' << I.getData() << ')';
3638
3639 Out << '}';
3640}
3641
Ted Kremenek8bef8232012-01-26 21:29:00 +00003642static bool UsesAutorelease(ProgramStateRef state) {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003643 // A state uses autorelease if it allocated an autorelease pool or if it has
3644 // objects in the caller's autorelease pool.
3645 return !state->get<AutoreleaseStack>().isEmpty() ||
3646 state->get<AutoreleasePoolContents>(SymbolRef());
3647}
3648
Ted Kremenek8bef8232012-01-26 21:29:00 +00003649void RetainCountChecker::printState(raw_ostream &Out, ProgramStateRef State,
Jordy Rose910c4052011-09-02 06:44:22 +00003650 const char *NL, const char *Sep) const {
Jordy Rosedbd658e2011-08-28 19:11:56 +00003651
3652 RefBindings B = State->get<RefBindings>();
3653
3654 if (!B.isEmpty())
3655 Out << Sep << NL;
3656
3657 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
3658 Out << I->first << " : ";
3659 I->second.print(Out);
3660 Out << NL;
3661 }
3662
3663 // Print the autorelease stack.
3664 if (UsesAutorelease(State)) {
3665 Out << Sep << NL << "AR pool stack:";
3666 ARStack Stack = State->get<AutoreleaseStack>();
3667
3668 PrintPool(Out, SymbolRef(), State); // Print the caller's pool.
3669 for (ARStack::iterator I = Stack.begin(), E = Stack.end(); I != E; ++I)
3670 PrintPool(Out, *I, State);
3671
3672 Out << NL;
3673 }
3674}
3675
3676//===----------------------------------------------------------------------===//
Jordy Rose910c4052011-09-02 06:44:22 +00003677// Checker registration.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00003678//===----------------------------------------------------------------------===//
3679
Jordy Rose17a38e22011-09-02 05:55:19 +00003680void ento::registerRetainCountChecker(CheckerManager &Mgr) {
Jordy Rose910c4052011-09-02 06:44:22 +00003681 Mgr.registerChecker<RetainCountChecker>();
Jordy Rose17a38e22011-09-02 05:55:19 +00003682}
3683