blob: fe7a1989704f57838441008a5a584f9fb906f56b [file] [log] [blame]
Chris Lattnerbda0b622008-03-15 23:59:48 +00001// CFRefCount.cpp - Transfer functions for tracking simple values -*- C++ -*--//
Ted Kremenek2fff37e2008-03-06 00:08:09 +00002//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9//
Gabor Greif843e9342008-03-06 10:40:09 +000010// This file defines the methods for CFRefCount, which implements
Ted Kremenek2fff37e2008-03-06 00:08:09 +000011// a reference count checker for Core Foundation (Mac OS X).
12//
13//===----------------------------------------------------------------------===//
14
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000015#include "GRSimpleVals.h"
Ted Kremenek072192b2008-04-30 23:47:44 +000016#include "clang/Basic/LangOptions.h"
Ted Kremenekc9fa2f72008-05-01 23:13:35 +000017#include "clang/Basic/SourceManager.h"
Ted Kremenek4adc81e2008-08-13 04:27:00 +000018#include "clang/Analysis/PathSensitive/GRState.h"
Ted Kremenekb9d17f92008-08-17 03:20:02 +000019#include "clang/Analysis/PathSensitive/GRStateTrait.h"
Ted Kremenek4dc41cc2008-03-31 18:26:32 +000020#include "clang/Analysis/PathDiagnostic.h"
Ted Kremenek2fff37e2008-03-06 00:08:09 +000021#include "clang/Analysis/LocalCheckers.h"
Ted Kremenekfa34b332008-04-09 01:10:13 +000022#include "clang/Analysis/PathDiagnostic.h"
23#include "clang/Analysis/PathSensitive/BugReporter.h"
Daniel Dunbarc4a1dea2008-08-11 05:35:13 +000024#include "clang/AST/DeclObjC.h"
Ted Kremenek6b3a0f72008-03-11 06:39:11 +000025#include "llvm/ADT/DenseMap.h"
26#include "llvm/ADT/FoldingSet.h"
27#include "llvm/ADT/ImmutableMap.h"
Ted Kremenek6d348932008-10-21 15:53:15 +000028#include "llvm/ADT/ImmutableList.h"
Ted Kremenek900a2d72008-05-07 18:36:45 +000029#include "llvm/ADT/StringExtras.h"
Ted Kremenekfa34b332008-04-09 01:10:13 +000030#include "llvm/Support/Compiler.h"
Ted Kremenek6ed9afc2008-05-16 18:33:44 +000031#include "llvm/ADT/STLExtras.h"
Ted Kremenekf3948042008-03-11 19:44:10 +000032#include <ostream>
Ted Kremenek2cf943a2008-04-18 04:55:01 +000033#include <sstream>
Ted Kremenek98530452008-08-12 20:41:56 +000034#include <stdarg.h>
Ted Kremenek2fff37e2008-03-06 00:08:09 +000035
36using namespace clang;
Ted Kremenek5c74d502008-10-24 21:18:08 +000037
38//===----------------------------------------------------------------------===//
39// Utility functions.
40//===----------------------------------------------------------------------===//
41
Ted Kremenek900a2d72008-05-07 18:36:45 +000042using llvm::CStrInCStrNoCase;
Ted Kremenek2fff37e2008-03-06 00:08:09 +000043
Ted Kremenek5c74d502008-10-24 21:18:08 +000044// The "fundamental rule" for naming conventions of methods:
45// (url broken into two lines)
46// http://developer.apple.com/documentation/Cocoa/Conceptual/
47// MemoryMgmt/Tasks/MemoryManagementRules.html
48//
49// "You take ownership of an object if you create it using a method whose name
50// begins with “alloc” or “new” or contains “copy” (for example, alloc,
51// newObject, or mutableCopy), or if you send it a retain message. You are
52// responsible for relinquishing ownership of objects you own using release
53// or autorelease. Any other time you receive an object, you must
54// not release it."
55//
56static bool followsFundamentalRule(const char* s) {
57 return CStrInCStrNoCase(s, "create") || CStrInCStrNoCase(s, "copy") ||
58 CStrInCStrNoCase(s, "new") == s || CStrInCStrNoCase(s, "alloc") == s;
59}
60
Ted Kremenek05cbe1a2008-04-09 23:49:11 +000061//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +000062// Selector creation functions.
Ted Kremenek4fd88972008-04-17 18:12:53 +000063//===----------------------------------------------------------------------===//
64
Ted Kremenekb83e02e2008-05-01 18:31:44 +000065static inline Selector GetNullarySelector(const char* name, ASTContext& Ctx) {
Ted Kremenek4fd88972008-04-17 18:12:53 +000066 IdentifierInfo* II = &Ctx.Idents.get(name);
67 return Ctx.Selectors.getSelector(0, &II);
68}
69
Ted Kremenek9c32d082008-05-06 00:30:21 +000070static inline Selector GetUnarySelector(const char* name, ASTContext& Ctx) {
71 IdentifierInfo* II = &Ctx.Idents.get(name);
72 return Ctx.Selectors.getSelector(1, &II);
73}
74
Ted Kremenek553cf182008-06-25 21:21:56 +000075//===----------------------------------------------------------------------===//
76// Type querying functions.
77//===----------------------------------------------------------------------===//
78
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +000079static bool isCFRefType(QualType T) {
80
81 if (!T->isPointerType())
82 return false;
83
Ted Kremenek553cf182008-06-25 21:21:56 +000084 // Check the typedef for the name "CF" and the substring "Ref".
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +000085 TypedefType* TD = dyn_cast<TypedefType>(T.getTypePtr());
86
87 if (!TD)
88 return false;
89
90 const char* TDName = TD->getDecl()->getIdentifier()->getName();
91 assert (TDName);
92
93 if (TDName[0] != 'C' || TDName[1] != 'F')
94 return false;
95
96 if (strstr(TDName, "Ref") == 0)
97 return false;
98
99 return true;
100}
101
Ted Kremenek37d785b2008-07-15 16:50:12 +0000102static bool isCGRefType(QualType T) {
103
104 if (!T->isPointerType())
105 return false;
106
107 // Check the typedef for the name "CG" and the substring "Ref".
108 TypedefType* TD = dyn_cast<TypedefType>(T.getTypePtr());
109
110 if (!TD)
111 return false;
112
113 const char* TDName = TD->getDecl()->getIdentifier()->getName();
114 assert (TDName);
115
116 if (TDName[0] != 'C' || TDName[1] != 'G')
117 return false;
118
119 if (strstr(TDName, "Ref") == 0)
120 return false;
121
122 return true;
123}
124
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +0000125static bool isNSType(QualType T) {
126
127 if (!T->isPointerType())
128 return false;
129
130 ObjCInterfaceType* OT = dyn_cast<ObjCInterfaceType>(T.getTypePtr());
131
132 if (!OT)
133 return false;
134
135 const char* ClsName = OT->getDecl()->getIdentifier()->getName();
136 assert (ClsName);
137
138 if (ClsName[0] != 'N' || ClsName[1] != 'S')
139 return false;
140
141 return true;
142}
143
Ted Kremenek4fd88972008-04-17 18:12:53 +0000144//===----------------------------------------------------------------------===//
Ted Kremenek553cf182008-06-25 21:21:56 +0000145// Primitives used for constructing summaries for function/method calls.
Ted Kremenek05cbe1a2008-04-09 23:49:11 +0000146//===----------------------------------------------------------------------===//
147
Ted Kremenek553cf182008-06-25 21:21:56 +0000148namespace {
149/// ArgEffect is used to summarize a function/method call's effect on a
150/// particular argument.
Ted Kremenek070a8252008-07-09 18:11:16 +0000151enum ArgEffect { IncRef, DecRef, DoNothing, DoNothingByRef,
152 StopTracking, MayEscape, SelfOwn, Autorelease };
Ted Kremenek553cf182008-06-25 21:21:56 +0000153
154/// ArgEffects summarizes the effects of a function/method call on all of
155/// its arguments.
156typedef std::vector<std::pair<unsigned,ArgEffect> > ArgEffects;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000157}
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000158
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000159namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000160template <> struct FoldingSetTrait<ArgEffects> {
161 static void Profile(const ArgEffects& X, FoldingSetNodeID& ID) {
162 for (ArgEffects::const_iterator I = X.begin(), E = X.end(); I!= E; ++I) {
163 ID.AddInteger(I->first);
164 ID.AddInteger((unsigned) I->second);
165 }
166 }
167};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000168} // end llvm namespace
169
170namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +0000171
172/// RetEffect is used to summarize a function/method call's behavior with
173/// respect to its return value.
174class VISIBILITY_HIDDEN RetEffect {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000175public:
Ted Kremeneka7344702008-06-23 18:02:52 +0000176 enum Kind { NoRet, Alias, OwnedSymbol, OwnedAllocatedSymbol,
177 NotOwnedSymbol, ReceiverAlias };
Ted Kremenek553cf182008-06-25 21:21:56 +0000178
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000179private:
180 unsigned Data;
Ted Kremenek553cf182008-06-25 21:21:56 +0000181 RetEffect(Kind k, unsigned D = 0) { Data = (D << 3) | (unsigned) k; }
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000182
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000183public:
Ted Kremenek553cf182008-06-25 21:21:56 +0000184
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000185 Kind getKind() const { return (Kind) (Data & 0x7); }
Ted Kremenek553cf182008-06-25 21:21:56 +0000186
187 unsigned getIndex() const {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000188 assert(getKind() == Alias);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000189 return Data >> 3;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000190 }
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000191
Ted Kremenek553cf182008-06-25 21:21:56 +0000192 static RetEffect MakeAlias(unsigned Idx) {
193 return RetEffect(Alias, Idx);
194 }
195 static RetEffect MakeReceiverAlias() {
196 return RetEffect(ReceiverAlias);
197 }
Ted Kremeneka7344702008-06-23 18:02:52 +0000198 static RetEffect MakeOwned(bool isAllocated = false) {
Ted Kremenek553cf182008-06-25 21:21:56 +0000199 return RetEffect(isAllocated ? OwnedAllocatedSymbol : OwnedSymbol);
200 }
201 static RetEffect MakeNotOwned() {
202 return RetEffect(NotOwnedSymbol);
203 }
204 static RetEffect MakeNoRet() {
205 return RetEffect(NoRet);
Ted Kremeneka7344702008-06-23 18:02:52 +0000206 }
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000207
Ted Kremenek553cf182008-06-25 21:21:56 +0000208 operator Kind() const {
209 return getKind();
210 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000211
Ted Kremenek553cf182008-06-25 21:21:56 +0000212 void Profile(llvm::FoldingSetNodeID& ID) const {
213 ID.AddInteger(Data);
214 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000215};
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000216
Ted Kremenek553cf182008-06-25 21:21:56 +0000217
218class VISIBILITY_HIDDEN RetainSummary : public llvm::FoldingSetNode {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000219 /// Args - an ordered vector of (index, ArgEffect) pairs, where index
220 /// specifies the argument (starting from 0). This can be sparsely
221 /// populated; arguments with no entry in Args use 'DefaultArgEffect'.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000222 ArgEffects* Args;
Ted Kremenek1bffd742008-05-06 15:44:25 +0000223
224 /// DefaultArgEffect - The default ArgEffect to apply to arguments that
225 /// do not have an entry in Args.
226 ArgEffect DefaultArgEffect;
227
Ted Kremenek553cf182008-06-25 21:21:56 +0000228 /// Receiver - If this summary applies to an Objective-C message expression,
229 /// this is the effect applied to the state of the receiver.
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000230 ArgEffect Receiver;
Ted Kremenek553cf182008-06-25 21:21:56 +0000231
232 /// Ret - The effect on the return value. Used to indicate if the
233 /// function/method call returns a new tracked symbol, returns an
234 /// alias of one of the arguments in the call, and so on.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000235 RetEffect Ret;
Ted Kremenek553cf182008-06-25 21:21:56 +0000236
Ted Kremenek70a733e2008-07-18 17:24:20 +0000237 /// EndPath - Indicates that execution of this method/function should
238 /// terminate the simulation of a path.
239 bool EndPath;
240
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000241public:
242
Ted Kremenek1bffd742008-05-06 15:44:25 +0000243 RetainSummary(ArgEffects* A, RetEffect R, ArgEffect defaultEff,
Ted Kremenek70a733e2008-07-18 17:24:20 +0000244 ArgEffect ReceiverEff, bool endpath = false)
245 : Args(A), DefaultArgEffect(defaultEff), Receiver(ReceiverEff), Ret(R),
246 EndPath(endpath) {}
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000247
Ted Kremenek553cf182008-06-25 21:21:56 +0000248 /// getArg - Return the argument effect on the argument specified by
249 /// idx (starting from 0).
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000250 ArgEffect getArg(unsigned idx) const {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000251
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000252 if (!Args)
Ted Kremenek1bffd742008-05-06 15:44:25 +0000253 return DefaultArgEffect;
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000254
255 // If Args is present, it is likely to contain only 1 element.
256 // Just do a linear search. Do it from the back because functions with
257 // large numbers of arguments will be tail heavy with respect to which
Ted Kremenek553cf182008-06-25 21:21:56 +0000258 // argument they actually modify with respect to the reference count.
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000259 for (ArgEffects::reverse_iterator I=Args->rbegin(), E=Args->rend();
260 I!=E; ++I) {
261
262 if (idx > I->first)
Ted Kremenek1bffd742008-05-06 15:44:25 +0000263 return DefaultArgEffect;
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000264
265 if (idx == I->first)
266 return I->second;
267 }
268
Ted Kremenek1bffd742008-05-06 15:44:25 +0000269 return DefaultArgEffect;
Ted Kremenek1ac08d62008-03-11 17:48:22 +0000270 }
271
Ted Kremenek553cf182008-06-25 21:21:56 +0000272 /// getRetEffect - Returns the effect on the return value of the call.
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000273 RetEffect getRetEffect() const {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000274 return Ret;
275 }
276
Ted Kremenek70a733e2008-07-18 17:24:20 +0000277 /// isEndPath - Returns true if executing the given method/function should
278 /// terminate the path.
279 bool isEndPath() const { return EndPath; }
280
Ted Kremenek553cf182008-06-25 21:21:56 +0000281 /// getReceiverEffect - Returns the effect on the receiver of the call.
282 /// This is only meaningful if the summary applies to an ObjCMessageExpr*.
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000283 ArgEffect getReceiverEffect() const {
284 return Receiver;
285 }
286
Ted Kremenek55499762008-06-17 02:43:46 +0000287 typedef ArgEffects::const_iterator ExprIterator;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000288
Ted Kremenek55499762008-06-17 02:43:46 +0000289 ExprIterator begin_args() const { return Args->begin(); }
290 ExprIterator end_args() const { return Args->end(); }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000291
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000292 static void Profile(llvm::FoldingSetNodeID& ID, ArgEffects* A,
Ted Kremenek1bffd742008-05-06 15:44:25 +0000293 RetEffect RetEff, ArgEffect DefaultEff,
Ted Kremenek2d1086c2008-07-18 17:39:56 +0000294 ArgEffect ReceiverEff, bool EndPath) {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000295 ID.AddPointer(A);
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000296 ID.Add(RetEff);
Ted Kremenek1bffd742008-05-06 15:44:25 +0000297 ID.AddInteger((unsigned) DefaultEff);
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000298 ID.AddInteger((unsigned) ReceiverEff);
Ted Kremenek2d1086c2008-07-18 17:39:56 +0000299 ID.AddInteger((unsigned) EndPath);
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000300 }
301
302 void Profile(llvm::FoldingSetNodeID& ID) const {
Ted Kremenek2d1086c2008-07-18 17:39:56 +0000303 Profile(ID, Args, Ret, DefaultArgEffect, Receiver, EndPath);
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000304 }
305};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000306} // end anonymous namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000307
Ted Kremenek553cf182008-06-25 21:21:56 +0000308//===----------------------------------------------------------------------===//
309// Data structures for constructing summaries.
310//===----------------------------------------------------------------------===//
Ted Kremenek53301ba2008-06-24 03:49:48 +0000311
Ted Kremenek553cf182008-06-25 21:21:56 +0000312namespace {
313class VISIBILITY_HIDDEN ObjCSummaryKey {
314 IdentifierInfo* II;
315 Selector S;
316public:
317 ObjCSummaryKey(IdentifierInfo* ii, Selector s)
318 : II(ii), S(s) {}
319
320 ObjCSummaryKey(ObjCInterfaceDecl* d, Selector s)
321 : II(d ? d->getIdentifier() : 0), S(s) {}
322
323 ObjCSummaryKey(Selector s)
324 : II(0), S(s) {}
325
326 IdentifierInfo* getIdentifier() const { return II; }
327 Selector getSelector() const { return S; }
328};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000329}
330
331namespace llvm {
Ted Kremenek553cf182008-06-25 21:21:56 +0000332template <> struct DenseMapInfo<ObjCSummaryKey> {
333 static inline ObjCSummaryKey getEmptyKey() {
334 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getEmptyKey(),
335 DenseMapInfo<Selector>::getEmptyKey());
336 }
Ted Kremenek4f22a782008-06-23 23:30:29 +0000337
Ted Kremenek553cf182008-06-25 21:21:56 +0000338 static inline ObjCSummaryKey getTombstoneKey() {
339 return ObjCSummaryKey(DenseMapInfo<IdentifierInfo*>::getTombstoneKey(),
340 DenseMapInfo<Selector>::getTombstoneKey());
341 }
342
343 static unsigned getHashValue(const ObjCSummaryKey &V) {
344 return (DenseMapInfo<IdentifierInfo*>::getHashValue(V.getIdentifier())
345 & 0x88888888)
346 | (DenseMapInfo<Selector>::getHashValue(V.getSelector())
347 & 0x55555555);
348 }
349
350 static bool isEqual(const ObjCSummaryKey& LHS, const ObjCSummaryKey& RHS) {
351 return DenseMapInfo<IdentifierInfo*>::isEqual(LHS.getIdentifier(),
352 RHS.getIdentifier()) &&
353 DenseMapInfo<Selector>::isEqual(LHS.getSelector(),
354 RHS.getSelector());
355 }
356
357 static bool isPod() {
358 return DenseMapInfo<ObjCInterfaceDecl*>::isPod() &&
359 DenseMapInfo<Selector>::isPod();
360 }
361};
Ted Kremenek4f22a782008-06-23 23:30:29 +0000362} // end llvm namespace
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000363
Ted Kremenek4f22a782008-06-23 23:30:29 +0000364namespace {
Ted Kremenek553cf182008-06-25 21:21:56 +0000365class VISIBILITY_HIDDEN ObjCSummaryCache {
366 typedef llvm::DenseMap<ObjCSummaryKey, RetainSummary*> MapTy;
367 MapTy M;
368public:
369 ObjCSummaryCache() {}
370
371 typedef MapTy::iterator iterator;
372
373 iterator find(ObjCInterfaceDecl* D, Selector S) {
374
375 // Do a lookup with the (D,S) pair. If we find a match return
376 // the iterator.
377 ObjCSummaryKey K(D, S);
378 MapTy::iterator I = M.find(K);
379
380 if (I != M.end() || !D)
381 return I;
382
383 // Walk the super chain. If we find a hit with a parent, we'll end
384 // up returning that summary. We actually allow that key (null,S), as
385 // we cache summaries for the null ObjCInterfaceDecl* to allow us to
386 // generate initial summaries without having to worry about NSObject
387 // being declared.
388 // FIXME: We may change this at some point.
389 for (ObjCInterfaceDecl* C=D->getSuperClass() ;; C=C->getSuperClass()) {
390 if ((I = M.find(ObjCSummaryKey(C, S))) != M.end())
391 break;
392
393 if (!C)
394 return I;
395 }
396
397 // Cache the summary with original key to make the next lookup faster
398 // and return the iterator.
399 M[K] = I->second;
400 return I;
401 }
402
Ted Kremenek98530452008-08-12 20:41:56 +0000403
Ted Kremenek553cf182008-06-25 21:21:56 +0000404 iterator find(Expr* Receiver, Selector S) {
405 return find(getReceiverDecl(Receiver), S);
406 }
407
408 iterator find(IdentifierInfo* II, Selector S) {
409 // FIXME: Class method lookup. Right now we dont' have a good way
410 // of going between IdentifierInfo* and the class hierarchy.
411 iterator I = M.find(ObjCSummaryKey(II, S));
412 return I == M.end() ? M.find(ObjCSummaryKey(S)) : I;
413 }
414
415 ObjCInterfaceDecl* getReceiverDecl(Expr* E) {
416
417 const PointerType* PT = E->getType()->getAsPointerType();
418 if (!PT) return 0;
419
420 ObjCInterfaceType* OI = dyn_cast<ObjCInterfaceType>(PT->getPointeeType());
421 if (!OI) return 0;
422
423 return OI ? OI->getDecl() : 0;
424 }
425
426 iterator end() { return M.end(); }
427
428 RetainSummary*& operator[](ObjCMessageExpr* ME) {
429
430 Selector S = ME->getSelector();
431
432 if (Expr* Receiver = ME->getReceiver()) {
433 ObjCInterfaceDecl* OD = getReceiverDecl(Receiver);
434 return OD ? M[ObjCSummaryKey(OD->getIdentifier(), S)] : M[S];
435 }
436
437 return M[ObjCSummaryKey(ME->getClassName(), S)];
438 }
439
440 RetainSummary*& operator[](ObjCSummaryKey K) {
441 return M[K];
442 }
443
444 RetainSummary*& operator[](Selector S) {
445 return M[ ObjCSummaryKey(S) ];
446 }
447};
448} // end anonymous namespace
449
450//===----------------------------------------------------------------------===//
451// Data structures for managing collections of summaries.
452//===----------------------------------------------------------------------===//
453
454namespace {
455class VISIBILITY_HIDDEN RetainSummaryManager {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000456
457 //==-----------------------------------------------------------------==//
458 // Typedefs.
459 //==-----------------------------------------------------------------==//
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000460
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000461 typedef llvm::FoldingSet<llvm::FoldingSetNodeWrapper<ArgEffects> >
462 ArgEffectsSetTy;
463
464 typedef llvm::FoldingSet<RetainSummary>
465 SummarySetTy;
466
467 typedef llvm::DenseMap<FunctionDecl*, RetainSummary*>
468 FuncSummariesTy;
469
Ted Kremenek4f22a782008-06-23 23:30:29 +0000470 typedef ObjCSummaryCache ObjCMethodSummariesTy;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000471
472 //==-----------------------------------------------------------------==//
473 // Data.
474 //==-----------------------------------------------------------------==//
475
Ted Kremenek553cf182008-06-25 21:21:56 +0000476 /// Ctx - The ASTContext object for the analyzed ASTs.
Ted Kremenek377e2302008-04-29 05:33:51 +0000477 ASTContext& Ctx;
Ted Kremenek179064e2008-07-01 17:21:27 +0000478
Ted Kremenek070a8252008-07-09 18:11:16 +0000479 /// CFDictionaryCreateII - An IdentifierInfo* representing the indentifier
480 /// "CFDictionaryCreate".
481 IdentifierInfo* CFDictionaryCreateII;
482
Ted Kremenek553cf182008-06-25 21:21:56 +0000483 /// GCEnabled - Records whether or not the analyzed code runs in GC mode.
Ted Kremenek377e2302008-04-29 05:33:51 +0000484 const bool GCEnabled;
485
Ted Kremenek553cf182008-06-25 21:21:56 +0000486 /// SummarySet - A FoldingSet of uniqued summaries.
Ted Kremenek3ea0b6a2008-04-10 22:58:08 +0000487 SummarySetTy SummarySet;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000488
Ted Kremenek553cf182008-06-25 21:21:56 +0000489 /// FuncSummaries - A map from FunctionDecls to summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000490 FuncSummariesTy FuncSummaries;
491
Ted Kremenek553cf182008-06-25 21:21:56 +0000492 /// ObjCClassMethodSummaries - A map from selectors (for instance methods)
493 /// to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000494 ObjCMethodSummariesTy ObjCClassMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000495
Ted Kremenek553cf182008-06-25 21:21:56 +0000496 /// ObjCMethodSummaries - A map from selectors to summaries.
Ted Kremenek1f180c32008-06-23 22:21:20 +0000497 ObjCMethodSummariesTy ObjCMethodSummaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000498
Ted Kremenek553cf182008-06-25 21:21:56 +0000499 /// ArgEffectsSet - A FoldingSet of uniqued ArgEffects.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000500 ArgEffectsSetTy ArgEffectsSet;
501
Ted Kremenek553cf182008-06-25 21:21:56 +0000502 /// BPAlloc - A BumpPtrAllocator used for allocating summaries, ArgEffects,
503 /// and all other data used by the checker.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000504 llvm::BumpPtrAllocator BPAlloc;
505
Ted Kremenek553cf182008-06-25 21:21:56 +0000506 /// ScratchArgs - A holding buffer for construct ArgEffects.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000507 ArgEffects ScratchArgs;
508
Ted Kremenek432af592008-05-06 18:11:36 +0000509 RetainSummary* StopSummary;
510
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000511 //==-----------------------------------------------------------------==//
512 // Methods.
513 //==-----------------------------------------------------------------==//
514
Ted Kremenek553cf182008-06-25 21:21:56 +0000515 /// getArgEffects - Returns a persistent ArgEffects object based on the
516 /// data in ScratchArgs.
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000517 ArgEffects* getArgEffects();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000518
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000519 enum UnaryFuncKind { cfretain, cfrelease, cfmakecollectable };
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000520
521public:
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000522 RetainSummary* getUnarySummary(FunctionDecl* FD, UnaryFuncKind func);
Ted Kremenek377e2302008-04-29 05:33:51 +0000523
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000524 RetainSummary* getNSSummary(FunctionDecl* FD, const char* FName);
525 RetainSummary* getCFSummary(FunctionDecl* FD, const char* FName);
Ted Kremenek37d785b2008-07-15 16:50:12 +0000526 RetainSummary* getCGSummary(FunctionDecl* FD, const char* FName);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000527
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000528 RetainSummary* getCFSummaryCreateRule(FunctionDecl* FD);
529 RetainSummary* getCFSummaryGetRule(FunctionDecl* FD);
Ted Kremenek37d785b2008-07-15 16:50:12 +0000530 RetainSummary* getCFCreateGetRuleSummary(FunctionDecl* FD, const char* FName);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000531
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000532 RetainSummary* getPersistentSummary(ArgEffects* AE, RetEffect RetEff,
Ted Kremenek1bffd742008-05-06 15:44:25 +0000533 ArgEffect ReceiverEff = DoNothing,
Ted Kremenek70a733e2008-07-18 17:24:20 +0000534 ArgEffect DefaultEff = MayEscape,
535 bool isEndPath = false);
Ted Kremenek706522f2008-10-29 04:07:07 +0000536
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000537 RetainSummary* getPersistentSummary(RetEffect RE,
Ted Kremenek1bffd742008-05-06 15:44:25 +0000538 ArgEffect ReceiverEff = DoNothing,
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000539 ArgEffect DefaultEff = MayEscape) {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000540 return getPersistentSummary(getArgEffects(), RE, ReceiverEff, DefaultEff);
Ted Kremenek9c32d082008-05-06 00:30:21 +0000541 }
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000542
Ted Kremenek1bffd742008-05-06 15:44:25 +0000543 RetainSummary* getPersistentStopSummary() {
Ted Kremenek432af592008-05-06 18:11:36 +0000544 if (StopSummary)
545 return StopSummary;
546
547 StopSummary = getPersistentSummary(RetEffect::MakeNoRet(),
548 StopTracking, StopTracking);
Ted Kremenek706522f2008-10-29 04:07:07 +0000549
Ted Kremenek432af592008-05-06 18:11:36 +0000550 return StopSummary;
Ted Kremenek1bffd742008-05-06 15:44:25 +0000551 }
Ted Kremenekb3095252008-05-06 04:20:12 +0000552
Ted Kremenek553cf182008-06-25 21:21:56 +0000553 RetainSummary* getInitMethodSummary(ObjCMessageExpr* ME);
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000554
Ted Kremenek1f180c32008-06-23 22:21:20 +0000555 void InitializeClassMethodSummaries();
556 void InitializeMethodSummaries();
Ted Kremenek896cd9d2008-10-23 01:56:15 +0000557
558private:
559
Ted Kremenek70a733e2008-07-18 17:24:20 +0000560 void addClsMethSummary(IdentifierInfo* ClsII, Selector S,
561 RetainSummary* Summ) {
562 ObjCClassMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
563 }
564
Ted Kremenek553cf182008-06-25 21:21:56 +0000565 void addNSObjectClsMethSummary(Selector S, RetainSummary *Summ) {
566 ObjCClassMethodSummaries[S] = Summ;
567 }
568
569 void addNSObjectMethSummary(Selector S, RetainSummary *Summ) {
570 ObjCMethodSummaries[S] = Summ;
571 }
572
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000573 void addInstMethSummary(const char* Cls, RetainSummary* Summ, va_list argp) {
Ted Kremenek70a733e2008-07-18 17:24:20 +0000574
Ted Kremenek9e476de2008-08-12 18:30:56 +0000575 IdentifierInfo* ClsII = &Ctx.Idents.get(Cls);
576 llvm::SmallVector<IdentifierInfo*, 10> II;
577
578 while (const char* s = va_arg(argp, const char*))
579 II.push_back(&Ctx.Idents.get(s));
580
581 Selector S = Ctx.Selectors.getSelector(II.size(), &II[0]);
Ted Kremenek70a733e2008-07-18 17:24:20 +0000582 ObjCMethodSummaries[ObjCSummaryKey(ClsII, S)] = Summ;
583 }
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000584
585 void addInstMethSummary(const char* Cls, RetainSummary* Summ, ...) {
586 va_list argp;
587 va_start(argp, Summ);
588 addInstMethSummary(Cls, Summ, argp);
589 va_end(argp);
590 }
Ted Kremenek9e476de2008-08-12 18:30:56 +0000591
592 void addPanicSummary(const char* Cls, ...) {
593 RetainSummary* Summ = getPersistentSummary(0, RetEffect::MakeNoRet(),
594 DoNothing, DoNothing, true);
595 va_list argp;
596 va_start (argp, Cls);
Ted Kremenekaf9dc272008-08-12 18:48:50 +0000597 addInstMethSummary(Cls, Summ, argp);
Ted Kremenek9e476de2008-08-12 18:30:56 +0000598 va_end(argp);
599 }
Ted Kremenek70a733e2008-07-18 17:24:20 +0000600
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000601public:
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000602
603 RetainSummaryManager(ASTContext& ctx, bool gcenabled)
Ted Kremenek179064e2008-07-01 17:21:27 +0000604 : Ctx(ctx),
Ted Kremenek070a8252008-07-09 18:11:16 +0000605 CFDictionaryCreateII(&ctx.Idents.get("CFDictionaryCreate")),
Ted Kremenek553cf182008-06-25 21:21:56 +0000606 GCEnabled(gcenabled), StopSummary(0) {
607
608 InitializeClassMethodSummaries();
609 InitializeMethodSummaries();
610 }
Ted Kremenek377e2302008-04-29 05:33:51 +0000611
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000612 ~RetainSummaryManager();
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000613
Ted Kremenekab592272008-06-24 03:56:45 +0000614 RetainSummary* getSummary(FunctionDecl* FD);
Ted Kremenek553cf182008-06-25 21:21:56 +0000615 RetainSummary* getMethodSummary(ObjCMessageExpr* ME, ObjCInterfaceDecl* ID);
Ted Kremenek1f180c32008-06-23 22:21:20 +0000616 RetainSummary* getClassMethodSummary(IdentifierInfo* ClsName, Selector S);
Ted Kremenekb3095252008-05-06 04:20:12 +0000617
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000618 bool isGCEnabled() const { return GCEnabled; }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000619};
620
621} // end anonymous namespace
622
623//===----------------------------------------------------------------------===//
624// Implementation of checker data structures.
625//===----------------------------------------------------------------------===//
626
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000627RetainSummaryManager::~RetainSummaryManager() {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000628
629 // FIXME: The ArgEffects could eventually be allocated from BPAlloc,
630 // mitigating the need to do explicit cleanup of the
631 // Argument-Effect summaries.
632
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000633 for (ArgEffectsSetTy::iterator I = ArgEffectsSet.begin(),
634 E = ArgEffectsSet.end(); I!=E; ++I)
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000635 I->getValue().~ArgEffects();
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000636}
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000637
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000638ArgEffects* RetainSummaryManager::getArgEffects() {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000639
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000640 if (ScratchArgs.empty())
641 return NULL;
642
643 // Compute a profile for a non-empty ScratchArgs.
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000644 llvm::FoldingSetNodeID profile;
645 profile.Add(ScratchArgs);
646 void* InsertPos;
647
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000648 // Look up the uniqued copy, or create a new one.
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000649 llvm::FoldingSetNodeWrapper<ArgEffects>* E =
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000650 ArgEffectsSet.FindNodeOrInsertPos(profile, InsertPos);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000651
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000652 if (E) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000653 ScratchArgs.clear();
654 return &E->getValue();
655 }
656
657 E = (llvm::FoldingSetNodeWrapper<ArgEffects>*)
Ted Kremenek553cf182008-06-25 21:21:56 +0000658 BPAlloc.Allocate<llvm::FoldingSetNodeWrapper<ArgEffects> >();
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000659
660 new (E) llvm::FoldingSetNodeWrapper<ArgEffects>(ScratchArgs);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000661 ArgEffectsSet.InsertNode(E, InsertPos);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000662
663 ScratchArgs.clear();
664 return &E->getValue();
665}
666
Ted Kremenek3c0cea32008-05-06 02:26:56 +0000667RetainSummary*
668RetainSummaryManager::getPersistentSummary(ArgEffects* AE, RetEffect RetEff,
Ted Kremenek1bffd742008-05-06 15:44:25 +0000669 ArgEffect ReceiverEff,
Ted Kremenek70a733e2008-07-18 17:24:20 +0000670 ArgEffect DefaultEff,
671 bool isEndPath) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000672
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000673 // Generate a profile for the summary.
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000674 llvm::FoldingSetNodeID profile;
Ted Kremenek2d1086c2008-07-18 17:39:56 +0000675 RetainSummary::Profile(profile, AE, RetEff, DefaultEff, ReceiverEff,
676 isEndPath);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000677
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000678 // Look up the uniqued summary, or create one if it doesn't exist.
679 void* InsertPos;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000680 RetainSummary* Summ = SummarySet.FindNodeOrInsertPos(profile, InsertPos);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000681
682 if (Summ)
683 return Summ;
684
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000685 // Create the summary and return it.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000686 Summ = (RetainSummary*) BPAlloc.Allocate<RetainSummary>();
Ted Kremenek70a733e2008-07-18 17:24:20 +0000687 new (Summ) RetainSummary(AE, RetEff, DefaultEff, ReceiverEff, isEndPath);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000688 SummarySet.InsertNode(Summ, InsertPos);
689
690 return Summ;
691}
692
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000693//===----------------------------------------------------------------------===//
694// Summary creation for functions (largely uses of Core Foundation).
695//===----------------------------------------------------------------------===//
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000696
Ted Kremenekab592272008-06-24 03:56:45 +0000697RetainSummary* RetainSummaryManager::getSummary(FunctionDecl* FD) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000698
699 SourceLocation Loc = FD->getLocation();
700
701 if (!Loc.isFileID())
702 return NULL;
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000703
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000704 // Look up a summary in our cache of FunctionDecls -> Summaries.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000705 FuncSummariesTy::iterator I = FuncSummaries.find(FD);
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000706
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000707 if (I != FuncSummaries.end())
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000708 return I->second;
709
710 // No summary. Generate one.
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000711 const char* FName = FD->getIdentifier()->getName();
712
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000713 RetainSummary *S = 0;
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000714
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +0000715 FunctionType* FT = dyn_cast<FunctionType>(FD->getType());
Ted Kremenek37d785b2008-07-15 16:50:12 +0000716
717 do {
718 if (FT) {
719
720 QualType T = FT->getResultType();
721
722 if (isCFRefType(T)) {
723 S = getCFSummary(FD, FName);
724 break;
725 }
726
727 if (isCGRefType(T)) {
728 S = getCGSummary(FD, FName );
729 break;
730 }
Ted Kremenek706522f2008-10-29 04:07:07 +0000731
732 // FIXME: This should all be refactored into a chain of "summary lookup"
733 // filters.
734 if (strcmp(FName, "IOServiceGetMatchingServices") == 0) {
735 // FIXES: <rdar://problem/6326900>
736 // This should be addressed using a API table. This strcmp is also
737 // a little gross, but there is no need to super optimize here.
738 assert (ScratchArgs.empty());
739 ScratchArgs.push_back(std::make_pair(1, DecRef));
740 S = getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
741 break;
742 }
Ted Kremenek37d785b2008-07-15 16:50:12 +0000743 }
744
Ted Kremenek64e859a2008-10-22 20:54:52 +0000745 if (FName[0] == 'C') {
746 if (FName[1] == 'F')
747 S = getCFSummary(FD, FName);
748 else if (FName[1] == 'G')
749 S = getCGSummary(FD, FName);
750 }
Ted Kremenek37d785b2008-07-15 16:50:12 +0000751 else if (FName[0] == 'N' && FName[1] == 'S')
752 S = getNSSummary(FD, FName);
753 }
754 while (0);
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000755
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000756 FuncSummaries[FD] = S;
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000757 return S;
Ted Kremenek2fff37e2008-03-06 00:08:09 +0000758}
759
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000760RetainSummary* RetainSummaryManager::getNSSummary(FunctionDecl* FD,
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000761 const char* FName) {
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000762 FName += 2;
763
764 if (strcmp(FName, "MakeCollectable") == 0)
765 return getUnarySummary(FD, cfmakecollectable);
766
767 return 0;
768}
Ted Kremenek37d785b2008-07-15 16:50:12 +0000769
770static bool isRetain(FunctionDecl* FD, const char* FName) {
Ted Kremenek10161bf2008-07-15 17:43:41 +0000771 const char* loc = strstr(FName, "Retain");
772 return loc && loc[sizeof("Retain")-1] == '\0';
Ted Kremenek37d785b2008-07-15 16:50:12 +0000773}
774
775static bool isRelease(FunctionDecl* FD, const char* FName) {
Ted Kremenek10161bf2008-07-15 17:43:41 +0000776 const char* loc = strstr(FName, "Release");
777 return loc && loc[sizeof("Release")-1] == '\0';
Ted Kremenek37d785b2008-07-15 16:50:12 +0000778}
779
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000780RetainSummary* RetainSummaryManager::getCFSummary(FunctionDecl* FD,
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000781 const char* FName) {
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000782
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +0000783 if (FName[0] == 'C' && FName[1] == 'F')
784 FName += 2;
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000785
Ted Kremenek37d785b2008-07-15 16:50:12 +0000786 if (isRetain(FD, FName))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000787 return getUnarySummary(FD, cfretain);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000788
Ted Kremenek37d785b2008-07-15 16:50:12 +0000789 if (isRelease(FD, FName))
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000790 return getUnarySummary(FD, cfrelease);
Ted Kremenek070a8252008-07-09 18:11:16 +0000791
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000792 if (strcmp(FName, "MakeCollectable") == 0)
793 return getUnarySummary(FD, cfmakecollectable);
Ted Kremenek37d785b2008-07-15 16:50:12 +0000794
795 return getCFCreateGetRuleSummary(FD, FName);
796}
797
798RetainSummary* RetainSummaryManager::getCGSummary(FunctionDecl* FD,
799 const char* FName) {
800
801 if (FName[0] == 'C' && FName[1] == 'G')
802 FName += 2;
803
804 if (isRelease(FD, FName))
805 return getUnarySummary(FD, cfrelease);
806
807 if (isRetain(FD, FName))
808 return getUnarySummary(FD, cfretain);
809
810 return getCFCreateGetRuleSummary(FD, FName);
811}
812
813RetainSummary*
814RetainSummaryManager::getCFCreateGetRuleSummary(FunctionDecl* FD,
815 const char* FName) {
816
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000817 if (strstr(FName, "Create") || strstr(FName, "Copy"))
818 return getCFSummaryCreateRule(FD);
Ted Kremenek37d785b2008-07-15 16:50:12 +0000819
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000820 if (strstr(FName, "Get"))
821 return getCFSummaryGetRule(FD);
822
823 return 0;
824}
825
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000826RetainSummary*
827RetainSummaryManager::getUnarySummary(FunctionDecl* FD, UnaryFuncKind func) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000828
829 FunctionTypeProto* FT =
830 dyn_cast<FunctionTypeProto>(FD->getType().getTypePtr());
831
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000832 if (FT) {
833
834 if (FT->getNumArgs() != 1)
835 return 0;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000836
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000837 TypedefType* ArgT = dyn_cast<TypedefType>(FT->getArgType(0).getTypePtr());
838
839 if (!ArgT)
840 return 0;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000841
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000842 if (!ArgT->isPointerType())
843 return NULL;
844 }
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000845
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000846 assert (ScratchArgs.empty());
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000847
Ted Kremenek377e2302008-04-29 05:33:51 +0000848 switch (func) {
849 case cfretain: {
Ted Kremenek377e2302008-04-29 05:33:51 +0000850 ScratchArgs.push_back(std::make_pair(0, IncRef));
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000851 return getPersistentSummary(RetEffect::MakeAlias(0),
852 DoNothing, DoNothing);
Ted Kremenek377e2302008-04-29 05:33:51 +0000853 }
854
855 case cfrelease: {
Ted Kremenek377e2302008-04-29 05:33:51 +0000856 ScratchArgs.push_back(std::make_pair(0, DecRef));
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000857 return getPersistentSummary(RetEffect::MakeNoRet(),
858 DoNothing, DoNothing);
Ted Kremenek377e2302008-04-29 05:33:51 +0000859 }
860
861 case cfmakecollectable: {
Ted Kremenek377e2302008-04-29 05:33:51 +0000862 if (GCEnabled)
863 ScratchArgs.push_back(std::make_pair(0, DecRef));
864
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000865 return getPersistentSummary(RetEffect::MakeAlias(0),
866 DoNothing, DoNothing);
Ted Kremenek377e2302008-04-29 05:33:51 +0000867 }
868
869 default:
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000870 assert (false && "Not a supported unary function.");
Ted Kremenek98530452008-08-12 20:41:56 +0000871 return 0;
Ted Kremenek940b1d82008-04-10 23:44:06 +0000872 }
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000873}
874
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000875RetainSummary* RetainSummaryManager::getCFSummaryCreateRule(FunctionDecl* FD) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000876
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +0000877 FunctionType* FT =
878 dyn_cast<FunctionType>(FD->getType().getTypePtr());
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000879
Ted Kremenek64e859a2008-10-22 20:54:52 +0000880 if (FT) {
881 QualType ResTy = FT->getResultType();
882
883 if (!isCFRefType(ResTy) && !isCGRefType(ResTy))
884 return getPersistentSummary(RetEffect::MakeNoRet());
885 }
886
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000887 assert (ScratchArgs.empty());
Ted Kremenek070a8252008-07-09 18:11:16 +0000888
889 if (FD->getIdentifier() == CFDictionaryCreateII) {
890 ScratchArgs.push_back(std::make_pair(1, DoNothingByRef));
891 ScratchArgs.push_back(std::make_pair(2, DoNothingByRef));
892 }
893
Ted Kremeneka7344702008-06-23 18:02:52 +0000894 return getPersistentSummary(RetEffect::MakeOwned(true));
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000895}
896
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000897RetainSummary* RetainSummaryManager::getCFSummaryGetRule(FunctionDecl* FD) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000898
Ted Kremenek0fcbf8e2008-05-07 20:06:41 +0000899 FunctionType* FT =
900 dyn_cast<FunctionType>(FD->getType().getTypePtr());
Ted Kremeneka0df99f2008-04-11 20:11:19 +0000901
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000902 if (FT) {
903 QualType RetTy = FT->getResultType();
Ted Kremeneka0df99f2008-04-11 20:11:19 +0000904
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000905 // FIXME: For now we assume that all pointer types returned are referenced
906 // counted. Since this is the "Get" rule, we assume non-ownership, which
907 // works fine for things that are not reference counted. We do this because
908 // some generic data structures return "void*". We need something better
909 // in the future.
910
911 if (!isCFRefType(RetTy) && !RetTy->isPointerType())
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000912 return getPersistentSummary(RetEffect::MakeNoRet(), DoNothing, DoNothing);
Ted Kremenek86ad3bc2008-05-05 16:51:50 +0000913 }
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000914
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000915 // FIXME: Add special-cases for functions that retain/release. For now
916 // just handle the default case.
917
Ted Kremenek891d5cc2008-04-24 17:22:33 +0000918 assert (ScratchArgs.empty());
Ted Kremenek3eabf1c2008-05-22 17:31:13 +0000919 return getPersistentSummary(RetEffect::MakeNotOwned(), DoNothing, DoNothing);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +0000920}
921
Ted Kremenek6b3a0f72008-03-11 06:39:11 +0000922//===----------------------------------------------------------------------===//
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000923// Summary creation for Selectors.
924//===----------------------------------------------------------------------===//
925
Ted Kremenek1bffd742008-05-06 15:44:25 +0000926RetainSummary*
Ted Kremenek553cf182008-06-25 21:21:56 +0000927RetainSummaryManager::getInitMethodSummary(ObjCMessageExpr* ME) {
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000928 assert(ScratchArgs.empty());
929
930 RetainSummary* Summ =
Ted Kremenek9c32d082008-05-06 00:30:21 +0000931 getPersistentSummary(RetEffect::MakeReceiverAlias());
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000932
Ted Kremenek553cf182008-06-25 21:21:56 +0000933 ObjCMethodSummaries[ME] = Summ;
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000934 return Summ;
935}
Ted Kremenekd3dbcf42008-05-05 22:11:16 +0000936
Ted Kremenek553cf182008-06-25 21:21:56 +0000937
Ted Kremenek1bffd742008-05-06 15:44:25 +0000938RetainSummary*
Ted Kremenek553cf182008-06-25 21:21:56 +0000939RetainSummaryManager::getMethodSummary(ObjCMessageExpr* ME,
940 ObjCInterfaceDecl* ID) {
Ted Kremenek1bffd742008-05-06 15:44:25 +0000941
942 Selector S = ME->getSelector();
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000943
Ted Kremenek553cf182008-06-25 21:21:56 +0000944 // Look up a summary in our summary cache.
945 ObjCMethodSummariesTy::iterator I = ObjCMethodSummaries.find(ID, S);
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000946
Ted Kremenek1f180c32008-06-23 22:21:20 +0000947 if (I != ObjCMethodSummaries.end())
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000948 return I->second;
Ted Kremenek553cf182008-06-25 21:21:56 +0000949
Ted Kremeneka4b695a2008-05-07 03:45:05 +0000950 if (!ME->getType()->isPointerType())
951 return 0;
952
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000953 // "initXXX": pass-through for receiver.
954
955 const char* s = S.getIdentifierInfoForSlot(0)->getName();
Ted Kremeneka4b695a2008-05-07 03:45:05 +0000956 assert (ScratchArgs.empty());
Ted Kremenekaee9e572008-05-06 06:09:09 +0000957
Ted Kremenek0327f772008-06-02 17:14:13 +0000958 if (strncmp(s, "init", 4) == 0 || strncmp(s, "_init", 5) == 0)
Ted Kremenek553cf182008-06-25 21:21:56 +0000959 return getInitMethodSummary(ME);
Ted Kremenek1bffd742008-05-06 15:44:25 +0000960
Ted Kremeneka4b695a2008-05-07 03:45:05 +0000961 // "copyXXX", "createXXX", "newXXX": allocators.
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000962
Ted Kremenek84060db2008-05-07 04:25:59 +0000963 if (!isNSType(ME->getReceiver()->getType()))
964 return 0;
965
Ted Kremenek9d1d5702008-10-24 21:22:44 +0000966 if (followsFundamentalRule(s)) {
Ted Kremeneka4b695a2008-05-07 03:45:05 +0000967
968 RetEffect E = isGCEnabled() ? RetEffect::MakeNoRet()
Ted Kremeneka7344702008-06-23 18:02:52 +0000969 : RetEffect::MakeOwned(true);
Ted Kremeneka4b695a2008-05-07 03:45:05 +0000970
971 RetainSummary* Summ = getPersistentSummary(E);
Ted Kremenek553cf182008-06-25 21:21:56 +0000972 ObjCMethodSummaries[ME] = Summ;
Ted Kremenek1bffd742008-05-06 15:44:25 +0000973 return Summ;
974 }
Ted Kremenek1bffd742008-05-06 15:44:25 +0000975
Ted Kremenek46e49ee2008-05-05 23:55:01 +0000976 return 0;
977}
978
Ted Kremenekc8395602008-05-06 21:26:51 +0000979RetainSummary*
Ted Kremenek1f180c32008-06-23 22:21:20 +0000980RetainSummaryManager::getClassMethodSummary(IdentifierInfo* ClsName,
981 Selector S) {
Ted Kremenekc8395602008-05-06 21:26:51 +0000982
Ted Kremenek553cf182008-06-25 21:21:56 +0000983 // FIXME: Eventually we should properly do class method summaries, but
984 // it requires us being able to walk the type hierarchy. Unfortunately,
985 // we cannot do this with just an IdentifierInfo* for the class name.
986
Ted Kremenekc8395602008-05-06 21:26:51 +0000987 // Look up a summary in our cache of Selectors -> Summaries.
Ted Kremenek553cf182008-06-25 21:21:56 +0000988 ObjCMethodSummariesTy::iterator I = ObjCClassMethodSummaries.find(ClsName, S);
Ted Kremenekc8395602008-05-06 21:26:51 +0000989
Ted Kremenek1f180c32008-06-23 22:21:20 +0000990 if (I != ObjCClassMethodSummaries.end())
Ted Kremenekc8395602008-05-06 21:26:51 +0000991 return I->second;
992
Ted Kremeneka22cc2f2008-05-06 23:07:13 +0000993 return 0;
Ted Kremenekc8395602008-05-06 21:26:51 +0000994}
995
Ted Kremenek1f180c32008-06-23 22:21:20 +0000996void RetainSummaryManager::InitializeClassMethodSummaries() {
Ted Kremenek9c32d082008-05-06 00:30:21 +0000997
998 assert (ScratchArgs.empty());
999
Ted Kremeneka7344702008-06-23 18:02:52 +00001000 RetEffect E = isGCEnabled() ? RetEffect::MakeNoRet()
1001 : RetEffect::MakeOwned(true);
1002
Ted Kremenek9c32d082008-05-06 00:30:21 +00001003 RetainSummary* Summ = getPersistentSummary(E);
1004
Ted Kremenek553cf182008-06-25 21:21:56 +00001005 // Create the summaries for "alloc", "new", and "allocWithZone:" for
1006 // NSObject and its derivatives.
1007 addNSObjectClsMethSummary(GetNullarySelector("alloc", Ctx), Summ);
1008 addNSObjectClsMethSummary(GetNullarySelector("new", Ctx), Summ);
1009 addNSObjectClsMethSummary(GetUnarySelector("allocWithZone", Ctx), Summ);
Ted Kremenek70a733e2008-07-18 17:24:20 +00001010
1011 // Create the [NSAssertionHandler currentHander] summary.
Ted Kremenek9e476de2008-08-12 18:30:56 +00001012 addClsMethSummary(&Ctx.Idents.get("NSAssertionHandler"),
Ted Kremenek1a804482008-07-18 18:14:26 +00001013 GetNullarySelector("currentHandler", Ctx),
Ted Kremenek6d348932008-10-21 15:53:15 +00001014 getPersistentSummary(RetEffect::MakeNotOwned()));
1015
1016 // Create the [NSAutoreleasePool addObject:] summary.
1017 if (!isGCEnabled()) {
1018 ScratchArgs.push_back(std::make_pair(0, Autorelease));
1019 addClsMethSummary(&Ctx.Idents.get("NSAutoreleasePool"),
1020 GetUnarySelector("addObject", Ctx),
1021 getPersistentSummary(RetEffect::MakeNoRet(),
1022 DoNothing, DoNothing));
1023 }
Ted Kremenek9c32d082008-05-06 00:30:21 +00001024}
1025
Ted Kremenek1f180c32008-06-23 22:21:20 +00001026void RetainSummaryManager::InitializeMethodSummaries() {
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001027
1028 assert (ScratchArgs.empty());
1029
Ted Kremenekc8395602008-05-06 21:26:51 +00001030 // Create the "init" selector. It just acts as a pass-through for the
1031 // receiver.
Ted Kremenek179064e2008-07-01 17:21:27 +00001032 RetainSummary* InitSumm = getPersistentSummary(RetEffect::MakeReceiverAlias());
1033 addNSObjectMethSummary(GetNullarySelector("init", Ctx), InitSumm);
Ted Kremenekc8395602008-05-06 21:26:51 +00001034
1035 // The next methods are allocators.
Ted Kremeneka7344702008-06-23 18:02:52 +00001036 RetEffect E = isGCEnabled() ? RetEffect::MakeNoRet()
1037 : RetEffect::MakeOwned(true);
1038
Ted Kremenek179064e2008-07-01 17:21:27 +00001039 RetainSummary* Summ = getPersistentSummary(E);
Ted Kremenekc8395602008-05-06 21:26:51 +00001040
1041 // Create the "copy" selector.
Ted Kremenek98530452008-08-12 20:41:56 +00001042 addNSObjectMethSummary(GetNullarySelector("copy", Ctx), Summ);
1043
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001044 // Create the "mutableCopy" selector.
Ted Kremenek553cf182008-06-25 21:21:56 +00001045 addNSObjectMethSummary(GetNullarySelector("mutableCopy", Ctx), Summ);
Ted Kremenek98530452008-08-12 20:41:56 +00001046
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001047 // Create the "retain" selector.
1048 E = RetEffect::MakeReceiverAlias();
1049 Summ = getPersistentSummary(E, isGCEnabled() ? DoNothing : IncRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001050 addNSObjectMethSummary(GetNullarySelector("retain", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001051
1052 // Create the "release" selector.
1053 Summ = getPersistentSummary(E, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001054 addNSObjectMethSummary(GetNullarySelector("release", Ctx), Summ);
Ted Kremenek299e8152008-05-07 21:17:39 +00001055
1056 // Create the "drain" selector.
1057 Summ = getPersistentSummary(E, isGCEnabled() ? DoNothing : DecRef);
Ted Kremenek553cf182008-06-25 21:21:56 +00001058 addNSObjectMethSummary(GetNullarySelector("drain", Ctx), Summ);
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001059
1060 // Create the "autorelease" selector.
Ted Kremeneke19f4492008-06-30 16:57:41 +00001061 Summ = getPersistentSummary(E, isGCEnabled() ? DoNothing : Autorelease);
Ted Kremenek553cf182008-06-25 21:21:56 +00001062 addNSObjectMethSummary(GetNullarySelector("autorelease", Ctx), Summ);
Ted Kremenek98530452008-08-12 20:41:56 +00001063
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001064 // For NSWindow, allocated objects are (initially) self-owned.
Ted Kremenek179064e2008-07-01 17:21:27 +00001065 RetainSummary *NSWindowSumm =
1066 getPersistentSummary(RetEffect::MakeReceiverAlias(), SelfOwn);
Ted Kremenekaf9dc272008-08-12 18:48:50 +00001067
1068 addInstMethSummary("NSWindow", NSWindowSumm, "initWithContentRect",
1069 "styleMask", "backing", "defer", NULL);
1070
1071 addInstMethSummary("NSWindow", NSWindowSumm, "initWithContentRect",
1072 "styleMask", "backing", "defer", "screen", NULL);
1073
1074 // For NSPanel (which subclasses NSWindow), allocated objects are not
1075 // self-owned.
1076 addInstMethSummary("NSPanel", InitSumm, "initWithContentRect",
1077 "styleMask", "backing", "defer", NULL);
1078
1079 addInstMethSummary("NSPanel", InitSumm, "initWithContentRect",
1080 "styleMask", "backing", "defer", "screen", NULL);
Ted Kremenek553cf182008-06-25 21:21:56 +00001081
Ted Kremenek70a733e2008-07-18 17:24:20 +00001082 // Create NSAssertionHandler summaries.
Ted Kremenek9e476de2008-08-12 18:30:56 +00001083 addPanicSummary("NSAssertionHandler", "handleFailureInFunction", "file",
1084 "lineNumber", "description", NULL);
Ted Kremenek70a733e2008-07-18 17:24:20 +00001085
Ted Kremenek9e476de2008-08-12 18:30:56 +00001086 addPanicSummary("NSAssertionHandler", "handleFailureInMethod", "object",
1087 "file", "lineNumber", "description", NULL);
Ted Kremenekb3c3c282008-05-06 00:38:54 +00001088}
1089
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001090//===----------------------------------------------------------------------===//
Ted Kremenek13922612008-04-16 20:40:59 +00001091// Reference-counting logic (typestate + counts).
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001092//===----------------------------------------------------------------------===//
1093
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001094namespace {
1095
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001096class VISIBILITY_HIDDEN RefVal {
Ted Kremenek4fd88972008-04-17 18:12:53 +00001097public:
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001098
Ted Kremenek4fd88972008-04-17 18:12:53 +00001099 enum Kind {
1100 Owned = 0, // Owning reference.
1101 NotOwned, // Reference is not owned by still valid (not freed).
1102 Released, // Object has been released.
1103 ReturnedOwned, // Returned object passes ownership to caller.
1104 ReturnedNotOwned, // Return object does not pass ownership to caller.
1105 ErrorUseAfterRelease, // Object used after released.
1106 ErrorReleaseNotOwned, // Release of an object that was not owned.
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001107 ErrorLeak, // A memory leak due to excessive reference counts.
1108 ErrorLeakReturned // A memory leak due to the returning method not having
1109 // the correct naming conventions.
Ted Kremenek4fd88972008-04-17 18:12:53 +00001110 };
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001111
Ted Kremenek4fd88972008-04-17 18:12:53 +00001112private:
1113
1114 Kind kind;
1115 unsigned Cnt;
Ted Kremenek553cf182008-06-25 21:21:56 +00001116 QualType T;
1117
1118 RefVal(Kind k, unsigned cnt, QualType t) : kind(k), Cnt(cnt), T(t) {}
1119 RefVal(Kind k, unsigned cnt = 0) : kind(k), Cnt(cnt) {}
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001120
1121public:
Ted Kremenekdb863712008-04-16 22:32:20 +00001122
Ted Kremenek4fd88972008-04-17 18:12:53 +00001123 Kind getKind() const { return kind; }
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001124
Ted Kremenek553cf182008-06-25 21:21:56 +00001125 unsigned getCount() const { return Cnt; }
1126 QualType getType() const { return T; }
Ted Kremenek4fd88972008-04-17 18:12:53 +00001127
1128 // Useful predicates.
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001129
Ted Kremenek73c750b2008-03-11 18:14:09 +00001130 static bool isError(Kind k) { return k >= ErrorUseAfterRelease; }
1131
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001132 static bool isLeak(Kind k) { return k >= ErrorLeak; }
Ted Kremenekdb863712008-04-16 22:32:20 +00001133
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001134 bool isOwned() const {
1135 return getKind() == Owned;
1136 }
1137
Ted Kremenekdb863712008-04-16 22:32:20 +00001138 bool isNotOwned() const {
1139 return getKind() == NotOwned;
1140 }
1141
Ted Kremenek4fd88972008-04-17 18:12:53 +00001142 bool isReturnedOwned() const {
1143 return getKind() == ReturnedOwned;
1144 }
1145
1146 bool isReturnedNotOwned() const {
1147 return getKind() == ReturnedNotOwned;
1148 }
1149
1150 bool isNonLeakError() const {
1151 Kind k = getKind();
1152 return isError(k) && !isLeak(k);
1153 }
1154
1155 // State creation: normal state.
1156
Ted Kremenek553cf182008-06-25 21:21:56 +00001157 static RefVal makeOwned(QualType t, unsigned Count = 1) {
1158 return RefVal(Owned, Count, t);
Ted Kremenek61b9f872008-04-10 23:09:18 +00001159 }
1160
Ted Kremenek553cf182008-06-25 21:21:56 +00001161 static RefVal makeNotOwned(QualType t, unsigned Count = 0) {
1162 return RefVal(NotOwned, Count, t);
Ted Kremenek61b9f872008-04-10 23:09:18 +00001163 }
Ted Kremenek4fd88972008-04-17 18:12:53 +00001164
1165 static RefVal makeReturnedOwned(unsigned Count) {
1166 return RefVal(ReturnedOwned, Count);
1167 }
1168
1169 static RefVal makeReturnedNotOwned() {
1170 return RefVal(ReturnedNotOwned);
1171 }
1172
Ted Kremenek4fd88972008-04-17 18:12:53 +00001173 // Comparison, profiling, and pretty-printing.
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001174
Ted Kremenek4fd88972008-04-17 18:12:53 +00001175 bool operator==(const RefVal& X) const {
Ted Kremenek553cf182008-06-25 21:21:56 +00001176 return kind == X.kind && Cnt == X.Cnt && T == X.T;
Ted Kremenek4fd88972008-04-17 18:12:53 +00001177 }
Ted Kremenekf3948042008-03-11 19:44:10 +00001178
Ted Kremenek553cf182008-06-25 21:21:56 +00001179 RefVal operator-(size_t i) const {
1180 return RefVal(getKind(), getCount() - i, getType());
1181 }
1182
1183 RefVal operator+(size_t i) const {
1184 return RefVal(getKind(), getCount() + i, getType());
1185 }
1186
1187 RefVal operator^(Kind k) const {
1188 return RefVal(k, getCount(), getType());
1189 }
1190
1191
Ted Kremenek4fd88972008-04-17 18:12:53 +00001192 void Profile(llvm::FoldingSetNodeID& ID) const {
1193 ID.AddInteger((unsigned) kind);
1194 ID.AddInteger(Cnt);
Ted Kremenek553cf182008-06-25 21:21:56 +00001195 ID.Add(T);
Ted Kremenek4fd88972008-04-17 18:12:53 +00001196 }
1197
Ted Kremenekf3948042008-03-11 19:44:10 +00001198 void print(std::ostream& Out) const;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001199};
Ted Kremenekf3948042008-03-11 19:44:10 +00001200
1201void RefVal::print(std::ostream& Out) const {
Ted Kremenek553cf182008-06-25 21:21:56 +00001202 if (!T.isNull())
1203 Out << "Tracked Type:" << T.getAsString() << '\n';
1204
Ted Kremenekf3948042008-03-11 19:44:10 +00001205 switch (getKind()) {
1206 default: assert(false);
Ted Kremenek61b9f872008-04-10 23:09:18 +00001207 case Owned: {
1208 Out << "Owned";
1209 unsigned cnt = getCount();
1210 if (cnt) Out << " (+ " << cnt << ")";
Ted Kremenekf3948042008-03-11 19:44:10 +00001211 break;
Ted Kremenek61b9f872008-04-10 23:09:18 +00001212 }
Ted Kremenekf3948042008-03-11 19:44:10 +00001213
Ted Kremenek61b9f872008-04-10 23:09:18 +00001214 case NotOwned: {
Ted Kremenek4fd88972008-04-17 18:12:53 +00001215 Out << "NotOwned";
Ted Kremenek61b9f872008-04-10 23:09:18 +00001216 unsigned cnt = getCount();
1217 if (cnt) Out << " (+ " << cnt << ")";
Ted Kremenekf3948042008-03-11 19:44:10 +00001218 break;
Ted Kremenek61b9f872008-04-10 23:09:18 +00001219 }
Ted Kremenekf3948042008-03-11 19:44:10 +00001220
Ted Kremenek4fd88972008-04-17 18:12:53 +00001221 case ReturnedOwned: {
1222 Out << "ReturnedOwned";
1223 unsigned cnt = getCount();
1224 if (cnt) Out << " (+ " << cnt << ")";
1225 break;
1226 }
1227
1228 case ReturnedNotOwned: {
1229 Out << "ReturnedNotOwned";
1230 unsigned cnt = getCount();
1231 if (cnt) Out << " (+ " << cnt << ")";
1232 break;
1233 }
1234
Ted Kremenekf3948042008-03-11 19:44:10 +00001235 case Released:
1236 Out << "Released";
1237 break;
1238
Ted Kremenekdb863712008-04-16 22:32:20 +00001239 case ErrorLeak:
1240 Out << "Leaked";
1241 break;
1242
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001243 case ErrorLeakReturned:
1244 Out << "Leaked (Bad naming)";
1245 break;
1246
Ted Kremenekf3948042008-03-11 19:44:10 +00001247 case ErrorUseAfterRelease:
1248 Out << "Use-After-Release [ERROR]";
1249 break;
1250
1251 case ErrorReleaseNotOwned:
1252 Out << "Release of Not-Owned [ERROR]";
1253 break;
1254 }
1255}
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001256
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001257} // end anonymous namespace
1258
1259//===----------------------------------------------------------------------===//
1260// RefBindings - State used to track object reference counts.
1261//===----------------------------------------------------------------------===//
1262
1263typedef llvm::ImmutableMap<SymbolID, RefVal> RefBindings;
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001264static int RefBIndex = 0;
1265
1266namespace clang {
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001267 template<>
1268 struct GRStateTrait<RefBindings> : public GRStatePartialTrait<RefBindings> {
1269 static inline void* GDMIndex() { return &RefBIndex; }
1270 };
1271}
Ted Kremenek6d348932008-10-21 15:53:15 +00001272
1273//===----------------------------------------------------------------------===//
1274// ARBindings - State used to track objects in autorelease pools.
1275//===----------------------------------------------------------------------===//
1276
1277typedef llvm::ImmutableSet<SymbolID> ARPoolContents;
1278typedef llvm::ImmutableList< std::pair<SymbolID, ARPoolContents*> > ARBindings;
1279static int AutoRBIndex = 0;
1280
1281namespace clang {
1282 template<>
1283 struct GRStateTrait<ARBindings> : public GRStatePartialTrait<ARBindings> {
1284 static inline void* GDMIndex() { return &AutoRBIndex; }
1285 };
1286}
1287
Ted Kremenek13922612008-04-16 20:40:59 +00001288//===----------------------------------------------------------------------===//
1289// Transfer functions.
1290//===----------------------------------------------------------------------===//
1291
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001292namespace {
1293
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001294class VISIBILITY_HIDDEN CFRefCount : public GRSimpleVals {
Ted Kremenek8dd56462008-04-18 03:39:05 +00001295public:
Ted Kremenek553cf182008-06-25 21:21:56 +00001296 // Type definitions.
Ted Kremenek8dd56462008-04-18 03:39:05 +00001297 typedef llvm::DenseMap<GRExprEngine::NodeTy*,std::pair<Expr*, SymbolID> >
1298 ReleasesNotOwnedTy;
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001299
Ted Kremenek8dd56462008-04-18 03:39:05 +00001300 typedef ReleasesNotOwnedTy UseAfterReleasesTy;
1301
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001302 typedef llvm::DenseMap<GRExprEngine::NodeTy*,
1303 std::vector<std::pair<SymbolID,bool> >*>
Ted Kremenekdb863712008-04-16 22:32:20 +00001304 LeaksTy;
Ted Kremenek8dd56462008-04-18 03:39:05 +00001305
Ted Kremenekae6814e2008-08-13 21:24:49 +00001306 class BindingsPrinter : public GRState::Printer {
Ted Kremenekf3948042008-03-11 19:44:10 +00001307 public:
Ted Kremenekae6814e2008-08-13 21:24:49 +00001308 virtual void Print(std::ostream& Out, const GRState* state,
1309 const char* nl, const char* sep);
Ted Kremenekf3948042008-03-11 19:44:10 +00001310 };
Ted Kremenek8dd56462008-04-18 03:39:05 +00001311
1312private:
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001313 RetainSummaryManager Summaries;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001314 const LangOptions& LOpts;
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001315
Ted Kremenek9e476de2008-08-12 18:30:56 +00001316 UseAfterReleasesTy UseAfterReleases;
1317 ReleasesNotOwnedTy ReleasesNotOwned;
1318 LeaksTy Leaks;
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001319
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001320 RefBindings Update(RefBindings B, SymbolID sym, RefVal V, ArgEffect E,
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001321 RefVal::Kind& hasErr, RefBindings::Factory& RefBFactory);
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001322
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001323 RefVal::Kind& Update(GRStateRef& state, SymbolID sym, RefVal V,
1324 ArgEffect E, RefVal::Kind& hasErr) {
1325
1326 state = state.set<RefBindings>(Update(state.get<RefBindings>(), sym, V,
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001327 E, hasErr,
1328 state.get_context<RefBindings>()));
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001329 return hasErr;
1330 }
1331
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001332 void ProcessNonLeakError(ExplodedNodeSet<GRState>& Dst,
1333 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenekdb863712008-04-16 22:32:20 +00001334 Expr* NodeExpr, Expr* ErrorExpr,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001335 ExplodedNode<GRState>* Pred,
1336 const GRState* St,
Ted Kremenek8dd56462008-04-18 03:39:05 +00001337 RefVal::Kind hasErr, SymbolID Sym);
Ted Kremenekdb863712008-04-16 22:32:20 +00001338
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001339 std::pair<GRStateRef, bool>
1340 HandleSymbolDeath(GRStateManager& VMgr, const GRState* St,
1341 const Decl* CD, SymbolID sid, RefVal V, bool& hasLeak);
Ted Kremenekdb863712008-04-16 22:32:20 +00001342
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001343public:
Ted Kremenek13922612008-04-16 20:40:59 +00001344
Ted Kremenek78d46242008-07-22 16:21:24 +00001345 CFRefCount(ASTContext& Ctx, bool gcenabled, const LangOptions& lopts)
Ted Kremenek377e2302008-04-29 05:33:51 +00001346 : Summaries(Ctx, gcenabled),
Ted Kremenek9e476de2008-08-12 18:30:56 +00001347 LOpts(lopts) {}
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001348
Ted Kremenek8dd56462008-04-18 03:39:05 +00001349 virtual ~CFRefCount() {
1350 for (LeaksTy::iterator I = Leaks.begin(), E = Leaks.end(); I!=E; ++I)
1351 delete I->second;
1352 }
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001353
1354 virtual void RegisterChecks(GRExprEngine& Eng);
Ted Kremenekf3948042008-03-11 19:44:10 +00001355
Ted Kremenek1c72ef02008-08-16 00:49:49 +00001356 virtual void RegisterPrinters(std::vector<GRState::Printer*>& Printers) {
1357 Printers.push_back(new BindingsPrinter());
Ted Kremenekf3948042008-03-11 19:44:10 +00001358 }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001359
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001360 bool isGCEnabled() const { return Summaries.isGCEnabled(); }
Ted Kremenek072192b2008-04-30 23:47:44 +00001361 const LangOptions& getLangOptions() const { return LOpts; }
1362
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001363 // Calls.
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001364
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001365 void EvalSummary(ExplodedNodeSet<GRState>& Dst,
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001366 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001367 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001368 Expr* Ex,
1369 Expr* Receiver,
1370 RetainSummary* Summ,
Ted Kremenek55499762008-06-17 02:43:46 +00001371 ExprIterator arg_beg, ExprIterator arg_end,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001372 ExplodedNode<GRState>* Pred);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001373
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001374 virtual void EvalCall(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek199e1a02008-03-12 21:06:49 +00001375 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001376 GRStmtNodeBuilder<GRState>& Builder,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001377 CallExpr* CE, SVal L,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001378 ExplodedNode<GRState>* Pred);
Ted Kremenekfa34b332008-04-09 01:10:13 +00001379
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001380
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001381 virtual void EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek85348202008-04-15 23:44:31 +00001382 GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001383 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenek85348202008-04-15 23:44:31 +00001384 ObjCMessageExpr* ME,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001385 ExplodedNode<GRState>* Pred);
Ted Kremenek85348202008-04-15 23:44:31 +00001386
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001387 bool EvalObjCMessageExprAux(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek85348202008-04-15 23:44:31 +00001388 GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001389 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenek85348202008-04-15 23:44:31 +00001390 ObjCMessageExpr* ME,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001391 ExplodedNode<GRState>* Pred);
Ted Kremenek85348202008-04-15 23:44:31 +00001392
Ted Kremenek13922612008-04-16 20:40:59 +00001393 // Stores.
1394
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001395 virtual void EvalStore(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek13922612008-04-16 20:40:59 +00001396 GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001397 GRStmtNodeBuilder<GRState>& Builder,
1398 Expr* E, ExplodedNode<GRState>* Pred,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001399 const GRState* St, SVal TargetLV, SVal Val);
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001400 // End-of-path.
1401
1402 virtual void EvalEndPath(GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001403 GREndPathNodeBuilder<GRState>& Builder);
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001404
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001405 virtual void EvalDeadSymbols(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek652adc62008-04-24 23:57:27 +00001406 GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001407 GRStmtNodeBuilder<GRState>& Builder,
1408 ExplodedNode<GRState>* Pred,
Ted Kremenek910e9992008-04-25 01:25:15 +00001409 Stmt* S,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001410 const GRState* St,
1411 const GRStateManager::DeadSymbolsTy& Dead);
Ted Kremenek4fd88972008-04-17 18:12:53 +00001412 // Return statements.
1413
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001414 virtual void EvalReturn(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek4fd88972008-04-17 18:12:53 +00001415 GRExprEngine& Engine,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001416 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenek4fd88972008-04-17 18:12:53 +00001417 ReturnStmt* S,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001418 ExplodedNode<GRState>* Pred);
Ted Kremenekcb612922008-04-18 19:23:43 +00001419
1420 // Assumptions.
1421
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001422 virtual const GRState* EvalAssume(GRStateManager& VMgr,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001423 const GRState* St, SVal Cond,
Ted Kremenek4323a572008-07-10 22:03:41 +00001424 bool Assumption, bool& isFeasible);
Ted Kremenekcb612922008-04-18 19:23:43 +00001425
Ted Kremenekfa34b332008-04-09 01:10:13 +00001426 // Error iterators.
1427
1428 typedef UseAfterReleasesTy::iterator use_after_iterator;
1429 typedef ReleasesNotOwnedTy::iterator bad_release_iterator;
Ted Kremenek989d5192008-04-17 23:43:50 +00001430 typedef LeaksTy::iterator leaks_iterator;
Ted Kremenekfa34b332008-04-09 01:10:13 +00001431
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001432 use_after_iterator use_after_begin() { return UseAfterReleases.begin(); }
1433 use_after_iterator use_after_end() { return UseAfterReleases.end(); }
Ted Kremenekfa34b332008-04-09 01:10:13 +00001434
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001435 bad_release_iterator bad_release_begin() { return ReleasesNotOwned.begin(); }
1436 bad_release_iterator bad_release_end() { return ReleasesNotOwned.end(); }
Ted Kremenek989d5192008-04-17 23:43:50 +00001437
1438 leaks_iterator leaks_begin() { return Leaks.begin(); }
1439 leaks_iterator leaks_end() { return Leaks.end(); }
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001440};
1441
1442} // end anonymous namespace
1443
Ted Kremenek8dd56462008-04-18 03:39:05 +00001444
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00001445
1446
Ted Kremenekae6814e2008-08-13 21:24:49 +00001447void CFRefCount::BindingsPrinter::Print(std::ostream& Out, const GRState* state,
1448 const char* nl, const char* sep) {
1449
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001450 RefBindings B = state->get<RefBindings>();
Ted Kremenekf3948042008-03-11 19:44:10 +00001451
Ted Kremenekae6814e2008-08-13 21:24:49 +00001452 if (!B.isEmpty())
Ted Kremenekf3948042008-03-11 19:44:10 +00001453 Out << sep << nl;
1454
1455 for (RefBindings::iterator I=B.begin(), E=B.end(); I!=E; ++I) {
1456 Out << (*I).first << " : ";
1457 (*I).second.print(Out);
1458 Out << nl;
1459 }
1460}
1461
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001462static inline ArgEffect GetArgE(RetainSummary* Summ, unsigned idx) {
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00001463 return Summ ? Summ->getArg(idx) : MayEscape;
Ted Kremenekf9561e52008-04-11 20:23:24 +00001464}
1465
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001466static inline RetEffect GetRetEffect(RetainSummary* Summ) {
1467 return Summ ? Summ->getRetEffect() : RetEffect::MakeNoRet();
Ted Kremenekf9561e52008-04-11 20:23:24 +00001468}
1469
Ted Kremenek14993892008-05-06 02:41:27 +00001470static inline ArgEffect GetReceiverE(RetainSummary* Summ) {
1471 return Summ ? Summ->getReceiverEffect() : DoNothing;
1472}
1473
Ted Kremenek70a733e2008-07-18 17:24:20 +00001474static inline bool IsEndPath(RetainSummary* Summ) {
1475 return Summ ? Summ->isEndPath() : false;
1476}
1477
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001478void CFRefCount::ProcessNonLeakError(ExplodedNodeSet<GRState>& Dst,
1479 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenekdb863712008-04-16 22:32:20 +00001480 Expr* NodeExpr, Expr* ErrorExpr,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001481 ExplodedNode<GRState>* Pred,
1482 const GRState* St,
Ted Kremenek8dd56462008-04-18 03:39:05 +00001483 RefVal::Kind hasErr, SymbolID Sym) {
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001484 Builder.BuildSinks = true;
1485 GRExprEngine::NodeTy* N = Builder.MakeNode(Dst, NodeExpr, Pred, St);
1486
1487 if (!N) return;
1488
1489 switch (hasErr) {
1490 default: assert(false);
1491 case RefVal::ErrorUseAfterRelease:
Ted Kremenek8dd56462008-04-18 03:39:05 +00001492 UseAfterReleases[N] = std::make_pair(ErrorExpr, Sym);
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001493 break;
1494
1495 case RefVal::ErrorReleaseNotOwned:
Ted Kremenek8dd56462008-04-18 03:39:05 +00001496 ReleasesNotOwned[N] = std::make_pair(ErrorExpr, Sym);
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001497 break;
1498 }
1499}
1500
Ted Kremenek553cf182008-06-25 21:21:56 +00001501/// GetReturnType - Used to get the return type of a message expression or
1502/// function call with the intention of affixing that type to a tracked symbol.
1503/// While the the return type can be queried directly from RetEx, when
1504/// invoking class methods we augment to the return type to be that of
1505/// a pointer to the class (as opposed it just being id).
1506static QualType GetReturnType(Expr* RetE, ASTContext& Ctx) {
1507
1508 QualType RetTy = RetE->getType();
1509
1510 // FIXME: We aren't handling id<...>.
Chris Lattner8b51fd72008-07-26 22:36:27 +00001511 const PointerType* PT = RetTy->getAsPointerType();
Ted Kremenek553cf182008-06-25 21:21:56 +00001512 if (!PT)
1513 return RetTy;
1514
1515 // If RetEx is not a message expression just return its type.
1516 // If RetEx is a message expression, return its types if it is something
1517 /// more specific than id.
1518
1519 ObjCMessageExpr* ME = dyn_cast<ObjCMessageExpr>(RetE);
1520
1521 if (!ME || !Ctx.isObjCIdType(PT->getPointeeType()))
1522 return RetTy;
1523
1524 ObjCInterfaceDecl* D = ME->getClassInfo().first;
1525
1526 // At this point we know the return type of the message expression is id.
1527 // If we have an ObjCInterceDecl, we know this is a call to a class method
1528 // whose type we can resolve. In such cases, promote the return type to
1529 // Class*.
1530 return !D ? RetTy : Ctx.getPointerType(Ctx.getObjCInterfaceType(D));
1531}
1532
1533
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001534void CFRefCount::EvalSummary(ExplodedNodeSet<GRState>& Dst,
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001535 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001536 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001537 Expr* Ex,
1538 Expr* Receiver,
1539 RetainSummary* Summ,
Ted Kremenek55499762008-06-17 02:43:46 +00001540 ExprIterator arg_beg, ExprIterator arg_end,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001541 ExplodedNode<GRState>* Pred) {
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001542
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001543 // Get the state.
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001544 GRStateRef state(Builder.GetState(Pred), Eng.getStateManager());
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001545 ASTContext& Ctx = Eng.getStateManager().getContext();
Ted Kremenek14993892008-05-06 02:41:27 +00001546
1547 // Evaluate the effect of the arguments.
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001548 RefVal::Kind hasErr = (RefVal::Kind) 0;
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001549 unsigned idx = 0;
Ted Kremenekbcf50ad2008-04-11 18:40:51 +00001550 Expr* ErrorExpr = NULL;
Ted Kremenek8dd56462008-04-18 03:39:05 +00001551 SymbolID ErrorSym = 0;
Ted Kremenekbcf50ad2008-04-11 18:40:51 +00001552
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001553 for (ExprIterator I = arg_beg; I != arg_end; ++I, ++idx) {
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001554 SVal V = state.GetSVal(*I);
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001555
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001556 if (isa<loc::SymbolVal>(V)) {
1557 SymbolID Sym = cast<loc::SymbolVal>(V).getSymbol();
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001558 if (RefBindings::data_type* T = state.get<RefBindings>(Sym))
1559 if (Update(state, Sym, *T, GetArgE(Summ, idx), hasErr)) {
Ted Kremenekbcf50ad2008-04-11 18:40:51 +00001560 ErrorExpr = *I;
Ted Kremeneke8fdc832008-07-07 16:21:19 +00001561 ErrorSym = Sym;
Ted Kremenekbcf50ad2008-04-11 18:40:51 +00001562 break;
1563 }
Ted Kremenekb8873552008-04-11 20:51:02 +00001564 }
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001565 else if (isa<Loc>(V)) {
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001566#if 0
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001567 // Nuke all arguments passed by reference.
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001568 StateMgr.Unbind(StVals, cast<Loc>(V));
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001569#else
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001570 if (loc::MemRegionVal* MR = dyn_cast<loc::MemRegionVal>(&V)) {
Ted Kremenek070a8252008-07-09 18:11:16 +00001571
1572 if (GetArgE(Summ, idx) == DoNothingByRef)
1573 continue;
1574
1575 // Invalidate the value of the variable passed by reference.
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001576
1577 // FIXME: Either this logic should also be replicated in GRSimpleVals
1578 // or should be pulled into a separate "constraint engine."
Ted Kremenek070a8252008-07-09 18:11:16 +00001579
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001580 // FIXME: We can have collisions on the conjured symbol if the
1581 // expression *I also creates conjured symbols. We probably want
1582 // to identify conjured symbols by an expression pair: the enclosing
1583 // expression (the context) and the expression itself. This should
Ted Kremenek070a8252008-07-09 18:11:16 +00001584 // disambiguate conjured symbols.
1585
1586 // Is the invalidated variable something that we were tracking?
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001587 SVal X = state.GetSVal(*MR);
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001588
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001589 if (isa<loc::SymbolVal>(X)) {
1590 SymbolID Sym = cast<loc::SymbolVal>(X).getSymbol();
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001591 state = state.remove<RefBindings>(Sym);
Ted Kremenek070a8252008-07-09 18:11:16 +00001592 }
Ted Kremenek9e240492008-10-04 05:50:14 +00001593
Ted Kremenek993f1c72008-10-17 20:28:54 +00001594 const TypedRegion* R = dyn_cast<TypedRegion>(MR->getRegion());
Ted Kremenek9e240492008-10-04 05:50:14 +00001595 if (R) {
1596 // Set the value of the variable to be a conjured symbol.
1597 unsigned Count = Builder.getCurrentBlockCount();
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001598 QualType T = R->getType(Ctx);
Ted Kremenek9e240492008-10-04 05:50:14 +00001599
Ted Kremenekfd301942008-10-17 22:23:12 +00001600 // FIXME: handle structs.
1601 if (T->isIntegerType() || Loc::IsLocType(T)) {
1602 SymbolID NewSym =
1603 Eng.getSymbolManager().getConjuredSymbol(*I, T, Count);
1604
1605 state = state.SetSVal(*MR,
1606 Loc::IsLocType(T)
1607 ? cast<SVal>(loc::SymbolVal(NewSym))
1608 : cast<SVal>(nonloc::SymbolVal(NewSym)));
1609 }
1610 else {
1611 state = state.SetSVal(*MR, UnknownVal());
1612 }
Ted Kremenek9e240492008-10-04 05:50:14 +00001613 }
1614 else
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001615 state = state.SetSVal(*MR, UnknownVal());
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001616 }
1617 else {
1618 // Nuke all other arguments passed by reference.
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001619 state = state.Unbind(cast<Loc>(V));
Ted Kremenek8c5633e2008-07-03 23:26:32 +00001620 }
1621#endif
Ted Kremenekb8873552008-04-11 20:51:02 +00001622 }
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001623 else if (isa<nonloc::LocAsInteger>(V))
1624 state = state.Unbind(cast<nonloc::LocAsInteger>(V).getLoc());
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001625 }
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001626
Ted Kremenek553cf182008-06-25 21:21:56 +00001627 // Evaluate the effect on the message receiver.
Ted Kremenek14993892008-05-06 02:41:27 +00001628 if (!ErrorExpr && Receiver) {
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001629 SVal V = state.GetSVal(Receiver);
1630 if (isa<loc::SymbolVal>(V)) {
1631 SymbolID Sym = cast<loc::SymbolVal>(V).getSymbol();
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001632 if (const RefVal* T = state.get<RefBindings>(Sym))
1633 if (Update(state, Sym, *T, GetReceiverE(Summ), hasErr)) {
Ted Kremenek14993892008-05-06 02:41:27 +00001634 ErrorExpr = Receiver;
Ted Kremeneke8fdc832008-07-07 16:21:19 +00001635 ErrorSym = Sym;
Ted Kremenek14993892008-05-06 02:41:27 +00001636 }
Ted Kremenek14993892008-05-06 02:41:27 +00001637 }
1638 }
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001639
Ted Kremenek553cf182008-06-25 21:21:56 +00001640 // Process any errors.
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001641 if (hasErr) {
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001642 ProcessNonLeakError(Dst, Builder, Ex, ErrorExpr, Pred, state,
Ted Kremenek8dd56462008-04-18 03:39:05 +00001643 hasErr, ErrorSym);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001644 return;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00001645 }
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001646
Ted Kremenek70a733e2008-07-18 17:24:20 +00001647 // Consult the summary for the return value.
Ted Kremenek3c0cea32008-05-06 02:26:56 +00001648 RetEffect RE = GetRetEffect(Summ);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001649
1650 switch (RE.getKind()) {
1651 default:
1652 assert (false && "Unhandled RetEffect."); break;
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001653
Ted Kremenekfd301942008-10-17 22:23:12 +00001654 case RetEffect::NoRet: {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001655
Ted Kremenekf9561e52008-04-11 20:23:24 +00001656 // Make up a symbol for the return value (not reference counted).
Ted Kremenekb8873552008-04-11 20:51:02 +00001657 // FIXME: This is basically copy-and-paste from GRSimpleVals. We
1658 // should compose behavior, not copy it.
Ted Kremenekf9561e52008-04-11 20:23:24 +00001659
Ted Kremenekfd301942008-10-17 22:23:12 +00001660 // FIXME: We eventually should handle structs and other compound types
1661 // that are returned by value.
1662
1663 QualType T = Ex->getType();
1664
1665 if (T->isIntegerType() || Loc::IsLocType(T)) {
Ted Kremenekf9561e52008-04-11 20:23:24 +00001666 unsigned Count = Builder.getCurrentBlockCount();
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001667 SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(Ex, Count);
Ted Kremenekf9561e52008-04-11 20:23:24 +00001668
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001669 SVal X = Loc::IsLocType(Ex->getType())
1670 ? cast<SVal>(loc::SymbolVal(Sym))
1671 : cast<SVal>(nonloc::SymbolVal(Sym));
Ted Kremenekf9561e52008-04-11 20:23:24 +00001672
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001673 state = state.SetSVal(Ex, X, false);
Ted Kremenekf9561e52008-04-11 20:23:24 +00001674 }
1675
Ted Kremenek940b1d82008-04-10 23:44:06 +00001676 break;
Ted Kremenekfd301942008-10-17 22:23:12 +00001677 }
Ted Kremenek940b1d82008-04-10 23:44:06 +00001678
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001679 case RetEffect::Alias: {
Ted Kremenek553cf182008-06-25 21:21:56 +00001680 unsigned idx = RE.getIndex();
Ted Kremenek55499762008-06-17 02:43:46 +00001681 assert (arg_end >= arg_beg);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001682 assert (idx < (unsigned) (arg_end - arg_beg));
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001683 SVal V = state.GetSVal(*(arg_beg+idx));
1684 state = state.SetSVal(Ex, V, false);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001685 break;
1686 }
1687
Ted Kremenek14993892008-05-06 02:41:27 +00001688 case RetEffect::ReceiverAlias: {
1689 assert (Receiver);
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001690 SVal V = state.GetSVal(Receiver);
1691 state = state.SetSVal(Ex, V, false);
Ted Kremenek14993892008-05-06 02:41:27 +00001692 break;
1693 }
1694
Ted Kremeneka7344702008-06-23 18:02:52 +00001695 case RetEffect::OwnedAllocatedSymbol:
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001696 case RetEffect::OwnedSymbol: {
1697 unsigned Count = Builder.getCurrentBlockCount();
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001698 SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(Ex, Count);
Ted Kremenek553cf182008-06-25 21:21:56 +00001699 QualType RetT = GetReturnType(Ex, Eng.getContext());
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001700
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001701 state = state.set<RefBindings>(Sym, RefVal::makeOwned(RetT));
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001702 state = state.SetSVal(Ex, loc::SymbolVal(Sym), false);
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001703
1704#if 0
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001705 RefBindings B = GetRefBindings(StImpl);
Ted Kremenek553cf182008-06-25 21:21:56 +00001706 SetRefBindings(StImpl, RefBFactory.Add(B, Sym, RefVal::makeOwned(RetT)));
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001707#endif
1708
Ted Kremeneka7344702008-06-23 18:02:52 +00001709 // FIXME: Add a flag to the checker where allocations are allowed to fail.
1710 if (RE.getKind() == RetEffect::OwnedAllocatedSymbol)
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001711 state = state.AddNE(Sym, Eng.getBasicVals().getZeroWithPtrWidth());
Ted Kremeneka7344702008-06-23 18:02:52 +00001712
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001713 break;
1714 }
1715
1716 case RetEffect::NotOwnedSymbol: {
1717 unsigned Count = Builder.getCurrentBlockCount();
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001718 SymbolID Sym = Eng.getSymbolManager().getConjuredSymbol(Ex, Count);
Ted Kremenek553cf182008-06-25 21:21:56 +00001719 QualType RetT = GetReturnType(Ex, Eng.getContext());
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001720
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001721 state = state.set<RefBindings>(Sym, RefVal::makeNotOwned(RetT));
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001722 state = state.SetSVal(Ex, loc::SymbolVal(Sym), false);
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00001723 break;
1724 }
1725 }
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001726
Ted Kremenek70a733e2008-07-18 17:24:20 +00001727 // Is this a sink?
1728 if (IsEndPath(Summ))
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001729 Builder.MakeSinkNode(Dst, Ex, Pred, state);
Ted Kremenek70a733e2008-07-18 17:24:20 +00001730 else
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001731 Builder.MakeNode(Dst, Ex, Pred, state);
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001732}
1733
1734
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001735void CFRefCount::EvalCall(ExplodedNodeSet<GRState>& Dst,
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001736 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001737 GRStmtNodeBuilder<GRState>& Builder,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001738 CallExpr* CE, SVal L,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001739 ExplodedNode<GRState>* Pred) {
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001740
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001741 RetainSummary* Summ = !isa<loc::FuncVal>(L) ? 0
1742 : Summaries.getSummary(cast<loc::FuncVal>(L).getDecl());
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00001743
1744 EvalSummary(Dst, Eng, Builder, CE, 0, Summ,
1745 CE->arg_begin(), CE->arg_end(), Pred);
Ted Kremenek2fff37e2008-03-06 00:08:09 +00001746}
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00001747
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001748void CFRefCount::EvalObjCMessageExpr(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek85348202008-04-15 23:44:31 +00001749 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001750 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenek85348202008-04-15 23:44:31 +00001751 ObjCMessageExpr* ME,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001752 ExplodedNode<GRState>* Pred) {
Ted Kremenekb3095252008-05-06 04:20:12 +00001753 RetainSummary* Summ;
Ted Kremenek9040c652008-05-01 21:31:50 +00001754
Ted Kremenek553cf182008-06-25 21:21:56 +00001755 if (Expr* Receiver = ME->getReceiver()) {
1756 // We need the type-information of the tracked receiver object
1757 // Retrieve it from the state.
1758 ObjCInterfaceDecl* ID = 0;
1759
1760 // FIXME: Wouldn't it be great if this code could be reduced? It's just
1761 // a chain of lookups.
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001762 const GRState* St = Builder.GetState(Pred);
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001763 SVal V = Eng.getStateManager().GetSVal(St, Receiver );
Ted Kremenek553cf182008-06-25 21:21:56 +00001764
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001765 if (isa<loc::SymbolVal>(V)) {
1766 SymbolID Sym = cast<loc::SymbolVal>(V).getSymbol();
Ted Kremenek553cf182008-06-25 21:21:56 +00001767
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001768 if (const RefVal* T = St->get<RefBindings>(Sym)) {
Ted Kremeneke8fdc832008-07-07 16:21:19 +00001769 QualType Ty = T->getType();
Ted Kremenek553cf182008-06-25 21:21:56 +00001770
1771 if (const PointerType* PT = Ty->getAsPointerType()) {
1772 QualType PointeeTy = PT->getPointeeType();
1773
1774 if (ObjCInterfaceType* IT = dyn_cast<ObjCInterfaceType>(PointeeTy))
1775 ID = IT->getDecl();
1776 }
1777 }
1778 }
1779
1780 Summ = Summaries.getMethodSummary(ME, ID);
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001781
Ted Kremenek896cd9d2008-10-23 01:56:15 +00001782 // Special-case: are we sending a mesage to "self"?
1783 // This is a hack. When we have full-IP this should be removed.
1784 if (!Summ) {
1785 ObjCMethodDecl* MD =
1786 dyn_cast<ObjCMethodDecl>(&Eng.getGraph().getCodeDecl());
1787
1788 if (MD) {
1789 if (Expr* Receiver = ME->getReceiver()) {
1790 SVal X = Eng.getStateManager().GetSVal(St, Receiver);
1791 if (loc::MemRegionVal* L = dyn_cast<loc::MemRegionVal>(&X))
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001792 if (L->getRegion() == Eng.getStateManager().getSelfRegion(St)) {
1793 // Create a summmary where all of the arguments "StopTracking".
1794 Summ = Summaries.getPersistentSummary(RetEffect::MakeNoRet(),
1795 DoNothing,
1796 StopTracking);
1797 }
Ted Kremenek896cd9d2008-10-23 01:56:15 +00001798 }
1799 }
1800 }
Ted Kremenek553cf182008-06-25 21:21:56 +00001801 }
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001802 else
Ted Kremenek1f180c32008-06-23 22:21:20 +00001803 Summ = Summaries.getClassMethodSummary(ME->getClassName(),
1804 ME->getSelector());
Ted Kremenek9ed18e62008-04-16 04:28:53 +00001805
Ted Kremenekb3095252008-05-06 04:20:12 +00001806 EvalSummary(Dst, Eng, Builder, ME, ME->getReceiver(), Summ,
1807 ME->arg_begin(), ME->arg_end(), Pred);
Ted Kremenek85348202008-04-15 23:44:31 +00001808}
Ted Kremenekb3095252008-05-06 04:20:12 +00001809
Ted Kremenek13922612008-04-16 20:40:59 +00001810// Stores.
1811
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001812void CFRefCount::EvalStore(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek13922612008-04-16 20:40:59 +00001813 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001814 GRStmtNodeBuilder<GRState>& Builder,
1815 Expr* E, ExplodedNode<GRState>* Pred,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001816 const GRState* St, SVal TargetLV, SVal Val) {
Ted Kremenek13922612008-04-16 20:40:59 +00001817
1818 // Check if we have a binding for "Val" and if we are storing it to something
1819 // we don't understand or otherwise the value "escapes" the function.
1820
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001821 if (!isa<loc::SymbolVal>(Val))
Ted Kremenek13922612008-04-16 20:40:59 +00001822 return;
1823
1824 // Are we storing to something that causes the value to "escape"?
1825
1826 bool escapes = false;
1827
Ted Kremeneka496d162008-10-18 03:49:51 +00001828 // A value escapes in three possible cases (this may change):
1829 //
1830 // (1) we are binding to something that is not a memory region.
1831 // (2) we are binding to a memregion that does not have stack storage
1832 // (3) we are binding to a memregion with stack storage that the store
1833 // does not understand.
1834
1835 SymbolID Sym = cast<loc::SymbolVal>(Val).getSymbol();
1836 GRStateRef state(St, Eng.getStateManager());
1837
Zhongxing Xu1c96b242008-10-17 05:57:07 +00001838 if (!isa<loc::MemRegionVal>(TargetLV))
Ted Kremenek13922612008-04-16 20:40:59 +00001839 escapes = true;
Ted Kremenek9e240492008-10-04 05:50:14 +00001840 else {
Ted Kremenek993f1c72008-10-17 20:28:54 +00001841 const MemRegion* R = cast<loc::MemRegionVal>(TargetLV).getRegion();
Ted Kremenek9e240492008-10-04 05:50:14 +00001842 escapes = !Eng.getStateManager().hasStackStorage(R);
Ted Kremeneka496d162008-10-18 03:49:51 +00001843
1844 if (!escapes) {
1845 // To test (3), generate a new state with the binding removed. If it is
1846 // the same state, then it escapes (since the store cannot represent
1847 // the binding).
1848 GRStateRef stateNew = state.SetSVal(cast<Loc>(TargetLV), Val);
1849 escapes = (stateNew == state);
1850 }
Ted Kremenek9e240492008-10-04 05:50:14 +00001851 }
Ted Kremenek13922612008-04-16 20:40:59 +00001852
1853 if (!escapes)
1854 return;
Ted Kremeneka496d162008-10-18 03:49:51 +00001855
1856 // Do we have a reference count binding?
1857 // FIXME: Is this step even needed? We do blow away the binding anyway.
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001858 if (!state.get<RefBindings>(Sym))
Ted Kremenek13922612008-04-16 20:40:59 +00001859 return;
1860
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001861 // Nuke the binding.
Ted Kremenekb9d17f92008-08-17 03:20:02 +00001862 state = state.remove<RefBindings>(Sym);
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001863
Ted Kremenek13922612008-04-16 20:40:59 +00001864 // Hand of the remaining logic to the parent implementation.
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001865 GRSimpleVals::EvalStore(Dst, Eng, Builder, E, Pred, state, TargetLV, Val);
Ted Kremenekdb863712008-04-16 22:32:20 +00001866}
1867
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001868// End-of-path.
1869
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001870
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001871std::pair<GRStateRef,bool>
1872CFRefCount::HandleSymbolDeath(GRStateManager& VMgr,
1873 const GRState* St, const Decl* CD,
1874 SymbolID sid,
1875 RefVal V, bool& hasLeak) {
Ted Kremenekdb863712008-04-16 22:32:20 +00001876
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001877 GRStateRef state(St, VMgr);
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001878 assert (!V.isReturnedOwned() || CD &&
1879 "CodeDecl must be available for reporting ReturnOwned errors.");
Ted Kremenek896cd9d2008-10-23 01:56:15 +00001880
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001881 if (V.isReturnedOwned() && V.getCount() == 0)
1882 if (const ObjCMethodDecl* MD = dyn_cast<ObjCMethodDecl>(CD)) {
1883 std::string s = MD->getSelector().getName();
1884 if (!followsFundamentalRule(s.c_str())) {
1885 hasLeak = true;
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001886 state = state.set<RefBindings>(sid, V ^ RefVal::ErrorLeakReturned);
1887 return std::make_pair(state, true);
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001888 }
1889 }
Ted Kremenek896cd9d2008-10-23 01:56:15 +00001890
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001891 // All other cases.
1892
1893 hasLeak = V.isOwned() ||
1894 ((V.isNotOwned() || V.isReturnedOwned()) && V.getCount() > 0);
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001895
Ted Kremenekdb863712008-04-16 22:32:20 +00001896 if (!hasLeak)
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001897 return std::make_pair(state.remove<RefBindings>(sid), false);
Ted Kremenekdb863712008-04-16 22:32:20 +00001898
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001899 return std::make_pair(state.set<RefBindings>(sid, V ^ RefVal::ErrorLeak),
1900 false);
Ted Kremenekdb863712008-04-16 22:32:20 +00001901}
1902
1903void CFRefCount::EvalEndPath(GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001904 GREndPathNodeBuilder<GRState>& Builder) {
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001905
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001906 const GRState* St = Builder.getState();
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001907 RefBindings B = St->get<RefBindings>();
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001908
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001909 llvm::SmallVector<std::pair<SymbolID, bool>, 10> Leaked;
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00001910 const Decl* CodeDecl = &Eng.getGraph().getCodeDecl();
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001911
Ted Kremenekdb863712008-04-16 22:32:20 +00001912 for (RefBindings::iterator I = B.begin(), E = B.end(); I != E; ++I) {
1913 bool hasLeak = false;
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001914
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001915 std::pair<GRStateRef, bool> X =
1916 HandleSymbolDeath(Eng.getStateManager(), St, CodeDecl,
1917 (*I).first, (*I).second, hasLeak);
Ted Kremenekdb863712008-04-16 22:32:20 +00001918
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001919 St = X.first;
1920 if (hasLeak) Leaked.push_back(std::make_pair((*I).first, X.second));
Ted Kremenekdb863712008-04-16 22:32:20 +00001921 }
Ted Kremenek652adc62008-04-24 23:57:27 +00001922
1923 if (Leaked.empty())
1924 return;
1925
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001926 ExplodedNode<GRState>* N = Builder.MakeNode(St);
Ted Kremenek4f285152008-04-18 16:30:14 +00001927
Ted Kremenek652adc62008-04-24 23:57:27 +00001928 if (!N)
Ted Kremenek4f285152008-04-18 16:30:14 +00001929 return;
Ted Kremenekcb612922008-04-18 19:23:43 +00001930
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001931 std::vector<std::pair<SymbolID,bool> >*& LeaksAtNode = Leaks[N];
Ted Kremenek8dd56462008-04-18 03:39:05 +00001932 assert (!LeaksAtNode);
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001933 LeaksAtNode = new std::vector<std::pair<SymbolID,bool> >();
Ted Kremenekdb863712008-04-16 22:32:20 +00001934
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001935 for (llvm::SmallVector<std::pair<SymbolID,bool>, 10>::iterator
1936 I = Leaked.begin(), E = Leaked.end(); I != E; ++I)
Ted Kremenek8dd56462008-04-18 03:39:05 +00001937 (*LeaksAtNode).push_back(*I);
Ted Kremeneke7bd9c22008-04-11 22:25:11 +00001938}
1939
Ted Kremenek652adc62008-04-24 23:57:27 +00001940// Dead symbols.
1941
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001942void CFRefCount::EvalDeadSymbols(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek652adc62008-04-24 23:57:27 +00001943 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001944 GRStmtNodeBuilder<GRState>& Builder,
1945 ExplodedNode<GRState>* Pred,
Ted Kremenek910e9992008-04-25 01:25:15 +00001946 Stmt* S,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001947 const GRState* St,
1948 const GRStateManager::DeadSymbolsTy& Dead) {
Ted Kremenek910e9992008-04-25 01:25:15 +00001949
Ted Kremenek652adc62008-04-24 23:57:27 +00001950 // FIXME: a lot of copy-and-paste from EvalEndPath. Refactor.
1951
Ted Kremenek72cd17f2008-08-14 21:16:54 +00001952 RefBindings B = St->get<RefBindings>();
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001953 llvm::SmallVector<std::pair<SymbolID,bool>, 10> Leaked;
Ted Kremenek652adc62008-04-24 23:57:27 +00001954
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001955 for (GRStateManager::DeadSymbolsTy::const_iterator
Ted Kremenek652adc62008-04-24 23:57:27 +00001956 I=Dead.begin(), E=Dead.end(); I!=E; ++I) {
1957
Ted Kremeneke8fdc832008-07-07 16:21:19 +00001958 const RefVal* T = B.lookup(*I);
Ted Kremenek652adc62008-04-24 23:57:27 +00001959
1960 if (!T)
1961 continue;
1962
1963 bool hasLeak = false;
1964
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001965 std::pair<GRStateRef, bool> X
1966 = HandleSymbolDeath(Eng.getStateManager(), St, 0, *I, *T, hasLeak);
1967
1968 St = X.first;
Ted Kremenek652adc62008-04-24 23:57:27 +00001969
Ted Kremeneke8fdc832008-07-07 16:21:19 +00001970 if (hasLeak)
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001971 Leaked.push_back(std::make_pair(*I,X.second));
Ted Kremenek652adc62008-04-24 23:57:27 +00001972 }
1973
1974 if (Leaked.empty())
1975 return;
1976
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001977 ExplodedNode<GRState>* N = Builder.MakeNode(Dst, S, Pred, St);
Ted Kremenek652adc62008-04-24 23:57:27 +00001978
1979 if (!N)
1980 return;
1981
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001982 std::vector<std::pair<SymbolID,bool> >*& LeaksAtNode = Leaks[N];
Ted Kremenek652adc62008-04-24 23:57:27 +00001983 assert (!LeaksAtNode);
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001984 LeaksAtNode = new std::vector<std::pair<SymbolID,bool> >();
Ted Kremenek652adc62008-04-24 23:57:27 +00001985
Ted Kremenekf9790ae2008-10-24 20:32:50 +00001986 for (llvm::SmallVector<std::pair<SymbolID,bool>, 10>::iterator
1987 I = Leaked.begin(), E = Leaked.end(); I != E; ++I)
Ted Kremenek652adc62008-04-24 23:57:27 +00001988 (*LeaksAtNode).push_back(*I);
1989}
1990
Ted Kremenek4fd88972008-04-17 18:12:53 +00001991 // Return statements.
1992
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001993void CFRefCount::EvalReturn(ExplodedNodeSet<GRState>& Dst,
Ted Kremenek4fd88972008-04-17 18:12:53 +00001994 GRExprEngine& Eng,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001995 GRStmtNodeBuilder<GRState>& Builder,
Ted Kremenek4fd88972008-04-17 18:12:53 +00001996 ReturnStmt* S,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00001997 ExplodedNode<GRState>* Pred) {
Ted Kremenek4fd88972008-04-17 18:12:53 +00001998
1999 Expr* RetE = S->getRetValue();
2000 if (!RetE) return;
2001
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002002 GRStateRef state(Builder.GetState(Pred), Eng.getStateManager());
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002003 SVal V = state.GetSVal(RetE);
Ted Kremenek4fd88972008-04-17 18:12:53 +00002004
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002005 if (!isa<loc::SymbolVal>(V))
Ted Kremenek4fd88972008-04-17 18:12:53 +00002006 return;
2007
2008 // Get the reference count binding (if any).
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002009 SymbolID Sym = cast<loc::SymbolVal>(V).getSymbol();
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002010 const RefVal* T = state.get<RefBindings>(Sym);
Ted Kremenek4fd88972008-04-17 18:12:53 +00002011
2012 if (!T)
2013 return;
2014
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002015 // Change the reference count.
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002016 RefVal X = *T;
Ted Kremenek4fd88972008-04-17 18:12:53 +00002017
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002018 switch (X.getKind()) {
Ted Kremenek4fd88972008-04-17 18:12:53 +00002019 case RefVal::Owned: {
2020 unsigned cnt = X.getCount();
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002021 assert (cnt > 0);
2022 X = RefVal::makeReturnedOwned(cnt - 1);
Ted Kremenek4fd88972008-04-17 18:12:53 +00002023 break;
2024 }
2025
2026 case RefVal::NotOwned: {
2027 unsigned cnt = X.getCount();
2028 X = cnt ? RefVal::makeReturnedOwned(cnt - 1)
2029 : RefVal::makeReturnedNotOwned();
2030 break;
2031 }
2032
2033 default:
Ted Kremenek4fd88972008-04-17 18:12:53 +00002034 return;
2035 }
2036
2037 // Update the binding.
Ted Kremenekb9d17f92008-08-17 03:20:02 +00002038 state = state.set<RefBindings>(Sym, X);
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002039 Builder.MakeNode(Dst, S, Pred, state);
Ted Kremenek4fd88972008-04-17 18:12:53 +00002040}
2041
Ted Kremenekcb612922008-04-18 19:23:43 +00002042// Assumptions.
2043
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002044const GRState* CFRefCount::EvalAssume(GRStateManager& VMgr,
2045 const GRState* St,
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002046 SVal Cond, bool Assumption,
Ted Kremenek4323a572008-07-10 22:03:41 +00002047 bool& isFeasible) {
Ted Kremenekcb612922008-04-18 19:23:43 +00002048
2049 // FIXME: We may add to the interface of EvalAssume the list of symbols
2050 // whose assumptions have changed. For now we just iterate through the
2051 // bindings and check if any of the tracked symbols are NULL. This isn't
2052 // too bad since the number of symbols we will track in practice are
2053 // probably small and EvalAssume is only called at branches and a few
2054 // other places.
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002055 RefBindings B = St->get<RefBindings>();
Ted Kremenekcb612922008-04-18 19:23:43 +00002056
2057 if (B.isEmpty())
2058 return St;
2059
2060 bool changed = false;
Ted Kremenekb9d17f92008-08-17 03:20:02 +00002061
2062 GRStateRef state(St, VMgr);
2063 RefBindings::Factory& RefBFactory = state.get_context<RefBindings>();
Ted Kremenekcb612922008-04-18 19:23:43 +00002064
2065 for (RefBindings::iterator I=B.begin(), E=B.end(); I!=E; ++I) {
Ted Kremenekcb612922008-04-18 19:23:43 +00002066 // Check if the symbol is null (or equal to any constant).
2067 // If this is the case, stop tracking the symbol.
Zhongxing Xu39cfed32008-08-29 14:52:36 +00002068 if (VMgr.getSymVal(St, I.getKey())) {
Ted Kremenekcb612922008-04-18 19:23:43 +00002069 changed = true;
2070 B = RefBFactory.Remove(B, I.getKey());
2071 }
2072 }
2073
Ted Kremenekb9d17f92008-08-17 03:20:02 +00002074 if (changed)
2075 state = state.set<RefBindings>(B);
Ted Kremenekcb612922008-04-18 19:23:43 +00002076
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002077 return state;
Ted Kremenekcb612922008-04-18 19:23:43 +00002078}
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002079
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002080RefBindings CFRefCount::Update(RefBindings B, SymbolID sym,
2081 RefVal V, ArgEffect E,
Ted Kremenekb9d17f92008-08-17 03:20:02 +00002082 RefVal::Kind& hasErr,
2083 RefBindings::Factory& RefBFactory) {
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002084
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002085 // FIXME: This dispatch can potentially be sped up by unifiying it into
2086 // a single switch statement. Opt for simplicity for now.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002087
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002088 switch (E) {
2089 default:
2090 assert (false && "Unhandled CFRef transition.");
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002091
2092 case MayEscape:
2093 if (V.getKind() == RefVal::Owned) {
Ted Kremenek553cf182008-06-25 21:21:56 +00002094 V = V ^ RefVal::NotOwned;
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002095 break;
2096 }
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002097 // Fall-through.
Ted Kremenek070a8252008-07-09 18:11:16 +00002098 case DoNothingByRef:
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002099 case DoNothing:
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00002100 if (!isGCEnabled() && V.getKind() == RefVal::Released) {
Ted Kremenek553cf182008-06-25 21:21:56 +00002101 V = V ^ RefVal::ErrorUseAfterRelease;
Ted Kremenek9ed18e62008-04-16 04:28:53 +00002102 hasErr = V.getKind();
Ted Kremenek00a3a5f2008-03-12 01:21:45 +00002103 break;
Ted Kremenek9e476de2008-08-12 18:30:56 +00002104 }
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002105 return B;
Ted Kremeneke19f4492008-06-30 16:57:41 +00002106
Ted Kremenek80d753f2008-07-01 00:01:02 +00002107 case Autorelease:
Ted Kremenek14993892008-05-06 02:41:27 +00002108 case StopTracking:
2109 return RefBFactory.Remove(B, sym);
Ted Kremenek9e476de2008-08-12 18:30:56 +00002110
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002111 case IncRef:
2112 switch (V.getKind()) {
2113 default:
2114 assert(false);
2115
2116 case RefVal::Owned:
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002117 case RefVal::NotOwned:
Ted Kremenek553cf182008-06-25 21:21:56 +00002118 V = V + 1;
Ted Kremenek9e476de2008-08-12 18:30:56 +00002119 break;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002120 case RefVal::Released:
Ted Kremenekd3dbcf42008-05-05 22:11:16 +00002121 if (isGCEnabled())
Ted Kremenek553cf182008-06-25 21:21:56 +00002122 V = V ^ RefVal::Owned;
Ted Kremenek65c91652008-04-29 05:44:10 +00002123 else {
Ted Kremenek553cf182008-06-25 21:21:56 +00002124 V = V ^ RefVal::ErrorUseAfterRelease;
Ted Kremenek65c91652008-04-29 05:44:10 +00002125 hasErr = V.getKind();
2126 }
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002127 break;
Ted Kremenek9e476de2008-08-12 18:30:56 +00002128 }
Ted Kremenek940b1d82008-04-10 23:44:06 +00002129 break;
2130
Ted Kremenek553cf182008-06-25 21:21:56 +00002131 case SelfOwn:
2132 V = V ^ RefVal::NotOwned;
Ted Kremenek9e476de2008-08-12 18:30:56 +00002133 // Fall-through.
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002134 case DecRef:
2135 switch (V.getKind()) {
2136 default:
2137 assert (false);
Ted Kremenek9e476de2008-08-12 18:30:56 +00002138
Ted Kremenek553cf182008-06-25 21:21:56 +00002139 case RefVal::Owned:
2140 V = V.getCount() > 1 ? V - 1 : V ^ RefVal::Released;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002141 break;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002142
Ted Kremenek553cf182008-06-25 21:21:56 +00002143 case RefVal::NotOwned:
2144 if (V.getCount() > 0)
2145 V = V - 1;
Ted Kremenek61b9f872008-04-10 23:09:18 +00002146 else {
Ted Kremenek553cf182008-06-25 21:21:56 +00002147 V = V ^ RefVal::ErrorReleaseNotOwned;
Ted Kremenek9ed18e62008-04-16 04:28:53 +00002148 hasErr = V.getKind();
Ted Kremenek9e476de2008-08-12 18:30:56 +00002149 }
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002150 break;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002151
2152 case RefVal::Released:
Ted Kremenek553cf182008-06-25 21:21:56 +00002153 V = V ^ RefVal::ErrorUseAfterRelease;
Ted Kremenek9ed18e62008-04-16 04:28:53 +00002154 hasErr = V.getKind();
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002155 break;
Ted Kremenek9e476de2008-08-12 18:30:56 +00002156 }
Ted Kremenek940b1d82008-04-10 23:44:06 +00002157 break;
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002158 }
Ted Kremenek1ac08d62008-03-11 17:48:22 +00002159 return RefBFactory.Add(B, sym, V);
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002160}
2161
Ted Kremenekfa34b332008-04-09 01:10:13 +00002162//===----------------------------------------------------------------------===//
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002163// Error reporting.
Ted Kremenekfa34b332008-04-09 01:10:13 +00002164//===----------------------------------------------------------------------===//
2165
Ted Kremenek8dd56462008-04-18 03:39:05 +00002166namespace {
2167
2168 //===-------------===//
2169 // Bug Descriptions. //
2170 //===-------------===//
2171
Ted Kremenek95cc1ba2008-04-18 20:54:29 +00002172 class VISIBILITY_HIDDEN CFRefBug : public BugTypeCacheLocation {
Ted Kremenek8dd56462008-04-18 03:39:05 +00002173 protected:
2174 CFRefCount& TF;
2175
2176 public:
2177 CFRefBug(CFRefCount& tf) : TF(tf) {}
Ted Kremenek072192b2008-04-30 23:47:44 +00002178
Ted Kremenekbb77e9b2008-05-01 22:50:36 +00002179 CFRefCount& getTF() { return TF; }
Ted Kremenek789deac2008-05-05 23:16:31 +00002180 const CFRefCount& getTF() const { return TF; }
2181
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002182 virtual bool isLeak() const { return false; }
Ted Kremenek8c036c72008-09-20 04:23:38 +00002183
2184 const char* getCategory() const {
Ted Kremenek062bae02008-09-27 22:02:42 +00002185 return "Memory (Core Foundation/Objective-C)";
Ted Kremenek8c036c72008-09-20 04:23:38 +00002186 }
Ted Kremenek8dd56462008-04-18 03:39:05 +00002187 };
2188
2189 class VISIBILITY_HIDDEN UseAfterRelease : public CFRefBug {
2190 public:
2191 UseAfterRelease(CFRefCount& tf) : CFRefBug(tf) {}
2192
2193 virtual const char* getName() const {
Ted Kremenek8c036c72008-09-20 04:23:38 +00002194 return "use-after-release";
Ted Kremenek8dd56462008-04-18 03:39:05 +00002195 }
2196 virtual const char* getDescription() const {
Ted Kremenek9e476de2008-08-12 18:30:56 +00002197 return "Reference-counted object is used after it is released.";
Ted Kremenek8dd56462008-04-18 03:39:05 +00002198 }
2199
2200 virtual void EmitWarnings(BugReporter& BR);
Ted Kremenek8dd56462008-04-18 03:39:05 +00002201 };
2202
2203 class VISIBILITY_HIDDEN BadRelease : public CFRefBug {
2204 public:
2205 BadRelease(CFRefCount& tf) : CFRefBug(tf) {}
2206
2207 virtual const char* getName() const {
Ted Kremenek8c036c72008-09-20 04:23:38 +00002208 return "bad release";
Ted Kremenek8dd56462008-04-18 03:39:05 +00002209 }
2210 virtual const char* getDescription() const {
2211 return "Incorrect decrement of the reference count of a "
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002212 "CoreFoundation object: "
Ted Kremenek8dd56462008-04-18 03:39:05 +00002213 "The object is not owned at this point by the caller.";
2214 }
2215
2216 virtual void EmitWarnings(BugReporter& BR);
2217 };
2218
2219 class VISIBILITY_HIDDEN Leak : public CFRefBug {
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002220 bool isReturn;
Ted Kremenek8dd56462008-04-18 03:39:05 +00002221 public:
2222 Leak(CFRefCount& tf) : CFRefBug(tf) {}
2223
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002224 void setIsReturn(bool x) { isReturn = x; }
2225
Ted Kremenek8dd56462008-04-18 03:39:05 +00002226 virtual const char* getName() const {
Ted Kremenek432af592008-05-06 18:11:36 +00002227
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002228 if (!isReturn) {
2229 if (getTF().isGCEnabled())
2230 return "leak (GC)";
2231
2232 if (getTF().getLangOptions().getGCMode() == LangOptions::HybridGC)
2233 return "leak (hybrid MM, non-GC)";
2234
2235 assert (getTF().getLangOptions().getGCMode() == LangOptions::NonGC);
2236 return "leak";
2237 }
2238 else {
2239 if (getTF().isGCEnabled())
Ted Kremenek9d1d5702008-10-24 21:22:44 +00002240 return "[naming convention] leak of returned object (GC)";
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002241
2242 if (getTF().getLangOptions().getGCMode() == LangOptions::HybridGC)
Ted Kremenek9d1d5702008-10-24 21:22:44 +00002243 return "[naming convention] leak of returned object (hybrid MM, "
2244 "non-GC)";
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002245
2246 assert (getTF().getLangOptions().getGCMode() == LangOptions::NonGC);
Ted Kremenek9d1d5702008-10-24 21:22:44 +00002247 return "[naming convention] leak of returned object";
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002248 }
Ted Kremenek8dd56462008-04-18 03:39:05 +00002249 }
2250
2251 virtual const char* getDescription() const {
Ted Kremenek9e476de2008-08-12 18:30:56 +00002252 return "Object leaked";
Ted Kremenek8dd56462008-04-18 03:39:05 +00002253 }
2254
2255 virtual void EmitWarnings(BugReporter& BR);
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002256 virtual void GetErrorNodes(std::vector<ExplodedNode<GRState>*>& Nodes);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002257 virtual bool isLeak() const { return true; }
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002258 virtual bool isCached(BugReport& R);
Ted Kremenek8dd56462008-04-18 03:39:05 +00002259 };
2260
2261 //===---------===//
2262 // Bug Reports. //
2263 //===---------===//
2264
2265 class VISIBILITY_HIDDEN CFRefReport : public RangedBugReport {
2266 SymbolID Sym;
2267 public:
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002268 CFRefReport(CFRefBug& D, ExplodedNode<GRState> *n, SymbolID sym)
Ted Kremenek8dd56462008-04-18 03:39:05 +00002269 : RangedBugReport(D, n), Sym(sym) {}
2270
2271 virtual ~CFRefReport() {}
2272
Ted Kremenekbb77e9b2008-05-01 22:50:36 +00002273 CFRefBug& getBugType() {
2274 return (CFRefBug&) RangedBugReport::getBugType();
2275 }
2276 const CFRefBug& getBugType() const {
2277 return (const CFRefBug&) RangedBugReport::getBugType();
2278 }
2279
2280 virtual void getRanges(BugReporter& BR, const SourceRange*& beg,
2281 const SourceRange*& end) {
2282
Ted Kremeneke92c1b22008-05-02 20:53:50 +00002283 if (!getBugType().isLeak())
Ted Kremenekbb77e9b2008-05-01 22:50:36 +00002284 RangedBugReport::getRanges(BR, beg, end);
Ted Kremenek9e476de2008-08-12 18:30:56 +00002285 else
2286 beg = end = 0;
Ted Kremenekbb77e9b2008-05-01 22:50:36 +00002287 }
2288
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002289 SymbolID getSymbol() const { return Sym; }
2290
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002291 virtual PathDiagnosticPiece* getEndPath(BugReporter& BR,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002292 ExplodedNode<GRState>* N);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002293
Ted Kremenek072192b2008-04-30 23:47:44 +00002294 virtual std::pair<const char**,const char**> getExtraDescriptiveText();
Ted Kremenek8dd56462008-04-18 03:39:05 +00002295
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002296 virtual PathDiagnosticPiece* VisitNode(ExplodedNode<GRState>* N,
2297 ExplodedNode<GRState>* PrevN,
2298 ExplodedGraph<GRState>& G,
Ted Kremenek8dd56462008-04-18 03:39:05 +00002299 BugReporter& BR);
2300 };
2301
2302
2303} // end anonymous namespace
2304
2305void CFRefCount::RegisterChecks(GRExprEngine& Eng) {
Ted Kremenek8dd56462008-04-18 03:39:05 +00002306 Eng.Register(new UseAfterRelease(*this));
2307 Eng.Register(new BadRelease(*this));
2308 Eng.Register(new Leak(*this));
2309}
2310
Ted Kremenek072192b2008-04-30 23:47:44 +00002311
2312static const char* Msgs[] = {
2313 "Code is compiled in garbage collection only mode" // GC only
2314 " (the bug occurs with garbage collection enabled).",
2315
2316 "Code is compiled without garbage collection.", // No GC.
2317
2318 "Code is compiled for use with and without garbage collection (GC)."
2319 " The bug occurs with GC enabled.", // Hybrid, with GC.
2320
2321 "Code is compiled for use with and without garbage collection (GC)."
2322 " The bug occurs in non-GC mode." // Hyrbird, without GC/
2323};
2324
2325std::pair<const char**,const char**> CFRefReport::getExtraDescriptiveText() {
2326 CFRefCount& TF = static_cast<CFRefBug&>(getBugType()).getTF();
2327
2328 switch (TF.getLangOptions().getGCMode()) {
2329 default:
2330 assert(false);
Ted Kremenek31593ac2008-05-01 04:02:04 +00002331
2332 case LangOptions::GCOnly:
2333 assert (TF.isGCEnabled());
Ted Kremenek9e476de2008-08-12 18:30:56 +00002334 return std::make_pair(&Msgs[0], &Msgs[0]+1);
2335
Ted Kremenek072192b2008-04-30 23:47:44 +00002336 case LangOptions::NonGC:
2337 assert (!TF.isGCEnabled());
Ted Kremenek072192b2008-04-30 23:47:44 +00002338 return std::make_pair(&Msgs[1], &Msgs[1]+1);
2339
2340 case LangOptions::HybridGC:
2341 if (TF.isGCEnabled())
2342 return std::make_pair(&Msgs[2], &Msgs[2]+1);
2343 else
2344 return std::make_pair(&Msgs[3], &Msgs[3]+1);
2345 }
2346}
2347
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002348PathDiagnosticPiece* CFRefReport::VisitNode(ExplodedNode<GRState>* N,
2349 ExplodedNode<GRState>* PrevN,
2350 ExplodedGraph<GRState>& G,
Ted Kremenek8dd56462008-04-18 03:39:05 +00002351 BugReporter& BR) {
2352
2353 // Check if the type state has changed.
2354
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002355 const GRState* PrevSt = PrevN->getState();
2356 const GRState* CurrSt = N->getState();
Ted Kremenek8dd56462008-04-18 03:39:05 +00002357
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002358 RefBindings PrevB = PrevSt->get<RefBindings>();
2359 RefBindings CurrB = CurrSt->get<RefBindings>();
Ted Kremenek8dd56462008-04-18 03:39:05 +00002360
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002361 const RefVal* PrevT = PrevB.lookup(Sym);
2362 const RefVal* CurrT = CurrB.lookup(Sym);
Ted Kremenek8dd56462008-04-18 03:39:05 +00002363
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002364 if (!CurrT)
2365 return NULL;
Ted Kremenek8dd56462008-04-18 03:39:05 +00002366
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002367 const char* Msg = NULL;
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002368 const RefVal& CurrV = *CurrB.lookup(Sym);
Ted Kremenekce48e002008-05-05 17:53:17 +00002369
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002370 if (!PrevT) {
2371
Ted Kremenekce48e002008-05-05 17:53:17 +00002372 Stmt* S = cast<PostStmt>(N->getLocation()).getStmt();
2373
2374 if (CurrV.isOwned()) {
2375
2376 if (isa<CallExpr>(S))
2377 Msg = "Function call returns an object with a +1 retain count"
2378 " (owning reference).";
2379 else {
2380 assert (isa<ObjCMessageExpr>(S));
2381 Msg = "Method returns an object with a +1 retain count"
2382 " (owning reference).";
2383 }
2384 }
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002385 else {
2386 assert (CurrV.isNotOwned());
Ted Kremenekce48e002008-05-05 17:53:17 +00002387
2388 if (isa<CallExpr>(S))
2389 Msg = "Function call returns an object with a +0 retain count"
2390 " (non-owning reference).";
2391 else {
2392 assert (isa<ObjCMessageExpr>(S));
2393 Msg = "Method returns an object with a +0 retain count"
2394 " (non-owning reference).";
2395 }
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002396 }
Ted Kremenekce48e002008-05-05 17:53:17 +00002397
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002398 FullSourceLoc Pos(S->getLocStart(), BR.getContext().getSourceManager());
2399 PathDiagnosticPiece* P = new PathDiagnosticPiece(Pos, Msg);
2400
2401 if (Expr* Exp = dyn_cast<Expr>(S))
2402 P->addRange(Exp->getSourceRange());
2403
2404 return P;
2405 }
2406
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002407 // Determine if the typestate has changed.
2408 RefVal PrevV = *PrevB.lookup(Sym);
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002409
2410 if (PrevV == CurrV)
2411 return NULL;
2412
2413 // The typestate has changed.
2414
2415 std::ostringstream os;
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002416 std::string s;
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002417
2418 switch (CurrV.getKind()) {
2419 case RefVal::Owned:
2420 case RefVal::NotOwned:
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002421
2422 if (PrevV.getCount() == CurrV.getCount())
2423 return 0;
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002424
2425 if (PrevV.getCount() > CurrV.getCount())
2426 os << "Reference count decremented.";
2427 else
2428 os << "Reference count incremented.";
2429
Ted Kremenek3eabf1c2008-05-22 17:31:13 +00002430 if (unsigned Count = CurrV.getCount()) {
Ted Kremenekce48e002008-05-05 17:53:17 +00002431
2432 os << " Object has +" << Count;
Ted Kremenek79c140b2008-04-18 05:32:44 +00002433
Ted Kremenekce48e002008-05-05 17:53:17 +00002434 if (Count > 1)
2435 os << " retain counts.";
Ted Kremenek79c140b2008-04-18 05:32:44 +00002436 else
Ted Kremenekce48e002008-05-05 17:53:17 +00002437 os << " retain count.";
Ted Kremenek79c140b2008-04-18 05:32:44 +00002438 }
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002439
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002440 s = os.str();
2441 Msg = s.c_str();
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002442
2443 break;
2444
2445 case RefVal::Released:
2446 Msg = "Object released.";
2447 break;
2448
2449 case RefVal::ReturnedOwned:
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002450 Msg = "Object returned to caller as an owning reference (single retain "
2451 "count transferred to caller).";
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002452 break;
2453
2454 case RefVal::ReturnedNotOwned:
Ted Kremenekce48e002008-05-05 17:53:17 +00002455 Msg = "Object returned to caller with a +0 (non-owning) retain count.";
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002456 break;
2457
2458 default:
2459 return NULL;
2460 }
2461
2462 Stmt* S = cast<PostStmt>(N->getLocation()).getStmt();
2463 FullSourceLoc Pos(S->getLocStart(), BR.getContext().getSourceManager());
2464 PathDiagnosticPiece* P = new PathDiagnosticPiece(Pos, Msg);
2465
2466 // Add the range by scanning the children of the statement for any bindings
2467 // to Sym.
2468
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002469 GRStateManager& VSM = cast<GRBugReporter>(BR).getStateManager();
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002470
2471 for (Stmt::child_iterator I = S->child_begin(), E = S->child_end(); I!=E; ++I)
2472 if (Expr* Exp = dyn_cast_or_null<Expr>(*I)) {
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002473 SVal X = VSM.GetSVal(CurrSt, Exp);
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002474
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002475 if (loc::SymbolVal* SV = dyn_cast<loc::SymbolVal>(&X))
Ted Kremenek2cf943a2008-04-18 04:55:01 +00002476 if (SV->getSymbol() == Sym) {
2477 P->addRange(Exp->getSourceRange()); break;
2478 }
2479 }
2480
2481 return P;
Ted Kremenek8dd56462008-04-18 03:39:05 +00002482}
2483
Ted Kremenek9e240492008-10-04 05:50:14 +00002484namespace {
2485class VISIBILITY_HIDDEN FindUniqueBinding :
2486 public StoreManager::BindingsHandler {
2487 SymbolID Sym;
2488 MemRegion* Binding;
2489 bool First;
2490
2491 public:
2492 FindUniqueBinding(SymbolID sym) : Sym(sym), Binding(0), First(true) {}
2493
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002494 bool HandleBinding(StoreManager& SMgr, Store store, MemRegion* R, SVal val) {
2495 if (const loc::SymbolVal* SV = dyn_cast<loc::SymbolVal>(&val)) {
Ted Kremenek9e240492008-10-04 05:50:14 +00002496 if (SV->getSymbol() != Sym)
2497 return true;
2498 }
Zhongxing Xu1c96b242008-10-17 05:57:07 +00002499 else if (const nonloc::SymbolVal* SV=dyn_cast<nonloc::SymbolVal>(&val)) {
Ted Kremenek9e240492008-10-04 05:50:14 +00002500 if (SV->getSymbol() != Sym)
2501 return true;
2502 }
2503 else
2504 return true;
2505
2506 if (Binding) {
2507 First = false;
2508 return false;
2509 }
2510 else
2511 Binding = R;
2512
2513 return true;
2514 }
2515
2516 operator bool() { return First && Binding; }
2517 MemRegion* getRegion() { return Binding; }
2518};
2519}
2520
2521static std::pair<ExplodedNode<GRState>*,MemRegion*>
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002522GetAllocationSite(GRStateManager* StateMgr, ExplodedNode<GRState>* N,
2523 SymbolID Sym) {
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002524
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002525 // Find both first node that referred to the tracked symbol and the
2526 // memory location that value was store to.
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002527 ExplodedNode<GRState>* Last = N;
Ted Kremenek9e240492008-10-04 05:50:14 +00002528 MemRegion* FirstBinding = 0;
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002529
2530 while (N) {
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002531 const GRState* St = N->getState();
Ted Kremenek72cd17f2008-08-14 21:16:54 +00002532 RefBindings B = St->get<RefBindings>();
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002533
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002534 if (!B.lookup(Sym))
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002535 break;
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002536
2537 if (StateMgr) {
Ted Kremenek9e240492008-10-04 05:50:14 +00002538 FindUniqueBinding FB(Sym);
2539 StateMgr->iterBindings(St, FB);
2540 if (FB) FirstBinding = FB.getRegion();
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002541 }
2542
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002543 Last = N;
2544 N = N->pred_empty() ? NULL : *(N->pred_begin());
2545 }
2546
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002547 return std::make_pair(Last, FirstBinding);
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002548}
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002549
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002550PathDiagnosticPiece* CFRefReport::getEndPath(BugReporter& br,
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002551 ExplodedNode<GRState>* EndN) {
Ted Kremenek1aa44c72008-05-22 23:45:19 +00002552
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002553 GRBugReporter& BR = cast<GRBugReporter>(br);
2554
Ted Kremenek1aa44c72008-05-22 23:45:19 +00002555 // Tell the BugReporter to report cases when the tracked symbol is
2556 // assigned to different variables, etc.
Ted Kremenekc0959972008-07-02 21:24:01 +00002557 cast<GRBugReporter>(BR).addNotableSymbol(Sym);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002558
2559 if (!getBugType().isLeak())
Ted Kremeneke28565b2008-05-05 18:50:19 +00002560 return RangedBugReport::getEndPath(BR, EndN);
Ted Kremeneke8fdc832008-07-07 16:21:19 +00002561
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002562 // We are a leak. Walk up the graph to get to the first node where the
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002563 // symbol appeared, and also get the first VarDecl that tracked object
2564 // is stored to.
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002565 ExplodedNode<GRState>* AllocNode = 0;
Ted Kremenek9e240492008-10-04 05:50:14 +00002566 MemRegion* FirstBinding = 0;
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002567
2568 llvm::tie(AllocNode, FirstBinding) =
2569 GetAllocationSite(&BR.getStateManager(), EndN, Sym);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002570
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002571 // Get the allocate site.
2572 assert (AllocNode);
2573 Stmt* FirstStmt = cast<PostStmt>(AllocNode->getLocation()).getStmt();
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002574
Ted Kremeneke28565b2008-05-05 18:50:19 +00002575 SourceManager& SMgr = BR.getContext().getSourceManager();
2576 unsigned AllocLine = SMgr.getLogicalLineNumber(FirstStmt->getLocStart());
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002577
Ted Kremeneke28565b2008-05-05 18:50:19 +00002578 // Get the leak site. We may have multiple ExplodedNodes (one with the
2579 // leak) that occur on the same line number; if the node with the leak
2580 // has any immediate predecessor nodes with the same line number, find
2581 // any transitive-successors that have a different statement and use that
2582 // line number instead. This avoids emiting a diagnostic like:
2583 //
2584 // // 'y' is leaked.
2585 // int x = foo(y);
2586 //
2587 // instead we want:
2588 //
2589 // int x = foo(y);
2590 // // 'y' is leaked.
2591
2592 Stmt* S = getStmt(BR); // This is the statement where the leak occured.
2593 assert (S);
2594 unsigned EndLine = SMgr.getLogicalLineNumber(S->getLocStart());
2595
2596 // Look in the *trimmed* graph at the immediate predecessor of EndN. Does
2597 // it occur on the same line?
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002598 PathDiagnosticPiece::DisplayHint Hint = PathDiagnosticPiece::Above;
Ted Kremeneke28565b2008-05-05 18:50:19 +00002599
2600 assert (!EndN->pred_empty()); // Not possible to have 0 predecessors.
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002601 ExplodedNode<GRState> *Pred = *(EndN->pred_begin());
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002602 ProgramPoint PredPos = Pred->getLocation();
Ted Kremeneke28565b2008-05-05 18:50:19 +00002603
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002604 if (PostStmt* PredPS = dyn_cast<PostStmt>(&PredPos)) {
Ted Kremeneke28565b2008-05-05 18:50:19 +00002605
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002606 Stmt* SPred = PredPS->getStmt();
Ted Kremeneke28565b2008-05-05 18:50:19 +00002607
2608 // Predecessor at same line?
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002609 if (SMgr.getLogicalLineNumber(SPred->getLocStart()) != EndLine) {
2610 Hint = PathDiagnosticPiece::Below;
2611 S = SPred;
2612 }
Ted Kremeneke28565b2008-05-05 18:50:19 +00002613 }
Ted Kremeneke28565b2008-05-05 18:50:19 +00002614
2615 // Generate the diagnostic.
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002616 FullSourceLoc L( S->getLocStart(), SMgr);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002617 std::ostringstream os;
Ted Kremeneke92c1b22008-05-02 20:53:50 +00002618
Ted Kremeneke28565b2008-05-05 18:50:19 +00002619 os << "Object allocated on line " << AllocLine;
Ted Kremeneke92c1b22008-05-02 20:53:50 +00002620
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002621 if (FirstBinding)
Ted Kremenek9e240492008-10-04 05:50:14 +00002622 os << " and stored into '" << FirstBinding->getString() << '\'';
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00002623
Ted Kremenek9e240492008-10-04 05:50:14 +00002624
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00002625 // Get the retain count.
2626 const RefVal* RV = EndN->getState()->get<RefBindings>(Sym);
2627
2628 if (RV->getKind() == RefVal::ErrorLeakReturned) {
2629 ObjCMethodDecl& MD = cast<ObjCMethodDecl>(BR.getGraph().getCodeDecl());
2630 os << " is returned from a method whose name ('"
2631 << MD.getSelector().getName()
Ted Kremenek9d1d5702008-10-24 21:22:44 +00002632 << "') does not contain 'create' or 'copy' or otherwise starts with"
2633 " 'new' or 'alloc'. This violates the naming convention rules given"
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00002634 " in the Memory Management Guide for Cocoa (object leaked).";
2635 }
2636 else
Ted Kremenek9d1d5702008-10-24 21:22:44 +00002637 os << " is no longer referenced after this point and has a retain count of"
2638 " +"
Ted Kremenek3ad2cc82008-10-22 23:56:21 +00002639 << RV->getCount() << " (object leaked).";
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002640
Ted Kremeneka22cc2f2008-05-06 23:07:13 +00002641 return new PathDiagnosticPiece(L, os.str(), Hint);
Ted Kremenekc9fa2f72008-05-01 23:13:35 +00002642}
2643
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002644void UseAfterRelease::EmitWarnings(BugReporter& BR) {
Ted Kremenekfa34b332008-04-09 01:10:13 +00002645
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002646 for (CFRefCount::use_after_iterator I = TF.use_after_begin(),
2647 E = TF.use_after_end(); I != E; ++I) {
2648
Ted Kremenek8dd56462008-04-18 03:39:05 +00002649 CFRefReport report(*this, I->first, I->second.second);
2650 report.addRange(I->second.first->getSourceRange());
Ted Kremenek75840e12008-04-18 01:56:37 +00002651 BR.EmitWarning(report);
Ted Kremenekfa34b332008-04-09 01:10:13 +00002652 }
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002653}
2654
2655void BadRelease::EmitWarnings(BugReporter& BR) {
Ted Kremenekfa34b332008-04-09 01:10:13 +00002656
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002657 for (CFRefCount::bad_release_iterator I = TF.bad_release_begin(),
2658 E = TF.bad_release_end(); I != E; ++I) {
2659
Ted Kremenek8dd56462008-04-18 03:39:05 +00002660 CFRefReport report(*this, I->first, I->second.second);
2661 report.addRange(I->second.first->getSourceRange());
2662 BR.EmitWarning(report);
Ted Kremenek05cbe1a2008-04-09 23:49:11 +00002663 }
2664}
Ted Kremenekfa34b332008-04-09 01:10:13 +00002665
Ted Kremenek989d5192008-04-17 23:43:50 +00002666void Leak::EmitWarnings(BugReporter& BR) {
2667
2668 for (CFRefCount::leaks_iterator I = TF.leaks_begin(),
2669 E = TF.leaks_end(); I != E; ++I) {
2670
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002671 std::vector<std::pair<SymbolID, bool> >& SymV = *(I->second);
Ted Kremenek8dd56462008-04-18 03:39:05 +00002672 unsigned n = SymV.size();
2673
2674 for (unsigned i = 0; i < n; ++i) {
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002675 setIsReturn(SymV[i].second);
2676 CFRefReport report(*this, I->first, SymV[i].first);
Ted Kremenek8dd56462008-04-18 03:39:05 +00002677 BR.EmitWarning(report);
2678 }
Ted Kremenek989d5192008-04-17 23:43:50 +00002679 }
2680}
2681
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002682void Leak::GetErrorNodes(std::vector<ExplodedNode<GRState>*>& Nodes) {
Ted Kremenekcb612922008-04-18 19:23:43 +00002683 for (CFRefCount::leaks_iterator I=TF.leaks_begin(), E=TF.leaks_end();
2684 I!=E; ++I)
2685 Nodes.push_back(I->first);
2686}
2687
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002688bool Leak::isCached(BugReport& R) {
2689
2690 // Most bug reports are cached at the location where they occured.
2691 // With leaks, we want to unique them by the location where they were
Ted Kremenekf9790ae2008-10-24 20:32:50 +00002692 // allocated, and only report a single path.
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002693
2694 SymbolID Sym = static_cast<CFRefReport&>(R).getSymbol();
2695
Ted Kremenek4adc81e2008-08-13 04:27:00 +00002696 ExplodedNode<GRState>* AllocNode =
Ted Kremenek2bc39c62008-08-29 00:47:32 +00002697 GetAllocationSite(0, R.getEndNode(), Sym).first;
Ted Kremenek6ed9afc2008-05-16 18:33:44 +00002698
2699 if (!AllocNode)
2700 return false;
2701
2702 return BugTypeCacheLocation::isCached(AllocNode->getLocation());
2703}
2704
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002705//===----------------------------------------------------------------------===//
Ted Kremenekd71ed262008-04-10 22:16:52 +00002706// Transfer function creation for external clients.
Ted Kremenek6b3a0f72008-03-11 06:39:11 +00002707//===----------------------------------------------------------------------===//
2708
Ted Kremenek072192b2008-04-30 23:47:44 +00002709GRTransferFuncs* clang::MakeCFRefCountTF(ASTContext& Ctx, bool GCEnabled,
2710 const LangOptions& lopts) {
Ted Kremenek78d46242008-07-22 16:21:24 +00002711 return new CFRefCount(Ctx, GCEnabled, lopts);
Ted Kremenek3ea0b6a2008-04-10 22:58:08 +00002712}